A network anomaly traffic detection method based on contrast learning

Abstract

The application provides a network abnormal traffic detection method based on contrast learning, comprising the following steps: constructing a label space position model; obtaining a low-dimensional network traffic state based on network traffic data; constructing a network traffic space position model; calculating the distance between the label position and the network traffic space position based on the label position in the metric space; constructing a network traffic space position value evaluation model; adjusting the parameters of each model based on the low-dimensional network traffic state and the label space position distance; and monitoring and warning the network traffic based on the adjusted network abnormal traffic detection model. Based on the application, the model construction and abnormal identification can be realized more quickly, and the difference between normal traffic and abnormal traffic can be better identified to implement early warning and defense against network attacks.

Description

Technical Field

[0001] This invention relates to the field of network anomaly traffic detection research, specifically to a network anomaly traffic detection method based on contrastive learning. Background Technology

[0002] With the continuous development of the internet, network traffic is increasing daily, and various attacks and network anomalies are emerging one after another. How to effectively monitor abnormal network behavior and traffic is a serious problem facing cyberspace security. Abnormal traffic comes in many forms, including hacker intrusions, network worms, denial-of-service attacks, and the use of malicious software. If network traffic is abnormal, it will endanger the entire network; therefore, it is essential to detect traffic anomalies promptly to minimize losses.

[0003] In recent years, traditional machine learning algorithms, such as K-nearest neighbors, random forests, and Naive Bayes, have been widely applied to network anomaly detection. While these methods can identify certain anomalies, they all suffer from difficulties in representing complex functions and low generalization ability. In complex network environments, the performance of these methods degrades significantly. Therefore, researchers have introduced deep learning algorithms, such as convolutional neural networks and recurrent neural networks, into traffic anomaly detection. However, with development, the boundary between anomaly and normal traffic has become increasingly blurred, leading to an increase in false detections and hindering further optimization of detection models. In recent research, researchers have discovered that contrastive learning can learn the similarities and differences between samples, mining more discriminative features from the data. Thus, they have begun to apply contrastive learning to network anomaly detection. For example, the paper by S. Lotfi et al., "Network Intrusion Detection with Limited Labeled Data Using Self-supervision," uses contrastive learning for better feature extraction to address the problem of blurred boundaries between normal and anomaly traffic.

[0004] Contrastive learning is an unsupervised method where each training sample needs to generate multiple positive samples (i.e., similar samples) and negative samples (i.e., dissimilar samples). The model identifies subtle differences between samples by controlling the distance between them. However, using only unsupervised methods to identify abnormal traffic has the following shortcomings: (1) Network traffic samples need to generate positive and negative samples through data augmentation for pairwise comparison, and multiple comparisons will cause a large time overhead; (2) Representative positive and negative samples need to be selected, but network traffic samples do not have the natural and intuitive features of image samples, making it difficult to select positive and negative samples; (3) It is difficult to apply to supervised schemes. In supervised schemes, samples without natural representation need to be compared with a large number of samples of different categories multiple times. The label can only be determined by comparing the similarity with samples of different categories, which will also take a lot of time. Summary of the Invention

[0005] The purpose of this invention is to provide a network anomaly traffic detection method based on contrastive learning, in order to solve the problems of high time overhead and positive / negative sample selection in existing technologies.

[0006] To achieve the above objectives, the present invention employs the following technical solution:

[0007] A network anomaly traffic detection method based on contrastive learning, characterized by including the construction of a label spatial location model;

[0008] Based on network traffic data, obtain low-dimensional network traffic status;

[0009] Construct a spatial location model of network traffic;

[0010] Based on the label location in the metric space, calculate the distance between the label location and the location in the network traffic space;

[0011] Construct a network traffic spatial location value assessment model;

[0012] The parameters of each model are adjusted based on the low-dimensional network traffic status and the spatial location distance of the labels;

[0013] Based on the adjusted network abnormal traffic detection model, network traffic is monitored and early warnings are issued.

[0014] Furthermore, the construction of the label spatial location model includes:

[0015] Each tag is encoded using one-hot encoding;

[0016] Set the label dimension values ​​for the metric space;

[0017] Construct a label spatial location model that transforms label encoding results into metric spatial locations;

[0018] Based on the spatial location model, the metric spatial location of each label is obtained.

[0019] Furthermore, the acquisition of low-dimensional network data traffic status includes:

[0020] A model is constructed to transform network traffic data into low-dimensional network traffic states. This model includes an encoder and a decoder, both of which are fully connected layer structures. The encoder is used to transform the input network traffic data into low-dimensional feature states, and the decoder is used to map the low-dimensional feature states back to the original data space, thereby realizing data reconstruction and recovery.

