A malicious traffic detection method and system based on transfer learning and knowledge distillation

Abstract

The present invention belongs to the field of artificial intelligence technology, and discloses a malicious traffic detection method and system based on transfer learning. First, the source domain and target domain data are preprocessed, and then the ResNet50 model is used to train on the source domain data. All layers of the source domain model except the fully connected layer are frozen. Then the value of MMD is calculated, and the teacher model is used to predict 1% of the target domain data, and the value of KD is obtained using the output probability. The model of the source domain is migrated to the target domain, and the loss of KD is increased during the training of the fully connected layer. Finally, the target domain model is integrated with a malicious traffic detection network that can adapt to multiple data sets. The present invention can effectively solve the problem of malicious traffic detection in multiple fields, and greatly reduce the number of labeled samples required while ensuring the detection accuracy, which is beneficial to subsequent detection tasks.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence technology, and in particular relates to a malicious traffic detection method and system based on transfer learning and knowledge distillation. Background Art

[0002] With the rapid development of network technology, malware has become a key tool for network attacks. Its detection and classification are of great significance for defending against network attacks and maintaining the security of the network environment. At present, most detection methods are based on a single malicious traffic data set. Although some results have been achieved in early network attacks, facing the complexity and variability of modern network attacks, traditional methods often cannot detect malicious traffic well.

[0003] In early research, traditional malicious traffic detection methods are often based on signature-based detection and machine learning-based detection. However, these methods often have the following problems: (1) The cost of data set annotation is high. Traditional malicious traffic detection methods usually rely on a large number of well-annotated data sets to train models. However, obtaining and annotating a large number of accurate malicious traffic samples is time-consuming and expensive, especially in an environment where new malicious activities continue to emerge. (2) Insufficient adaptability. As network environments and attack technologies continue to change, traditional detection models often find it difficult to quickly adapt to these changes, resulting in a decrease in detection capabilities. When the scenario changes from the network to the industrial Internet of Things, classic deep learning algorithms such as CNN can only achieve an accuracy rate of 70%.

[0004] In this context, transfer learning technology has attracted attention for its ability to use existing knowledge to accelerate the model's adaptability to new tasks. It has proven its powerful performance in many machine learning fields, especially when facing the challenges of large data distribution deviation and scarce labeled data. The rise of deep learning has further promoted the research of transfer learning, making it a new field for solving network security problems.

[0005] Through the above analysis, the problems and defects of the existing technology are as follows: the existing methods often cannot be deployed in the environment in a timely manner, and a large number of labeled samples are required. The existing technology has obvious limitations and challenges in terms of the dependence of traditional malicious traffic detection methods on a large number of labeled samples. Traditional methods usually require large-scale accurately labeled data sets to train models in order to obtain sufficient knowledge and features to cope with the ever-changing and growing forms of malicious traffic. However, obtaining and labeling these data sets requires a lot of time, manpower and money, especially in the face of the continuous emergence and evolution of emerging malicious activities, traditional methods often find it difficult to keep up.

[0006] In this context, the present invention proposes an innovative malicious traffic detection method and system based on transfer learning and knowledge distillation technology, aiming to overcome the dependence of traditional methods on a large number of labeled samples. Transfer learning is a powerful machine learning technology that accelerates the adaptability of the model to new tasks by leveraging the knowledge and models of the source domain to help the learning of the target domain. In malicious traffic detection, we can use transfer learning to learn the knowledge and features from existing malicious traffic datasets, and then transfer this knowledge to the target domain to improve the generalization ability and adaptability of the model, thereby reducing the need for large-scale labeled data.

[0007] In addition, knowledge distillation is another key technical means, which extracts key knowledge and features from a complex model and then passes this knowledge to a simpler and more efficient model to reduce the model's computational and storage costs while maintaining the model's accuracy and performance. In malicious traffic detection, knowledge distillation can help build a lightweight model, improve the model's real-time performance and efficiency, and enable it to quickly identify and classify various forms of malicious traffic.

[0008] In summary, the present invention combines the advantages of transfer learning and knowledge distillation to provide a more flexible, efficient and cost-effective malicious traffic detection method and system. This method can not only reduce the dependence on a large amount of labeled data, but also effectively cope with the diversification of malicious activities and the dynamic changes of the network environment, and has important practical applications and commercial prospects. Summary of the invention

[0009] In view of the problems existing in the prior art, the present invention provides a malicious traffic detection method and system based on transfer learning.

