A model training method, device, apparatus and medium

Abstract

The application discloses a model training method and device, equipment and medium, and relates to the technical field of network security. An original data set and a bidirectional time convolution network (Bi-TCN) model to be trained are acquired; feature classification is performed on the original data set to obtain a plurality of attack features in the original data set; and iteration is performed based on the plurality of target attack features. The iteration includes: performing data dimension expansion on each network traffic data corresponding to the plurality of target attack features to obtain a plurality of reference data; performing traffic classification on the plurality of reference data to obtain a plurality of expansion data; taking the plurality of expansion data obtained in each iteration as expansion data corresponding to the plurality of attack features to obtain an expansion data set; and training the Bi-TCN model to be trained based on the original data set and the expansion data set to obtain a trained Bi-TCN model. Through multiple data dimension expansions on the attack features, the data imbalance problem is well solved, and the accuracy of network traffic detection results is improved.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to a model training method, apparatus, device, and medium. Background Technology

[0002] With the rapid development of information technology, various infrastructures rely on networks and are therefore inevitably vulnerable to network traffic threats. Network traffic security plays a crucial role in the stable operation of infrastructure systems. Currently, network traffic detection methods can be mainly categorized into rule-based detection, statistical detection, and machine learning-based detection.

[0003] Rule-based network traffic detection methods utilize prior knowledge of attacks, such as their characteristics, to create rules and perform threat traffic detection. In contrast, statistical detection-based network traffic detection methods detect anomalies by establishing statistical distributions of intrusion patterns.

[0004] However, rule-based traffic detection methods require manual creation of different rules for different network traffic patterns, and rule updates are difficult, resulting in low accuracy and efficiency. Statistical traffic detection methods have very high computational costs and limited ability to handle large datasets. Therefore, an increasing number of researchers are applying machine learning-based traffic detection methods to the security protection of various infrastructure systems.

[0005] Currently, the main method for building network traffic attack detection systems is to establish attack detection models using publicly available network traffic datasets. However, most network traffic datasets suffer from data imbalance. Using imbalanced network traffic datasets to build attack detection models will reduce the accuracy of subsequent network traffic detection results. Summary of the Invention

[0006] This application provides a model training method, apparatus, device, and medium to address the problem that using an imbalanced network traffic dataset to build an attack detection model reduces the accuracy of subsequent network traffic detection results.

[0007] In a first aspect, embodiments of this application provide a model training method, the method comprising:

[0008] Obtain the original dataset and the Bi-TCN model to be trained; the original dataset includes multiple network traffic data.

[0009] The original dataset is subjected to feature classification to obtain multiple attack features in the original dataset;

[0010] Based on multiple target attack features, iterative operations are performed until the similarity between the multiple extended data in this iteration and the multiple network traffic data in the original dataset exceeds a similarity threshold, at which point the iterative operation ends. The iterative operation includes: expanding the data dimensions of each network traffic data corresponding to the multiple target attack features to obtain multiple reference data; classifying the traffic of the multiple reference data to obtain the multiple extended data; if this iteration is the first iteration, then the multiple target attack features are the attack features themselves; if this iteration is not the first iteration, then the multiple target attack features are the attack features corresponding to the multiple extended data obtained in the previous iteration.

[0011] The multiple extended data obtained in each iteration are used as the extended data corresponding to the multiple attack features to obtain the extended dataset;

[0012] The Bi-TCN model to be trained is trained based on the original dataset and the extended dataset to obtain the trained Bi-TCN model.

[0013] In some embodiments, after obtaining the extended dataset, and before training the Bi-TCN model to be trained based on the original dataset and the extended dataset to obtain the trained Bi-TCN model, the method further includes:

[0014] Each network traffic extended data in the extended dataset is subjected to a quality check to obtain network traffic extended data that conforms to the preset quality detection rules.

[0015] The network traffic extended data that conforms to the preset quality detection rules is used as the network traffic extended data in the extended dataset.

[0016] In some embodiments, the network traffic extended data conforming to preset quality detection rules includes:

[0017] Excludes network traffic extension data containing illegal values;

[0018] When the maximum mean difference between the extended dataset and the original dataset is less than a preset difference threshold, the extended dataset includes network traffic extended data.

[0019] The data includes network traffic extension data with multiple preset attack features; these preset attack features are used to perform feature classification on the original dataset.

[0020] In some embodiments, the step of performing feature classification on the original dataset to obtain multiple attack features in the original dataset includes:

[0021] For each network traffic data point in the original dataset:

[0022] Feature extraction is performed on the network traffic data to obtain multiple feature information corresponding to the network traffic data;

[0023] Feature information that is identical to any one of the preset attack features is used as the attack feature in the original dataset.

[0024] In some embodiments, expanding the data dimensions of each network traffic data corresponding to the plurality of target attack features to obtain multiple reference data includes:

[0025] Perform the following operations for each type of network traffic data:

[0026] The target attack features corresponding to the network traffic data are combined into a one-dimensional feature vector, and the one-dimensional feature vector is multiplied by the identity matrix to obtain the first matrix;

[0027] Based on the number of target attack features corresponding to the network traffic data, determine the row and column numbers of each parameter in the two-dimensional matrix;

[0028] For each parameter in the two-dimensional matrix: if the row number and column number of the parameter are the same, then the value of the parameter is zero; if the row number and column number of the parameter are different, then based on the first matrix, the column vector corresponding to the row number and the column vector corresponding to the column number are determined, and based on the column vector corresponding to the row number and the column vector corresponding to the column number, the value of the parameter is determined.

[0029] The two-dimensional matrix is ​​input into the generator of the CL-WGAN model to generate the multiple reference data.

[0030] In some embodiments, classifying the traffic from the plurality of reference data to obtain the plurality of extended data includes:

[0031] The multiple reference data are input into a convolutional bidirectional long short-term memory neural network (CNN-BiLSTM) to extract features from the multiple reference data and obtain feature vectors.

[0032] The feature vectors are subjected to forward and reverse feature extraction to obtain sequence feature vectors in two directions. The sequence feature vectors in the two directions are then fused to obtain the traffic classification results of the multiple reference data.

[0033] The traffic classification results are used as reference data to represent attack network traffic as extended data; the attack network traffic is network traffic with the same feature information as any one of the preset multiple attack features.

[0034] In some embodiments, the Bi-TCN model to be trained is trained based on the original dataset and the extended dataset to obtain a trained Bi-TCN model, including:

[0035] The original dataset and the extended dataset are used as training datasets and input into the Bi-TCN model to be trained to obtain the classification results of each network traffic data in the training dataset;

[0036] Based on the classification results and the labeled data in the training dataset, the loss function of the Bi-TCN model to be trained is determined; the labeled data in the training dataset characterizes whether each network traffic data in the training dataset is attack network traffic.

[0037] Based on the loss function of the Bi-TCN model to be trained, the weight parameters and bias parameters of the Bi-TCN model to be trained are adjusted until the classification result is consistent with the labeled data in the training dataset, thus obtaining the trained Bi-TCN model.