[0021] Based on the model, the low-dimensional network traffic state of each network traffic is obtained.

[0022] Furthermore, the construction of the network traffic spatial location model includes:

[0023] Obtain the aforementioned low-dimensional network traffic status;

[0024] Construct a spatial location model of network traffic. This model is a fully connected layer network, including an input layer, two hidden layers, and an output layer.

[0025] Based on the network traffic spatial location model, the low-dimensional network traffic state is input to obtain its location information in the metric space;

[0026] The network traffic location information is obtained by adding randomly sampled Gaussian noise.

[0027] Furthermore, the calculation of the distance between the tag and the spatial location of network traffic includes:

[0028] Obtain the metric spatial location information of the label and the low-dimensional network traffic status;

[0029] Calculate the Euclidean distance in the metric space between the location information of the tag and the low-dimensional network traffic state;

[0030] Based on the distance, obtain the feedback from the metric space;

[0031] Obtain the next low-dimensional network traffic state;

[0032] The status, feedback, and network traffic location information are stored in the experience replay buffer. Further, the information storage format of the experience replay buffer R is as follows:

[0033] (S t A t ,r t ,S t+1 )

[0034] Among them, S t To input the low-dimensional network traffic state of the network traffic spatial location model, A t The metric spatial location information provided by the network traffic spatial location model, r t S is the feedback obtained after calculating the spatial distance. t+1 This refers to the next low-dimensional network traffic state.

[0035] Furthermore, the construction of the network traffic spatial location value assessment model includes:

[0036] A network traffic spatial location value assessment model is constructed. This model is a multi-layer neural network, including an input layer for receiving and concatenating low-dimensional network traffic state and location information, three hidden layers, and an output layer for outputting the spatial location value of network traffic.

[0037] Obtain the low-dimensional network traffic status;

[0038] Based on the aforementioned network traffic spatial location model, the spatial location of network traffic is obtained;

[0039] Based on the spatial location of network traffic and the low-dimensional network traffic state, the network traffic spatial location value assessment model provides a value assessment of the spatial location of network traffic.

[0040] Furthermore, for the already created network traffic spatial location value assessment model Q and network traffic spatial location model μ, target network traffic spatial location value assessment model Q' and target network traffic spatial location model μ' are created. The weight parameters of the target models Q' and μ are initialized by copying the weights of models Q and μ to Q' and μ'. The structures of the two target models Q' and μ are consistent with the original models Q and μ, including input layer, hidden layer and output layer. In each training iteration, the weights of the target models are gradually updated by a soft update method of weighted averaging of the weights of the target models, so that they gradually approach the weights of the original models.

[0041] Furthermore, the adjustment of parameters for each model based on network traffic status and spatial distance of tags includes:

[0042] Randomly retrieve a batch of previously observed information (S) from the experience replay buffer R. t A t ,r t ,S t+1 This data is used to update model parameters; it is randomly sampled during each update, for each (S) t A t ,r t ,S t+1The information is used to obtain the location A' of the network traffic state St+1 in the metric space using the target network traffic spatial location model μ'. t+1 The target network traffic spatial location value assessment model Q' is used to evaluate the network traffic location A'. t+1 The value Q'(St+1,A') t+1 Using the network traffic spatial location value assessment model Q, the value of location At is assessed as Q(St,At);

[0043] The parameters θ of the network traffic spatial location value assessment model are updated based on the principles of TD error and gradient descent. Q ;

[0044] The parameters θ of the network traffic spatial location model are updated based on the principle of gradient ascent. μ ;

[0045] The parameters θ of the label space location model are updated based on the distance between the network traffic state location and the label location in the metric space. ρ ;

[0046] Parameters θ based on the spatial location model of network traffic μ The parameters of the target network traffic spatial location model and the target network traffic spatial location value assessment model are updated based on the parameter θQ of the network traffic spatial location value assessment model.

