A network anomaly detection method, system, device and medium based on conformal prediction

Abstract

The application discloses a network anomaly detection method and system based on conformal prediction, and a device and a medium, and relates to the technical field of network anomaly detection. The method comprises the following steps: acquiring network access data; performing data preprocessing on the network access data to obtain text data with a set length; the set length is a text maximum length limit of the network access data; inputting the text data into an anomaly detection model based on conformal prediction to determine whether the network access data is abnormal data, and determining that the current network is abnormal when the network access data is abnormal data; and the anomaly detection model is constructed based on a Transformer model and conformal correction probability. The application can save the model training time length, control the detection error, and ensure the model detection effect.

Description

Technical Field

[0001] This invention relates to the field of network anomaly detection technology, and in particular to a network anomaly detection method, system, device and medium based on conformal prediction. Background Technology

[0002] Network anomaly detection is a technology that identifies and locates network faults by analyzing network traffic and device status. The purpose of network anomaly detection is to promptly identify various problems in the network, such as congestion, latency, packet loss, attacks, and configuration errors, thereby improving network reliability and security. Network anomaly detection is an important network management technology that helps network administrators identify and resolve network problems in a timely manner, improving network performance and user experience. Different detection methods have their own advantages and disadvantages, and the selection and optimization should be based on specific application scenarios and requirements.

[0003] Currently, methods for network anomaly detection mainly include threshold-based methods, statistical methods, and machine learning-based methods. Threshold-based methods are simple to implement, but threshold setting often relies on experience and subjective judgment, making them difficult to adapt to dynamically changing network environments. Statistical methods can overcome the difficulty of threshold setting, but require extensive data collection and processing, and have high requirements for data quality and completeness. Machine learning-based methods can adapt to complex and changing network environments, but traditional machine learning schemes lack contextual relationships within the text, have limited model classification capabilities, high false positive rates, and require a large number of labeled samples. Deep learning-based schemes suffer from time-consuming model training, low training efficiency, lack of interpretability in the output results, and a lack of theoretical guarantees.

[0004] Therefore, current detection schemes are limited by subjective factors, large amounts of training data, and computational resources, making it difficult to control detection errors and ensure model detection performance while reducing training time. Summary of the Invention

[0005] The purpose of this invention is to provide a network anomaly detection method, system, device, and medium based on conformal prediction, which can save model training time, control detection errors, and ensure model detection performance.

[0006] To achieve the above objectives, the present invention provides the following solution:

[0007] A network anomaly detection method based on conformal prediction includes:

[0008] Obtain network access data;

[0009] The network access data is preprocessed to obtain text data of a set length; the set length is the maximum length limit of the text in the network access data.

[0010] The text data is input into an anomaly detection model based on conformal prediction to determine whether the network access data is abnormal. When the network access data is abnormal, it is determined that the current network is abnormal. The anomaly detection model is constructed based on the Transformer model and conformal correction probability.

[0011] Optionally, the step of preprocessing the network access data to obtain text data of a set length specifically includes:

[0012] Each character in the network access data is mapped to a corresponding number format according to a dictionary table;

[0013] Based on the aforementioned digital format, the data is completed and truncated to ensure that the data length is the set length;

[0014] Data that has been mapped and is guaranteed to be within a set length is identified as the text data.

[0015] Optionally, the step of completing and truncating the data based on the digital format specifically includes:

[0016] Based on the digital format, data that does not meet the set length is padded with 0s, and data that exceeds the set length is truncated.

[0017] Optionally, the training process of the anomaly detection model specifically includes:

[0018] Determine the training data; the training data includes historical network access data and corresponding tags;

[0019] Construct a conformal correction set based on the training data;

[0020] The negative of the classification probability output of the Transformer pre-trained model is used as the inconsistency measure function of conformal prediction; then the inconsistency measure function is run on the conformal correction set to obtain n conformal correction scores;

[0021] Set the conformal correction probability, and determine the anomaly judgment threshold based on the conformal correction probability as a fraction of the conformal correction score. quantiles, where, Let x be the floor function, and α be the conformal correction probability.

