A network covert channel detection method and system based on stacking model

Abstract

The present invention provides a network covert channel detection method and system based on a stacking model, and relates to the field of network security technology. The method includes: collecting network traffic data; performing nonlinear dimensionality reduction on the network traffic data to extract nonlinear features in the network traffic data; linearly reducing the dimensionality of the nonlinear features to obtain abnormal data features belonging to the label category; constructing an abnormal data classification model based on the k-nearest neighbor algorithm; constructing a mixed loss function based on the classification accuracy of the abnormal data classification model; using the mixed loss function as the objective function, performing hyperparameter optimization based on the Bayesian algorithm in the stacking model; collecting real-time network traffic data; inputting the real-time network traffic data into the optimized stacking model for classification, extracting the abnormal data category in the real-time network traffic data; tracing the abnormal data corresponding to the abnormal data category according to the abnormal data category, and obtaining the network covert channel. Improve the accuracy of network covert channel detection.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network covert channel detection method and system based on a stacking model. Background Art

[0002] Network covert channels may be exploited by malicious users or attackers to transmit malicious code, steal sensitive information, or conduct other attacks in network communications. Therefore, timely detection and prevention of covert channels is crucial to network security. Compared with traditional network attacks, covert channels are usually more hidden and difficult to detect. Attackers may use specific characteristics of network communication protocols or hide data transmission methods to circumvent traditional detection methods, so more intelligent and efficient methods are needed for detection. Many industries and organizations face security requirements and need to monitor and audit network communications to ensure data security and integrity.

[0003] The stacked model is an integrated learning method that can combine the prediction results of multiple basic models to improve the overall prediction performance. By stacking different learners together, the shortcomings of a single model can be compensated and the generalization ability of the model can be improved. When dealing with complex data and problems, a single machine learning model may not fit the data well or make accurate predictions. The stacked model can better adapt to complex data distribution and problem structure by combining the prediction results of multiple models. Because the stacked model combines the prediction results of multiple models, it has better robustness to noisy data or abnormal situations, can reduce the risk of overfitting of the model, can effectively extract abnormal data, and then trace the source to detect network covert channels.

[0004] However, as the most important process of network covert channel detection, the feature extraction process and data classification process, due to the diversity, complexity and heterogeneity of network traffic data, linear features and nonlinear features are often extracted with preference in the feature capture process, which leads to excessive deviation of the extracted abnormal data. The insufficient accuracy of feature extraction directly leads to the problem of extremely high complexity in the network data classification process, and the classification process will introduce errors in the feature extraction process, which leads to the problem of large error propagation. In this case, the detection efficiency of network covert channels is low, the detection difficulty is high and the detection accuracy is low. Summary of the invention

[0005] In order to solve the technical problems of low detection efficiency, high detection difficulty and low detection accuracy of network covert channels in the prior art, the present invention provides a network covert channel detection method and system based on a stacking model.

[0006] The technical solution provided by the embodiment of the present invention is as follows:

[0007] First aspect

[0008] An embodiment of the present invention provides a network covert channel detection method based on a stacking model, wherein the stacking model includes a nonlinear feature extraction model, a linear feature extraction model, and an abnormal data classification model connected in sequence, and the method includes:

[0009] S1: collect network traffic data;

[0010] S2: Perform nonlinear dimensionality reduction on network traffic data through a nonlinear feature extraction model based on the kernel principal component analysis algorithm to extract nonlinear features in the network traffic data;

[0011] S3: Perform supervised linear dimensionality reduction on the nonlinear features through a linear feature extraction model based on a linear discriminant analysis algorithm to obtain abnormal data features belonging to a label category, where the label category includes multiple attack data type labels;

[0012] S4: Construct an abnormal data classification model based on the k-nearest neighbor algorithm, where each item of the k-nearest neighbor algorithm has a dimension weight;

[0013] S5: constructing a mixed loss function of classification accuracy based on the abnormal data classification model, wherein the mixed loss function includes a cross entropy loss function and a mean square error loss function;

[0014] S6: Using the hybrid loss function as the objective function, the stacking model is optimized based on the Bayesian algorithm for hyperparameters, where the hyperparameters include the number of neighbors and dimension weights in the k-nearest neighbor algorithm.

[0015] S7: collect real-time network traffic data;

[0016] S8: input the real-time network traffic data into the optimized stacking model for classification, and extract abnormal data categories in the real-time network traffic data;

[0017] S9: According to the abnormal data category, data tracing is performed on the abnormal data corresponding to the abnormal data category to obtain the network covert channel.

[0018] Second aspect

[0019] An embodiment of the present invention provides a network covert channel detection system based on a stacking model, comprising:

[0020] processor;

[0021] A memory, wherein computer-readable instructions are stored in the memory, and when the computer-readable instructions are executed by the processor, the network covert channel detection method based on the stacking model as described in the first aspect is implemented.

[0022] The third aspect

[0023] An embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the network covert channel detection method based on the stacking model as described in the first aspect is implemented.