[0010] The present invention is implemented as follows: a malicious traffic detection method based on transfer learning, comprising:

[0011] S1, train the model on the source domain dataset and save the model;

[0012] S2, randomly selects 1% of the data from another dataset and performs data preprocessing as the target domain data;

[0013] S3, calculate the maximum mean difference between the source domain and the data obtained in step 2;

[0014] S4, use the teacher model to train the deep neural network with the data obtained in step 2 and obtain the KD loss;

[0015] S5, using the model obtained in step 1 to perform deep neural network training on the data obtained in step 2, and adding the KD obtained in step 4 during the training process;

[0016] S6, readjust the weight of KD according to the accuracy after each iteration.

[0017] S7, finally, the trained model is used to make predictions on the remaining 99% of the data in step 2.

[0018] Furthermore, S1 specifically includes: a simplified version of the deep residual learning network ResNet50 model is used to perform malicious traffic detection tasks on the source domain dataset. )y is the category probability distribution predicted by the model, W f and b f ; represent the weight and bias of the fully connected layer, f resent represents the feature extraction part of the ResNet50 network, X norm Represents the normalized input data. The output layer of the model is adjusted according to the number of categories of malicious traffic, and the Softmax function is applied after the last fully connected layer for multi-classification:

[0019]

[0020] Furthermore, S2 specifically includes: randomly selecting 1% of the data in the target domain data set and preprocessing the data, the preprocessing includes replacing nan values ​​and empty values ​​with 0, normalizing all data, and copying labels with fewer labels after processing until the number of labels for each category is consistent.

[0021] Further, S3 specifically includes: calculating the maximum mean difference (MMD) between the source domain and 1% of the target domain data to reduce the difference between the source domain and the target domain data distribution. P and Q represent the data distribution of the source domain and the target domain, respectively, f represents the feature mapping function mapped to the Hilbert space, and n and m are the number of samples in the two domains, respectively.

[0022]

[0023] Furthermore, S4 specifically includes: selecting the complete Resnet50 as the teacher model, training it on the target domain data, and obtaining the probability of each category for each sample. P(i) and Q(i) are the true probability and predicted probability of the i-th category, respectively. In this paper, P(i) is represented by one-hot encoding, where the probability of the correct category is 1 and the probability of the remaining categories is 0. KL (P||Q) represents the KL divergence from distribution Q to distribution P.

[0024]

[0025] According to this formula, the initial KL divergence (KD) loss of each sample can be obtained.

[0026] Furthermore, S5 specifically includes: migrating the model trained in the source domain to the target domain for training, and adding the MMD value calculated in step 3 and the KD value calculated in step 4 as losses during the training process. Specifically, in each iteration, the loss of model training is:

[0027]

[0028] Where L cls (y,)y) is the classification loss for supervising the student model, usually using the cross entropy loss function.

[0029] l mmd is the weight coefficient of MMD, which is used to balance the contribution of MMD loss in the total loss function. kd is the weight coefficient of knowledge distillation loss. is the knowledge distillation loss, which defines the student model output Output from the teacher model The KL divergence distance metric between .

[0030] It should be noted that the value of KD is not static. At the end of each epoch, the KD loss is updated separately for each category. Specifically, we adjust the corresponding KD loss weight of each category according to its accuracy in the current epoch. The reason for this is that categories with higher accuracy often indicate that they are close to convergence in the current training process, so the impact on the model during the migration process should be relatively small. On the contrary, categories with lower accuracy may still need more training, so their KD loss weights will be relatively high in transfer learning. This strategy of updating KD loss weights by category effectively takes into account the different situations of each category during the training process, making the model pay more attention to categories that need more learning, thereby improving the effect of transfer learning.

[0031] Further, S6 specifically includes: re-updating the weight of KD after each iteration, and the specific updating formula is:

[0032] TD=TD·(1+γ((Acc target -Acc i,t ))

[0033] By iterating the weight of the KD loss value after each iteration, the accuracy of the entire model is improved, and eventually a good prediction can be made for each sample.

[0034] The present invention also provides a malicious traffic detection system, which includes:

[0035] A. Data preprocessing module, used to randomly select some data from the target domain dataset and preprocess the selected data. The preprocessing includes replacing missing values ​​and null values ​​with preset values, normalizing all data, and balancing the number of labels of different categories;

[0036] B. Transfer learning module, which is used to train the model on the source domain dataset and use the trained model to train the deep neural network on the preprocessed target domain data, where the training process combines knowledge distillation (KD) loss;

[0037] C. KD adjustment module, used to readjust the weight of KD according to the accuracy of the model on the target domain data after each iteration;

[0038] D. Prediction module, used to apply the trained model to the remaining data in the target domain dataset to perform malicious traffic prediction.