[0022] The Transformer pre-trained model is trained based on the anomaly judgment threshold and the inconsistency metric function to obtain a trained anomaly detection model based on conformal prediction.

[0023] Optionally, determining the training data specifically includes:

[0024] Obtain historical network access data;

[0025] The label corresponding to normal data in the network historical access data is recorded as 1, and the label corresponding to abnormal data in the network historical access data is recorded as 0.

[0026] The present invention also provides a network anomaly detection system based on conformal prediction, comprising:

[0027] The data acquisition module is used to acquire network access data;

[0028] The data preprocessing module is used to preprocess the network access data to obtain text data of a set length; the set length is the maximum length limit of the text in the network access data.

[0029] The model prediction module is used to input the text data into an anomaly detection model based on conformal prediction to determine whether the network access data is abnormal data. When the network access data is abnormal data, it is determined that the current network is abnormal. The anomaly detection model is constructed based on the Transformer model and conformal correction probability.

[0030] The present invention also provides an electronic device, including a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to perform the network anomaly detection method based on conformal prediction as described above.

[0031] The present invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the network anomaly detection method based on conformal prediction as described above.

[0032] According to specific embodiments provided by the present invention, the present invention discloses the following technical effects:

[0033] This invention discloses a network anomaly detection method, system, device, and medium based on conformal prediction. The method includes acquiring network access data; preprocessing the network access data to obtain text data of a set length, where the set length is a maximum text length limit for the network access data; inputting the text data into an anomaly detection model based on conformal prediction to determine whether the network access data is anomalous; and determining that the current network is anomaly when the network access data is anomalous. The anomaly detection model is constructed based on a Transformer model and conformal correction probabilities. By employing the above-mentioned anomaly detection model, this invention can save model training time while considering the text context and control detection errors, thus ensuring the model's detection performance. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0035] Figure 1 This is a flowchart illustrating the network anomaly detection method based on conformal prediction of the present invention.

[0036] Figure 2 This is a logical diagram illustrating the model training process in this embodiment. Detailed Implementation

[0037] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0038] The purpose of this invention is to provide a network anomaly detection method, system, device, and medium based on conformal prediction, which can save model training time, control detection errors, and ensure model detection performance.

[0039] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0040] like Figure 1 As shown, this invention provides a network anomaly detection method based on conformal prediction, comprising:

[0041] Step 100: Obtain network access data;

[0042] Step 200: Perform data preprocessing on the network access data to obtain text data of a set length; the set length is the maximum length limit of the text in the network access data.

[0043] Step 300: Input the text data into the anomaly detection model based on conformal prediction to determine whether the network access data is abnormal data. When the network access data is abnormal data, it is determined that the current network is abnormal. The anomaly detection model is constructed based on the Transformer model and conformal correction probability.

[0044] As one specific implementation of step 200, it includes:

[0045] Step 210: Map each character in the network access data to its corresponding numeric format according to a dictionary table;

[0046] Step 220: Based on the stated number format, complete and truncate the data to ensure the data length is the set length; the completion and truncation process specifically includes:

[0047] Based on the digital format, data that does not meet the set length is padded with 0s, and data that exceeds the set length is truncated.

[0048] Step 230: Determine the mapped data that is within the set length as the text data.

[0049] The training process of the anomaly detection model specifically includes:

[0050] Determine training data; the training data includes historical network access data and corresponding labels; construct a conformal correction set based on the training data; use the negative of the classification probability output of the Transformer pre-trained model as the inconsistency measure function of conformal prediction; then run the inconsistency measure function on the conformal correction set to obtain n conformal correction scores; set the conformal correction probability, and determine the anomaly judgment threshold based on the conformal correction probability as a percentage of the conformal correction scores. quantiles, where, Let x be the floor function, and α be the conformal correction probability.