[0038] In some embodiments, the Bi-TCN model includes an input layer, a convolutional layer, a fully connected layer, and a softmax layer. The convolutional layer includes n residual modules, each residual module including a causal dilated convolutional unit. The dilation coefficient of the causal dilated convolutional unit in each residual module increases exponentially. The method further includes:

[0039] The original dataset is input into the convolutional layer. In each residual module, forward and reverse feature extraction is performed based on the dilation coefficient of the causal dilated convolutional unit to obtain sequential feature vectors in two directions. The sequential feature vectors in the two directions are then fused and input into the next residual module until the last residual module outputs the convolutional feature vector.

[0040] The convolutional feature vector is input into the fully connected layer, and a reference feature vector is determined based on the weight parameters and bias parameters in the trained Bi-TCN model.

[0041] The reference feature vector output by the fully connected layer is input into the softmax layer for activation to obtain the classification results of multiple network traffic data in the original dataset.

[0042] Secondly, embodiments of this application provide a model training apparatus, the apparatus comprising:

[0043] The first acquisition module is used to acquire the original dataset and the Bi-TCN model to be trained; the original dataset includes multiple network traffic data.

[0044] The classification module is used to perform feature classification on the original dataset to obtain multiple attack features in the original dataset.

[0045] An extension module is used to perform iterative operations based on multiple target attack features until the similarity between the multiple extended data in this iteration and multiple network traffic data in the original dataset is greater than a similarity threshold, at which point the iterative operation ends. The iterative operation includes: expanding the data dimensions of each network traffic data corresponding to the multiple target attack features to obtain multiple reference data; classifying the traffic of the multiple reference data to obtain the multiple extended data; if this iteration is the first iteration, then the multiple target attack features are the multiple attack features themselves; if this iteration is not the first iteration, then the multiple target attack features are the attack features corresponding to the multiple extended data obtained in the previous iteration.

[0046] An extended dataset determination module is used to take multiple extended data obtained in each iteration as extended data corresponding to the multiple attack features to obtain an extended dataset;

[0047] The training module is used to train the Bi-TCN model to be trained based on the original dataset and the extended dataset, so as to obtain the trained Bi-TCN model.

[0048] In some embodiments, the apparatus further includes:

[0049] The quality inspection module is used to perform quality checks on each network traffic extended data in the extended dataset to obtain network traffic extended data that conforms to preset quality inspection rules.

[0050] The network traffic extended data that conforms to the preset quality detection rules is used as the network traffic extended data in the extended dataset.

[0051] In some embodiments, the network traffic extended data conforming to preset quality detection rules includes:

[0052] Excludes network traffic extension data containing illegal values;

[0053] When the maximum mean difference between the extended dataset and the original dataset is less than a preset difference threshold, the extended dataset includes network traffic extended data.

[0054] The data includes network traffic extension data with multiple preset attack features; these preset attack features are used to perform feature classification on the original dataset.

[0055] In some embodiments, the classification module is specifically used for:

[0056] For each network traffic data point in the original dataset:

[0057] Feature extraction is performed on the network traffic data to obtain multiple feature information corresponding to the network traffic data;

[0058] Feature information that is identical to any one of the preset attack features is used as the attack feature in the original dataset.

[0059] In some embodiments, the extension module is specifically used for:

[0060] Perform the following operations for each type of network traffic data:

[0061] The target attack features corresponding to the network traffic data are combined into a one-dimensional feature vector, and the one-dimensional feature vector is multiplied by the identity matrix to obtain the first matrix;

[0062] Based on the number of target attack features corresponding to the network traffic data, determine the row and column numbers of each parameter in the two-dimensional matrix;

[0063] For each parameter in the two-dimensional matrix: if the row number and column number of the parameter are the same, then the value of the parameter is zero; if the row number and column number of the parameter are different, then based on the first matrix, the column vector corresponding to the row number and the column vector corresponding to the column number are determined, and based on the column vector corresponding to the row number and the column vector corresponding to the column number, the value of the parameter is determined.

[0064] The two-dimensional matrix is ​​input into the generator of the CL-WGAN model to generate the multiple reference data.

[0065] In some embodiments, the extension module is specifically used for:

[0066] The multiple reference data are input into a convolutional bidirectional long short-term memory neural network (CNN-BiLSTM) to extract features from the multiple reference data and obtain feature vectors.

[0067] The feature vectors are subjected to forward and reverse feature extraction to obtain sequence feature vectors in two directions. The sequence feature vectors in the two directions are then fused to obtain the traffic classification results of the multiple reference data.

[0068] The traffic classification results are used as reference data to represent attack network traffic as extended data; the attack network traffic is network traffic with the same feature information as any one of the preset multiple attack features.

[0069] In some embodiments, the training module is specifically used for:

[0070] The original dataset and the extended dataset are used as training datasets and input into the Bi-TCN model to be trained to obtain the classification results of each network traffic data in the training dataset;

[0071] Based on the classification results and the labeled data in the training dataset, the loss function of the Bi-TCN model to be trained is determined; the labeled data in the training dataset characterizes whether each network traffic data in the training dataset is attack network traffic.

[0072] Based on the loss function of the Bi-TCN model to be trained, the weight parameters and bias parameters of the Bi-TCN model to be trained are adjusted until the classification result is consistent with the labeled data in the training dataset, thus obtaining the trained Bi-TCN model.

[0073] In some embodiments, the Bi-TCN model includes an input layer, a convolutional layer, a fully connected layer, and a softmax layer. The convolutional layer includes n residual modules, and each residual module includes a causal dilated convolutional unit. The dilation coefficient of the causal dilated convolutional unit of each residual module increases exponentially.

[0074] The device further includes a detection module for:

[0075] The original dataset is input into the convolutional layer. In each residual module, forward and reverse feature extraction is performed based on the dilation coefficient of the causal dilated convolutional unit to obtain sequential feature vectors in two directions. The sequential feature vectors in the two directions are then fused and input into the next residual module until the last residual module outputs the convolutional feature vector.

[0076] The convolutional feature vector is input into the fully connected layer, and a reference feature vector is determined based on the weight parameters and bias parameters in the trained Bi-TCN model.

[0077] The reference feature vector output by the fully connected layer is input into the softmax layer for activation to obtain the classification results of multiple network traffic data in the original dataset.

[0078] Thirdly, embodiments of this application provide an electronic device, including: at least one processor, and a memory communicatively connected to the at least one processor, wherein:

[0079] The memory stores a computer program that can be executed by at least one processor, which enables the at least one processor to perform the model training method described above.

[0080] Fourthly, embodiments of this application provide a storage medium in which the electronic device can execute the above-described model training method when the computer program in the storage medium is executed by the processor of the electronic device.

[0081] Fifthly, embodiments of this application provide a computer program product. When the computer program product is executed by an electronic device, the electronic device can implement the model training method described above provided in this application.

[0082] The technical solutions provided by the embodiments of this application bring at least the following beneficial effects:

[0083] In this embodiment, an original dataset and a Bi-TCN model to be trained are obtained. The original dataset includes multiple network traffic data. The original dataset is classified to obtain multiple attack features. Based on the multiple target attack features, iterative operations are performed until the similarity between the multiple extended data in this iteration and the multiple network traffic data in the original dataset is greater than a similarity threshold, at which point the iteration ends. The iterative operations include: expanding the data dimensions of each network traffic data corresponding to the multiple target attack features to obtain multiple reference data; classifying the multiple reference data to obtain multiple extended data; if this iteration is the first iteration, the multiple target attack features are multiple attack features; if this iteration is not the first iteration, the multiple target attack features are the attack features corresponding to the multiple extended data obtained in the previous iteration; the multiple extended data obtained in each iteration are used as the extended data corresponding to the multiple attack features to obtain an extended dataset; the Bi-TCN model to be trained is trained based on the original dataset and the extended dataset to obtain the trained Bi-TCN model.