[0024] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0025] In the present invention, an unsupervised kernel principal component analysis algorithm is introduced in the most important feature extraction process in the network channel detection process to perform nonlinear redundant feature removal and complete a feature dimensionality reduction. After that, a supervised linear discriminant analysis algorithm is used to perform secondary feature dimensionality reduction, further optimizing the accuracy of the extracted features, taking into account the category information of the data, and minimizing the information loss in the process of data dimensionality reduction, thereby improving the accuracy of subsequent network covert channel detection. In addition, in the process of classifying the number of abnormalities, a hybrid loss function with dimensional weights is constructed, and a hyperparameter optimization based on the Bayesian algorithm is introduced, which not only makes up for the overfitting problem caused by the excessive sensitivity of the classification model to abnormal values ​​during the training process, but also improves the classification accuracy of abnormal data, and further improves the detection accuracy of the network covert channel. This method of processing data by a stacked model that first performs unified feature extraction and then classification greatly shortens the processing complexity of data processing, effectively reduces the detection difficulty of network covert channels, and improves the detection efficiency and detection accuracy of network covert channels. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0027] Figure 1 A schematic diagram of a flow chart of a network covert channel detection method based on a stacking model provided by an embodiment of the present invention;

[0028] Figure 2 A schematic diagram of the structure of a stacking model provided by an embodiment of the present invention;

[0029] Figure 3 A schematic diagram of the structure of a network covert channel detection system based on a stacking model provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0030] The technical solution of the present invention is described below in conjunction with the accompanying drawings.

[0031] In the embodiments of the present invention, words such as "exemplarily" and "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "example" in the present invention should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "example" is intended to present the concept in a specific way. In addition, in the embodiments of the present invention, the meaning expressed by "and / or" can be both, or it can be either of the two.

[0032] In the embodiments of the present invention, "image" and "picture" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they intend to express are the same. "of", "corresponding, relevant" and "corresponding" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they intend to express are the same.

[0033] In the embodiments of the present invention, sometimes a subscript such as W1 may be mistakenly written as a non-subscript such as W1. When the difference is not emphasized, the meanings to be expressed are consistent.

[0034] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0035] Reference Manual Attached Figure 1 , shows a schematic flow chart of a network covert channel detection method based on a stacking model provided in an embodiment of the present invention.

[0036] Reference Manual Attached Figure 2 , showing a structural schematic diagram of a stacking model provided by an embodiment of the present invention.

[0037] Figure 2 The figure shows the connection relationship between the nonlinear feature extraction model, the linear feature extraction model and the abnormal data classification model included in the stacking model, and the direction of the arrow indicates the data flow.

[0038] The embodiment of the present invention provides a network covert channel detection method based on a stacking model, which can be implemented by a network covert channel detection device based on a stacking model, and the network covert channel detection device based on a stacking model can be a terminal or a server. The stacking model includes a nonlinear feature extraction model, a linear feature extraction model, and an abnormal data classification model connected in sequence. The processing flow of the network covert channel detection method based on the stacking model may include the following steps:

[0039] S1: Collect network traffic data.

[0040] Among them, network traffic data includes various information about data transmitted through computer networks. This information can cover multiple aspects, some of the main aspects include: Source address and destination address: The source address and destination address of the data packet indicate the sender and receiver of the data packet. Protocol type: Indicates the protocol used by the data packet, such as TCP, UDP, ICMP, etc. Port number: Indicates the port used by the data packet, which is used to identify the service or application transmitted by the data packet. Packet size: The size of the data packet, that is, the amount of data transmitted. Timestamp: The time when the data packet is sent or received. Transmission flag: Used to identify the transmission status of the data packet, such as SYN, ACK, FIN, etc. Payload data: The actual data content transmitted, such as web page content, files, etc. Traffic characteristics: Including the arrival rate, sending rate, transmission delay, etc. of the data packet. Transmission type: The transmission type of the data packet, such as unicast, broadcast, multicast, etc. Some or all of this information can be used as the characteristics of the network traffic data packet, which can be used to analyze network traffic, detect abnormal behavior, and conduct network security monitoring.

[0041] S2: The nonlinear feature extraction model based on the kernel principal component analysis algorithm is used to perform nonlinear dimensionality reduction on the network traffic data to extract the nonlinear features in the network traffic data.

[0042] Among them, Kernel PCA is a nonlinear dimensionality reduction technology that can capture nonlinear relationships and structures in data. Compared with traditional linear methods, Kernel PCA can better handle complex data distribution and nonlinear relationships, thereby extracting richer and more accurate features. By mapping network traffic data into a high-dimensional feature space, the data dimension can be effectively reduced and key information can be retained by flexibly selecting principal components and evaluating data importance, thereby improving the data representation ability and analysis effect, and providing a more accurate basis for subsequent abnormal data classification and detection.

[0043] In a possible implementation, S2 specifically includes:

[0044] S201: Normalize the quantity of each type of data in the network traffic data to obtain a sample data set X having multiple network traffic standard data:

[0045] X=[x1,x2,…,x a ].

[0046] Among them, x i ,i=1,2,…a represents the i-th network traffic standard data.

[0047] S202: Use radial basis kernel functions to map sample data sets corresponding to various types of data to linearly separable high-dimensional feature spaces, and construct a kernel matrix K:

[0048]

[0049] Among them, K ij Represents the i-th network traffic standard data x i and the jth network traffic standard data x j The similarity between them, σ represents the bandwidth parameter of the radial basis kernel function, ‖‖ 2 Indicates that the square of the Euclidean distance is calculated.