[0039] Furthermore, the data preprocessing module also includes:

[0040] A1. Missing value processing unit, used to replace nan values ​​and null values ​​in the target domain data with preset 0 values;

[0041] A2. Data normalization unit, used to normalize the target domain data;

[0042] A3. Label balancing unit, used to copy the labels in the target domain data until the number of labels for each category is consistent.

[0043] Furthermore, the transfer learning module also includes:

[0044] B1. Maximum mean difference calculation unit, used to calculate the maximum mean difference (MMD) between the source domain and the target domain data to evaluate the distribution difference between the two data sets;

[0045] B2. Teacher model training unit, used to select Resnet50 as the teacher model, train it on the target domain data, and calculate the KD loss of each sample;

[0046] B3. Deep neural network training unit, used to train the deep neural network on the target domain data and combine the KD loss in the training process.

[0047] Furthermore, the system includes:

[0048] E. Accuracy monitoring module, used to monitor the accuracy of the model on the target domain data after each iteration and adjust the weight of KD according to the accuracy;

[0049] F. A result output module is used to output the malicious traffic prediction results obtained by the prediction module to a user interface or store them in a preset data storage area.

[0050] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0051] First, the present invention introduces transfer learning and knowledge distillation, and performs model training based on the source domain model. During the migration process, additional MMD loss values ​​and KD loss values ​​are added to help the model better adapt to the data in the new target domain. By setting a loss for each sample instead of simply adding loss to the entire data set using the MMD value, the model can identify malicious traffic well, and the sample detection F1 value can reach more than 99.86%. It can effectively solve the problem of fake news detection.

[0052] The technical effects and advantages of the technical solution of the present invention are as follows: First, the amount of data required for our training is very small, and 1% of the data is used in the target domain. Compared with traditional methods, it can greatly reduce the workload of labeling data. Secondly, compared with other traditional methods, the accuracy in the target domain is higher, and the accuracy and F1 value can exceed those of traditional methods.

[0053] Second, as auxiliary evidence of the inventiveness of the claims of the present invention, it is also reflected in the following important aspects:

[0054] (1) The expected benefits and commercial value of the technical solution of the present invention after transformation are as follows: The expected benefits are to improve the overall efficiency and overall accuracy of malicious traffic detection, provide detection models for related commercial detection systems, and migrate related model areas to handle malicious traffic detection in different fields.

[0055] (2) The technical solution of the present invention solves the technical problem that people have been eager to solve but have never succeeded in solving: it solves the problem of poor detection results in the field of malicious traffic detection due to sparse label data, and combines knowledge distillation to help the migration model better adapt to the domain, effectively enhancing the detection efficiency of the overall detection system. And through fuzzy rules, it can better understand the multi-domain features of each piece of news, and improve the accuracy of subsequent detection and discrimination.

[0056] (3) The technical solution of the present invention overcomes technical bias: based on transfer learning, combined with model knowledge distillation and maximum mean difference value, it can better detect malicious traffic.

[0057] Third, the present invention solves a series of technical problems in the prior art and achieves significant technical progress by introducing a malicious traffic detection method based on transfer learning. These aspects are described in detail below:

[0058] Technical issues solved:

[0059] 1. Limitations of traditional methods: Existing malicious traffic detection methods often rely on a large number of labeled samples, which makes it impossible to deploy malicious traffic detection models when the environment to be detected changes. The present invention uses transfer learning to speed up the model's detection preparation time on new types of data.

[0060] 2. Poor generalization ability: Previous methods usually target a single data set of a specific type and lack wide applicability. The present invention improves the generalization of the model by adding additional losses in the transfer learning process.

[0061] 3. Low accuracy: In the past, malicious traffic detection often produced low accuracy. By combining transfer learning and knowledge distillation, the present invention effectively improves the accuracy.

[0062] Significant technological advances achieved:

[0063] 1. Reduction of required labeled samples: The present invention uses transfer learning. After training in the source domain, only 1% of the labeled samples are needed in the target domain to classify the remaining samples.

[0064] 2. Improved generalization ability: The invented method is not only applicable to a single data set, but is also suitable for malicious traffic detection in multiple data sets, and can even detect malicious traffic of attacks that are not in the source domain data set.

[0065] 3. Improve accuracy and efficiency: The combination of transfer learning and knowledge distillation methods improves the accuracy of detection.

[0066] The method provided by the present invention has achieved significant technical progress, effectively solved many defects of the prior art, and provided an innovative solution in the field of malicious traffic detection. These technical advances not only improve the accuracy of detection, but also reduce the number of labeled samples required for early training. It has a positive role in promoting the cleaning of network traffic.