[0051] The Transformer pre-trained model is trained based on the anomaly judgment threshold and the inconsistency metric function to obtain a trained anomaly detection model based on conformal prediction.

[0052] The determination of training data specifically includes:

[0053] Obtain the network historical access data; mark the label corresponding to the normal data in the network historical access data as 1, and mark the label corresponding to the abnormal data in the network historical access data as 0.

[0054] Based on the above implementation scheme, provide the embodiments as Figure 2 shown in the following.

[0055] 1. Data preparation and preprocessing:

[0056] Map each character in the network access data to the corresponding digital format according to the dictionary table. The maximum length limit of the network access text is the maximum length of the text for model training; pad the network access longest text that is less than the maximum length with 0; for the network text that exceeds the set maximum length, only intercept the text up to the maximum length; and mark the label of the normal network access data as 1, and the label of the abnormal network access data as 0. The data set is denoted as (Xi, Yi), where i = 1, 2, 3, …, N. N is the number of samples in the data set, Xi is the sequence after text mapping, and Yi is the label corresponding to the text. And randomly split the data set according to the ratio of 8:2 to form the training set and the test set.

[0057] 2. Anomaly detection model based on conformal prediction

[0058] Conformal prediction is a user-customized framework for creating statistically rigorous uncertainty sets. Its advantages are: it does not assume the distribution of data in advance, and any pre-trained model, such as a neural network, can be used to generate a set that guarantees to contain the true value with a user-specified probability (such as 90%).

[0059] The pre-trained model used in this paper is the Transformer model. The pre-trained model is a text classification model formed based on the wiki corpus.

[0060] The steps of anomaly detection based on conformal prediction are as follows:

[0061] 1. First, select n (n < N, N is the size of the data set) samples with label 0 (i.e., normal samples) in the data set to form the conformal calibration set (X1, X2, …, Xn).

[0062] 2. Take the negative of the classification probability output by the Transformer pre-trained model as the inconsistency metric function s(x) of conformal prediction. Then run the inconsistency metric function s(x) on the conformal calibration set in step 1 to obtain n conformal calibration scores s(x1), s(x2), …, s(xn).

[0063] 3. Set the conformal correction probability α for this task (this setting is a desired misclassification probability for different tasks; a smaller probability can be set when strict filtering is desired, and a larger probability can be set when a better user experience is desired. Setting this probability theoretically guarantees probability convergence and eliminates the need to adjust the pre-trained model), and obtain the anomaly detection threshold q as (s(x1), s(x2), s(x3), ..., s(xn)) quantiles, where, Round x down.

[0064] 4. Finally, determine whether the new sample x_test is abnormal, based on the following rules:

[0065] The inconsistency measure function obtained from the pre-trained Transformer model in step 2 is applied to the new sample x_test to obtain s(x_test). If s(x_test) is less than q, then x_test is considered a normal sample; otherwise, it is an abnormal sample.

[0066] In this embodiment, the advantages of conformal prediction are as follows:

[0067] 1. Based on pre-trained models, it saves the training time currently used for deep learning;

[0068] 2. The pre-trained model, considering the context of the text, performs better than traditional machine learning methods in text classification problems.

[0069] 3. The following theories simultaneously guarantee the reliability of anomaly detection error control.

[0070] Assuming X1, ..., Xn, Xn+1 are independent and identically distributed, the probability that Xn+1 is misclassified as an outlier is less than the conformal correction probability. This theoretically guarantees that the model will not commit a Type I error.

[0071] Furthermore, this invention also provides a network anomaly detection system based on conformal prediction, comprising:

[0072] The data acquisition module is used to acquire network access data;

[0073] The data preprocessing module is used to preprocess the network access data to obtain text data of a set length; the set length is the maximum length limit of the text in the network access data.

