IPv6 multi-field covert channel detection method and system based on self-attention mechanism

Abstract

The present application relates to the technical field of IPv6 network security, and particularly relates to an IPv6 multi-field covert channel detection method and system based on a self-attention mechanism, which comprises the following steps: obtaining target IPv6 network message data, extracting message field features and forming a feature matrix, wherein the message field features include header field features and extension header field features; inputting the feature matrix into a covert channel detection model, detecting the message field features by using the covert channel detection model, and determining whether there is a covert channel in the target IPv6 network message data; wherein the covert channel detection model aggregates the weights of each message field feature based on the self-attention mechanism, and performs weighted fusion on the message field features according to the correlation between the message fields, so as to highlight the key message field features in the detection and identification feature vector. The present application aggregates the input data by using the multi-head attention mechanism, performs weighted average on each field by calculating the correlation scores between different sub-fields to detect and locate the covert channel, and can be applied to IPv6 multi-field covert channel detection, and has a good application prospect in the field of network security protection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of IPv6 network security, and particularly relates to an IPv6 multi-field covert channel detection method and system based on a self-attention mechanism. BACKGROUND

[0002] A network covert channel is a real-time communication channel that transmits secret information in violation of network and system security policies. With the increasing widespread deployment and application of IPv6 networks, IPv6 network covert channels have brought new challenges to network security and management. According to the different mechanisms of shared resources (content features and timing features), IPv6 covert channels can be divided into two categories: storage type and timing type. IPv6 storage type covert channels use IPv6 header and extension header fields to hide secret information, while IPv6 timing type covert channels use the time interval or sequence features of IPv6 data packets as the transmission carrier of hidden data.

[0003] When describing the covert channel using the prisoner model, as two participants in the exchange of hidden information, Alice and Bob actively create correct communications and send secret information by changing the content or features of the communications. As a listener, Wendy tries to detect and detect the hidden communication between Alice and Bob at a certain position of the covert channel, and even interferes with the transmission of information by Alice and Bob in the covert channel. In the IPv6 covert channel, Alice and Bob use one or more fields in the IPv6 header and IPv6 extension header to hide secret information and facilitate the exchange of hidden messages. The model plays a similar role to Wendy, and the goal is to detect the existence of the covert channel.

[0004] With the continuous development of network technology, the importance of detecting IPv6 covert channels has increased. The existence of a covert channel can pose a significant security risk to the network, especially in the field of network security. Therefore, how to effectively detect and locate IPv6 covert channels has become one of the current hot issues.

[0005] At present, there are many deep learning-based IPv6 storage-type covert channel detection methods, such as a blind network steganalysis model based on convolutional neural network (BNS-CNN) and detecting IPv6-based covert channel scheme using DNN (DICCh-D), which can only classify IPv6 traffic into two categories of normal and abnormal, and cannot identify the type of IPv6 storage-type covert channel and accurately locate the embedded field. The deep neural network (DNN) scheme realizes the positioning of a single embedded field, but cannot detect the covert channel embedded in multiple fields and accurately locate multiple fields. SUMMARY

[0006] To this end, the present application provides an IPv6 multi-field covert channel detection method and system based on a self-attention mechanism, which solves the problem that existing deep learning-based covert channel detection schemes are mostly used for single-field covert channel detection and cannot be applied to multi-field covert channel detection.

[0007] According to the design scheme provided by the present application, on the one hand, an IPv6 multi-field covert channel detection method based on a self-attention mechanism is provided, which comprises:

[0008] Obtaining target IPv6 network message data, extracting message field features and forming a feature matrix, wherein the message field features include header field features and extension header field features;

[0009] Inputting the feature matrix into a pre-trained covert channel detection model, detecting the message field features using the covert channel detection model and determining whether there is a covert channel in the target IPv6 network message data;

[0010] Wherein, the covert channel detection model aggregates the weights of each extracted message field feature based on the self-attention mechanism and weights and fuses the message field features according to the correlation between the message fields, so as to highlight the key message field features in the detection and identification feature vector.

[0011] As the IPv6 multi-field covert channel detection method based on the self-attention mechanism of the present application, further, the message field features are extracted, comprising:

[0012] Filtering the version field in the message data and extracting other fields in the message data;

[0013] The extracted fields are arranged in packet order to form a two-dimensional feature matrix composed of the number of samples and sample features;

[0014] The two-dimensional feature matrix is normalized, and the discrete attribute values are mapped to a specified dimensional feature space through matrix conversion to form a three-dimensional feature matrix composed of the number of samples, the number of time steps, and the feature array.

[0015] As the IPv6 multi-field covert channel detection method based on the self-attention mechanism of the application, further, the covert channel detection model comprises: an input layer for receiving message field features, a self-attention mechanism layer for weight aggregation and weighted fusion of the message field features based on the self-attention mechanism, a global average pooling layer for performing global average pooling operation on the weighted and fused feature vectors, a global connection layer for mapping the feature vectors after the global average pooling operation to a specified dimensional feature space, a random inactivation layer for randomly adjusting preset proportion feature values, and an output layer for mapping the feature vectors to a fixed dimension and outputting a representative category probability using an activation function.

[0016] As the IPv6 multi-field covert channel detection method based on the self-attention mechanism of the application, further, the self-attention mechanism comprises:

[0017] The feature matrix is divided into different feature subspaces, each feature subspace corresponds to an attention head, and each attention head has its own weight matrix and bias term;

[0018] Each attention head uses the query weight matrix, the key weight matrix and the value weight matrix to perform linear transformation on the current attention head input, uses the transformed query vector and the key vector to obtain the attention score, and uses the scaling dot product operation to obtain the attention weight; the attention weight is weighted and summed with the value vector of each feature subspace to obtain the output vector of each attention head;

[0019] The output vectors of the attention heads are spliced to obtain the final multi-head attention representation.

[0020] As the IPv6 multi-field covert channel detection method based on the self-attention mechanism of the application, further, the process of obtaining the attention weight using the scaling dot product operation is represented as: Wherein, Q is the query vector, K is the key vector, d k is the vector dimension.

[0021] As the IPv6 multi-field covert channel detection method based on the self-attention mechanism of the application, further, the process of weighting and summing the attention weight with the value vector of each feature subspace is represented as: Wherein, V is the value vector.