[0067] Fourth, the model and technical design adopted by the malicious traffic detection method based on transfer learning and knowledge distillation of the present invention targets several key technical problems in the prior art and achieves significant technical progress.

[0068] 1. Maximum mean difference function: Use the maximum mean difference function to define a loss for each dataset as a whole to help the migrated model to perform better domain adaptation. The output of MMD is a fixed value for each dataset. By calculating the average value of each feature in the source domain, adding and dividing by the number of features, and then performing the same operation on the target domain dataset, the value obtained in the source domain is subtracted from the value obtained in the target domain. The output is the value of MMD.

[0069] 2. Feature extraction: During the training process in the source domain, it is necessary to first train the parameters of the model. For the source domain dataset, ResNet technology is used to extract the features of each sample.

[0070] 3. Calculate the KD value of the target domain: By training on the teacher model, a KD value is obtained for each sample, which is used as the loss in the subsequent target domain training. This not only considers the overall difference between the source domain and the target domain, but also the individual difference of each sample in the target domain.

[0071] Technical issues solved:

[0072] 1. Limitation of a single dataset: Traditional detection models can only be verified on a single dataset, while the present invention achieves excellent accuracy on multiple datasets.

[0073] 2. Insufficient generalization ability: Previous models often performed poorly in dealing with new attack types. The introduction of MMD and KD losses can better detect new attacks.

[0074] 3. Domain adaptability: Existing methods often lack cross-domain adaptability. The present invention adds additional losses during the migration process and can be applied to traffic in various fields.

[0075] Technological advances achieved:

[0076] 1. Improved the accuracy of malicious traffic detection: By combining transfer learning and knowledge distillation, the accuracy of malicious traffic identification is significantly improved.

[0077] 2. Significantly reduces the number of labels required for the model: when training in the target domain,

[0078] 3. Improved system adaptability and flexibility: Multi-domain adaptive design and data expansion strategy enable the present invention to adapt to a wider range of application scenarios and more complex information environments.

[0079] The present invention not only solves the existing problems technically, but also demonstrates significant technical advantages in practical applications, providing an efficient and flexible new tool for detecting malicious traffic.

[0080] Fifth, the present invention proposes a malicious traffic detection method based on transfer learning, which effectively solves multiple bottleneck problems in the prior art through multiple improvements and achieves significant technical progress. First, the performance of traditional malicious traffic detection methods varies greatly between different data sets, making it difficult to achieve efficient cross-domain detection. The present invention trains the model on the source domain data set and uses step S2 to randomly select 1% of the data from the target domain data set for preprocessing, thereby ensuring the diversity and representativeness of the data distribution and effectively improving the generalization ability and cross-domain adaptability of the model.

[0081] Traditional transfer learning methods have limited effects when dealing with differences in data distribution between the source domain and the target domain. The present invention significantly reduces the difference between the source domain and target domain data distribution by calculating the maximum mean difference (MMD) between the source domain and the target domain data, thereby enhancing the model's adaptability to the target domain data. Combined with the knowledge distillation (KD) loss in step S4, the present invention uses the teacher model to perform deep neural network training on the target domain data, and uses the KD loss as an additional supervisory signal to improve the detection accuracy of the model on the target domain.

[0082] The present invention dynamically adjusts the weight of KD during the training process, so that the KD loss weight is adjusted according to the accuracy of each category in the current iteration, further optimizing the performance of the model. In this way, by dynamically adjusting the KD loss weight of each category, the model can better adapt to the target domain data and improve the overall detection accuracy.

[0083] The present invention transfers the model trained in the source domain to the target domain for training, and combines the MMD and KD losses calculated in steps three and four to form a comprehensive loss function, which effectively improves the detection performance of the model on the target domain data. Through experimental verification, the malicious traffic detection method of the present invention has shown excellent performance on multiple actual data sets, significantly better than traditional methods, with higher detection accuracy and stronger cross-domain adaptability, solving many key problems in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0084] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments of the present invention. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0085] Figure 1 This is the mmd calculation process provided by the embodiment of the present invention;

[0086] Figure 2 is a schematic diagram of source domain model training provided by an embodiment of the present invention;

[0087] Figure 3 It is a structural diagram of a malicious traffic detection model based on transfer learning and knowledge distillation provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0088] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0089] In view of the problems existing in the prior art, the present invention provides a malicious traffic detection method based on transfer learning, and the present invention is described in detail below in conjunction with the accompanying drawings.