[0050] S203: Calculate the eigenvalue λ of the kernel matrix and the eigenvector ν corresponding to the eigenvalue:

[0051] |K-λI|=0

[0052] (K-λI)v=0

[0053] Among them, || means taking the absolute value, and I means the unit matrix.

[0054] S204: Arrange the eigenvalues ​​and the eigenvectors corresponding to the eigenvalues ​​as principal components in descending order to obtain a descending queue.

[0055] S205: Calculate the cumulative contribution rate and value of the preset number according to the rule that the eigenvalues ​​of the main components are from large to small

[0056]

[0057] Among them, m represents the preset number, λ i Represents the eigenvalue of the i-th principal component.

[0058] S206: When the cumulative contribution rate and value are greater than a preset cumulative contribution rate and value, the principal component participating in the calculation of the cumulative contribution rate and value is obtained.

[0059] It should be noted that those skilled in the art can set the preset cumulative contribution rate according to actual needs, and the present invention is not limited thereto.

[0060] Specifically, the preset cumulative contribution rate and value is specifically 95%.

[0061] S207: Construct the first projection matrix W based on the principal components involved in calculating the cumulative contribution rate and value KPCA :

[0062] W KPCA =[v′1,v'2,...,v' m ]

[0063] Among them, v′ i Represents the eigenvector corresponding to the i-th, i=1,2,…,m-th principal component involved in calculating the cumulative contribution rate and value.

[0064] S208: Project the sample data set X to the feature space corresponding to the first projection matrix to obtain a new feature vector set Y corresponding to each element in the sample data set, wherein the new feature vector set includes nonlinear feature vectors in multiple network traffic data.

[0065]

[0066] Where T represents the transpose of the matrix.

[0067] Specifically, in S201, the network traffic data is quantitatively normalized to ensure that data of different categories have similar orders of magnitude. Then, in S202, the normalized data is mapped to a linearly separable high-dimensional feature space using a radial basis kernel function, and a kernel matrix K is constructed to describe the similarity between the data. Next, in S203 and S204, the eigenvalues ​​and corresponding eigenvectors of the kernel matrix are calculated and sorted to obtain the principal components in descending order. In S205, the cumulative contribution rate of the principal components is calculated to determine the number of principal components retained. Then, in S206, the principal components whose cumulative contribution rate is greater than a preset value are selected for subsequent calculations. Finally, in S207 and S208, a first projection matrix is ​​constructed using the selected principal components, and the original data is projected into the feature space to obtain a new set of eigenvectors, which contains the nonlinear characteristics of the network traffic data.

[0068] The kernel principal component analysis algorithm can handle nonlinear relationships and overcome the limitation that the traditional principal component analysis method is only applicable to linear data. By using the radial basis kernel function to map the data to a high-dimensional feature space, the complex nonlinear relationships between the data can be better captured and the expressive power of the data features can be improved. By calculating and sorting the eigenvalues ​​and eigenvectors of the kernel matrix, the principal components with a cumulative contribution rate greater than the preset value are selected to achieve dimensionality reduction and screening of data features. This can retain the most important information in the data, reduce the dimension of the features, and reduce the noise and redundant information in the data, thereby improving the efficiency of data representation. Through nonlinear feature extraction, the complex patterns and structures in the data can be captured more accurately, thereby improving the performance of the subsequent classification model. This method can better distinguish data between different categories and improve the discrimination and accuracy of the classification model. The kernel principal component analysis algorithm does not rely on the distribution assumption of the data and can adapt to various types of data distribution, including non-normal distribution and highly nonlinear data distribution. Therefore, this method has good adaptability and flexibility when processing complex network traffic data.

[0069] In summary, the nonlinear feature extraction method based on the kernel principal component analysis algorithm can effectively improve the characterization ability of data, improve the performance and accuracy of the classification model, and is suitable for processing various types of complex data.

[0070] S3: A linear feature extraction model based on a linear discriminant analysis algorithm is used to perform supervised linear dimensionality reduction on the nonlinear features to obtain abnormal data features belonging to a label category, wherein the label category includes multiple attack data type labels.

[0071] Among them, the Linear Discriminant Analysis (LDA) algorithm is a classic supervised learning algorithm that aims to achieve linear dimensionality reduction and classification of data by maximizing the interval between categories while minimizing the variance within the categories. Here, LDA is used to reduce the dimension of data in a supervised manner in order to better distinguish abnormal data of different categories. By extracting linear features based on the linear discriminant analysis algorithm, supervised linear dimensionality reduction is performed on the features previously obtained by nonlinear feature extraction. Its main purpose is to extract linear features related to known attack types from nonlinear features, and then identify and classify abnormal data. After linear dimensionality reduction, the abnormal data features belonging to the label category are obtained. These features are selected as linear features related to known attack types, so they can be better used to identify and classify abnormal data in network traffic.

[0072] The attack data type labels describe various known categories of attack data and attack methods, such as DoS attacks, DDoS attacks, attack packet sniffing, network scanning attacks, etc. These attack data type labels are used to guide the linear discriminant analysis algorithm to extract linear features related to these known attack types.