[0047] Among them, the parameter θ of the updated network traffic spatial location value assessment model is... Q At that time, the loss function LQ of the constructed network traffic spatial location evaluation model is as follows:

[0048]

[0049] Where N is the total number of sampled information in the experience playback buffer R, Q′(S t+1 ,A' t+1 The location A' of the low-dimensional network traffic state St+1 in the metric space is evaluated by the target network traffic location value assessment model. t+1 The value of Q(S) t A t The location A of the low-dimensional network traffic state St in the metric space is evaluated by the network traffic location value assessment model. t value, r i To calculate network traffic location A t The feedback obtained from the distance between its label and its location in the metric space, where γ is the discount factor;

[0050] Update the parameters θ of the network traffic spatial location model μ At that time, the loss function Lμ of the network traffic spatial location model is as follows:

[0051]

[0052] Where N is the total number of sampled information in the experience replay buffer R, Q(St,At) is the value of network traffic location At, C is the total number of tags, D(X,Y) is the distance value between X and Y in the metric space, and A t L represents the location of the low-dimensional network traffic state St in the metric space. ki Let be the position of the i-th low-dimensional network traffic state label in the metric space.

[0053] Furthermore, the aforementioned monitoring and early warning of network traffic includes:

[0054] Acquire network traffic and convert it into a low-dimensional network traffic state;

[0055] Based on the network abnormal traffic detection model, the metric space location prediction of the low-dimensional network traffic status is performed, and the positional distance between it and different labels in the metric space is calculated.

[0056] If the distance between the low-dimensional network traffic status and the normal traffic label is the smallest among all distances, it indicates that the network traffic is normal traffic, and the next detection will be performed.

[0057] If the distance between the low-dimensional network traffic status and the normal traffic label is greater than the distance between it and other abnormal traffic labels, it indicates that the network traffic is malicious traffic, and an alarm is output.

[0058] Compared with the prior art, the present invention has the following technical features:

[0059] 1. This invention constructs a network anomaly traffic detection model based on label embedding contrastive learning and reinforcement learning. Network traffic in the metric space is no longer compared between samples, but rather compared with label information. Compared to unsupervised methods that generate new samples for pairwise comparisons, this label embedding method significantly reduces the number of comparisons, improving the efficiency of building the network anomaly traffic detection model. Furthermore, the embedding of label information eliminates the need to consider the generation and selection of positive and negative network traffic samples during model construction. For each network traffic category, it possesses the naturally representative attribute of a label. In supervised implementation, it is not necessary to compare with multiple samples of different categories to determine the category; only comparison with the label information is required. This also improves the efficiency of network anomaly traffic detection in supervised methods.

[0060] 2. This invention further incorporates reinforcement learning concepts. Reinforcement learning, based on the reward signals from contrastive learning feedback, utilizes techniques such as target networks, experience replay, and policy optimization to improve the stability during training, dynamically adjust the parameters of the contrastive learning model, improve the accuracy of network anomaly traffic monitoring, reduce false alarm rates, and avoid affecting normal network communication traffic in actual production. Attached Figure Description

[0061] Figure 1 This is a diagram illustrating the overall structure of the network abnormal traffic detection method of the present invention.

[0062] Figure 2 This is a model structure diagram for obtaining the spatial location of tags in the network abnormal traffic detection method of the present invention;

[0063] Figure 3 This is a model structure diagram for obtaining low-dimensional network traffic status in the network anomaly traffic detection method of this paper;

[0064] Figure 4 This is a model structure diagram for obtaining network traffic location in the network abnormal traffic detection method of the present invention;

[0065] Figure 5 This is a model structure diagram for obtaining low-dimensional network traffic state value assessment in the network abnormal traffic detection method of the present invention. Detailed Implementation

[0066] This invention proposes a network anomaly traffic detection method based on contrastive learning. It introduces label information as a natural representative attribute of samples, transforming the comparison object into label information. This eliminates the need to generate new samples for comparison during model construction, reducing time overhead and solving the problem of selecting positive and negative samples. Simultaneously, it integrates a reinforcement learning Actor-Critic architecture. The Actor network generates the location information of network traffic, while the Critic network estimates the value of this location information. The Actor network learns how to select mapping locations by maximizing the value estimated by the Critic network, while the Critic network provides feedback signals by estimating the value of the Actor network's output to guide the Actor network's updates. The Actor and Critic networks continuously influence and update each other, improving the accuracy of anomaly traffic detection.

[0067] like Figure 1 As shown, this invention proposes a network anomaly traffic detection method based on contrastive learning, comprising:

[0068] S1, Construct a label spatial location model.

[0069] The construction of the label spatial location model includes:

[0070] Each tag is encoded using One-Hot encoding;

[0071] Set the label dimension value of the metric space, embedding_dim;

[0072] Construct a label spatial location model ρ that transforms the label encoding results into a metric spatial location;

[0073] Based on the spatial location model, the metric spatial location of each label is obtained.