[0022] As the IPv6 multi-field covert channel detection method based on the self-attention mechanism of the application, further, the covert channel detection model training process comprises:

[0023] Normal data packets are collected from a transmission link between an authorized workgroup and an upstream ISP, and covert data is injected into the IPv6 protocol extension header and header field of a specific proportion of data packets using a covert channel embedding tool to form abnormal data packets, and a sample data set is constructed based on the abnormal data packets and the normal data packets;

[0024] The sample data set is used to train the covert channel detection model based on a cross-loss function to obtain a trained covert channel detection model.

[0025] In another aspect, the application also provides an IPv6 multi-field covert channel detection system based on a self-attention mechanism, comprising a data acquisition module and an anomaly detection module, wherein,

[0026] The data acquisition module is used to acquire target IPv6 network message data, extract message field features and form a feature matrix, and the message field features include header field features and extension header field features;

[0027] The anomaly detection module is used to input the feature matrix into a pre-trained covert channel detection model, and use the covert channel detection model to detect the message field features and determine whether there is a covert channel in the target IPv6 network message data;

[0028] The covert channel detection model aggregates the weights of each extracted message field feature based on the self-attention mechanism and weights the message field features according to the correlation between the message fields to highlight the key message field features in the detection and recognition feature vector.

[0029] The application has the following advantages:

[0030] The application uses a multi-head attention mechanism to aggregate input data, and calculates the correlation scores between different sub-fields to weight and average each field to detect and locate the covert channel, which can be applied to IPv6 multi-field covert channel detection. Further, experimental data show that the scheme can detect 23 kinds of multi-field covert channels constructed using IPv6 headers and IPv6 extension headers. Compared with the existing BNS-CNN and DICCh-D, the number of detectable fields is increased by 2.5 times, and the scheme shows a significant accuracy of 97.13% and a low false positive rate of 6.3% in detecting and locating multiple scenes, which has good application prospects in the field of network security protection. BRIEF DESCRIPTION OF DRAWINGS

[0031] Figure 1This is a schematic diagram illustrating the principle of IPv6 multi-field covert channel detection based on self-attention mechanism in the embodiment;

[0032] Figure 2 This is a schematic diagram of the covert channel detection model structure in the embodiment;

[0033] Figure 3 This is a schematic diagram illustrating the principle of the multi-head attention mechanism in the embodiment;

[0034] Figure 4 This is a schematic diagram of the dataset construction process in the example;

[0035] Figure 5 This illustration shows a comparison of the loss trends of different optimizers during model training in the example.

[0036] Figure 6 This is a schematic diagram comparing the macro-average accuracy of different models in the example.

[0037] Figure 7 This is a schematic diagram comparing the macro average recall rates of different models in the embodiments;

[0038] Figure 8 This is a comparison of the macro-average F1 scores of different models in the example.

[0039] Figure 9 This is a schematic diagram comparing the detection accuracy of different models for various types of concealed channels in the embodiments;

[0040] Figure 10 This example illustrates the comparison of F1 scores for different models in detecting various types of concealed channels.

[0041] Figure 11 This example illustrates a comparison of the false negative rates of different models for detecting various types of covert channels.

[0042] Figure 12 This example illustrates a comparison of false alarm rates for different models in various types of covert channels. Detailed implementation method:

[0043] To make the objectives, technical solutions, and advantages of this invention clearer and more understandable, the invention will be further described in detail below with reference to the accompanying drawings and technical solutions.

[0044] In IPv6 multi-field covert channels, covert information may be embedded in multiple fields, including IPv6 flow labels, traffic categories, hop limits, reserved fields in the IPv6 fragmentation extension header, and option fields in the IPv6 hop-by-hop option extension header. To detect IPv6 multi-field covert channels, it is necessary to simultaneously analyze the variations and correlations of multiple fields, which increases the complexity of detection and localization. Furthermore, covert channel developers can employ different encoding strategies and hiding techniques, allowing the hidden information to vary in multiple ways across different fields. These variations not only increase the difficulty of detection but also place higher demands on the design and implementation of detection models. Therefore, embodiments of the present invention are described below. Figure 1 As shown, a method for detecting multi-field covert channels in IPv6 based on a self-attention mechanism is provided, comprising:

[0045] S101. Obtain target IPv6 network packet data, extract packet field features and form a feature matrix. The packet field features include header field features and extended header field features.

[0046] Specifically, the version field in the message data can be filtered to extract other fields from the message data; the extracted fields are arranged in the order of the data packets to form a two-dimensional feature matrix composed of the number of samples and the number of sample features; the two-dimensional feature matrix is ​​normalized and the discrete attribute values ​​are mapped to the specified dimension feature space through matrix transformation to form a three-dimensional feature matrix composed of the number of samples, the number of time steps, and the number of features.

[0047] To fully preserve data characteristics while considering the nature and importance of each field, all fields in the IPv6 header except the version field can be extracted. The source and destination address fields are extracted in 8-bit columns, for a total of 32 columns, which are then arranged in the order of the data packets. This results in a two-dimensional feature matrix X of shape (A, B), where A represents the number of samples and B represents the number of features in a single sample.

[0048] Then, feature normalization is performed on the two-dimensional feature matrix, scaling each feature to a range with a mean of 0 and a variance of 1, resulting in a matrix X_norm with a mean of 0 and a variance of 1. Based on the feature normalization, the two-dimensional feature matrix is ​​transformed into a three-dimensional feature matrix X of shape (A,1,B). seq This maps discrete attribute values ​​to a high-dimensional feature space, where the first dimension represents the number of samples, the second dimension represents the number of time steps, and the third dimension represents the number of features. Each IPv6 packet can be considered as a time step, so the time step is set to 1, and each time step has B features. This results in a three-dimensional matrix X. seqIt can adapt to input from multi-head attention mechanisms, more accurately describing the properties of the data. To properly evaluate and process the data, the model requires a three-dimensional matrix X as input. seq .

[0049] S102. Input the feature matrix into the covert channel detection model, and use the covert channel detection model to detect the features of the packet fields and determine whether there is a covert channel in the target IPv6 network packet data.

[0050] The covert channel detection model uses a self-attention mechanism to aggregate the weights of the extracted message field features and performs weighted fusion of the message field features based on the correlation between message fields, so as to highlight the key message field features in the detection and identification feature vector.