[0084] Therefore, by classifying the original dataset, attack features corresponding to attack network traffic with a small amount of data are obtained. Then, the attack features are expanded multiple times to generate an expanded dataset, thereby increasing the attack network traffic with attack features. The Bi-TCN model is then trained using the expanded dataset and the original dataset together, which effectively solves the data imbalance problem and further improves the accuracy of the detection results of network traffic using the model.

[0085] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0086] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0087] Figure 1 This is a schematic diagram of the system structure of a model training method provided in an embodiment of this application;

[0088] Figure 2 A schematic flowchart illustrating a model training method provided in an embodiment of this application;

[0089] Figure 3 A schematic diagram of the structure of a CL-WGAN model provided in an embodiment of this application;

[0090] Figure 4 A schematic diagram illustrating a data dimension expansion process provided in an embodiment of this application;

[0091] Figure 5 A schematic diagram of a traffic classification process provided for an embodiment of this application;

[0092] Figure 6 A schematic diagram illustrating the process of training a Bi-TCN model provided in an embodiment of this application;

[0093] Figure 7 A schematic diagram of the structure of a Bi-TCN model provided in an embodiment of this application;

[0094] Figure 8 A flowchart illustrating a method for detecting network traffic data provided in an embodiment of this application;

[0095] Figure 9 A substructure diagram of a convolutional layer provided in an embodiment of this application;

[0096] Figure 10 This is a schematic diagram of the structure of a model training device provided in an embodiment of this application;

[0097] Figure 11 This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0098] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. The described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0099] Furthermore, in the description of the embodiments of this application, unless otherwise stated, " / " means "or". For example, A / B can mean A or B. The "and / or" in the text is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone. In addition, in the description of the embodiments of this application, "multiple" means two or more.

[0100] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined with "first" and "second" may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0101] To facilitate understanding of this application, some of the technical terms used in this application are introduced below:

[0102] 1. Data Imbalance: This refers to a significant difference in the number of samples between different categories within the same dataset, making it difficult to extract features from a small number of samples. Data imbalance is mainly divided into two categories: large-scale data imbalance and small-scale data imbalance. Large-scale data imbalance means that in a large dataset, the proportion of samples from a certain category is small; small-scale data imbalance means that in a small dataset, the number of samples from a certain category is even smaller.

[0103] 2. Temporal Convolutional Network (TCN): This refers to a new model that combines convolutional neural networks with time series models for the classification of time series data.

[0104] 3. Generative Adversarial Networks (GANs): These consist of a generator network and a discriminator network. Inspired by zero-sum games in game theory, the data generation problem in GANs can be viewed as an adversarial zero-sum game between the discriminator and generator networks, achieving model optimization in the process. They are currently widely used in deep learning image processing.

[0105] With the rapid development of information technology, various infrastructures rely on networks and are therefore inevitably vulnerable to network traffic threats. Network traffic security plays a crucial role in the stable operation of infrastructure systems. Currently, network traffic detection methods can be mainly categorized into rule-based detection, statistical detection, and machine learning-based detection.

[0106] Rule-based network traffic detection methods utilize prior knowledge of attacks, such as their characteristics, to create rules and perform threat traffic detection. In contrast, statistical detection-based network traffic detection methods detect anomalies by establishing statistical distributions of intrusion patterns.

[0107] However, rule-based traffic detection methods require manual creation of different rules for different network traffic patterns, and rule updates are difficult, resulting in low accuracy and efficiency. Statistical traffic detection methods have very high computational costs and limited ability to handle large datasets. Therefore, an increasing number of researchers are applying machine learning-based traffic detection methods to the security protection of various infrastructure systems.

[0108] Currently, the main method for building network traffic attack detection systems is to establish attack detection models using publicly available network traffic datasets. However, most network traffic datasets suffer from data imbalance. Using imbalanced network traffic datasets to build attack detection models will reduce the accuracy of subsequent network traffic detection results.

[0109] In view of this, embodiments of this application provide a model training method, apparatus, device, and medium to address the problem that using an imbalanced network traffic dataset to build an attack detection model reduces the accuracy of subsequent network traffic detection results using the model.

[0110] The inventive concept of this application embodiment is as follows: In this application embodiment, by classifying the original dataset, attack features corresponding to attack network traffic with a small amount of data are obtained. Then, the attack features are expanded multiple times in terms of data dimensions to generate an expanded dataset, thereby increasing the attack network traffic with attack features. Then, the expanded dataset and the original dataset are used together to train the Bi-TCN model, which effectively solves the data imbalance problem and further improves the accuracy of the detection results of network traffic detection using the model.

[0111] In this embodiment, to construct a real-time, efficient, and accurate attack detection model, the dataset must possess sufficient attack traffic characteristics, and the model must be able to learn these attack characteristics for classification. Therefore, regarding the data, to address the issue of imbalanced traffic data proportions in publicly available datasets reducing the accuracy of abnormal traffic detection, data supplementation is achieved by generating samples for abnormal traffic data with limited volume. This results in a high pass rate for traffic quality checks, effectively resolving the data imbalance problem and obtaining a balanced dataset. Regarding the model, the existing temporal convolutional network is improved to a bidirectional temporal convolutional network model, which can better capture traffic feature information over longer time dimensions and has lower model space complexity.

[0112] like Figure 1 The diagram shown is a schematic of the system structure of the model training method in this embodiment. First, the CL-WGAN model is used to process the imbalanced data in the original dataset. Then, the balanced data undergoes preprocessing such as data integration, data cleaning, and data normalization. Finally, the Bi-TCN deep learning model is trained and tested to obtain the network traffic detection and classification results, that is, to obtain the attack network traffic and normal network traffic in the original dataset.

[0113] To further illustrate the technical solutions provided in the embodiments of this application, a detailed description is provided below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiments of this application provide method operation steps as shown in the following embodiments or drawings, the method may include more or fewer operation steps based on conventional or non-inventive methods. In steps where there is no logically necessary causal relationship, the execution order of these steps is not limited to the execution order provided in the embodiments of this application.

[0114] See Figure 2 This is a flowchart illustrating a model training method provided in an embodiment of this application. The method includes, as follows: Figure 2 The steps shown are as follows:

[0115] In step 201, the original dataset and the Bi-TCN model to be trained are obtained; the original dataset includes multiple network traffic data.

[0116] After obtaining the original dataset, the raw data in the original dataset is preprocessed by data cleaning, normalization and other data preprocessing.

[0117] In step 202, the original dataset is classified to obtain multiple attack features in the original dataset.

[0118] In some embodiments, feature classification is performed on the original dataset to obtain multiple attack features in the original dataset, which can be performed as follows: for each network traffic data in the original dataset:

[0119] Feature extraction is performed on network traffic data to obtain multiple feature information corresponding to the network traffic data; the feature information that is the same as any one of the preset multiple attack features is used as the attack feature in the original dataset.