[0074] The label spatial location model is as follows: Figure 2 As shown, this is a fully connected network. The model includes an input layer, a hidden layer, and an output layer. The input layer receives a feature vector of size N1 as input, where N1 represents the dimension of the one-hot encoding result. The hidden layer contains 20 neurons and extracts features from the input vector. The output layer contains Q1 neurons, where Q1 represents the label dimension value embedding_dim set in the metric space. The neurons in the output layer map the features from the previous layers to the final output result.

[0075] Based on the model, the result of one-hot encoding of the input tags is used to obtain the metric space position ρ(L|θ) of each tag. ρ ); where L is the vector of the tag data after one-hot encoding, θ ρ These are the parameters of the label spatial location model.

[0076] S2, based on network traffic data, obtains low-dimensional network traffic status.

[0077] The acquisition of low-dimensional network traffic status includes:

[0078] Construct an auto encoder model to transform network traffic data into low-dimensional network traffic states;

[0079] The model that transforms network traffic data into low-dimensional network traffic states is as follows: Figure 3 As shown, the system consists of an encoder and a decoder, both of which are fully connected layer structures. The encoder is a key component of the autoencoder network, responsible for transforming the input data into a low-dimensional feature representation. In this invention, the dimension of the first layer of the encoder is determined by the dimension of the network traffic data. The next two hidden layers contain 50 and 30 neurons respectively. The presence of these hidden layers can improve the model's representational and feature extraction capabilities. Finally, the dimension of the encoder's output layer is determined by the set number of low-dimensional network traffic state dimensions to achieve compression and dimensionality reduction of the input data.

[0080] The decoder is another crucial component of the autoencoder network. It is responsible for mapping the low-dimensional feature states output by the encoder back to the original data space, thus reconstructing and restoring the data. Similar to the encoder, the decoder also consists of multiple layers, each containing a certain number of neurons. In this invention, the number of layers and neurons in the decoder corresponds to that of the encoder to maintain the model's symmetry and inverse mapping capability. By gradually increasing the dimensionality of the features, the decoder can map the low-dimensional feature states back to the original data space and reconstruct the input data as accurately as possible.

[0081] During the training phase of the autoencoder model, to ensure that the encoded result can represent the features of the original data to the greatest extent and that the decoded data has a high similarity to the data before encoding, this invention uses Mean Squared Error (MSE) as an indicator to measure the reconstruction error between the decoder output and the original input data. By optimizing to minimize the MSE, we aim to enable the encoder to learn feature representations that can preserve the features of the original data to the greatest extent.

[0082] The calculation method for the MSE loss function is as follows:

[0083]

[0084] Where n represents the number of input data samples, x i This represents the i-th input data sample. This indicates the corresponding decoder output.

[0085] Based on the model that transforms network traffic data into low-dimensional network traffic states, the trained encoder is used to obtain the low-dimensional network traffic state of each network traffic; the network parameters of the encoder are not updated when training the network abnormal traffic detection model.

[0086] The network traffic data includes, but is not limited to: duration, protocol type, service type, status flags, source byte count, destination byte count, number of erroneous segments, header buffer size, number of failed login attempts, whether a login has occurred, number of compromised computers, whether root shell privileges are available, number of root user login attempts, number of files created, number of shells, number of files accessed, number of outgoing commands, whether a login is for a host, whether a login is for a guest, number of connections, number of service connections, same service rate, different service rate, service to different hosts rate, target host count, target host service count, same service rate for target hosts, different service rate for target hosts, same source port rate for target hosts, and the ratio of target host services to different hosts.

[0087] S3, construct a spatial location model of network traffic.

[0088] The construction of the network traffic spatial location model includes:

[0089] Obtain the aforementioned low-dimensional network traffic status;

[0090] Construct a spatial location model μ for network traffic;

[0091] The network traffic spatial location model μ is as follows Figure 4 As shown, this is a fully connected layer network. The first layer is the input layer, which receives feature vectors of size N2 as input, where N2 is the dimension of the low-dimensional network flow state. The next two hidden layers contain 100 and 50 neurons respectively. Finally, the output layer outputs the network flow space location, which contains Q2 neurons. Q2 represents the dimension of the low-dimensional network flow state in the metric space, which is the same as the dimension value embedding_dim of the label in the metric space.

[0092] Based on the network traffic spatial location model μ, the low-dimensional network traffic state is input to obtain its location information μ(S|θ) in the metric space. μ ),θ μ Here, S represents the parameters of the spatial location model of network traffic, and S represents the low-dimensional network traffic state.