[0073] In summary, by using the linear discriminant analysis algorithm in the S3 step to perform supervised linear dimensionality reduction on nonlinear features, features related to known attack types can be better extracted, thereby helping to identify and classify abnormal data in network traffic.

[0074] In a possible implementation, S3 specifically includes:

[0075] S301: Calculate the intra-class discrete matrix S of the nonlinear eigenvector w and the inter-class discrete matrix S b :

[0076]

[0077] Where N represents the total number of categories of network traffic data, y i represents the nonlinear feature vector of the i-th type of network traffic data, Y represents the new feature vector set, μ i Represents the mean vector of the nonlinear feature vector corresponding to the i-th type of network traffic data, N irepresents the number of the i-th type of network traffic data, μ represents the total mean vector of the nonlinear feature vectors corresponding to the network traffic data, and T represents the transpose.

[0078] S302: Calculate the linear eigenvalue λ of the product of the inverse of the intra-class discrete matrix and the inter-class discrete matrix L and the linear eigenvector ν L .

[0079] In linear discriminant analysis, we hope to find a projection direction that can make samples of the same category as close as possible and samples of different categories as separated as possible. Calculating the linear eigenvalues ​​and linear eigenvectors of the product of the inverse of the intra-class discrete matrix and the inter-class discrete matrix can provide an optimal projection direction, so that the variance of samples of the same category is as small as possible and the variance of samples of different categories is as large as possible, thereby achieving the best linear separability of samples, and then optimizing the feature classification ability and improving the detection accuracy of network covert channels.

[0080] S303: Take a linear eigenvalue greater than a preset linear eigenvalue, and construct a second projection matrix W based on an eigenvector corresponding to the linear eigenvalue LDA :

[0081] W LDA =[ν′ L1 ,ν′ L2 ,…,ν′ Lp ]

[0082] Among them, ν′ Li represents the i-th, i=1,2,…,p-th linear eigenvector.

[0083] S304: Project the nonlinear features using the second projection matrix to obtain a target feature vector set Z including a plurality of abnormal data features.

[0084] Specifically, by performing supervised linear dimensionality reduction based on the linear discriminant analysis algorithm, the key features of the abnormal data can be effectively retained and projected into a lower-dimensional linear space, achieving better data separability, thereby improving the detection and classification accuracy of abnormal data.

[0085] S4: Construct an abnormal data classification model based on the k-nearest neighbor algorithm, where each item of the k-nearest neighbor algorithm has a dimensional weight.

[0086] Among them, the k-nearest neighbor algorithm is an instance-based learning method. Its core idea is to determine the category label of a sample as the majority category of its nearest neighbors by measuring the distance between different features. Here, the algorithm not only considers the distance of the sample in the feature space, but also weights the importance of each feature, that is, gives different weights to different features. This method can better reflect the influence of different features on the classification results, making the model more flexible and accurate. Therefore, the abnormal data classification model can more accurately identify abnormal data, and can adapt to the correlation and importance differences between different features, improving the accuracy and robustness of classification.

[0087] Specifically, first, the distance between each feature vector in the target feature vector set and the corresponding feature vector in the existing database is calculated, and then each feature vector in the target feature vector set is sorted in descending order according to the distance. Then, the top K features are selected as the K nearest neighbors of the current abnormal data feature, and then the probability of the K nearest neighbors belonging to each attack data type label is counted. Finally, the attack data type label with the highest probability is taken as the category to which the current network data asset belongs.

[0088] In a possible implementation, S4 specifically includes:

[0089] S401: Establish a k-nearest neighbor algorithm based on Euclidean distance, and add dimension weights to each dimension in the Euclidean distance to introduce the contribution of different dimensions, i.e., different network traffic data, to sample similarity:

[0090]

[0091] Among them, d ij represents the Euclidean distance between the i-th abnormal data feature and the j-th abnormal data feature, T represents the dimension of the abnormal data feature, x ik ,x jk They represent the values ​​of the i-th abnormal data feature and the j-th abnormal data feature in the t-th dimension, respectively, and w t Represents the dimension weight of the t-th dimension.

[0092] S402: Determine the number of neighbors of the abnormal data feature to be classified.

[0093] S403: Based on the voting mechanism, the features of the abnormal data to be classified are classified using the k-nearest neighbor algorithm.

[0094] S404: Output the abnormal data category of the abnormal data to be classified.

[0095] It should be noted that by introducing dimension weights, determining the number of neighbors and utilizing a voting mechanism, combined with the k-nearest neighbor algorithm, it is possible to more accurately classify abnormal data, thereby realizing the detection and identification of abnormal behaviors in network traffic.

[0096] S5: Construct a hybrid loss function based on the classification accuracy of the abnormal data classification model.

[0097] Among them, the hybrid loss function includes the cross entropy loss function and the mean square error loss function.

[0098] It should be noted that the hybrid loss function can effectively utilize the advantages of different tasks, improve the performance and generalization ability of the model, and enhance the robustness to outliers. It is an effective loss function design method.

[0099] In a possible implementation, the hybrid loss function Loss is specifically:

[0100]

[0101] Among them, N' represents the number of abnormal data features to be classified, y' i represents the true label of the i-th abnormal data to be classified, represents the predicted value of the i-th abnormal data to be classified, It represents the predicted probability that the i-th abnormal data to be classified is normal data.