[0051] Specifically, the covert channel detection model may include: an input layer for receiving message field features; a self-attention mechanism layer for weighted aggregation and weighted fusion of message field features based on a self-attention mechanism; a global average pooling layer for performing global average pooling on the weighted fused feature vector; a global connection layer for mapping the feature vector after global average pooling to a specified dimension feature space; a random deactivation layer for randomly adjusting a preset proportion of feature values; and an output layer for mapping the feature vector to a fixed dimension and using an activation function to output a probability representing the category.

[0052] like Figure 2 As shown, utilizing a multi-head attention mechanism layer helps to better detect the intrinsic relationships between different domains and provides better insight into the decision-making process by visualizing attention weights, which in turn enhances the interpretability of the model and the understanding of its behavior. The output of the multi-head attention mechanism layer is used as the input to a global average pooling layer, which performs a global average pooling operation on the input matrix. This operation averages the features of each instance to generate a fixed-length vector representation. This operation reduces the size and number of feature maps, thereby reducing the computational complexity of the model while preserving the ability to extract features and maintain spatial location information. The fully connected layer maps the global average pooling vector representation to a higher-dimensional feature space and introduces a non-linear activation function (Rectified Linear Unit, ReLU) to learn complex features and non-linear relationships in the input data. A random deactivation layer is used to reduce overfitting by randomly setting a certain proportion of the input features to zero, thereby improving the model's generalization ability. The output layer can consist of a dense layer that maps the input features to a 24-dimensional vector. The generated vector is then normalized using a Softmax activation function to generate outputs representing the probabilities of various classes, ultimately achieving the classification of hidden channels. Through the aforementioned network structure and self-attention mechanism, the proposed model in this case can more effectively identify key features in IPv6 traffic.

[0053] Specifically, see Figure 3 As shown, a self-attention mechanism may include:

[0054] The feature matrix is ​​divided into different feature subspaces, each feature subspace corresponds to an attention head, and each attention head has its own weight matrix and bias term;

[0055] Each attention head performs a linear transformation on the current attention head input using the query weight matrix, key weight matrix, and value weight matrix. The transformed query vector and key vector are used to obtain the attention score, and the scaling dot product operation is used to obtain the attention weights. The attention weights are then weighted and summed with the value vectors of each feature subspace to obtain the output vector of each attention head.

[0056] The output vectors of each attention head are concatenated to obtain the final multi-head attention representation.

[0057] The multi-head attention mechanism layer receives the input three-dimensional matrix X seq The feature space is divided into 8 different feature subspaces, each corresponding to an attention head. For each attention head, the input data is linearly transformed using different weight matrices to obtain the transformed Q (query), K (key), and V (value). The linear transformation process is shown in formulas (1) to (3), where X is the input data, and Wq, Wk, and Wv are the weight matrices for query, key, and value transformations.

[0058] Q = W q X (1)

[0059] K = W k X (2)

[0060] V = W v X (3)

[0061] For each feature subspace, attention scores are calculated using the transformed query and keywords, and attention weights are calculated using scaled dot product attention. To obtain attention weights, the similarity between the key vector and the query vector needs to be specifically determined using dot product operations, followed by Softmax normalization. When analyzing IPv6 packet sequence data, attention weights enable the model to focus more on key fields. Equation (4) explains how to calculate attention weights, where Q is used as the query vector, K as the key vector, and dk as the vector dimension.

[0062]

[0063] The calculated attention weight vector is weighted and summed with the value vector in each feature subspace to obtain the output vector of each attention head, as shown in formula (5).

[0064]

[0065] After calculating the output vector of each attention head, they are concatenated to obtain the final multi-head attention representation. Specifically, this is achieved using a learnable weight matrix W. O The attention output vectors of different heads are linearly transformed and weighted, and then summed to obtain the multi-head attention representation. The calculation formula is shown in formula (6).

[0066] MHA(Q,K,V)=Concat(head1,···,head8)W o (6)

[0067] Where head_1 to head_8 are the attention output vectors of the eight attention heads, W O It is a learnable weight matrix used to map the concatenated vectors to the target dimension. Through this concatenation and mapping, richer information and features in IPv6 packet data can be captured, improving the model's expressiveness and recognition ability. The output multi-head attention representation is usually a three-dimensional tensor with the shape (batch_size, num_steps, num_heads*head_size), where head_size represents the output dimension of each attention head.

[0068] In the LSTM+Attention scheme, the attention mechanism is also used to weight the input, enabling the model to more accurately focus on the important parts of the input sequence. Specifically, the attention mechanism calculates attention scores to determine the importance of each element in the input sequence, and then weights the elements based on these scores. For the LSTM+Attention scheme, the computation steps of the attention mechanism are as follows: First, the output of the LSTM is passed as input to the attention layer. The attention layer multiplies the input by the attention weight matrix, adds a bias term, applies the hyperbolic tangent activation function, and calculates the attention score for each input element. Then, the attention scores are normalized using the Softmax function to obtain the attention weights. Finally, the input is multiplied by the attention weights to obtain a weighted sum as the final output.

[0069] In contrast, the proposed model employs a multi-head attention layer. This layer introduces multiple independent attention heads, each with its own weight matrix and bias term. These heads can compute attention weights in parallel and weight the input accordingly. Finally, the multi-head attention layer concatenates the outputs of all heads to form the final attention representation. By introducing this multi-head attention mechanism, the proposed model exhibits greater flexibility and expressiveness when processing different feature subspaces. The multi-head attention layer can learn different attention patterns and independently model different input features, thereby better capturing important information in the input sequence.

[0070] The training process for the covert channel detection model can be designed to include:

[0071] Normal data packets are collected from the transmission link between the authorized working group and the upstream ISP. Covert channel embedding tools are used to inject covert data into the IPv6 protocol extension header and header fields of a specific proportion of data packets to form abnormal data packets. A sample dataset is constructed based on the abnormal data packets and normal data packets.

[0072] The covert channel detection model is trained using a sample dataset to obtain the trained covert channel detection model.

[0073] Furthermore, based on the above method, this embodiment of the invention also provides an IPv6 multi-field covert channel detection system based on a self-attention mechanism, comprising: a data acquisition module and an anomaly detection module, wherein,

[0074] The data acquisition module is used to acquire target IPv6 network packet data, extract packet field features and form a feature matrix. The packet field features include header field features and extended header field features.

[0075] The anomaly detection module is used to input the feature matrix into the pre-trained covert channel detection model, and use the covert channel detection model to detect the features of the packet fields and determine whether there is a covert channel in the target IPv6 network packet data.