[0093] Add noise N to the current network traffic location information. t New network traffic location information A is obtained t To introduce a degree of randomness, in order to explore the metric space and discover more possible locations, the formula is as follows:

[0094] A t =μ(S|θ) μ )+N t

[0095] Where, μ(S|θ) μ N represents the spatial location information of low-dimensional network traffic states. t This represents noise randomly sampled from a Gaussian distribution.

[0096] S4 calculates the distance between the label location and the network traffic location based on the label location in the metric space.

[0097] The calculation of the distance between the label and the spatial location of network traffic features includes:

[0098] Obtain the metric spatial location information ρ(L|θ) of the label and the low-dimensional network traffic state. ρ ) and A t The representation of both the label metric spatial location and the network traffic metric spatial location is a vector, and both have the same dimension.

[0099] Calculate the Euclidean distance D between the two in the metric space;

[0100] The distance is calculated as follows:

[0101] D = ||v1-v2|| 2

[0102] Where v1 and v2 represent two position vectors, ‖·‖ 2 This represents the L2 norm.

[0103] Based on the distance D between the low-dimensional network traffic state and its label position in the metric space, the feedback r provided by the metric space can be obtained. t When the low-dimensional network traffic state in the metric space is closest to its label, r t This will provide positive feedback; conversely, when the low-dimensional network traffic state is not closest to its label location, r t Negative feedback will be given.

[0104] When the feedback is positive, the r t The calculation method is as follows:

[0105]

[0106] Where D is the distance between the low-dimensional network traffic state S and its label position in the metric space.

[0107] When the feedback is negative, the r t The calculation method is as follows:

[0108] r t =-D

[0109] Where D is the distance between the low-dimensional network traffic state S and its label position in the metric space.

[0110] Obtain the next low-dimensional network traffic state;

[0111] The low-dimensional network traffic state, feedback, and spatial location information are stored in the experience replay buffer R. The experience replay buffer R stores the interaction data of the low-dimensional network traffic state under different conditions. By randomly sampling the data in the experience buffer to update the model parameters, the diversity of the samples can be increased, enabling the model to better adapt to different situations.

[0112] The experience playback buffer is set at (S) t A t ,r t ,S t+1 The information is stored in the format of ), where S tTo input the low-dimensional network traffic state of the network traffic spatial location model, A t The metric spatial location information provided by the network traffic spatial location model, r t S is the feedback obtained after calculating the spatial distance. t+1 This refers to the next low-dimensional network traffic state.

[0113] S5, construct a network traffic spatial location value assessment model.

[0114] The aforementioned network traffic spatial location value assessment model includes:

[0115] Construct a network traffic spatial location value assessment model Q;

[0116] The network traffic spatial location value assessment model Q is as follows: Figure 5 As shown, the network traffic spatial location value assessment model is designed as a multi-layer neural network. The input layer receives low-dimensional network traffic state and its location information, concatenating the two pieces of information into a feature vector to represent the process by which the network traffic location model μ derives the network traffic spatial location based on the low-dimensional network traffic state. The intermediate layers include three hidden layers with 128, 64, and 32 neurons respectively. These hidden layers perform non-linear transformations and feature extraction on the input to learn abstract feature representations of the environment. Finally, the output layer is a single-dimensional neuron that outputs the value of the network traffic spatial location, used to evaluate the quality of the location.

[0117] Based on the aforementioned network traffic spatial location and low-dimensional network traffic state, the network traffic spatial location value assessment model outputs a value assessment Q(S,A) for the network traffic spatial location. t |θ Q ), where S represents the low-dimensional network traffic state, and A t Let S be the position of S in the metric space.

[0118] Furthermore, for the already created network traffic spatial location value evaluation model Q and network traffic spatial location model μ, target network traffic spatial location value evaluation models Q' and μ' are created. The weight parameters of the target models are initialized by copying the weights of models Q and μ to Q' and μ'. The structures of the two target models are consistent with the original models, including input layers, hidden layers, and output layers. In each training iteration, the weights of the target models are gradually updated using a soft update method to gradually approach the weights of the original models. Since the weights of the target models are updated relatively slowly, instability during training can be reduced, improving the convergence and performance of the algorithm. The soft update is achieved by weighted averaging of the weights of the target models, where the update learning rate τ controls the update speed of the target model weights. Specifically, the weights of the target network are updated in the following way in each update:

[0119] θ Q′ =τθ Q +(1-τ)θ Q′

[0120] θ μ′ =τθ μ +(1-τ)θ μ′

[0121] Where τ is a very small update learning rate, and θ μ′ θ represents the parameters of the target network traffic spatial location model. Q′ θ is the parameter of the target network traffic spatial location value assessment model. μ θ is a parameter of the spatial location model of network traffic. Q These are the parameters for the spatial location value assessment model of network traffic.