[0102] Specifically, the mean square error and cross entropy loss are combined so that the model can adapt to both regression and classification tasks, which can better handle situations with both continuous and discrete outputs. The impact of different tasks on the model is balanced, thereby improving the robustness and generalization ability of the model. Even if a task has fewer training samples or more noise, the overall stability of the model can be maintained. Since the mean square error (MSE) is usually more sensitive to outliers, while the cross entropy loss (CE) is relatively more robust, the hybrid loss function can reduce the sensitivity to outliers to a certain extent and improve the model's ability to handle abnormal situations.

[0103] S6: Using the hybrid loss function as the objective function, we perform Bayesian algorithm-based hyperparameter optimization in the stacked model.

[0104] Among them, hyperparameters include the number of neighbors and dimension weights in the k-nearest neighbor algorithm.

[0105] It should be noted that the parameter settings in the stacked model are optimized using hyperparameter optimization based on the Bayesian algorithm. These hyperparameters include the number of neighbors and dimension weights in the k-nearest neighbor algorithm. By using a mixed loss function as the objective function, the Bayesian algorithm can automatically determine the optimal hyperparameter configuration based on the performance of different hyperparameter combinations to maximize the performance of the model. This method can help the system find the most suitable parameter combination for the data and task, thereby further improving the performance and generalization ability of the abnormal data classification model. Through hyperparameter optimization, the model can be made more adaptable to different data sets and application scenarios, improving the flexibility and usability of the model.

[0106] In a possible implementation, S6 specifically includes:

[0107] S601: Initialize the probability function p(e|φ) whose error of the objective function under the hyperparameter φ to be evaluated is e and the maximum number of iterations.

[0108] S602: Solve the probability function and collect random hyperparameters of the stacking model

[0109]

[0110] Among them, argmin() means taking the hyperparameter value that minimizes the loss function Loss(), that is, the random hyperparameter.

[0111] It should be noted that the acquisition function based on the loss function can quickly locate and screen out more optimal random hyperparameters to find a more favorable area to be searched in the search space, avoiding the high computational cost caused by random hyperparameter selection based on errors, and greatly reducing the selection cost of random hyperparameters. By solving the probability function in S602 to collect random hyperparameters, the minimum value of the loss function can be quickly located, thereby determining a more optimal hyperparameter configuration. This can avoid the high computational cost of traversing the entire hyperparameter space and improve the efficiency of the search.

[0112] S603: Calculate the mixed loss function value under random hyperparameters.

[0113] S604: When the hybrid loss function value is less than the preset hybrid loss function value, the random hyperparameter is stored in the initial knowledge base as an alternative hyperparameter, and the loss function value corresponding to the random hyperparameter is also stored in the knowledge base to obtain an updated knowledge base:

[0114]

[0115] Among them, D0 represents the initial knowledge base, D1 represents the updated knowledge base, Indicates the candidate hyperparameters The stacking model below, Represents the loss function value corresponding to the random hyperparameter, and the symbol “∪” represents the union operation.

[0116] It should be noted that, based on the initial knowledge base and the updated knowledge base, historical knowledge can be better utilized to update the probability function, which can make the search process more intelligent and effective, avoiding repeated experiments and wasting computing resources.

[0117] S605: Update the probability function according to the updated knowledge base.

[0118] In a possible implementation manner, S605 specifically includes:

[0119] S605A: Divide the generative model based on the Bayesian algorithm into a first density function and a second density function.

[0120] S605B: Set the minimum value of the hybrid loss function in the updated knowledge base as the target threshold.

[0121] S605C: Establish an improved metric function E(φ) based on the hyperparameter to be evaluated:

[0122]

[0123] Among them, γ represents the preset quantile of the loss function value corresponding to the random hyperparameter, l(φ) represents the first density function, g(φ) represents the second density function, and the symbol “∝” represents proportional to.

[0124] It should be noted that those skilled in the art can set the size of the preset quantile according to actual needs, and the present invention is not limited here.

[0125] S605D: Taking the target threshold as the stopping condition, maximizing the first density function and minimizing the second density function are performed under the updated knowledge base, and the improved metric function value under the random hyperparameters is calculated.

[0126] S605F: Select a random hyperparameter that maximizes the value of the improved metric function as a new hyperparameter to be evaluated.

[0127] S605G: Bring the new hyperparameter to be evaluated into the probability function to complete the update of the probability function.

[0128] It should be noted that by establishing an improved metric function, the preset quantiles of the loss function value, the first density function and the second density function are comprehensively considered, so as to select the random hyperparameters that maximize the improved metric function value as the new hyperparameters to be evaluated. This can more comprehensively consider the performance of the hyperparameters, make the selected hyperparameters more appropriate, and improve the practicality, detection efficiency and detection accuracy of the stacking model.

[0129] S606: The number of iterations is increased by 1, and the process returns to S602 until the number of iterations is equal to the maximum number of iterations.

[0130] It should be noted that the entire process is automated and does not require human intervention, which reduces the impact of human factors on hyperparameter selection, reduces the time and cost of manual parameter adjustment, and improves detection efficiency. The hyperparameter optimization method based on the Bayesian algorithm can more effectively search the hyperparameter space and improve the performance and generalization ability of the stacked model.