[0120] The preset attack features can be set based on practical experience or actual needs, and this application does not impose any restrictions on this.

[0121] In practical implementation, the data expansion in this application is only generated for attack features. Therefore, the original dataset first needs to be divided into attack network traffic and normal network traffic. Thus, multiple attack features are pre-set and stored on the server. Then, features of each network traffic data in the original dataset are extracted and compared with the pre-set multiple attack features. The features of all data in the original dataset are divided into attack features and non-attack features; that is, features identical to any one of the pre-set attack features are attack features, otherwise they are non-attack features.

[0122] In step 203, based on multiple target attack features, an iterative operation is performed until the similarity between the multiple extended data in this iteration and the multiple network traffic data in the original dataset is greater than a similarity threshold, at which point the iterative operation ends. The iterative operation includes: expanding the data dimensions of each network traffic data corresponding to multiple target attack features to obtain multiple reference data; and classifying the traffic of the multiple reference data to obtain multiple extended data.

[0123] If this iteration is the first iteration, then multiple target attack features are multiple attack features; if this iteration is not the first iteration, then multiple target attack features are attack features corresponding to multiple extended data obtained in the previous iteration.

[0124] In specific implementation, such as Figure 3 As shown, when using the CL-WGAN model to address the imbalance of the original dataset, the original dataset is input into the CL-WGAN model, and after passing through the data dimension expansion unit, generator, classification control unit, and discriminator in the model, the expanded dataset is finally generated.

[0125] In some embodiments, when expanding the data dimensions of network traffic data corresponding to multiple target attack features to obtain multiple reference data, the following steps are performed for each network traffic data: Figure 4 The operation shown:

[0126] In step 401, the target attack features corresponding to the network traffic data are combined into a one-dimensional feature vector, and the one-dimensional feature vector is multiplied by the identity matrix to obtain the first matrix;

[0127] In step 402, the row and column numbers of each parameter in the two-dimensional matrix are determined based on the number of target attack features corresponding to the network traffic data.

[0128] In step 403, for each parameter in the two-dimensional matrix: if the row number and column number of the parameter are the same, the value of the parameter is zero; if the row number and column number of the parameter are different, then based on the first matrix, determine the column vector corresponding to the row number and the column vector corresponding to the column number, and determine the value of the parameter based on the column vector corresponding to the row number and the column vector corresponding to the column number.

[0129] In step 404, the two-dimensional matrix is ​​input into the generator of the CL-WGAN model to generate multiple reference data.

[0130] In practice, the network traffic corresponding to the attack characteristics in the original dataset undergoes a data dimension expansion operation, as follows:

[0131] The target attack features corresponding to the network traffic data are combined into a one-dimensional feature vector. Assume that a network traffic instance corresponding to an attack feature can be represented as X = [x1, ..., x]. t ,…,x n ], where x1 represents a certain feature information. For each network traffic instance, the network traffic X can be transformed into a two-dimensional matrix X′ by expanding the data dimension.

[0132] Specifically, the first matrix is ​​obtained by multiplying the one-dimensional eigenvector by the identity matrix, as shown in formula (1):

[0133]

[0134] Then, for i∈[n], according to formulas (1) and (2), we obtain the matrix F corresponding to each feature information i. i :

[0135]

[0136] Next, for the row number j and column number k of each parameter in the two-dimensional matrix, j,k∈[n], the value x of each parameter in the two-dimensional matrix is ​​defined according to formula (1). jk :

[0137]

[0138] Among them, F j It is the matrix F corresponding to the feature information j in formula (2). j That is, the first matrix XI m The column vector of the j-th column;

[0139] Finally, after calculating the values ​​of each parameter in the two-dimensional matrix according to formula (3), the two-dimensional matrix X can be obtained. ′ :

[0140]

[0141] Thus, the feature information x1 in network traffic X is transformed into X1 ‘ =[x 11 ,…,x 1t ,…,x 1n ], and so on, other feature information xi It also transforms into the corresponding X i ‘ =[x i1 ,…,x it ,…,x in The original one-dimensional vector form is transformed into a two-dimensional matrix form, and the matrix contains all the feature information of the original network traffic X, thus obtaining the data after the data dimension expansion. Then, the two-dimensional matrix after the data dimension expansion is input into the generator to obtain the generated data. The generated data is converted into a vector form through the inverse operation of dimension transformation, that is, through the inverse operation of formulas (1), (2), and (3), the multiple parameter traffic corresponding to the network traffic is obtained.

[0142] In some embodiments, traffic classification of multiple reference data to obtain multiple extended data can be performed as follows:

[0143] Multiple reference data are input into a convolutional bidirectional long short-term memory neural network CNN-BiLSTM, and feature extraction is performed on the multiple reference data to obtain feature vectors;

[0144] Forward and reverse feature extraction is performed on the feature vectors to obtain sequence feature vectors in two directions. The sequence feature vectors in the two directions are then fused to obtain the traffic classification results of multiple reference data.

[0145] The traffic classification results are used as reference data to represent attack network traffic as extended data; attack network traffic is network traffic with the same feature information as any one of the preset attack features.

[0146] In specific implementation, such as Figure 5 As shown, multiple parameter traffic corresponding to network traffic X is input into a pre-trained CNN-BiLSTM classification control unit for sample classification checks, resulting in traffic classification results, including correctly classified traffic and incorrectly classified traffic, i.e., attack network traffic and normal network traffic. Then, the reference data that passes the check, i.e., the correctly classified traffic data, is input into the discriminator, while the reference data that fails the check, i.e., the incorrectly classified traffic data, is directly discarded. The result of the discriminator is used as the extended data for this iteration and fed back to the generator. The data dimension expansion and traffic classification operations are repeated until a high-quality extended dataset is finally generated.

[0147] The CNN-BiLSTM classification control unit is mainly composed of an input layer, a CNN (Convolutional Neural Networks) layer, a BiLSTM (Bi-directional Long Short-Term Memory) layer, a connection layer, and an output layer. The training dataset first enters the input layer, then passes through the CNN layer to extract relationships between features and generate feature vectors. Next, it enters the BiLSTM layer to learn the patterns between features, and finally, the classification result is obtained through the output layer.

[0148] The structure of each layer of the CNN-BiLSTM classification control unit is described below:

[0149] Input layer: This layer reads the preprocessed reference data into the model. For example, with n as the batch length of the reference data, the input vector can be represented as X = [x1, ..., x]. t ,…,x n ].

[0150] CNN layers: These layers extract features from the reference data of the input layer, obtain the relationships between features, construct important feature vectors, and then provide these feature vectors to the BiLSTM layer. CNN layers can be further divided into convolutional layers, pooling layers, and fully connected layers. The main function of convolutional and pooling layers is to extract features from the input vector, which is then passed through the fully connected layer to output the feature vector.

[0151] The BiLSTM layer performs forward and backward feature extraction on the feature vectors extracted by the CNN layer, resulting in two sequence feature vectors. It learns the feature relationships between time-series features and then fuses the two sequence feature vectors based on these relationships to obtain a new feature vector. Here, a forward LSTM network and a backward LSTM network are used, with two interconnected LSTMs on the input sequence. Data passes through the recurrent neural network in both forward and backward directions, better capturing the contextual and relational features of the traffic data.