[0090] The malicious traffic detection method based on transfer learning of the present invention provides an effective solution for detecting malicious traffic by combining transfer learning and knowledge distillation technology. A specific embodiment is listed below to demonstrate the application of the method in different scenarios.

[0091] Example 1: Malicious traffic detection in IoT environment

[0092] 1. Data preprocessing: Preprocessing includes replacing nan values ​​and null values ​​with 0, normalizing all data, and duplicating labels with fewer labels after processing until the number of labels for each category is consistent.

[0093] 2. Train the source domain model: Train on the source domain dataset and use a simplified version of the deep residual learning network ResNet50 model to perform malicious traffic detection tasks on the source domain dataset. The output layer of the model is adjusted according to the number of malicious traffic categories, and the Softmax function is applied after the last fully connected layer for multi-classification.

[0094] 3. Calculate the MMD value and the KD value of the target domain: Calculate the maximum mean difference (MMD) between the source domain and 1% of the target domain data to narrow the difference between the source domain and target domain data distribution. Then select the full Resnet50 as the teacher model and train it on the target domain data to obtain the probability of each category for each sample.

[0095] 4. Migrate the model trained in the source domain to the target domain for training, and add the calculated MMD and KD values ​​as losses during the training process. At the end of each epoch, update the KD loss for each category separately. We adjust the corresponding KD loss weight of each category according to its accuracy in the current epoch. The reason for this is that categories with higher accuracy often indicate that they are close to convergence in the current training process, so the impact on the model during the migration process should be relatively small. On the contrary, categories with lower accuracy may still need more training, so their KD loss weights will be relatively high in transfer learning. This strategy of updating KD loss weights by category effectively takes into account the different situations of each category during the training process, making the model pay more attention to categories that need more learning, thereby improving the effect of transfer learning.

[0096] 5. Classification detection: The samples of the data set are input into the final model, which can determine whether each flow is benign or malicious.

[0097] This embodiment demonstrates that the model can adapt to the characteristics of different data sets, thereby effectively improving the detection rate of malicious traffic.

[0098] like Figure 1 , Figure 2 , Figure 3 As shown, the malicious traffic detection method based on transfer learning provided by the embodiment of the present invention includes:

[0099] S1, train the model on the source domain dataset and save the model;

[0100] S2, randomly selects 1% of the data from another dataset and performs data preprocessing as the target domain data;

[0101] S3, calculate the maximum mean difference between the source domain and the data obtained in step 2;

[0102] S4, use the teacher model to train the deep neural network with the data obtained in step 2 and obtain the KD loss;

[0103] S5, using the model obtained in step 1 to perform deep neural network training on the data obtained in step 2, and adding the KD obtained in step 4 during the training process;

[0104] S6, readjust the weight of KD according to the accuracy after each iteration.

[0105] S7, finally, the trained model is used to make predictions on the remaining 99% of the data in step 2.

[0106] The malicious traffic detection method based on transfer learning provided by the embodiment of the present invention involves a series of steps from preprocessing of the source domain data set, calculating the difference between the source domain and the target domain, training of the deep neural network, combining the teacher model knowledge, and performing detection through the final model. The signal and data processing process in each step will be explained in detail below:

[0107] S1, train the model on the source domain dataset and save the model;

[0108] Signal and data reception: First, the source domain model receives the traffic data set of the source domain data. These data sets contain various types of traffic, such as benign traffic, backdoor attack traffic, worm attack traffic, etc.

[0109] S2, randomly selects 1% of the data from another dataset and performs data preprocessing as the target domain data;

[0110] Preprocessing: The preprocessing model cleans the original traffic samples, replaces nan values ​​and null values ​​with 0, normalizes all data, and copies labels with fewer labels after processing until the number of labels for each category is consistent.

[0111] S3, calculate the maximum mean difference between the source domain and the data obtained in step 2;

[0112] Calculate mmd: The processed source domain data and target domain data are used to calculate MMD to reduce the difference between the source domain and target domain data distribution. The calculation method of MMD is to calculate the average value of each feature value in the source domain, add and divide by the number of features, then calculate the average value of each feature value in the target domain, add and divide by the number of features, and finally subtract the former from the latter.

[0113] S4, use the teacher model to train the deep neural network with the data obtained in step 2 and obtain the KD loss;

[0114] Calculate KD: Select the complete Resnet50 as the teacher model, train it on the target domain data, and get the probability of each category for each sample. Based on this probability, the KD value of each sample can be obtained.

