Industrial internet multi-instance time sequence network traffic data processing method

Abstract

The application discloses a kind of time series network traffic data processing methods based on multi-instance learning, for network security detection.The method of the application is first preprocessed and feature extraction to network traffic data, is organized as time series feature data;Again, data is divided into sub-bags and bags with set time window and bag length, realize fine granularity and coarse granularity division, bag contains multiple sub-bags;Using Simple-MI algorithm, the feature of all network stream instances in each sub-bag is mapped to fixed dimension vector, and bag feature is obtained;GAF algorithm is used to construct multi-channel graph for bag feature;For target task, construct deep learning model, convert multi-channel graph as model input, and carry out target task detection.The application converts network traffic data into image format, and then uses deep learning technology for analysis, which can effectively solve the problem of inaccurate data labels and class imbalance, improve the accuracy and efficiency of network traffic analysis, and the adaptability to dynamic network environment.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and specifically relates to an industrial internet multi-instance time sequence network flow data processing method. BACKGROUND

[0002] In the industrial internet scenario, the challenges in the field of network security are more prominent. With the increasing interconnection and intelligentization of industrial equipment, the risk of network attacks is also increasing. Traditional network flow analysis methods are not up to the task in this environment, and more efficient and accurate solutions are needed.

[0003] In the industrial internet, the scale of data is huge and diversified, and network flow analysis must be able to handle these data. The fixed rules and features of traditional methods are no longer applicable, as the threats faced by industrial networks are constantly evolving. For example, traditional intrusion detection systems may not be able to identify new attacks against industrial control systems in a timely manner. At the same time, flow analysis tools respond slowly when processing large-scale data, which may result in the omission of critical information and reduce data processing capabilities.

[0004] The diversification and continuous evolution of security threats in the industrial internet make it more difficult to conduct fine-grained network flow analysis. The flow generated by industrial equipment can be highly complex, and accurately labeling each data packet or event becomes crucial. However, traditional methods often fail to meet this demand, resulting in an impact on the accuracy of analysis results. At the same time, there is a quantitative difference between normal flow and abnormal flow in industrial networks, which also poses a challenge to traditional anomaly detection methods.

[0005] The invention patent application with publication number CN117313035A disclosed an industrial information-physical system cross-layer anomaly detection method based on information-physical feature fusion on December 29, 2023. First, the network traffic is divided by a communication event triggered method, dividing the overall traffic into multiple packet sequences, aligning the physical space data and network space data in the time scale. Then, each packet sequence is deeply analyzed, and according to the communication protocol type, it is divided into special-purpose packets and general-purpose packets. Information layer and physical layer features are extracted for each type of packet. Subsequently, the information layer features in the special-purpose packet subset, the general-purpose unicast packet subset, and the general-purpose broadcast packet subset are processed respectively using feature splicing and stacking. The results are fused with the physical layer features and sequence coarse-grained features to obtain the overall feature vector of the sequence. Finally, the KSVD algorithm considering label constraints is used to train the dictionary and classifier model based on the feature vector to realize anomaly detection. In this technical solution, the sequence coarse-grained features include a small number of indicators such as packet quantity, communication duration, and bit rate. The amount of information represented by the sequence coarse-grained features is relatively low, making it difficult to fully reflect the change pattern of network traffic. The sequence coarse-grained features may have difficulty distinguishing between different types of anomalies, affecting the learning and judgment of subsequent classifiers. As the network environment becomes more complex, the sequence coarse-grained features need to be constantly supplemented and improved, otherwise it will be difficult to adapt to changes in the operating environment.

[0006] Fine-grained network traffic analysis focuses on a single network flow, which is a series of data packets with the same protocol type, source IP address, destination IP address, source port number, and destination port number within a specific time period. Using traffic feature extraction tools such as CICflowmeter, the packet sequence in the pcap file can be converted into a CSV format dataset, with each row representing the features of an independent network flow.

[0007] In the field of network security, the current network traffic analysis mainly has the following problems:

[0008] (1) Insufficient large-scale network data processing capability: Traditional methods often struggle to handle large amounts of network traffic data, and cannot meet the demand for efficient processing and real-time response.

[0009] (2) Inaccurate data labeling: In fine-grained network traffic analysis, existing methods often struggle to accurately label each data packet, affecting the accuracy of the analysis results.