[0122] S6 adjusts the parameters of each model based on low-dimensional network traffic status and the spatial distance of labels.

[0123] The adjustment of parameters for each model based on low-dimensional network traffic status and spatial distance of labels includes:

[0124] Randomly retrieve a batch of previously observed information (S) from the experience replay buffer R. t A t ,r t ,S t+1 Used to update model parameters;

[0125] The parameters θ of the network traffic spatial location value assessment model are updated based on the principles of TD error and gradient descent. Q ;

[0126] The parameters θ of the network traffic spatial location model are updated based on the principle of gradient ascent. μ ;

[0127] The parameters θ of the label space location model are updated based on the distance between the network traffic state location and the label location in the metric space. ρ ;

[0128] Parameters θ based on the spatial location model of network traffic μ The parameter θ of the network traffic spatial location value assessment model Q Update the parameters of the target network traffic spatial location model and the target network traffic spatial location value assessment model.

[0129] The parameter θ Q θ μ θ ρ Each update utilizes a batch of data from the experience replay buffer R, which is randomly sampled during each update. For each (S) t A t ,r t ,S t+1 Information, using the target network traffic spatial location model μ' to obtain network traffic state S t+1 At position A' in metric space t+1 The target network traffic spatial location value assessment model Q' is used to evaluate the network traffic location A'. t+1 The value Q'(S) t+1 ,A' t+1 Using the network traffic spatial location value assessment model Q, location A is evaluated. t Value Q(S) t A t ).

[0130] Update the parameter θ of the network traffic spatial location value assessment model Q In this study, Temporal Difference (TD) error is used as a metric to measure the difference between the model's predicted and target values. By calculating the TD error in the network traffic spatial location value assessment model, the accuracy of the model's value estimation for different locations can be measured. Furthermore, a gradient descent optimization method is used to update the model's parameters. With the goal of minimizing the TD error, through multiple iterations, the model parameters can be gradually adjusted to approach or reach the optimal state. The loss function L of the constructed network traffic spatial location assessment model is... Q as follows:

[0131]

[0132] Where N is the total number of sampled information in the experience playback buffer R, Q′(S t+1,A' t+1 The low-dimensional network traffic state S is evaluated by the target network traffic location value assessment model. t+1 At position A' in metric space t+1 The value of Q(S) t A t The low-dimensional network traffic state S is evaluated by the network traffic location value assessment model. t At position A in the metric space t value, r i To calculate network traffic location A t The feedback obtained from the distance between its label and its location in the metric space, where γ is the discount factor;

[0133] Update the parameters θ of the network traffic spatial location model μ At that time, by calculating the low-dimensional network traffic state S t Distances between different labels in the metric space, and the value Q(S) t A t The loss function L for constructing a spatial location model of network traffic μ as follows:

[0134]

[0135] Where N is the total number of sampled information in the experience playback buffer R, Q(S t A t ) represents the location of network traffic A t The value of A is C, the total number of labels is D(X,Y), and the distance between X and Y in the metric space is calculated. t For low-dimensional network traffic state S t In the location of the metric space, L ki Let L be the position of the i-th low-dimensional network traffic state label in the metric space. j≠ki Let j be the position of the j-th (j≠ki) low-dimensional network traffic state label in the metric space.

[0136] The loss function L μ Gradient descent is employed to gradually approach the optimal solution by updating the model parameters. Adding a negative sign before the loss function helps transform the optimization objective into a maximization problem, thereby increasing the value of the model's output position. Furthermore, considering Q(S... t A t The distance between the network traffic location model and the metric space is used to update the network traffic location model. This update process can not only guide the network traffic spatial location model to more accurately predict the spatial location of low-dimensional network traffic states, but also further guide the model output location to move closer to the true label, so that the network traffic location can more accurately represent the network traffic state in the metric space.

[0137] When updating the parameters of the label spatial location model, the network traffic S is considered, similar to the network traffic spatial location model. t A loss function is constructed based on the distances between different labels in the metric space. The model parameters are updated using gradient descent optimization, allowing the label spatial location model to better adapt to the network traffic spatial location model. This results in a more accurate reflection of the distance between network traffic and its labels in the metric space. ρ The formula is as follows:

[0138]

[0139] Where N is the total number of sampled information in the experience playback buffer R, C is the total number of labels, D(X,Y) is the distance value between X and Y in the metric space, and A t For low-dimensional network traffic state S t In the location of the metric space, L ki Let be the position of the i-th low-dimensional network traffic state label in the metric space.