[0131] S7: Collect real-time network traffic data.

[0132] Among them, real-time network traffic data is data required for network covert channel detection system. By analyzing real-time data, network covert channel detection is carried out in a virtuous cycle of discovery and tracing to maintain network security.

[0133] S8: Input the real-time network traffic data into the optimized stacking model for classification, and extract the abnormal data categories in the real-time network traffic data.

[0134] It should be noted that by inputting real-time network traffic data into the optimized stacking model for classification, the real-time extraction and classification of abnormal data is achieved, thus realizing the real-time performance of the network anomaly detection system. This real-time performance is reflected in the model's rapid response capability, real-time update and dynamic adjustment capabilities, as well as the characteristics of reduced delays and instant alarm processing, enabling the system to detect and respond to network attacks in a timely manner and ensure network security.

[0135] S9: According to the abnormal data category, data tracing is performed on the abnormal data corresponding to the abnormal data category to obtain the network covert channel.

[0136] It should be noted that in the massive amount of network data, the abnormal output is extracted and the abnormal data is accurately classified, the data category is accurately located, and then the abnormal data is traced by category, which improves the feasibility of tracing the source, reduces the difficulty of detecting network covert channels, and improves the detection efficiency and accuracy. Common data tracing methods include log collection and analysis, data association and analysis, IP address tracking, malicious code analysis, log review and investigation, and cooperation and information sharing. Through the analysis of network traffic and log data, as well as the investigation of malicious code and abnormal activities, the source and characteristics of abnormal activities can be determined more comprehensively, so as to obtain network covert channels and take corresponding security measures.

[0137] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0138] In the present invention, an unsupervised kernel principal component analysis algorithm is introduced in the most important feature extraction process in the network channel detection process to perform nonlinear redundant feature removal and complete a feature dimensionality reduction. After that, a supervised linear discriminant analysis algorithm is used to perform secondary feature dimensionality reduction, further optimizing the accuracy of the extracted features, taking into account the category information of the data, and minimizing the information loss in the process of data dimensionality reduction, thereby improving the accuracy of subsequent network covert channel detection. In addition, in the process of classifying the number of abnormalities, a hybrid loss function with dimensional weights is constructed, and a hyperparameter optimization based on the Bayesian algorithm is introduced, which not only makes up for the overfitting problem caused by the excessive sensitivity of the classification model to abnormal values ​​during the training process, but also improves the classification accuracy of abnormal data, and further improves the detection accuracy of the network covert channel. This method of processing data by a stacked model that first performs unified feature extraction and then classification greatly shortens the processing complexity of data processing, effectively reduces the detection difficulty of network covert channels, and improves the detection efficiency and detection accuracy of network covert channels.

[0139] Reference Manual Attached Figure 3 , showing a structural schematic diagram of a network covert channel detection system based on a stacking model provided by the present invention.

[0140] The present invention further provides a network covert channel detection system 20 based on a stacking model, which is applied to the above-mentioned network covert channel detection method based on a stacking model, and comprises:

[0141] Processor 201;

[0142] The memory 202 stores computer-readable instructions, and when the computer-readable instructions are executed by the processor 201, the network covert channel detection method based on the stacking model as described in the method embodiment is implemented.

[0143] The stacking model-based network covert channel detection system 20 provided by the present invention can execute the above-mentioned stacking model-based network covert channel detection method and achieve the same or similar technical effects. To avoid repetition, the present invention will not describe them again.

[0144] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0145] In the present invention, an unsupervised kernel principal component analysis algorithm is introduced in the most important feature extraction process in the network channel detection process to perform nonlinear redundant feature removal and complete a feature dimensionality reduction. After that, a supervised linear discriminant analysis algorithm is used to perform secondary feature dimensionality reduction, further optimizing the accuracy of the extracted features, taking into account the category information of the data, and minimizing the information loss in the process of data dimensionality reduction, thereby improving the accuracy of subsequent network covert channel detection. In addition, in the process of classifying the number of abnormalities, a hybrid loss function with dimensional weights is constructed, and a hyperparameter optimization based on the Bayesian algorithm is introduced, which not only makes up for the overfitting problem caused by the excessive sensitivity of the classification model to abnormal values ​​during the training process, but also improves the classification accuracy of abnormal data, and further improves the detection accuracy of the network covert channel. This method of processing data by a stacked model that first performs unified feature extraction and then classification greatly shortens the processing complexity of data processing, effectively reduces the detection difficulty of network covert channels, and improves the detection efficiency and detection accuracy of network covert channels.

[0146] It should be understood that the processor in the embodiment of the present invention may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0147] It should also be understood that the memory in the embodiments of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0148] The above embodiments can be implemented in whole or in part by software, hardware (such as circuits), firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0149] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0150] In the present invention, "at least one" means one or more, and "plurality" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can be represented by: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0151] It should be understood that in various embodiments of the present invention, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0152] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0153] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described equipment, devices and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0154] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0155] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0156] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0157] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0158] An embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein when the program is executed by a processor, the stacking model-based network covert channel detection method as described in the method embodiment is implemented.

[0159] A computer-readable storage medium provided by the present invention can implement the steps and effects of the network covert channel detection method based on the stacking model of the above method embodiment. To avoid repetition, the present invention will not go into details.