[0076] The covert channel detection model uses a self-attention mechanism to aggregate the weights of the extracted message field features and performs weighted fusion of the message field features based on the correlation between message fields, so as to highlight the key message field features in the detection and identification feature vector.

[0077] To verify the effectiveness of this solution, the following explanation is based on experimental data:

[0078] The primary focus is on detecting covert channels embedded in IPv6 headers, while neglecting potential covert channels within IPv6 extension headers. An investigation into the usage of IPv6 extension headers in real-world network environments yielded results, as shown in Table 1. The IPv6 Hop-by-Hop Options extension header and Fragmentation extension header have the highest utilization rates, while the Routing extension header and Destination Options extension header have almost zero utilization. Furthermore, due to integrity check requirements, the ESP and AH headers are unsuitable for embedding secret information.

[0079] Table 1. IPv6 Extended Header Usage Rate in Real Networks

[0080]

[0081] The interactions between fields in the IPv6 hop-by-hop options extension header, fragmentation extension header, and the IPv6 header itself offer significant potential for constructing multi-field IPv6 covert channels. Within the IPv6 header, the variability of the flow label field and the receiver's tolerance allow for the clever concealment of certain covert information, while the diversity and variability of the traffic category field provide another avenue for transmitting covert information. Furthermore, by adjusting the value of the hop limit field, the propagation range of covert communication can be limited, thereby enhancing its security and concealment.

[0082] Furthermore, the variable-length option fields and ignore functionality of the hop-by-hop option extension header allow for the clever embedding of covert information within the option data portion. The receiver ignores reserved fields in the IPv6 fragmentation extension header, providing another possibility for constructing covert channels. By comprehensively utilizing the IPv6 hop-by-hop option extension header, the IPv6 fragmentation extension header, and the flow label, traffic category, and hop limit fields in the IPv6 header, more complex multi-field IPv6 covert channels can be constructed.

[0083] To construct IPv6 single-field and multi-field covert channels, a covert channel embedding tool was used to inject covert data into various fields of the IPv6 protocol, including the IPv6 Hop-by-Hop Options Extension header, the IPv6 Fragmentation Extension header, and fields within the IPv6 header. Daily tracking data was collected from the transmission link between the WIDE workgroup and the upstream ISP (Internet Service Provider) and treated as normal data. The collected traffic was then modified using the covert channel embedding tool to create anomalous data. By combining the anomalous data with normal data, a dataset was generated for training and testing the IPv6 covert channel model. The IPv6 covert channel dataset creation process is as follows: Figure 4 As shown.

[0084] After completing the process of generating normal and abnormal data, a total of 138,607 IPv6 packets were collected, of which 131,917 packets were classified as covert channels. Each IPv6 packet was assigned a label to indicate which type of IPv6 covert channel it belonged to.

[0085] Table 2 introduces the structure of the IPv6 covert channel dataset, listing the number of samples, embedding fields, and hiding capacity for each covert channel type.

[0086] First, the IPv6 packets are stored in pcap file format. Then, following the order of the IPv6 packet fields in the pcap file, relevant field values ​​are extracted from the IPv6 header, the IPv6 hop-by-hop options extension header, and the IPv6 fragmentation extension header. Finally, these field values ​​are stored as comma-separated values ​​(CSV) in a file.

[0087] Meanwhile, to prevent data leakage from affecting model training and the integration of the test set into the system construction, the complete IPv6 covert channel dataset consisting of 138,607 data points was strictly divided into two parts: a training set consisting of 110,891 data points and a test set consisting of 27,716 data points, with a ratio of 8:2.

[0088] Table 2. Introduction to the structure of the IPv6 covert channel dataset.

[0089]

[0090]

[0091] The generated CSV file includes the following fields: Traffic Category, Flow Label, Payload Length, Next Header, Hop Limit, Source IPv6 Address, Destination IPv6 Address, Next Header of IPv6 Hop-by-Hop Options Extension, Header Extension Length, Options, Next Header of IPv6 Fragmentation Extension, Reserved, Offset, Flags, Source Port Number, and Destination Port Number of the Upper-Layer Protocol. Note that the source and destination address fields are treated as 8-bit attributes. The pseudocode for the packet extraction algorithm is shown in Algorithm 1.

[0092]

[0093]

[0094] Using a Windows 10-based workstation running an Intel Core i5-12500H CPU at 2.60GHz, equipped with 16GB of RAM and an NVIDIA GeForce RTX 3090 24GB GPU, network models were built using frameworks such as TensorFlow and Keras.

[0095] During model training, the cross-entropy loss function was used as the training loss function, the batch size was set to 64, the number of training epochs was set to 20, the initial learning rate of the model was set to 0.1, and the Adam optimizer was selected to update the model parameters.

[0096] Model evaluation is crucial for determining whether a model is overfitting or underfitting. In binary classification problems, the definitions of precision, recall, false negative rate, false positive rate, and F1 score are shown in formulas (7) to (11).

[0097]

[0098]

[0099]

[0100]

[0101]

[0102] In this system, TP stands for True Positive, representing the number of samples accurately classified as covert communication. TN corresponds to True Negative, representing the number of samples correctly classified as normal communication. FP represents False Positive, representing the number of samples incorrectly classified as covert communication, while FN represents False Negative, representing the number of samples incorrectly classified as normal communication.

[0103] Since the model proposed in this case can detect 23 types of IPv6 covert channels, the binary evaluation index cannot reflect the true detection performance of the model. After finding that the sample size of various covert channel data is roughly the same, macro average precision, macro average recall and macro average F1-Score were selected to reflect the performance of the model, as shown in formulas (12) to (14).

[0104]

[0105]

[0106]

[0107] Where n represents the total number of IPv6 covert channel types, P i and R iThese are the precision and recall rates of the model for detecting each type of IPv6 covert channel.

[0108] Macro averaging refers to first calculating the statistical value for each category, and then taking the arithmetic mean of all categories. For example, macro-average recall calculates the recall rate detected by the model for each category, and then takes the arithmetic mean of the recall rates of all categories; macro-average F1 score calculates the F1 score detected by the model for each category, and then takes the arithmetic mean of the F1 scores of all categories. Using macro averaging allows for a more comprehensive evaluation of the model's performance and generalization ability without bias caused by over- or under-sampling of a particular category.

[0109] To comprehensively evaluate the effectiveness and advancement of the proposed model, its performance will be measured from three aspects: 1. Evaluating the impact of hyperparameters on the detection performance of the proposed model; 2. Comparing the proposed model with state-of-the-art deep learning solutions; 3. Comparing the proposed model with other relevant research.