[0140] Finally, the parameters θ of the target network traffic spatial location model and the target network traffic spatial location value assessment model are updated using the soft update method. μ′ and θ Q′ .

[0141] Furthermore, the training data is input into the model, and after multiple iterations, the model's performance is measured using metrics such as accuracy, recall, precision, and F1 score. Accuracy is one of the most common evaluation metrics, representing the proportion of samples correctly classified by the model. Precision measures how many samples predicted as positive by the model are actually positive. Recall measures the model's ability to correctly detect all true positives. The F1 score is the harmonic mean of precision and recall, taking into account the balance between the two. Based on these metrics, the target network traffic spatial location model μ' and the label spatial location model ρ are finally output for the network anomaly traffic detection task. The following are the formulas for calculating accuracy, recall, precision, and F1 score:

[0142]

[0143]

[0144]

[0145]

[0146] Wherein, TP represents the number of anomalies that were correctly classified; TN represents the number of normal types that were correctly classified; FP represents the number of normal types that were misclassified, i.e., false alarms; and FN represents the number of anomalies that were misclassified, i.e., missed alarms.

[0147] S7. Based on the adjusted network abnormal traffic detection model, monitor and issue early warnings for the network traffic.

[0148] Based on the final output target network traffic spatial location model μ' and label spatial location model ρ, the detected network traffic is input into the target network traffic spatial location model to obtain its position in the metric space. Different labels are one-hot encoded and then input into the label spatial location model to obtain their positions in the metric space. The distance between the network traffic spatial location and the spatial locations of different labels is calculated. If the distance to the normal network traffic label is closest, it is considered normal traffic; otherwise, it is considered abnormal traffic. This achieves anomaly detection of network traffic, specifically:

[0149] Acquire network traffic and convert it into a low-dimensional network traffic state;

[0150] Based on the network abnormal traffic detection model, the metric space location prediction of the low-dimensional network traffic status is performed, and the positional distance between it and different labels in the metric space is calculated.

[0151] If the distance between the low-dimensional network traffic status and the normal traffic label is the smallest among all distances, it indicates that the network traffic is normal traffic, and the next detection will be performed.

[0152] If the distance between the low-dimensional network traffic status and the normal traffic label is greater than the distance between it and other abnormal traffic labels, it indicates that the network traffic is malicious traffic, and an alarm is output.

[0153] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for detecting abnormal network traffic based on contrastive learning, characterized in that, include: Construct a label spatial location model; Based on network traffic data, obtain low-dimensional network traffic status; Construct a spatial location model of network traffic; Based on the label location in the metric space, calculate the distance between the label location and the location in the network traffic space; Construct a network traffic spatial location value assessment model; The parameters of each model are adjusted based on the low-dimensional network traffic status and the spatial location distance of the labels; Based on the adjusted network abnormal traffic detection model, the network traffic is monitored and early warning is issued. The distance between the calculated tag and the spatial location of network traffic includes: Obtain the metric spatial location information of the label and the low-dimensional network traffic status; Calculate the Euclidean distance in the metric space between the location information of the tag and the low-dimensional network traffic state; Based on the distance, obtain the feedback from the metric space; Obtain the next low-dimensional network traffic state; The status, feedback, and network traffic location information are stored in the experience replay buffer. The information storage format of the experience playback buffer R is as follows: ； in, To input the low-dimensional network traffic state of the network traffic spatial location model, The spatial location information provided for the spatial location model of network traffic. This is the feedback obtained after calculating the spatial distance. This refers to the next low-dimensional network traffic state; The adjustment of parameters for each model based on network traffic status and spatial distance of tags includes: Randomly retrieve a batch of previously observed information from the experience replay buffer R. Used to update model parameters; this batch of data is randomly sampled during each update, for each Information, using the target network traffic spatial location model 'Get the location of network traffic state St+1 in the metric space' The target network traffic spatial location value assessment model Q' is used to evaluate network traffic location. The value Q'(St+1, Using the network traffic spatial location value assessment model Q, the value of location At is assessed as Q(St, At); The parameters of the network traffic spatial location value assessment model are updated based on the principles of TD error and gradient descent. ; Updating the parameters of the network traffic spatial location model based on the gradient ascent principle. ; The parameters of the label space location model are updated based on the distance between the network traffic state location and the label location in the metric space. ; Parameters based on the spatial location model of network traffic Parameters of the network traffic spatial location value assessment model Update the parameters of the target network traffic spatial location model and the target network traffic spatial location value assessment model; Among them, the parameters of the updated network traffic spatial location value assessment model are... At that time, the loss function of the constructed network traffic spatial location assessment model as follows: ； Where N is the total number of sampled information in the experience playback buffer R. The location of low-dimensional network traffic state St+1 in the metric space evaluated by the target network traffic location value assessment model. value, The location of low-dimensional network traffic state St in the metric space evaluated by the network traffic location value assessment model. value, To calculate network traffic location The feedback obtained from the distance between its label and its location in the metric space. Discount factor; Update the parameters of the network traffic spatial location model At that time, the loss function of the network traffic spatial location model as follows: ； Where N is the total number of sampled information in the experience replay buffer R, Q(St, At) is the value of network traffic location At, C is the total number of tags, and D(X, Y) is the distance value between X and Y in the metric space. This represents the location of the low-dimensional network traffic state St in the metric space. Let be the position of the i-th low-dimensional network traffic state label in the metric space.