[0160] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0161] In the present invention, an unsupervised kernel principal component analysis algorithm is introduced in the most important feature extraction process in the network channel detection process to perform nonlinear redundant feature removal and complete a feature dimensionality reduction. After that, a supervised linear discriminant analysis algorithm is used to perform secondary feature dimensionality reduction, further optimizing the accuracy of the extracted features, taking into account the category information of the data, and minimizing the information loss in the process of data dimensionality reduction, thereby improving the accuracy of subsequent network covert channel detection. In addition, in the process of classifying the number of abnormalities, a hybrid loss function with dimensional weights is constructed, and a hyperparameter optimization based on the Bayesian algorithm is introduced, which not only makes up for the overfitting problem caused by the excessive sensitivity of the classification model to abnormal values ​​during the training process, but also improves the classification accuracy of abnormal data, and further improves the detection accuracy of the network covert channel. This method of processing data by a stacked model that first performs unified feature extraction and then classification greatly shortens the processing complexity of data processing, effectively reduces the detection difficulty of network covert channels, and improves the detection efficiency and detection accuracy of network covert channels.

[0162] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

[0163] Compared with the prior art, the above technical solution has at least the following beneficial effects:

[0164] In the present invention, the light and shadow of the static objects can be optimized based on the light baking technology, and the light streaming of the game animation can be optimized based on the light streaming processing technology, and the screen of the nostalgic online game can be optimized to enhance the attractiveness of the nostalgic online game to new players and enhance the market competitiveness of the nostalgic online game.

[0165] There are a few points to note:

[0166] (1) The drawings of the embodiments of the present invention only relate to the structures related to the embodiments of the present invention, and other structures may refer to the general design.

[0167] (2) For the sake of clarity, in the drawings used to describe the embodiments of the present invention, the thickness of the layers or regions is exaggerated or reduced, that is, these drawings are not drawn according to the actual scale. It is understood that when an element such as a layer, film, region or substrate is referred to as being "on" or "under" another element, the element may be "directly" "on" or "under" the other element or there may be intermediate elements.

[0168] (3) In the absence of conflict, the embodiments of the present invention and the features therein may be combined with each other to obtain new embodiments.