[0115] S5, using the model obtained in step 1 to perform deep neural network training on the data obtained in step 2, and adding the KD obtained in step 4 during the training process;

[0116] Target domain training: The model trained in the source domain is transferred to the target domain for training, and the MMD value calculated in step 3 and the KD value calculated in step 4 are added as losses during the training process.

[0117] S6, readjust the weight of KD according to the accuracy after each iteration.

[0118] Update KD value: KD value is not fixed. At the end of each epoch, the KD loss is updated for each category separately. Specifically, we adjust the corresponding KD loss weight according to the accuracy of each category in the current epoch.

[0119] S7, finally, the trained model is used to make predictions on the remaining 99% of the data in step 2.

[0120] Final prediction: The remaining 99% samples of the target domain dataset are input into the classification model for prediction. Based on the learned knowledge, the model determines whether the sample is malicious traffic and gives the corresponding detection result.

[0121] Throughout the entire process, each step involves processing and transforming data to meet the needs of subsequent steps. At the same time, by combining transfer learning, knowledge distillation, and deep learning, this method can more comprehensively extract the characteristics of malicious traffic and improve the accuracy of malicious traffic detection.

[0122] Furthermore, S1 specifically includes: a simplified version of the deep residual learning network ResNet50 model is used to perform malicious traffic detection tasks on the source domain dataset. )y is the category probability distribution predicted by the model, W f and b f ; represent the weight and bias of the fully connected layer, f resent represents the feature extraction part of the ResNet50 network, X norm Represents the normalized input data. The output layer of the model is adjusted according to the number of categories of malicious traffic, and the Softmax function is applied after the last fully connected layer for multi-classification:

[0123]

[0124] Furthermore, S2 specifically includes: randomly selecting 1% of the data in the target domain data set and preprocessing the data, the preprocessing includes replacing nan values ​​and empty values ​​with 0, normalizing all data, and copying labels with fewer labels after processing until the number of labels for each category is consistent.

[0125] Further, S3 specifically includes: calculating the maximum mean difference (MMD) between the source domain and 1% of the target domain data to reduce the difference between the source domain and the target domain data distribution. P and Q represent the data distribution of the source domain and the target domain, respectively, f represents the feature mapping function mapped to the Hilbert space, and n and m are the number of samples in the two domains, respectively.

[0126]

[0127] Furthermore, S4 specifically includes: selecting the complete Resnet50 as the teacher model, training it on the target domain data, and obtaining the probability of each category for each sample. P(i) and Q(i) are the true probability and predicted probability of the i-th category, respectively. In this paper, P(i) is represented by one-hot encoding, where the probability of the correct category is 1 and the probability of the remaining categories is 0. KL (P||Q) represents the KL divergence from distribution Q to distribution P.

[0128]

[0129] According to this formula, the initial KL divergence (KD) loss of each sample can be obtained.

[0130] Furthermore, S5 specifically includes: migrating the model trained in the source domain to the target domain for training, and adding the MMD value calculated in step 3 and the KD value calculated in step 4 as losses during the training process. Specifically, in each iteration, the loss of model training is:

[0131]

[0132] Where L cls (y,)y) is the classification loss for supervising the student model, usually using the cross entropy loss function.

[0133] l mmd is the weight coefficient of MMD, which is used to balance the contribution of MMD loss in the total loss function. kd is the weight coefficient of knowledge distillation loss. is the knowledge distillation loss, which defines the student model output Output from the teacher model The KL divergence distance metric between .

[0134] It should be noted that the value of KD is not static. At the end of each epoch, the KD loss is updated separately for each category. Specifically, we adjust the corresponding KD loss weight of each category according to its accuracy in the current epoch. The reason for this is that categories with higher accuracy often indicate that they are close to convergence in the current training process, so the impact on the model during the migration process should be relatively small. On the contrary, categories with lower accuracy may still need more training, so their KD loss weights will be relatively high in transfer learning. This strategy of updating KD loss weights by category effectively takes into account the different situations of each category during the training process, making the model pay more attention to categories that need more learning, thereby improving the effect of transfer learning.

[0135] Further, S6 specifically includes: re-updating the weight of KD after each iteration, and the specific updating formula is:

[0136] TD=TD·(1+γ((Acc target -Acc i,t ))

[0137] By iterating the weight of the KD loss value after each iteration, the accuracy of the entire model is improved, and eventually a good prediction can be made for each sample.

[0138] like Figure 3 As shown, the malicious traffic detection model based on transfer learning provided by the embodiment of the present invention includes:

[0139] A data preprocessing module, used for inputting the original traffic data set into the model for preprocessing;

[0140] Source domain deep neural network training module, used to pre-train the model on source domain data;

[0141] The target domain deep neural network training module is used to train the model on the target domain data;

[0142] Update KD module, which is used to update the KD weight after each iteration;

[0143] The classifier detection module is used to input the feature vector of the learned detection sample into the classifier for detection.