[0010] (3) Class imbalance problem: Traditional methods are not effective in handling the difference in the number of normal and abnormal traffic, making it difficult to effectively identify network anomalies.

[0011] (4) Poor adaptability to dynamic network environment: The rapid changes in network environment make it difficult for traditional methods to adapt to new applications and services, affecting the analysis effect.

[0012] (5) Limitations of fine-grained data processing: Although detailed information is provided, fine-grained methods are inefficient in large-scale data processing and difficult to cope with rapidly changing network threats.

[0013] In this context, a new method is needed to solve these problems and improve the effect of network security event prediction. SUMMARY

[0014] To solve the above problems, the present application proposes a time series network traffic data processing method based on multi-instance learning, which innovatively represents network traffic data as coarse-grained multi-instance time series network traffic data, and then converts network traffic data into image format, analyzes data using deep learning technology, and performs network traffic data analysis and security event prediction, improving the accuracy and efficiency of network traffic analysis and effectively addressing the challenges faced by the network security field today.

[0015] The time series network traffic data processing method based on multi-instance learning of the present application comprises the following steps:

[0016] Step 1: Preprocess network traffic data, extract network traffic data features, and organize them into time series feature data;

[0017] The preprocessing includes: filtering out data related to security event detection from network traffic data, cleaning noise and redundant information, then extracting features from the cleaned data, standardizing the feature data, and reorganizing the standardized features into time series data according to the timestamp; the extracted features include network stream collection time, source IP address, target IP address, source port, target port, protocol type, and network traffic statistics; let the extracted feature dimension be d;

[0018] Step 2: Instance and image encoding of time series feature data; the present application uses a method combining time window division and advanced algorithm conversion to effectively represent network streams, including the following:

[0019] (2.1) First, according to the set bag time length, the network traffic data is coarsely divided, then each bag is finely divided according to the set time window, set to k sub-bags, each sub-bag contains all network stream instances within the corresponding time window, and the proportion of malicious traffic in the bag is counted, the bag is assigned a security event label; extract d features of each network stream instance;

[0020] (2.2) Then, for each sub-bag, the features of all network flow instances within each sub-bag are mapped into a fixed-dimension vector using the Simple-MI algorithm, and a function set for calculating statistics is set The statistics of all network flow instances of the sub-bag under each feature dimension are calculated using the Simple-MI algorithm, and the sub-bag features of the corresponding time window are aggregated, and the sub-bag features are vector, d is the feature dimension, is the number of functions in the set The bag features are obtained from the sub-bag features, and the bag features are vector, k is the number of sub-bags contained in the bag, is the dimension of the bag features;

[0021] (2.3) For each bag feature, a multi-channel graph is constructed using the GAF algorithm, including: converting each feature dimension of the bag into a channel in the multi-channel graph, using the GAF algorithm to calculate the Gramian matrix for the feature sequence under the same dimension, and converting it into an image, and converting the bag features into an image group with

[0022] Step 3: For the target task, a deep learning model is constructed, real-time collected network traffic data is preprocessed and feature extracted according to step 1, converted into a multi-channel image sequence according to step 2, and the multi-channel image is input into the deep learning model for target task detection.

[0023] Compared with the prior art, the advantages and positive effects of the present application are:

[0024] (1) The method of the present application innovatively proposes a coarse-grained representation method for network traffic data with time sequence characteristics, which converts multi-instance time sequence data into a fixed-dimension multi-channel graph, not only capturing the global trend and pattern of network traffic, but also laying the foundation for using advanced image recognition technology, and improving the detection and prediction ability of security events. The method of the present application provides a new perspective for the detection of network traffic data security events, and shows a new development direction of network security technology, which not only improves the ability to handle large-scale data, but also enhances the accuracy of fine-grained network traffic analysis. Through the conversion of network traffic time sequence data to a multi-channel graph, the problem of inaccurate data labels and class imbalance can be effectively solved, and the adaptability to dynamic network environment is improved.

[0025] (2) The method of the present application is suitable for large data network traffic scenarios. When processing large-scale network traffic data, the method of the present application can effectively process and analyze complex network traffic in a large data environment, especially for coarse-grained detection and prediction of overall trends, which is particularly important for the current rapidly developing network environment.

[0026] ​(3) The method of the present application can fully utilize the strong potential of image recognition technology, and by converting network flow data into image form, complex network flow analysis can be performed with the aid of mature image processing tools and algorithms, which greatly expands the analysis toolbox in the field of network security and provides an intuitive and powerful tool for network security analysis.