[0152] Output layer: The new feature vector obtained from the BiLSTM layer is passed through the output layer to obtain the final traffic classification result.

[0153] In step 204, the multiple extended data obtained in each iteration are used as extended data corresponding to multiple attack features to obtain an extended dataset.

[0154] In this application, the condition for ending the iteration operation is: the similarity between the multiple extended data points in this iteration and the multiple network traffic data points in the original dataset is greater than a similarity threshold, at which point the iteration operation ends. The similarity between the multiple extended data points in this iteration and the multiple network traffic data points in the original dataset refers to the percentage of the number of identical data points among the multiple extended data points. For example, if this iteration generates 10 extended data points, but 9 of them are identical to multiple network traffic data points in the original dataset (i.e., the similarity reaches 90%, which is greater than the similarity threshold of 70%), then the iteration operation ends.

[0155] Then, all the extended data obtained from each previous iteration are used as extended data corresponding to multiple attack features to generate an extended dataset.

[0156] In some embodiments, after obtaining the extended dataset, and before training the Bi-TCN model to be trained based on the original dataset and the extended dataset to obtain the trained Bi-TCN model, the model training method provided in this application may also be performed as follows:

[0157] Each network traffic extended data in the extended dataset is subjected to quality checks to obtain network traffic extended data that conforms to the preset quality detection rules; the network traffic extended data that conforms to the preset quality detection rules is used as the network traffic extended data in the extended dataset.

[0158] Among them, the network traffic extended data that conforms to the preset quality detection rules includes:

[0159] Excludes network traffic extension data containing illegal values;

[0160] When the maximum mean difference between the extended dataset and the original dataset is less than a preset difference threshold, the extended dataset includes network traffic extended data.

[0161] This includes network traffic extension data with multiple preset attack features; these preset attack features are used for feature classification of the original dataset.

[0162] In practice, after obtaining the extended dataset, quality checks are performed on each network traffic extension data point within the extended dataset from both overall and local perspectives. Overall, the maximum mean discrepancy (MMD) between the extended dataset and the original dataset is calculated. Locally, each network traffic extension data point is checked for illegal values ​​and attack characteristics.

[0163] Illegal Value Check: This check examines whether each network traffic extension data in the extended dataset contains any illegal values. For example, illegal values ​​include at least one of the following: character data not present in the original dataset, decimal points, or null values. Therefore, it checks whether character data not present in the original dataset appears in the extended dataset; whether multiple decimal points exist; and whether null values ​​exist. Network traffic extension data that does not contain illegal values ​​is considered to meet the preset quality inspection rules.

[0164] Maximum mean difference check: This checks whether the original dataset and the expanded dataset originate from the same distribution, i.e., assuming D... s =(x1,x2,…,x n P(x) and D t =(y1,y2,…,y n )~Q(y), calculate D s and D t The MMD value between the two datasets is used to determine the model's performance. A smaller MMD value indicates better model performance and greater similarity between the two datasets. Therefore, when the maximum mean difference between the expanded dataset and the original dataset is less than a preset difference threshold, the network traffic expansion data included in the expanded dataset is considered as network traffic expansion data that meets the preset quality detection rules.

[0165] The preset difference threshold can be set based on experience or actual needs, and this application does not impose any restrictions on it.

[0166] Attack signature check: This checks whether the network traffic extension data in the extended dataset contains multiple preset attack signatures. Network traffic extension data containing these preset attack signatures is considered to meet the preset quality inspection rules. These preset attack signatures are used for feature classification of the original dataset. The attack signature check is based on the attack principles. For example, taking the Reconnaissance attack in the Modbus protocol as an example, its attack signatures are command_address and response_address. This means that the attack signatures of the generated network traffic extension data should include command_address and response_address, while other non-attack signatures should not include these signatures.

[0167] Finally, network traffic extended data that conforms to the preset quality detection rules in the extended dataset is used as the network traffic extended data in the extended dataset, while network traffic extended data that does not conform to the preset quality detection rules in the extended dataset is deleted and not used in the training process of the Bi-TCN model.

[0168] In step 205, the Bi-TCN model to be trained is trained based on the original dataset and the extended dataset to obtain the trained Bi-TCN model.

[0169] In some embodiments, training the Bi-TCN model to be trained based on the original dataset and the extended dataset to obtain the trained Bi-TCN model can be performed as follows:

[0170] The original dataset and the extended dataset are used as training datasets and input into the Bi-TCN model to be trained to obtain the classification results of each network traffic data in the training dataset.

[0171] Based on the classification results and the labeled data in the training dataset, the loss function of the Bi-TCN model to be trained is determined; the labeled data in the training dataset characterizes whether each network traffic data in the training dataset is attack network traffic.

[0172] Based on the loss function of the Bi-TCN model to be trained, the weight parameters and bias parameters of the Bi-TCN model to be trained are adjusted until the classification result is consistent with the labeled data in the training dataset, thus obtaining the trained Bi-TCN model.

[0173] like Figure 6 As shown, a new dataset is obtained by mixing the extended dataset with the original dataset. Then, the new traffic data is preprocessed, including data integration, data cleaning, and data normalization. The new dataset is then divided into training and testing datasets. For example, the new dataset is divided into 10 parts, with 9 parts used as training datasets and 1 part used as testing datasets, and 10-fold cross-validation is performed.

[0174] The training dataset is then fed into the Bi-TCN model for training to obtain classification results. Based on the classification results and the labeled data in the training dataset, the loss function of the Bi-TCN model to be trained is determined. The convergence of the model is judged according to the loss function, and the weight parameters and bias parameters are updated by the optimizer according to the loss function. The model is iteratively updated until the model converges, and the trained Bi-TCN model is obtained. Then, the test dataset is input into the trained Bi-TCN model, and 10-fold cross-validation is performed on the trained Bi-TCN model to output the test results.

[0175] In some embodiments, such as Figure 7As shown, the trained Bi-TCN model includes an input layer, a convolutional layer, a fully connected layer, and a softmax layer. The convolutional layer includes n residual blocks, each of which includes two dilated causal convolutional units, two weight normalization units, two activation units (ReLU), and two regularization units (Dropout). The dilation coefficient of the dilated causal convolutional units in each residual block increases exponentially.

[0176] Therefore, in this application, after training the Bi-TCN model, the original dataset is input into the trained Bi-TCN model to obtain the classification results of multiple network traffic data in the original dataset, namely, attack network traffic and normal network traffic in the original dataset. Specifically, this can be executed as follows: Figure 8 The steps shown are as follows:

[0177] In step 801, the original dataset is input into the convolutional layer. In each residual module, forward and reverse feature extraction is performed based on the dilation coefficient of the causal dilated convolutional unit to obtain sequential feature vectors in two directions. The sequential feature vectors in the two directions are then fused and input into the next residual module until the last residual module outputs the convolutional feature vector.

[0178] In step 802, the convolutional feature vector is input into the fully connected layer, and the reference feature vector is determined based on the weight parameters and bias parameters in the trained Bi-TCN model.