[0144] An application embodiment of the present invention provides a computer device, which includes a memory and a processor. The memory stores a computer program. When the computer program is executed by the processor, the processor executes the steps of a malicious traffic detection method based on transfer learning.

[0145] An application embodiment of the present invention provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor executes the steps of a malicious traffic detection method based on transfer learning.

[0146] An application embodiment of the present invention provides an information data processing terminal, which is used to implement a malicious traffic detection system based on transfer learning.

[0147] Example:

[0148] The malicious traffic detection method based on transfer learning is characterized in that the knowledge learned by knowledge distillation is added during the migration process. The method includes the following steps:

[0149] Step 1: Load the public CICIDS2018 dataset;

[0150] Step 2: Build the source domain model as ResNet50, set the learning rate to 0.002, use the Adam optimizer during training, and the batch size is 30;

[0151] Step 3: Get the data content and label of each sample in the CICIDS2018 dataset;

[0152] Step 4: Input the data content obtained in step 3 into the traffic preprocessing model;

[0153] Step 5: The input data is first pre-trained with the ResNet50 model, and the trained model is saved;

[0154] Step 6: Calculate the MMD value and the KD value of 1% samples in the target domain.

[0155] Step 7: Transfer the model trained in step 5 to 1% samples of the target domain. Freeze the convolutional layer, train only the fully connected layer, and add MMD and KD values ​​as losses during model training.

[0156] Step 8: After an epoch, modify the KD weight according to the current accuracy

[0157] Step 9: Repeat steps 7-8 for a total of 30 times until the preset number of traversals is completed.

[0158] Step 10: Use the final model obtained in step 7 to make predictions on the remaining 99% of the data in the target domain.

[0159] Step 11: The highest accuracy of model detection is 99.87%; compared with other models, in the case of transfer learning, our model has an overall advantage over other models.

[0160] The embodiments of the present invention have achieved some positive effects during the development or use process, and indeed have great advantages over the prior art. The following content is described in conjunction with data, charts, etc. of the test process.

[0161]

[0162]

[0163] As shown in the above table, the data marked with Our are the data of our model experiment. Compared with the experimental data of other models, it can be seen that our model has an advantage overall.

[0164] Example:

[0165] The malicious traffic detection method based on transfer learning is characterized in that the knowledge learned by knowledge distillation is added during the migration process. The method includes the following steps:

[0166] Step 1: Simulate attacks in an industrial control environment, including botnet attacks, worm attacks, Trojan attacks, virus attacks, and distributed denial of service attacks;

[0167] Step 2: Use Wireshark to capture packets during the attack.

[0168] Step 3: Perform feature extraction on the captured packets and save the results as a csv file.

[0169] Step 4: Label each sample.

[0170] Step 5: Select the UNSW-NB15 dataset as the source domain dataset and send the source domain dataset to the source domain model for pre-training.

[0171] Step 6: Separate 1% of the captured data and feed it into the teacher model for prediction, and calculate the KD value of each sample.

[0172] Step 7: Freeze the convolutional layers of the source domain model and only keep the fully connected layers for training.

[0173] Step 8: Feed 1% of the data into the source domain model, and add the MMD value and KD value as loss during the training process to obtain the prediction results.

[0174] Step 9: Re-adjust the KD weight of each category based on the accuracy of step 8.

[0175] Step 10: Continue to repeat steps 8 to 9 for a total of 30 times, that is, train the deep neural network for 30 rounds;

[0176] Step 11: Save the model;

[0177] Step 12: Feed the remaining 99% of the data into the model and output the prediction;

[0178] Step 11: The highest accuracy of model detection is 99.18%. Compared with other models, our model has an overall advantage over other models.

[0179] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. It can be understood by a person of ordinary skill in the art that the above-mentioned devices and methods can be implemented using computer executable instructions and / or contained in a processor control code, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. Such code is provided on the carrier medium. The device and its modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, and can also be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0180] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principle of the present invention should be covered by the protection scope of the present invention.