[0027] (4) The method of the present application uses an image processing combined method to analyze network flow, which has a significant improvement in detection efficiency and accuracy compared to traditional text or numerical data analysis methods, making the detection of security events faster and more accurate, and enabling rapid response to network security events.

[0028] (5) The technical means provided in the method of the present application for coarse-grained characterization of time-series network flow data is also applicable to other scenarios that require coarse-grained analysis, such as flow monitoring and behavior analysis, and has the potential for widespread application in the field of network security and can play an important role in other data analysis fields. The method of the present application provides an innovative perspective and method for network flow big data analysis through coarse-grained multi-instance time-series network flow characterization and multi-channel graph application, significantly improving the efficiency and accuracy of network security event detection, and also providing the possibility for related technologies to be applied in other fields, with broad application prospects. BRIEF DESCRIPTION OF DRAWINGS

[0029] Figure 1 is the overall flowchart of the network flow security event early warning method of the present application;

[0030] Figure 2 is the flowchart of the multi-instance data graph characterization method of the present application. DETAILED DESCRIPTION

[0031] The present application will be further described in detail below with reference to the accompanying drawings and examples.

[0032] Based on the current network traffic analysis problems, coarse-grained network flow data representation is particularly important. By aggregating multiple instances into a single label, the problem of inaccurate data labeling can be effectively addressed. This is particularly critical in the field of network security, as accurately labeling each packet is often impractical. Combining multiple packets into a large instance (or "packet") not only improves the efficiency and accuracy of the labeling process, but also helps to address the class imbalance problem. In network traffic data, the number of normal traffic and abnormal traffic is vastly different, and the coarse-grained method can more effectively identify and handle this imbalance, thereby improving the accuracy of anomaly detection. Compared with the fine-grained method, the coarse-grained representation makes it feasible to handle large-scale data while maintaining the effectiveness of the analysis. This method can better adapt to new network environments and security needs to provide more comprehensive and flexible network security solutions.

[0033] Based on this, the present application provides an innovative network traffic data processing method, which combines multi-instance learning (MIL) and deep learning technology to convert network traffic data into image format for processing. Visual analysis techniques, especially deep learning technology, can be used for further network traffic data analysis and security event prediction.

[0034] The present application is a time series network traffic data processing method based on multi-instance learning. First, from the perspective of multi-instance learning, network traffic data is grouped into multiple packets, each packet containing multiple network flow instances. The key here is to understand the definition of each packet and how it represents the collective characteristics of network traffic.

[0035] Data packets are the cornerstone of network communication, responsible for breaking down complex information into manageable units for transmission over the network. This process involves layer-by-layer encapsulation and decapsulation of data within the multi-layer architecture of the network. Specifically, a piece of information initially exists in the form of application layer data, which is then encapsulated into transport layer segments, further encapsulated into network layer packets, and then into data link layer frames, and finally transmitted as a bitstream at the physical layer. In network analysis, these data packets are often recorded in the PCAP (Packet Capture) format, which is an industry standard for network packet capture technology and can be captured and analyzed using tools such as Wireshark or TcpDump. Although a single data packet may only contain a small portion of information, it is not sufficient to reflect the entire communication process, but it is the basic building block of network flow.

[0036] A network flow is a sequence of packets transmitted between a fixed source IP address and destination IP address, source port and destination port over the same protocol within a certain time period. The uniqueness of a flow is usually identified by the five-tuple: source IP address, destination IP address, source port number, destination port number and protocol type. According to the transmission direction of the packets, network flows can be divided into unidirectional flows and bidirectional flows. Unidirectional flow means that all packets flow from one endpoint to another, while bidirectional flow captures the complete communication session between two endpoints and can exchange the roles of source and target in the flow. Considering that packets are only a small part of the entire communication, network flows provide a more continuous and complete view, so network flows are considered as a higher level of analysis unit in network traffic analysis.

[0037] For example, a Pcap packet is captured by TcpDump for one hour of communication information, and by Cicflowmeter for Pcap analysis, network flow information can be extracted and parsed into second-by-second statistical feature content, as shown in Table 1. The network flow feature sequence of each second can be regarded as an instance, which is the smallest unit for network traffic analysis. This structured data can be used as input for the model and directly applied to machine learning and other models for training.