[0110] 1. The impact of different hyperparameters on the detection performance of the proposed model

[0111] The evaluation results show the performance of the proposed model when using various hyperparameters, including the effects of various head sizes, activation functions, optimizers, learning rates, and batch sizes.

[0112] 1) The impact of head size on the performance of the proposed model

[0113] Head size refers to the number of attention heads used in a multi-head attention mechanism. Head size is an adjustable hyperparameter, typically optimized and tuned during model design. Table 3 shows the impact of head size on the proposed model's performance, and accuracy and training time were selected as performance metrics for evaluation.

[0114] Table 3. Impact of head size on the detection performance of the proposed model

[0115]

[0116] The observations show that the detection accuracy of the proposed model gradually improves as the head size increases. Specifically, when the head size increases from 2 to 16, the detection accuracy increases from 93.18% to 97.01%, showing a significant positive relationship. This indicates that a larger head size can better capture the complex relationships and features in the input data, thereby improving the model's detection accuracy.

[0117] Meanwhile, the increase in head size also impacted training time. As the head size increases, the model requires more computational resources to handle more complex attention weight allocations, leading to longer training times. Experimental data shows that when the head size increased from 2 to 16, the average training time increased from 5.23 seconds to 13.40 seconds, an increase that was in line with expectations.

[0118] After considering the balance between detection accuracy and training time, eight heads were selected as the optimal model configuration. While larger head sizes lead to higher accuracy, they also significantly increase training time. Therefore, in practical applications, choosing an eight-head configuration allows for effective control over training time and computational costs while maintaining high accuracy.

[0119] 2) The impact of activation functions on model performance

[0120] Activation functions play a crucial role in neural networks, enhancing their expressive power and enabling them to effectively model and learn from more complex nonlinear data. This experiment provides an in-depth comparison of commonly used activation functions in machine learning algorithms, including the Tangent Hyperbola (Tanh), ReLU, and Exponential Linear Unit (ELU). The impact of these activation functions on model performance is evaluated using two metrics: detection accuracy and average training time.

[0121] Experimental results show that applying different activation functions in dense layers significantly affects the detection performance of the model. Specifically, Table 4 shows a comparison of the detection performance of models using ReLU, ELU, and Tanh activation functions.

[0122] Table 4. Impact of activation function on the detection performance of the proposed model

[0123]

[0124] While the Tanh activation function offers the shortest average training time, its accuracy is relatively low. The ELU activation function exhibits the highest accuracy, despite its longer training time. Models using the ReLU activation function, while less accurate than ELU, show significantly improved training efficiency, achieving a 12.4% increase in training efficiency with only a 0.52% loss in accuracy. Considering both detection performance and training efficiency, the ReLU activation function, due to its balanced performance, is the preferred choice for model activation.

[0125] 3) The impact of the optimizer on model performance

[0126] After determining the activation function, choosing an appropriate optimizer is crucial for the model training process. The main function of the optimizer is to update parameters during model training, aiming to minimize the loss function, thereby improving the model's convergence speed and generalization ability. In this experiment, three commonly used optimizers in machine learning were compared: Nestorov Accelerated Adaptive Moment Estimation (Nadam), Stochastic Gradient Descent (SGD), and Adaptive Moment Estimation (Adam). The results are as follows: Figure 5 As shown.

[0127] The analysis results show that the Nadam and Adam optimizers exhibit superior convergence performance compared to SGD. In particular, the Adam optimizer not only converges faster but also shows a lower loss value after 20 training epochs compared to Nadam. Based on these considerations, the Adam optimizer, due to its excellent performance, can be selected as the final optimizer for the model.

[0128] 4) The impact of learning rate and batch size on model performance

[0129] The learning rate plays a crucial role in model training, determining the step size for each parameter update, thus directly impacting model performance and convergence speed. Batch size refers to the number of samples used in each training epoch. Using smaller batches helps improve the model's generalization ability, but this may sacrifice training efficiency. Conversely, larger batches usually speed up training, but can sometimes lead to overfitting.

[0130] Table 5 shows the detection accuracy and average training time of models with different learning rates and batch sizes over 20 training epochs. The analysis results clearly reveal the significant impact of learning rate and batch size on model performance and training speed.

[0131] Table 5. Impact of learning rate and batch size on the detection performance of the proposed model.

[0132]

[0133] Experimental results show that the learning rate has a significant impact on model performance. In Table 5, when the learning rate is 0.05, a smaller batch size (16) achieves an accuracy of 93.75%. As the batch size increases to 32 or 64, the model's detection accuracy also improves accordingly. This finding indicates that at lower learning rates, increasing the batch size often helps improve model performance. Larger batches generally provide more sample information, reduce the variance of parameter updates, and contribute to more accurate gradient estimation.

[0134] When the learning rate is increased to 0.1, mini-batch (16) results in a decrease in precision to 93.46%, while increasing the batch size to 32 restores precision to 96.55%. Further increasing the batch size to 64 results in a slight increase in precision again. At a higher learning rate of 0.2, mini-batch (16) still achieves 96.48% precision, while the precision reaches its highest level of 97.38% when the batch size is 32.

[0135] However, when the batch size was further increased to 64, the accuracy dropped slightly to 96.94%. This indicates that at a high learning rate, the model's weight updates for individual samples have a greater impact, while the impact of adjusting the batch size on performance is relatively weakened.

[0136] Furthermore, training time is also affected by the combination of learning rate and batch size. Small batches typically require more iterations to process the entire dataset, thus increasing training time. In contrast, large batches can reduce training time because more samples are involved in each update.

[0137] After weighing the average training time and accuracy, it was found that the combination of a learning rate of 0.2 and a batch size of 32 achieved the highest accuracy (97.38%). Although this configuration had a longer training time, the final decision was to use a combination of a learning rate of 0.1 and a batch size of 64 as the model hyperparameters because it significantly reduced the average training time while maintaining high accuracy.

[0138] 2. Performance comparison between the proposed model and deep learning solutions in this case.

[0139] The proposed model is compared with a range of state-of-the-art deep learning models to analyze their performance on multi-classification tasks. The models involved include BNS-CNN, DICCh-D, LSTM, and LSTM with attention mechanisms. These models were used to detect 23 IPv6 covert channels, and their performance is compared in detail using macro-average precision, macro-average recall, and macro-average F1 score on the training set.