[0179] In step 803, the reference feature vector output by the fully connected layer is input into the softmax layer for activation to obtain the classification results of multiple network traffic data in the original dataset.

[0180] Before the original dataset is input into the convolutional layer, it is processed according to the dimensionality information of the original dataset, the size of the preset sliding window, and the stride of the preset sliding window to obtain the processed original dataset. Then, the processed original dataset is input into the convolutional layer.

[0181] The size and step size of the preset sliding window can be set based on experience or actual needs, and this application does not impose any restrictions on them.

[0182] In practice, the time series input vector of the original dataset can be represented as X = [x1, x2, ..., x...]. t-1 ,x t ], where t is the batch length of the original dataset. The input x at time i... i It can be represented as x i=[r,r2,…,r k-1 ,r k [The text describes a process where k represents the dimension of the data at that moment.] The input vector X is segmented using a sliding window approach. Assuming the sliding window size is m, each segment along the time series yields an m×k two-dimensional matrix. When the sliding window step size is s, a p×m×k three-dimensional matrix is ​​ultimately obtained, where p = ts, representing the number of times the sliding window has slid. This transforms the original two-dimensional matrix into a three-dimensional matrix, covering all sequence information while preserving the temporal characteristics.

[0183] Then, the 3D matrix is ​​input into the convolutional layer for training. The convolutional layer consists of n concatenated time blocks, each of which is a residual module, preventing performance degradation during model training. As the network depth increases, the dilation coefficient d in the causal dilated convolution increases exponentially (d = 2^n). n-1 The expansion coefficient d increases the expansion field, allowing the model to learn information from a longer period of time and reducing the network depth.

[0184] like Figure 9 The diagram shows the substructure of a convolutional layer. The input to each module is a linear superposition of the output values ​​obtained from the skipping mechanism in the residual connections of the previous module. This process is repeated to complete the convolution, resulting in a final m×k two-dimensional matrix as the output. Specifically, in each residual module, forward and backward feature extraction is performed based on the dilation coefficient of the causal dilated convolutional unit, resulting in two sequential feature vectors. These two sequential feature vectors are then fused and input into the next residual module, until the last residual module outputs the convolutionally processed feature vector. For example, in a hidden layer with a dilation coefficient of 1, one neuron is selected for every two neurons (the gray neuron). This neuron then obtains feature information from the three adjacent neurons in the input layer from both the forward and backward directions, fuses the sequential feature vectors from both directions, and inputs them into the neurons of the next hidden layer. This process continues in the same manner, with other hidden layers obtaining their corresponding sequential feature vectors, which are then output in the output layer.

[0185] Next, the convolutional feature vector, i.e., a two-dimensional matrix of size m×k, is linearly reduced in dimensionality by a fully connected layer, then multiplied by the weight parameters, and finally multiplied by the bias parameters to obtain a one-dimensional reference feature vector. Finally, the one-dimensional reference feature vector is activated by a Sofamax layer, mapping multiple outputs to the (0,1) interval to obtain the probability distribution of each network traffic data point in the original dataset.

[0186] The probability distribution represents the probability that the network traffic data is normal network traffic. If the probability is greater than the preset probability threshold, the network traffic data is determined to be normal network traffic; otherwise, it is attack network traffic, and a classification result is obtained.

[0187] The preset probability threshold can be set based on experience or actual needs, and this application does not impose any restrictions on it.

[0188] The model training method provided in this application can be used to expand attack traffic samples: construct near-real high-quality attack traffic samples based on small samples of real attack traffic data, balance the distribution ratio of normal traffic and attack traffic, enrich the attack characteristics of attack traffic, so as to help to better optimize and establish subsequent attack detection models, or use them for research experiments by security research experts to reduce network security risks.

[0189] The model trained according to the model training method provided in the embodiments of this application can also be used to detect attack events and block attacks: using the Bi-TCN model trained in this application to detect attack traffic is highly efficient, and the Bi-TCN model has low complexity, consumes little resources on the deployment machine, and can obtain detection results in real time and accurately, and block attacks in real time.

[0190] The model training method provided in this application embodiment can be used to enrich attack range cases: In the current environment of frequent security incidents, the method of generating extended datasets in the model training method can generate attack traffic similar to real attacks to build network ranges in different environments, providing security personnel of various systems with an environment for attack simulation. This makes the generated traffic effective in the network range, with high usability and practicality.

[0191] Based on the foregoing description, in this embodiment, an original dataset and a Bi-TCN model to be trained are obtained. The original dataset includes multiple network traffic data. The original dataset is classified to obtain multiple attack features. Based on the multiple target attack features, iterative operations are performed until the similarity between the multiple extended data in this iteration and the multiple network traffic data in the original dataset is greater than a similarity threshold, at which point the iteration ends. The iterative operations include: expanding the data dimensions of each network traffic data corresponding to the multiple target attack features to obtain multiple reference data; classifying the multiple reference data to obtain multiple extended data; if this iteration is the first iteration, the multiple target attack features are multiple attack features; if this iteration is not the first iteration, the multiple target attack features are the attack features corresponding to the multiple extended data obtained in the previous iteration; the multiple extended data obtained in each iteration are used as the extended data corresponding to the multiple attack features to obtain an extended dataset; the Bi-TCN model to be trained is trained based on the original dataset and the extended dataset to obtain a trained Bi-TCN model.

[0192] Therefore, by classifying the original dataset, attack features corresponding to attack network traffic with a small amount of data are obtained. Then, the attack features are expanded multiple times to generate an expanded dataset, thereby increasing the attack network traffic with attack features. The Bi-TCN model is then trained using the expanded dataset and the original dataset together, which effectively solves the data imbalance problem and further improves the accuracy of the detection results of network traffic using the model.

[0193] Based on the same technical concept, this application also provides a model training device. The principle of the model training device in solving the problem is similar to that of the model training method described above. Therefore, the implementation of the model training device can refer to the implementation of the model training method, and the repeated parts will not be described again.

[0194] Figure 10 This is a schematic diagram of a model training device provided in an embodiment of this application. The device includes a first acquisition module 1001, a classification module 1002, an expansion module 1003, an expansion dataset determination module 1004, and a training module 1005; wherein:

[0195] The first acquisition module 1001 is used to acquire the original dataset and the Bi-TCN model to be trained; the original dataset includes multiple network traffic data.

[0196] The classification module 1002 is used to perform feature classification on the original dataset to obtain multiple attack features in the original dataset;

[0197] Extension module 1003 is used to perform iterative operations based on multiple target attack features until the similarity between the multiple extended data in this iteration and multiple network traffic data in the original dataset is greater than a similarity threshold, at which point the iterative operation ends. The iterative operation includes: expanding the data dimensions of each network traffic data corresponding to the multiple target attack features to obtain multiple reference data; classifying the traffic of the multiple reference data to obtain the multiple extended data; if this iteration is the first iteration, then the multiple target attack features are the multiple attack features; if this iteration is not the first iteration, then the multiple target attack features are the attack features corresponding to the multiple extended data obtained in the previous iteration.

[0198] The extended dataset determination module 1004 is used to take the multiple extended data obtained in each iteration as the extended data corresponding to the multiple attack features to obtain the extended dataset;

[0199] Training module 1005 is used to train the Bi-TCN model to be trained based on the original dataset and the extended dataset to obtain the trained Bi-TCN model.