[0074] The model prediction module is used to input the text data into an anomaly detection model based on conformal prediction to determine whether the network access data is abnormal data. When the network access data is abnormal data, it is determined that the current network is abnormal. The anomaly detection model is constructed based on the Transformer model and conformal correction probability.

[0075] The present invention also provides an electronic device, including a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to perform the network anomaly detection method based on conformal prediction as described above.

[0076] The present invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the network anomaly detection method based on conformal prediction as described above.

[0077] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0078] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the core ideas of the present invention. Furthermore, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A network anomaly detection method based on conformal prediction, characterized in that, include: Obtain network access data; The network access data is preprocessed to obtain text data of a set length; The set length is the maximum length limit for text accessed via the network; The text data is input into an anomaly detection model based on conformal prediction to determine whether the network access data is abnormal. When the network access data is abnormal, it is determined that the current network is abnormal. The anomaly detection model is built based on the Transformer model and conformal correction probability; The training process of the anomaly detection model specifically includes: Determine the training data; the training data includes historical network access data and corresponding tags; Construct a conformal correction set based on the training data; The negative of the classification probability output of the Transformer pre-trained model is used as the inconsistency measure function of conformal prediction; then the inconsistency measure function is run on the conformal correction set to obtain n conformal correction scores; Set the conformal correction probability, and determine the anomaly judgment threshold based on the conformal correction probability as a fraction of the conformal correction score. quantiles, where, Let x be rounded down, and α be the conformal correction probability. The Transformer pre-trained model is trained based on the anomaly judgment threshold and the inconsistency metric function to obtain a trained anomaly detection model based on conformal prediction.

2. The network anomaly detection method based on conformal prediction according to claim 1, characterized in that, The step of preprocessing the network access data to obtain text data of a set length specifically includes: Each character in the network access data is mapped to a corresponding number format according to a dictionary table; Based on the aforementioned digital format, the data is completed and truncated to ensure that the data length is the set length; Data that has been mapped and is guaranteed to be within a set length is identified as the text data.

3. The network anomaly detection method based on conformal prediction according to claim 2, characterized in that, The process of completing and truncating data based on the aforementioned digital format specifically includes: Based on the digital format, data that does not meet the set length is padded with 0s, and data that exceeds the set length is truncated.

4. The network anomaly detection method based on conformal prediction according to claim 1, characterized in that, The determination of training data specifically includes: Obtain historical network access data; The label corresponding to normal data in the network historical access data is recorded as 1, and the label corresponding to abnormal data in the network historical access data is recorded as 0.

5. A network anomaly detection system based on conformal prediction, characterized in that, include: The data acquisition module is used to acquire network access data; The data preprocessing module is used to preprocess the network access data to obtain text data of a set length; the set length is the maximum length limit of the text in the network access data. The model prediction module is used to input the text data into an anomaly detection model based on conformal prediction to determine whether the network access data is abnormal data. When the network access data is abnormal data, it is determined that the current network is abnormal. The anomaly detection model is built based on the Transformer model and conformal correction probability; The training process of the anomaly detection model specifically includes: Determine the training data; the training data includes historical network access data and corresponding tags; Construct a conformal correction set based on the training data; The negative of the classification probability output of the Transformer pre-trained model is used as the inconsistency measure function of conformal prediction; then the inconsistency measure function is run on the conformal correction set to obtain n conformal correction scores; Set the conformal correction probability, and determine the anomaly judgment threshold based on the conformal correction probability as a fraction of the conformal correction score. quantiles, where, Let x be rounded down, and α be the conformal correction probability. The Transformer pre-trained model is trained based on the anomaly judgment threshold and the inconsistency metric function to obtain a trained anomaly detection model based on conformal prediction.

6. An electronic device, characterized in that, The device includes a memory and a processor, the memory being used to store a computer program, and the processor running the computer program to cause the electronic device to perform the network anomaly detection method based on conformal prediction according to any one of claims 1-5.

7. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the network anomaly detection method based on conformal prediction as described in any one of claims 1-4.

Images