[0140] Subsequently, the actual performance of these models was verified on the test dataset, and the detection performance of the models for various covert channels was comprehensively evaluated using metrics such as precision, recall, F1 score, false negative rate, and false positive rate.

[0141] 1) Comparison of macro-average precision of different models

[0142] Figure 6 This study reveals a comparison of the macro-average accuracy of the proposed model with other schemes in detecting 23 covert channels. Observing the data in the figure, it is clear that all models require a series of training iterations to significantly improve their detection performance.

[0143] Throughout the training process, the detection accuracy of all models in this case showed a rapid upward trend in the initial stage. From training epoch 1 to epoch 5, the accuracy of the models improved by approximately 0.2 to 0.3 percentage points. As the number of training epochs increased, the rate of performance improvement began to slow down. Between epoch 6 and epoch 10, the accuracy of each model improved by approximately 0.1 to 0.2 percentage points, while after epoch 10, the rate of improvement slowed further, with the accuracy of each model improving by approximately 0.01 to 0.05 percentage points.

[0144] In terms of model performance, DICCh-D and LSTM performed relatively weakly, with accuracy lower than other models at most time points. LSTM and BNS-CNN, with their attention mechanisms, demonstrated better performance, with their accuracy steadily increasing throughout training. This model showed the best performance after one training epoch, and its growth rate in subsequent training significantly surpassed that of other models, reaching an accuracy of 97.13% in the final epoch.

[0145] 2) Comparison of macro-average recall rates of different models

[0146] Figure 7 The study presents a comparison of the macroscopic average recall rate of the proposed model with other schemes across 23 covert channel detection tasks. (Observation) Figure 7 It can be observed that the recall rate of all models generally increases with the increase of training rounds, which reflects that the model performance improves as training progresses.

[0147] In terms of model performance, BNS-CNN showed a high recall rate in the first training round and steadily improved in the first five training rounds. Although the improvement rate slowed down in the later rounds, the recall rate in the last training round reached 96.59%.

[0148] The DICCh-D model initially showed a low recall rate, but it quickly closed the gap with other models in the first five training epochs and maintained a steady improvement. The LSTM model also saw a gradual increase in recall with each training epoch, but at a slower pace than other models, possibly due to its limitations in handling sequence data. The recall rate in the final training epoch was 95.58%. In contrast, the LSTM+Attention model generally had a higher recall rate than LSTM, and its trend was similar to LSTM, with a recall rate of 95.99% in the final training epoch.

[0149] Compared to other models, the model proposed in this study employs a multi-head attention mechanism, which can more effectively capture the relationships between positions in a sequence, significantly improving performance. Experimental results show that although the recall rate of the proposed model is lower than that of BNS-CNN and LSTM+Attention in the first five training rounds, the recall rate of the proposed model continues to climb with the increase of training rounds, achieving a recall rate of 97.23% in the last training round, demonstrating the best performance.

[0150] 3) Comparison of macro-average F1 scores of different models

[0151] Figure 8 The macro-average F1 scores of different models were compared across 23 covert channel detection tasks. Observations Figure 8 As can be seen, the macro average F1 score of all models shows an upward trend as the number of training rounds increases. This indicates that the models gradually learn more features and knowledge during the training process, thereby improving their classification performance.

[0152] BNS-CNN showed good performance in the early stages, but the subsequent improvement was relatively limited. This may be related to its relatively simple way of processing text sequences. As the number of training rounds increased, its performance improvement was limited, and the final macro average F1 score was 96.53%.

[0153] Compared to BNS-CNN, the DICCh-D model initially performs weaker, but its performance improves significantly over time and remains at a high level in subsequent training. This may be due to the stronger generalization ability of the DICCh-D model, which can better adapt to the features of the dataset.

[0154] The performance of the LSTM model is mediocre in the initial stage, but it gradually improves with the increase of training epochs and maintains a high level in subsequent training. This may be because the LSTM model can take into account contextual information when processing text sequences.

[0155] The LSTM+Attention model, by introducing an attention mechanism, can more effectively focus on key parts of a text sequence. Although its initial performance is average, it gradually surpasses the LSTM model with increasing training epochs.

[0156] The proposed model employs multiple attention heads, enabling it to capture rich information and features within the IPv6 header and IPv6 extended headers. This enhances the model's performance and recognition capabilities, effectively identifying logical relationships between IPv6 fields, distinguishing between embedded covert traffic and normal traffic, and better handling the detection and localization of multi-field covert channels. As the number of training epochs increases, the model's performance gradually improves and maintains its highest level in subsequent training, ultimately achieving a macro-average F1 score of 97.18%.

[0157] After comparing the macro-average precision, macro-average recall, and macro-average F1 score of each model, the results show that our proposed model performs best in all three metrics. These results further confirm that the proposed model excels in multi-class classification tasks, outperforming other deep learning approaches. In multi-class classification tasks, accurate and reliable predictions are crucial for correctly identifying and classifying data, and these results demonstrate the great potential of the proposed model in the field of IPv6 covert channel detection.

[0158] 4) Comparison of precision, recall, and F1 score of different models on various covert channels.

[0159] Table 6 shows the recall rates of five different models under different types of covert channels. Figure 9 The accuracy of the five models is shown in normal traffic and 23 covert channel classification tasks. Figure 10 The F1 scores of several models, including this model, were compared when identifying 23 covert channels.

[0160] Table 6. Classification recall rates of different models under different types of covert channels.

[0161]

[0162] Compared to covert channels that only embed secret information in the IPv6 header, the study found that all models exhibited significantly reduced detection performance when identifying covert channels with IPv6 extended headers. This may indicate limitations in these models' ability to learn the characteristics of IPv6 extended headers. The reduced detection performance may stem from the fact that the embedded secret information alters the data characteristics, making it difficult for the models to accurately identify the presence of covert channels.

[0163] Furthermore, the study observed that all models exhibited poor performance when handling multi-field covert channels. Multi-field covert channels involve more complex data structures and features, which may require models with more advanced analytical capabilities to accurately detect hidden information. To address this challenge, the proposed model employs a multi-head attention mechanism to simultaneously focus on information at different positions in the sequence and capture the relationships between them, thereby more effectively capturing sequence context information and achieving effective detection of multi-field covert channels.