[0200] In some embodiments, the apparatus further includes:

[0201] The quality inspection module is used to perform quality checks on each network traffic extended data in the extended dataset to obtain network traffic extended data that conforms to preset quality inspection rules.

[0202] The network traffic extended data that conforms to the preset quality detection rules is used as the network traffic extended data in the extended dataset.

[0203] In some embodiments, the network traffic extended data conforming to preset quality detection rules includes:

[0204] Excludes network traffic extension data containing illegal values;

[0205] When the maximum mean difference between the extended dataset and the original dataset is less than a preset difference threshold, the extended dataset includes network traffic extended data.

[0206] The data includes network traffic extension data with multiple preset attack features; these preset attack features are used to perform feature classification on the original dataset.

[0207] In some embodiments, the classification module 1002 is specifically used for:

[0208] For each network traffic data point in the original dataset:

[0209] Feature extraction is performed on the network traffic data to obtain multiple feature information corresponding to the network traffic data;

[0210] Feature information that is identical to any one of the preset attack features is used as the attack feature in the original dataset.

[0211] In some embodiments, the extension module 1003 is specifically used for:

[0212] Perform the following operations for each type of network traffic data:

[0213] The target attack features corresponding to the network traffic data are combined into a one-dimensional feature vector, and the one-dimensional feature vector is multiplied by the identity matrix to obtain the first matrix;

[0214] Based on the number of target attack features corresponding to the network traffic data, determine the row and column numbers of each parameter in the two-dimensional matrix;

[0215] For each parameter in the two-dimensional matrix: if the row number and column number of the parameter are the same, then the value of the parameter is zero; if the row number and column number of the parameter are different, then based on the first matrix, the column vector corresponding to the row number and the column vector corresponding to the column number are determined, and based on the column vector corresponding to the row number and the column vector corresponding to the column number, the value of the parameter is determined.

[0216] The two-dimensional matrix is ​​input into the generator of the CL-WGAN model to generate the multiple reference data.

[0217] In some embodiments, the extension module 1003 is specifically used for:

[0218] The multiple reference data are input into a convolutional bidirectional long short-term memory neural network (CNN-BiLSTM) to extract features from the multiple reference data and obtain feature vectors.

[0219] The feature vectors are subjected to forward and reverse feature extraction to obtain sequence feature vectors in two directions. The sequence feature vectors in the two directions are then fused to obtain the traffic classification results of the multiple reference data.

[0220] The traffic classification results are used as reference data to represent attack network traffic as extended data; the attack network traffic is network traffic with the same feature information as any one of the preset multiple attack features.

[0221] In some embodiments, the training module 1005 is specifically used for:

[0222] The original dataset and the extended dataset are used as training datasets and input into the Bi-TCN model to be trained to obtain the classification results of each network traffic data in the training dataset;

[0223] Based on the classification results and the labeled data in the training dataset, the loss function of the Bi-TCN model to be trained is determined; the labeled data in the training dataset characterizes whether each network traffic data in the training dataset is attack network traffic.

[0224] Based on the loss function of the Bi-TCN model to be trained, the weight parameters and bias parameters of the Bi-TCN model to be trained are adjusted until the classification result is consistent with the labeled data in the training dataset, thus obtaining the trained Bi-TCN model.

[0225] In some embodiments, the Bi-TCN model includes an input layer, a convolutional layer, a fully connected layer, and a softmax layer. The convolutional layer includes n residual modules, and each residual module includes a causal dilated convolutional unit. The dilation coefficient of the causal dilated convolutional unit of each residual module increases exponentially.

[0226] The device further includes a detection module for:

[0227] The original dataset is input into the convolutional layer. In each residual module, forward and reverse feature extraction is performed based on the dilation coefficient of the causal dilated convolutional unit to obtain sequential feature vectors in two directions. The sequential feature vectors in the two directions are then fused and input into the next residual module until the last residual module outputs the convolutional feature vector.

[0228] The convolutional feature vector is input into the fully connected layer, and a reference feature vector is determined based on the weight parameters and bias parameters in the trained Bi-TCN model.

[0229] The reference feature vector output by the fully connected layer is input into the softmax layer for activation to obtain the classification results of multiple network traffic data in the original dataset.

[0230] The module division in this application embodiment is illustrative and only represents one logical functional division. In actual implementation, other division methods are possible. Furthermore, the functional modules in each embodiment of this application can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. Coupling between modules can be achieved through interfaces, typically electrical communication interfaces, but mechanical interfaces or other types of interfaces are also possible. Therefore, modules described as separate components may or may not be physically separate; they can be located in one place or distributed across different locations on the same or different devices. The integrated modules described above can be implemented in hardware or as software functional modules.

[0231] Having introduced the model training method and apparatus according to exemplary embodiments of this application, we will now introduce an electronic device according to another exemplary embodiment of this application.

[0232] The following reference Figure 11 To describe an electronic device 130 implemented according to this embodiment of the present application. Figure 11 The electronic device 130 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0233] like Figure 11 As shown, the electronic device 130 is presented in the form of a general-purpose electronic device. The components of the electronic device 130 may include, but are not limited to: at least one processor 131, at least one memory 132, and a bus 133 connecting different system components (including memory 132 and processor 131).

[0234] At least one memory 132 stores a computer program that can be executed by at least one processor 131. When the computer program is executed by at least one processor 131, it enables at least one processor 131 to perform the steps of any model training method provided in the embodiments of this application.

[0235] Bus 133 represents one or more of several bus structures, including a memory bus or memory controller, peripheral bus, processor, or local bus using any of the various bus structures.

[0236] The memory 132 may include a readable medium in the form of volatile memory, such as random access memory (RAM) 1321 and / or cache memory 1322, and may further include read-only memory (ROM) 1323.

[0237] The memory 132 may also include a program / utility 1325 having a set (at least one) of program modules 1324, including but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0238] Electronic device 130 can also communicate with one or more external devices 134 (e.g., keyboard, pointing device, etc.), and with one or more devices that enable a user to interact with electronic device 130, and / or with any device that enables electronic device 130 to communicate with one or more other electronic devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 135. Furthermore, electronic device 130 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 136. As shown, network adapter 136 communicates with other modules used in electronic device 130 via bus 133. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 130, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0239] In an exemplary embodiment, a storage medium is also provided, which, when executed by a processor of an electronic device, enables the electronic device to perform any of the model training methods described above. Optionally, the storage medium may be a non-transitory computer-readable storage medium, such as a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device.

[0240] In an exemplary embodiment, a computer program product is also provided, which, when executed by an electronic device, enables the electronic device to implement the steps of any model training method provided in this application.

[0241] Furthermore, computer program products may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections having one or more wires, portable disks, hard disks, RAM, ROM, erasable programmable read-only memory (EPROM), flash memory, optical fiber, compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0242] The program product for device discovery in this application embodiment may be a CD-ROM and include program code, and may run on a computing device. However, the program product of this application is not limited thereto. In this document, the readable storage medium may be any tangible medium that contains or stores a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0243] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. This propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0244] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, radio frequency (RF), or any suitable combination thereof.