[0169] The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. The protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A network covert channel detection method based on a stacking model, characterized in that: The stacked model includes a nonlinear feature extraction model, a linear feature extraction model and an abnormal data classification model connected in sequence, and the method includes: S1: collect network traffic data; S2: performing nonlinear dimensionality reduction on the network traffic data through a nonlinear feature extraction model based on a kernel principal component analysis algorithm to extract nonlinear features in the network traffic data; S3: Performing supervised linear dimensionality reduction on the nonlinear features through a linear feature extraction model based on a linear discriminant analysis algorithm to obtain abnormal data features belonging to a label category, wherein the label category includes multiple attack data type labels; S4: constructing an abnormal data classification model based on a k-nearest neighbor algorithm, wherein each item of the k-nearest neighbor algorithm has a dimensional weight; S5: constructing a mixed loss function based on the classification accuracy of the abnormal data classification model, wherein the mixed loss function includes a cross entropy loss function and a mean square error loss function; S6: Using the hybrid loss function as the objective function, optimizing hyperparameters based on the Bayesian algorithm in the stacking model, wherein the hyperparameters include the number of neighbors in the k-nearest neighbor algorithm and the dimension weight; S7: collect real-time network traffic data; S8: inputting the real-time network traffic data into the optimized stacking model for classification, and extracting abnormal data categories in the real-time network traffic data; S9: Tracing the source of the abnormal data corresponding to the abnormal data category according to the abnormal data category to obtain the network covert channel; Wherein, the S2 specifically includes: S201: Normalize the quantity of each type of data in the network traffic data to obtain a sample data set X having a plurality of network traffic standard data: X=[x1,x2,…,x a ]. Among them, x i ,i=1,2,…a represents the i-th network traffic standard data; S202: Use radial basis kernel functions to map sample data sets corresponding to various types of data to linearly separable high-dimensional feature spaces, and construct a kernel matrix K: Among them, K ij Represents the i-th network traffic standard data x i and the jth network traffic standard data x j The similarity between them, σ represents the bandwidth parameter of the radial basis kernel function, ‖‖ 2 Indicates the calculation of the square value of the Euclidean distance; S203: Calculate the eigenvalue λ of the kernel matrix and the eigenvector ν corresponding to the eigenvalue: |K-λI|=0 (K-λI)v=0 Among them, || means taking the absolute value, and I means the unit matrix; S204: Arrange the eigenvalues ​​and the eigenvectors corresponding to the eigenvalues ​​as principal components in descending order to obtain a descending queue; S205: Calculate the cumulative contribution rate and value of the preset number according to the rule that the eigenvalues ​​of the main components are from large to small Wherein, m represents the preset number, λ i represents the eigenvalue of the i-th principal component; S206: taking the principal component that participates in calculating the cumulative contribution rate and value when the cumulative contribution rate and value is greater than a preset cumulative contribution rate and value; S207: Constructing a first projection matrix W according to the principal components involved in calculating the cumulative contribution rate and value KPCA : W KPCA =[v1',v'2,…,v' m ] Among them, v′ i represents the eigenvector corresponding to the i-th, i=1,2,…,m-th principal component participating in calculating the cumulative contribution rate and value; S208: Projecting the sample data set X to the feature space corresponding to the first projection matrix to obtain a new feature vector set Y corresponding to each element in the sample data set, wherein the new feature vector set includes a plurality of nonlinear feature vectors in the network traffic data; Where T represents the transpose of the matrix; Among them, the hybrid loss function Loss is specifically: Among them, N' represents the number of abnormal data features to be classified, y' i represents the true label of the i-th abnormal data to be classified, represents the predicted value of the i-th abnormal data to be classified, Indicates the predicted probability that the i-th abnormal data to be classified is normal data; Wherein, the S6 specifically includes: S601: Initialize the probability function p(e|φ) whose error of the objective function under the hyperparameter φ to be evaluated is e and the maximum number of iterations; S602: Solving the probability function and collecting random hyperparameters of the stacking model Wherein, argmin() represents taking the hyperparameter value that makes the loss function Loss() minimum, that is, the random hyperparameter; S603: Calculate the mixed loss function value under the random hyperparameters; S604: When the hybrid loss function value is less than a preset hybrid loss function value, the random hyperparameter is stored as a candidate hyperparameter in the initial knowledge base, and the loss function value corresponding to the random hyperparameter is also stored in the knowledge base to obtain an updated knowledge base: Wherein, D0 represents the initial knowledge base, D1 represents the updated knowledge base, Indicates the alternative hyperparameters The stacking model below, represents the loss function value corresponding to the random hyperparameter, and the symbol "∪" represents a union operation; S605: updating the probability function according to the updated knowledge base; S606: The number of iterations is increased by 1, and the process returns to S602 until the number of iterations is equal to the maximum number of iterations; Wherein, the S605 specifically includes: S605A: dividing the generation model based on the Bayesian algorithm into a first density function and a second density function; S605B: setting the minimum value of the hybrid loss function in the updated knowledge base as a target threshold; S605C: Establish an improved metric function E(φ) based on the hyperparameter to be evaluated: Wherein, γ represents the preset quantile of the loss function value corresponding to the random hyperparameter, l(φ) represents the first density function, g(φ) represents the second density function, and the symbol "∝" represents proportional to; S605D: Taking the target threshold as a stop condition, performing operations of maximizing a first density function and minimizing a second density function under the updated knowledge base, and calculating an improved metric function value under the random hyperparameter; S605F: Selecting a random hyperparameter that maximizes the improved metric function value as a new hyperparameter to be evaluated; S605G: Bringing the new hyperparameter to be evaluated into the probability function to complete the update of the probability function; Wherein, the S4 specifically includes: S401: Establish a k-nearest neighbor algorithm based on Euclidean distance, and add dimension weights to each dimension in the Euclidean distance to introduce the contribution of different dimensions, i.e., different network traffic data, to sample similarity: Among them, d ij represents the Euclidean distance between the i-th abnormal data feature and the j-th abnormal data feature, T represents the dimension of the abnormal data feature, x ik ,x jk They represent the values ​​of the i-th abnormal data feature and the j-th abnormal data feature in the t-th dimension, respectively, and w t represents the dimension weight of the tth dimension; S402: Determine the number of neighbors with the abnormal data feature to be classified; S403: Classifying the features of the abnormal data to be classified using the k-nearest neighbor algorithm based on a voting mechanism; S404: Outputting the abnormal data category of the abnormal data to be classified.

2. The network covert channel detection method based on the stacking model according to claim 1 is characterized in that: The preset cumulative contribution rate and value is 95%.

3. The network covert channel detection method based on the stacking model according to claim 1 is characterized in that: The S3 specifically includes: S301: Calculate the intra-class discrete matrix S of the nonlinear feature vector w and the inter-class discrete matrix S b : Where N represents the total number of categories of network traffic data, y i represents the nonlinear feature vector of the i-th type of network traffic data, Y represents the new feature vector set, μ i Represents the mean vector of the nonlinear feature vector corresponding to the i-th type of network traffic data, N i represents the number of the i-th type of network traffic data, μ represents the total mean vector of the nonlinear feature vector corresponding to the network traffic data, and T represents transposition; S302: Calculate the linear eigenvalue λ of the product of the inverse of the intra-class discrete matrix and the inter-class discrete matrix L and the linear eigenvector ν L ; S303: Take a linear eigenvalue greater than a preset linear eigenvalue, and construct a second projection matrix W based on an eigenvector corresponding to the linear eigenvalue LDA : W LDA =[n′ L1 ,n′ L2 ,…,n′ Lp ] Among them, ν′ Li represents the i-th, i=1,2,…,p-th linear eigenvector; S304: Projecting the nonlinear feature using the second projection matrix to obtain a target feature vector set Z including a plurality of abnormal data features.

4. A network covert channel detection system based on a stacking model, characterized in that: include: processor; A memory having computer-readable instructions stored thereon, wherein when the computer-readable instructions are executed by the processor, the stacking model-based network covert channel detection method according to any one of claims 1 to 3 is implemented.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the stacking model-based network covert channel detection method according to any one of claims 1 to 3 is implemented.

Images