[0164] 5) Comparison of false negative rates of different models on various covert channels

[0165] Figure 11This paper presents the false negative rates (FNRs) for five different schemes targeting each type of covert channel. In the field of covert channel detection, the FNR refers to the proportion of covert channels that the model fails to detect correctly. The FNRs for each covert channel are then aggregated to obtain the overall baseline FNR for that specific type of covert channel. Next, the FNR for each scheme is calculated, representing the proportion of false negatives caused by each scheme relative to the overall baseline FNR. The FNR for each scheme is obtained by dividing the FNR for each scheme by the overall baseline FNR and then multiplying by 100%. This analytical method aims to evaluate the performance of different schemes in detecting covert channels and provide a relative benchmark for a more comprehensive understanding of the false negative rate of each scheme.

[0166] Figure 11 The results show that the proposed model achieves the lowest false negative rate for most covert channel types. Specifically, for 90% of covert channel types, the proposed model can effectively detect the existence of covert channels, indicating that the model effectively utilizes the relevant information between IPv6 packet fields to accurately identify complex and varied multi-field covert channels. Notably, compared with other schemes, the proposed model has a lower false negative rate for detecting single-field covert channels. This may be because multi-field covert channels involve more complex data interactions and covert techniques, making it difficult for other schemes to correctly identify and detect these channels. This finding further confirms the superior performance of the proposed model in detecting multi-field covert channels.

[0167] 6) Comparison of false alarm rates of different models on various covert channels

[0168] Figure 12 The false alarm rates of the proposed model and other schemes in detecting 23 types of covert channels are presented. In covert channel detection, the false alarm rate represents the proportion of normal data that the model incorrectly identifies as a covert channel. Observations show that the false alarm rates of these five schemes are relatively low when detecting covert channels where covert data is embedded only in the IPv6 header. However, once the IPv6 extended header is introduced, the false alarm rates of all schemes increase significantly, indicating that the complexity of the IPv6 extended header has a significant impact on the false alarm rate.

[0169] This impact is attributed to the additional fields and options introduced by the IPv6 extended header, which increase the complexity of covert channel detection. These supplementary fields and options increase the number of variables and potentially hidden information that detection algorithms must consider, thereby increasing the risk of false alarms. Furthermore, the design flexibility of the IPv6 extended header allows for customization of its structure and content to suit specific applications and requirements. This introduces variability and uncertainty into the header, making accurate modeling and identification of covert channels even more complex.

[0170] Specifically, the average false alarm rate (MFR) of BNS-CNN is 7.78%, that of DICCH-D is 7.5%, that of LSTM is 8.43%, and that of LSTM+Attention is 7.18%. Notably, the proposed model has the lowest average MFR of only 6.51% among all schemes, demonstrating superior performance. Experimental results show that the proposed model exhibits significant performance in various covert channels, with low false alarm and false negative rates, providing an effective solution for mitigating covert channel threats.

[0171] 3. Performance comparison of the model proposed in this case with other relevant studies

[0172] To more comprehensively evaluate the performance of the proposed model, it is compared with other state-of-the-art solutions for IPv6 covert channel detection.

[0173] 1) Comparison of the proposed model with deep learning solutions in this case

[0174] Table 7 shows a performance comparison of the proposed model with other deep learning solutions in different aspects, including the functions implemented, the types of detections, the sample prediction time, the accuracy, and whether multi-field detection can be achieved.

[0175] Table 7 compares the proposed model with deep learning solutions.

[0176]

[0177] In terms of functionality, BNS-CNN and DICCh-D schemes have detection capabilities, while DNN, One-vs-Rest, and the proposed model can perform both detection and localization simultaneously. This indicates that the proposed model has broader application prospects in situations requiring simultaneous identification and localization of covert channels.

[0178] Regarding the detection of IPv6 covert channel types, BNS-CNN and DICCh-D schemes can detect two different covert channels, DNN and One-vs-Rest can detect three, while the model proposed in this case can detect 23 different covert channels, indicating that the detection range of the proposed model is greater than that of existing schemes.

[0179] In terms of sample prediction time, BNS-CNN has the longest prediction time at 0.1921 seconds per sample, while DICCh-D, DNN, and One-vs-Rest have relatively shorter prediction times of 0.0815 seconds and 0.0719 seconds, respectively. Because this model employs a self-attention mechanism, it has fewer parameters and lower computational complexity, allowing it to process more data with the same computational resources. The model proposed in this case has the shortest prediction time at 0.0624 seconds.

[0180] In terms of detection accuracy, BNS-CNN achieves 95.67%, DICCh-D 95.84%, DNN and One-vs-Rest 98.06%, while the proposed model achieves 97.13%. This indicates that DNN and One-vs-Rest have higher accuracy but are slower in sample prediction time. The proposed model loses less than 1% in detection accuracy but improves sample prediction time by 15%.

[0181] Compared with BNS-CNN and DICCh-D schemes, the model proposed in this case can not only detect more types of covert channels, but also locate the storage area of ​​secret data, thus providing more effective assistance for subsequent decoding of hidden information in network packets.

[0182] Compared with DNN and One-vs-Rest solutions, the model proposed in this case can directly locate the embedded secret field without secondary training, thereby reducing the sample prediction time by 15% and enabling faster detection and location of the storage area of ​​secret data.

[0183] Furthermore, the model proposed in this case employs a multi-head attention mechanism, which can effectively identify the logical relationships between IPv6 header fields. This allows for the simultaneous detection and location of secret data storage areas in multiple fields of IPv6 packets, further enhancing detection capabilities.

[0184] 2) Comparison of the proposed model with traditional machine learning solutions

[0185] Table 8 shows a performance comparison between the proposed model and traditional machine learning solutions in terms of training time, precision, and recall.

[0186] Table 8 compares the proposed model with traditional machine learning solutions.

[0187]

[0188] As shown in Table 8, compared to traditional machine learning approaches, the proposed model requires a longer training time. This is mainly because traditional machine learning approaches are relatively simple, require fewer parameters to be estimated, and their algorithm complexity is usually linear or near-linear, thus resulting in a relatively shorter training time. Although the proposed model has the longest training time, its detection precision reaches 97.13% and its recall reaches 96.96%, both of which are superior to traditional machine learning approaches.

[0189] 3) Comparison of the proposed model with non-machine learning solutions in this case

[0190] Throughout the evaluation process, we should not only focus on comparing complex models, but also consider comparing simpler solutions. These solutions are easier to interpret, have lower computational requirements, and have proven to be effective and scalable in practice.