2. The network anomaly traffic detection method based on contrastive learning according to claim 1, characterized in that, The construction of the label spatial location model includes: Each tag is encoded using one-hot encoding; Set the label dimension values ​​for the metric space; Construct a label spatial location model that transforms label encoding results into metric spatial locations; Based on the spatial location model, the metric spatial location of each label is obtained.

3. The network anomaly traffic detection method based on contrastive learning according to claim 1, characterized in that, The acquisition of low-dimensional network data traffic status includes: A model is constructed to transform network traffic data into low-dimensional network traffic states. This model includes an encoder and a decoder, both of which are fully connected layer structures. The encoder is used to transform the input network traffic data into low-dimensional feature states, and the decoder is used to map the low-dimensional feature states back to the original data space, thereby realizing data reconstruction and recovery. Based on the model, the low-dimensional network traffic state of each network traffic is obtained.

4. The network anomaly traffic detection method based on contrastive learning according to claim 1, characterized in that, The construction of the network traffic spatial location model includes: Obtain the aforementioned low-dimensional network traffic status; Construct a spatial location model of network traffic. This model is a fully connected layer network, including an input layer, two hidden layers, and an output layer. Based on the network traffic spatial location model, the low-dimensional network traffic state is input to obtain its location information in the metric space; The network traffic location information is obtained by adding randomly sampled Gaussian noise.

5. The network anomaly traffic detection method based on contrastive learning according to claim 1, characterized in that, The aforementioned network traffic spatial location value assessment model includes: A network traffic spatial location value assessment model is constructed. This model is a multi-layer neural network, including an input layer for receiving and concatenating low-dimensional network traffic state and location information, three hidden layers, and an output layer for outputting the spatial location value of network traffic. Obtain the low-dimensional network traffic status; Based on the aforementioned network traffic spatial location model, the spatial location of network traffic is obtained; Based on the spatial location of network traffic and the low-dimensional network traffic state, the network traffic spatial location value assessment model provides a value assessment of the spatial location of network traffic.

6. The network anomaly traffic detection method based on contrastive learning according to claim 1, characterized in that, The established network traffic spatial location value assessment model and network traffic spatial location model Create a target network traffic spatial location value assessment model 'and target network traffic spatial location model ', by model Q and The weights are copied to Q' and ', Initialize the target model Q' and Weight parameters; Two target models Q' and The structure and the original model Q and The consistency includes the input layer, hidden layer, and output layer. In each training iteration, the weights of the target model are gradually updated by a soft update method that uses a weighted average of the weights of the target model, so that it gradually approaches the weights of the original model.

7. The network anomaly traffic detection method based on contrastive learning according to claim 1, characterized in that, The aforementioned network traffic monitoring and early warning system includes: Acquire network traffic and convert it into a low-dimensional network traffic state; Based on the network abnormal traffic detection model, the metric space location prediction of the low-dimensional network traffic status is performed, and the positional distance between it and different labels in the metric space is calculated. If the distance between the low-dimensional network traffic status and the normal traffic label is the smallest among all distances, it indicates that the network traffic is normal traffic, and the next detection will be performed. If the distance between the low-dimensional network traffic status and the normal traffic label is greater than the distance between it and other abnormal traffic labels, it indicates that the network traffic is malicious traffic, and an alarm is output.

Images