[0245] Program code for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, such as a Local Area Network (LAN) or a Wide Area Network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0246] It should be noted that although several units or sub-units of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of this application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units.

[0247] Furthermore, although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0248] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0249] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0250] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0251] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0252] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0253] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, then this application also includes such modifications and variations.

Claims

1. A model training method, characterized in that, The method includes: Obtain the original dataset and the Bi-TCN model to be trained; the original dataset includes multiple network traffic data. The original dataset is subjected to feature classification to obtain multiple attack features in the original dataset; Based on multiple target attack features, iterative operations are performed until the similarity between the multiple extended data in this iteration and the multiple network traffic data in the original dataset exceeds a similarity threshold, at which point the iterative operation ends. The iterative operation includes: expanding the data dimensions of each network traffic data corresponding to the multiple target attack features to obtain multiple reference data; classifying the traffic of the multiple reference data to obtain the multiple extended data; if this iteration is the first iteration, then the multiple target attack features are the attack features themselves; if this iteration is not the first iteration, then the multiple target attack features are the attack features corresponding to the multiple extended data obtained in the previous iteration. The multiple extended data obtained in each iteration are used as the extended data corresponding to the multiple attack features to obtain the extended dataset; The Bi-TCN model to be trained is trained based on the original dataset and the extended dataset to obtain the trained Bi-TCN model.

2. The method as described in claim 1, characterized in that, After obtaining the extended dataset, and before training the Bi-TCN model to be trained based on the original dataset and the extended dataset to obtain the trained Bi-TCN model, the method further includes: Each network traffic extended data in the extended dataset is subjected to a quality check to obtain network traffic extended data that conforms to the preset quality detection rules. The network traffic extended data that conforms to the preset quality detection rules is used as the network traffic extended data in the extended dataset.

3. The method as described in claim 2, characterized in that, The network traffic extended data conforming to the preset quality detection rules includes: Excludes network traffic extension data containing illegal values; When the maximum mean difference between the extended dataset and the original dataset is less than a preset difference threshold, the extended dataset includes network traffic extended data. The data includes network traffic extension data with multiple preset attack features; these preset attack features are used to perform feature classification on the original dataset.

4. The method as described in claim 1, characterized in that, The process of performing feature classification on the original dataset yields multiple attack features in the original dataset, including: For each network traffic data point in the original dataset: Feature extraction is performed on the network traffic data to obtain multiple feature information corresponding to the network traffic data; Feature information that is identical to any one of the preset attack features is used as the attack feature in the original dataset.

5. The method as described in claim 1, characterized in that, The process of expanding the data dimensions of each network traffic data corresponding to the multiple target attack characteristics yields multiple reference data, including: Perform the following operations for each type of network traffic data: The target attack features corresponding to the network traffic data are combined into a one-dimensional feature vector, and the one-dimensional feature vector is multiplied by the identity matrix to obtain the first matrix; Based on the number of target attack features corresponding to the network traffic data, determine the row and column numbers of each parameter in the two-dimensional matrix; For each parameter in the two-dimensional matrix: if the row number and column number of the parameter are the same, then the value of the parameter is zero; if the row number and column number of the parameter are different, then based on the first matrix, the column vector corresponding to the row number and the column vector corresponding to the column number are determined, and based on the column vector corresponding to the row number and the column vector corresponding to the column number, the value of the parameter is determined. The two-dimensional matrix is ​​input into the generator of the CL-WGAN model to generate the multiple reference data.

6. The method as described in claim 5, characterized in that, The process of classifying the traffic from the multiple reference data to obtain the multiple extended data includes: The multiple reference data are input into a convolutional bidirectional long short-term memory neural network (CNN-BiLSTM) to extract features from the multiple reference data and obtain feature vectors. The feature vectors are subjected to forward and reverse feature extraction to obtain sequence feature vectors in two directions. The sequence feature vectors in the two directions are then fused to obtain the traffic classification results of the multiple reference data. The traffic classification results are used as reference data to represent attack network traffic as extended data; the attack network traffic is network traffic with the same feature information as any one of the preset multiple attack features.

7. The method as described in claim 1, characterized in that, The Bi-TCN model to be trained is trained based on the original dataset and the extended dataset to obtain the trained Bi-TCN model, including: The original dataset and the extended dataset are used as training datasets and input into the Bi-TCN model to be trained to obtain the classification results of each network traffic data in the training dataset; Based on the classification results and the labeled data in the training dataset, the loss function of the Bi-TCN model to be trained is determined; the labeled data in the training dataset characterizes whether each network traffic data in the training dataset is attack network traffic. Based on the loss function of the Bi-TCN model to be trained, the weight parameters and bias parameters of the Bi-TCN model to be trained are adjusted until the classification result is consistent with the labeled data in the training dataset, thus obtaining the trained Bi-TCN model.

8. The method according to any one of claims 1-7, characterized in that, The Bi-TCN model includes an input layer, a convolutional layer, a fully connected layer, and a softmax layer. Each convolutional layer comprises n residual modules, and each residual module includes a causal dilated convolutional unit. The dilation coefficient of the causal dilated convolutional unit in each residual module increases exponentially. The method further includes: The original dataset is input into the convolutional layer. In each residual module, forward and reverse feature extraction is performed based on the dilation coefficient of the causal dilated convolutional unit to obtain sequential feature vectors in two directions. The sequential feature vectors in the two directions are then fused and input into the next residual module until the last residual module outputs the convolutional feature vector. The convolutional feature vector is input into the fully connected layer, and a reference feature vector is determined based on the weight parameters and bias parameters in the trained Bi-TCN model. The reference feature vector output by the fully connected layer is input into the softmax layer for activation to obtain the classification results of multiple network traffic data in the original dataset.

9. A model training device, characterized in that, The device includes: The first acquisition module is used to acquire the original dataset and the Bi-TCN model to be trained; the original dataset includes multiple network traffic data. The classification module is used to perform feature classification on the original dataset to obtain multiple attack features in the original dataset. An extension module is used to perform iterative operations based on multiple target attack features until the similarity between the multiple extended data in this iteration and multiple network traffic data in the original dataset is greater than a similarity threshold, at which point the iterative operation ends. The iterative operation includes: expanding the data dimensions of each network traffic data corresponding to the multiple target attack features to obtain multiple reference data; classifying the traffic of the multiple reference data to obtain the multiple extended data; if this iteration is the first iteration, then the multiple target attack features are the multiple attack features themselves; if this iteration is not the first iteration, then the multiple target attack features are the attack features corresponding to the multiple extended data obtained in the previous iteration. An extended dataset determination module is used to take the multiple extended data obtained in each iteration as the extended data corresponding to the multiple attack features to obtain an extended dataset; The training module is used to train the Bi-TCN model to be trained based on the original dataset and the extended dataset, so as to obtain the trained Bi-TCN model.

10. An electronic device, characterized in that, include: At least one processor, and a memory communicatively connected to said at least one processor, wherein: The memory stores a computer program that can be executed by the at least one processor to enable the at least one processor to perform the method as described in any one of claims 1-8.

11. A storage medium, characterized in that, When the computer program in the storage medium is executed by the processor of the electronic device, the electronic device is able to perform the method as described in any one of claims 1-8.

Images