[0191] Table 9 presents a detailed performance comparison between the proposed model and the Bccstego solution, covering several core indicators such as detection categories, detection accuracy, and multi-field detection capabilities. Analysis of the data in this table shows that the proposed model achieves a detection accuracy of 97.13%, significantly surpassing the Bccstego solution. Furthermore, the proposed model can detect up to 23 different types of IPv6 covert channels and also possesses multi-field detection capabilities.

[0192] Table 9 Comparison of the proposed model and non-machine learning solutions in this case.

[0193]

[0194] The experimental results above demonstrate that the proposed model achieves an accuracy of 97.13% in detecting and locating hidden data in IPv6 headers and IPv6 extension headers. Furthermore, the model predicts and locates test samples in an average time of 0.0624 seconds and can detect 23 types of IPv6 covert channels, making it suitable for security protection in large-scale distributed network environments and showing promising application prospects.

[0195] Unless otherwise specifically stated, the relative steps, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0196] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0197] The units and method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations are not considered to be beyond the scope of this invention.

[0198] Those skilled in the art will understand that all or part of the steps in the above methods can be implemented by a program instructing related hardware, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk. Optionally, all or part of the steps in the above embodiments can also be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiments can be implemented in hardware or as a software functional module. This invention is not limited to any particular combination of hardware and software.

[0199] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for detecting multi-field covert channels in IPv6 based on a self-attention mechanism, characterized in that, Include: Acquire target IPv6 network packet data, extract packet field features and form a feature matrix, wherein the packet field features include header field features and extended header field features; The feature matrix is ​​input into the covert channel detection model, which is then used to detect packet field features and determine whether a covert channel exists in the target IPv6 network packet data. Among them, the covert channel detection model performs weighted aggregation of the extracted message field features based on the self-attention mechanism and performs weighted fusion of the message field features according to the correlation between message fields, so as to highlight the key message field features in the detection and identification feature vector; The covert channel detection model comprises: an input layer for receiving message field features; a self-attention mechanism layer for weighted aggregation and weighted fusion of message field features based on a self-attention mechanism; a global average pooling layer for performing global average pooling on the weighted fused feature vector; a global connection layer for mapping the feature vector after global average pooling to a feature space of a specified dimension; a random deactivation layer for randomly adjusting feature values ​​at a preset ratio; and an output layer for mapping the feature vector to a fixed dimension and using an activation function to output a probability representing the class. The self-attention mechanism includes: dividing the feature matrix into different feature subspaces, with each feature subspace corresponding to an attention head, and each attention head having its own weight matrix and bias term; each attention head performing a linear transformation on the current attention head input using the query weight matrix, key weight matrix, and value weight matrix, obtaining the attention score using the transformed query vector and key vector, and obtaining the relevant attention weights using scaling dot product operation; weighted summing of the attention weights with the value vectors of each feature subspace to obtain the output vector of each attention head; and concatenating the output vectors of all attention heads to obtain the final multi-head attention representation.

2. The IPv6 multi-field covert channel detection method based on self-attention mechanism according to claim 1, characterized in that, Extract message field features, including: Filter the version field in the message data and extract the other fields from the message data; The extracted fields are arranged in the order of the data packets to form a two-dimensional feature matrix consisting of the number of samples and the number of sample features; The two-dimensional feature matrix is ​​normalized, and the discrete attribute values ​​are mapped to a specified dimension feature space through matrix transformation to form a three-dimensional feature matrix composed of the number of samples, the number of time steps, and the number of features.

3. The IPv6 multi-field covert channel detection method based on self-attention mechanism according to claim 1, characterized in that, The process of obtaining relevant attention weights using scaled dot product operations can be represented as follows: Where Q is the query vector, K is the key vector, and d k For vector dimensions.

4. The IPv6 multi-field covert channel detection method based on self-attention mechanism according to claim 3, characterized in that, The process of weighted summation of attention weights with the value vectors of each feature subspace can be represented as: Where V is a value vector.

5. The IPv6 multi-field covert channel detection method based on self-attention mechanism according to claim 1, characterized in that, The training process for the covert channel detection model includes: Normal data packets are collected from the transmission link between the authorized working group and the upstream ISP. Covert channel embedding tools are used to inject covert data into the IPv6 protocol extension header and header fields of a specific proportion of data packets to form abnormal data packets. A sample dataset is constructed based on the abnormal data packets and normal data packets. The covert channel detection model is trained using a sample dataset and based on the cross loss function to obtain the trained covert channel detection model.

6. A multi-field covert channel detection system for IPv6 based on a self-attention mechanism, characterized in that, It includes: a data acquisition module and an anomaly detection module, wherein, The data acquisition module is used to acquire target IPv6 network packet data, extract packet field features and form a feature matrix. The packet field features include header field features and extended header field features. The anomaly detection module is used to input the feature matrix into the pre-trained covert channel detection model, and use the covert channel detection model to detect the features of the packet fields and determine whether there is a covert channel in the target IPv6 network packet data. Among them, the covert channel detection model performs weighted aggregation of the extracted message field features based on the self-attention mechanism and performs weighted fusion of the message field features according to the correlation between message fields, so as to highlight the key message field features in the detection and identification feature vector; The covert channel detection model comprises: an input layer for receiving message field features; a self-attention mechanism layer for weighted aggregation and weighted fusion of message field features based on a self-attention mechanism; a global average pooling layer for performing global average pooling on the weighted fused feature vector; a global connection layer for mapping the feature vector after global average pooling to a feature space of a specified dimension; a random deactivation layer for randomly adjusting feature values ​​at a preset ratio; and an output layer for mapping the feature vector to a fixed dimension and using an activation function to output a probability representing the class. The self-attention mechanism includes: dividing the feature matrix into different feature subspaces, with each feature subspace corresponding to an attention head, and each attention head having its own weight matrix and bias term; each attention head performing a linear transformation on the current attention head input using the query weight matrix, key weight matrix, and value weight matrix, obtaining the attention score using the transformed query vector and key vector, and obtaining the relevant attention weights using scaling dot product operation; weighted summing of the attention weights with the value vectors of each feature subspace to obtain the output vector of each attention head; and concatenating the output vectors of all attention heads to obtain the final multi-head attention representation.

7. An electronic device, characterized in that, include: At least one processor, and a memory coupled to said at least one processor; The memory stores a computer program that can be executed by the at least one processor to implement the method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed, enables the implementation of the method as described in any one of claims 1 to 5.

Images