Claims

1. A malicious traffic detection method based on transfer learning, characterized in that: include: S1, train the model on the source domain dataset and save the model; S2, randomly selects 1% of the data from another dataset and performs data preprocessing as the target domain data; S3, calculate the maximum mean difference between the source domain and the data obtained in step 2; S4, use the teacher model to train the deep neural network with the data obtained in step 2 and obtain the KD loss; S5, using the model obtained in step 1 to perform deep neural network training on the data obtained in step 2, and adding the KD obtained in step 4 during the training process; S6, readjust the weight of KD according to the accuracy after each iteration; S7, finally, the trained model is used to make predictions on the remaining 99% of the data in step 2; S4 specifically includes: selecting the complete Resnet50 as the teacher model, training it on the target domain data, and obtaining the probability of each category for each sample; P(i) and Q(j) are the true probability and predicted probability of the i-th category respectively; P(i) is represented by one-hot encoding, where the probability of the correct category is 1 and the probability of the remaining categories is 0; D KL (P||Q) represents the KL divergence from distribution Q to distribution P; According to this formula, the initial KL divergence (KD) loss of each sample can be obtained; S5 specifically includes: migrating the model trained in the source domain to the target domain for training, and adding the MMD value calculated in step 3 and the KD value calculated in step 4 as losses during the training process; specifically, in each iteration, the loss of model training is: in It is the classification loss for supervising the student model, using the cross entropy loss function; λ mmd is the weight coefficient of MMD, which is used to balance the contribution of MMD loss in the total loss function; kd is the weight coefficient of knowledge distillation loss; is the knowledge distillation loss, which defines the student model output Output from the teacher model The KL divergence distance metric between them; The KD loss is not static. At the end of each epoch, the KD loss is updated separately for each category, and the corresponding KD loss weight is adjusted according to the accuracy of each category in the current epoch.

2. The malicious traffic detection method based on transfer learning as claimed in claim 1, characterized in that: S2 specifically includes: S2 specifically includes: randomly selecting 1% of the data in the target domain dataset and preprocessing the data. The preprocessing includes replacing nan values ​​and empty values ​​with 0, normalizing all data, and copying labels with fewer labels after processing until the number of labels for each category is consistent.

3. The malicious traffic detection method based on transfer learning as claimed in claim 1, characterized in that: S3 specifically includes: calculating the maximum mean difference (MMD) between the source domain and 1% of the target domain data, which is used to reduce the difference between the source domain and the target domain data distribution; P and Q represent the data distribution of the source domain and the target domain, respectively, φ represents the feature mapping function mapped to the Hilbert space, and n and m are the number of samples in the two domains, respectively; 4. The malicious traffic detection method based on transfer learning as claimed in claim 1, characterized in that: S6 specifically includes: re-updating the weight of KD after each iteration, and the specific update formula is: TD=TD·(1+γ((Acc target -Acc i,t )) By iterating the weight of the KD loss value after each iteration, the accuracy of the entire model is improved, and eventually a good prediction can be made for each sample.

5. A malicious traffic detection system implementing the malicious traffic detection method based on transfer learning as described in any one of claims 1 to 4, characterized in that: The system includes: A. Data preprocessing module, used to randomly select some data from the target domain dataset and preprocess the selected data. The preprocessing includes replacing missing values ​​and null values ​​with preset values, normalizing all data, and balancing the number of labels of different categories; B. Transfer learning module, which is used to train the model on the source domain dataset and use the trained model to train the deep neural network on the preprocessed target domain data, where the training process combines knowledge distillation (KD) loss; C. KD adjustment module, used to readjust the weight of KD according to the accuracy of the model on the target domain data after each iteration; D. Prediction module, used to apply the trained model to the remaining data in the target domain dataset to perform malicious traffic prediction.

6. The malicious traffic detection system according to claim 5, characterized in that: The data preprocessing module also includes: A1. Missing value processing unit, used to replace nan values ​​and null values ​​in the target domain data with preset 0 values; A2. Data normalization unit, used to normalize the target domain data; A3. Label balancing unit, used to copy the labels in the target domain data until the number of labels for each category is consistent.

7. The malicious traffic detection system according to claim 5, characterized in that: The transfer learning module also includes: B1. Maximum mean difference calculation unit, used to calculate the maximum mean difference (MMD) between the source domain and the target domain data to evaluate the distribution difference between the two data sets; B2. Teacher model training unit, used to select Resnet50 as the teacher model, train it on the target domain data, and calculate the KD loss of each sample; B3. Deep neural network training unit, used to train the deep neural network on the target domain data and combine the KD loss in the training process.

8. The malicious traffic detection system according to claim 5, characterized in that: The system also includes: E. Accuracy monitoring module, used to monitor the accuracy of the model on the target domain data after each iteration and adjust the weight of KD according to the accuracy; F. A result output module is used to output the malicious traffic prediction results obtained by the prediction module to a user interface or store them in a preset data storage area.

Images