[0038] Table 1 Description of main features of network flow

[0039] Feature Name Description datetime Flow capture time srcip Source IP address sport Source port number dstip Destination IP address dsport Destination port number proto Protocol type state State of connection dur Duration of flow sbytes Data bytes from source to destination dbytes Data bytes from destination to source sttl TTL value of IP packets from source to destination dttl TTL value of IP packets from destination to source sloss Number of packet losses from source to destination dloss Number of packet losses from destination to source service Service type, e.g. http, ftp, etc. Sload Data load from source to destination Dload Data load from destination to source attack_cat Attack type Label Whether it is an attack, True represents an attack, False represents normal

[0040] In traditional network analysis methods, the analysis of each network flow instance is usually independent, while in the multi-instance learning of the present application, a packet is analyzed as a whole, so as to better understand and identify the complex patterns in network traffic. Next, considering the continuity of network flow within each packet in the time domain, the present application adopts a special method to process this time series data. This method involves dividing the network flow within each packet into different time periods, each of which represents a specific state or feature of the network flow. Then, the SimpleMI algorithm is used to map the network flow in each time period, which allows the originally dynamic network flow to be converted into a new form with fixed dimensions.

[0041] Secondly, the present application adopts the Gram Matrix Angle Frequency Analysis (GAF) algorithm to convert time series data into images. In the present application, each feature sequence is converted into an image representation. This means that the network flow data originally in the form of numerical sequences is converted into images that can be analyzed visually.

[0042] Then, the present application aggregates the multiple channel graphs obtained by converting all feature sequences. This aggregation not only preserves the unique information of each feature sequence, but also forms a multi-channel image containing rich network traffic features by combining these information. This multi-channel image represents a comprehensive visual representation of the original network traffic, providing rich input data for deep learning models.

[0043] In the method of the present application, the deep learning technology used, especially the convolutional neural network (CNN), plays a crucial role in analyzing these images. CNN can identify patterns and features in images, which makes it particularly suitable for processing converted network traffic images. Through training, CNN can learn how to identify signs of network security events such as intrusions, abnormal traffic patterns, etc. from these images.

[0044] In summary, the present application provides a new and efficient method for network traffic data analysis by combining multi-instance learning with image conversion and deep learning technology, which provides an effective solution for processing large-scale network data in network security event detection and prediction.

[0045] The following describes the multi-instance learning-based time series network traffic data processing method of the present application embodiment in an application scenario task of network flow security event detection. The main process includes: first, collect raw network traffic data and preprocess these data to parse them into structured form; next, extract key information such as traffic size, duration and protocol type from structured data through feature extraction step; then, these data are divided into different event windows, and the multi-instance data in these windows are converted into image format based on time or specific traffic patterns. Using this representation method, image processing techniques can be used for in-depth analysis. Finally, a suitable machine learning or deep learning model (such as CNN) is used for model training, and the prediction result such as identifying different types of network security events is output. The whole process not only improves the accuracy of event detection, but also enhances the adaptability of the model to complex network environments. Figure 1 As shown in the figure, the present application embodiment includes the following 6 steps.

[0046] Step 1, the present application embodiment collects raw network traffic data through pcap tool.

[0047] The UNSW-NB15 dataset was developed by the Cyber Security Research Group at the University of New South Wales in Australia. It aims to provide a comprehensive and modern dataset of network traffic to support research in cybersecurity, particularly in the field of intrusion detection systems. This dataset contains a wealth of network interaction data, covering various types of normal and malicious network activities, providing a realistic and challenging environment for analyzing cybersecurity incidents. One of the key features of the UNSW-NB15 dataset is its diversity and timeliness. It includes not only common types of network attacks such as DoS attacks, worms, backdoor attacks, etc., but also some newer attack types, ensuring that the dataset is up-to-date with current cybersecurity threats. In addition, each network flow in the dataset is labeled with detailed labels, including the type of flow, the type of attack (if any), and other information, which provides important ground truth for machine learning-based models.

[0048] In the embodiments of the present application, the UNSW-NB15 dataset is used as the basis for multi-instance time series network traffic data representation and processing research, which can demonstrate the effectiveness and applicability of the method in processing real-world data. Through in-depth analysis of this dataset and model training, the effectiveness of the method proposed in the present application can be better verified, especially in identifying and classifying different types of network security events. Therefore, the use of the UNSW-NB15 dataset not only provides a comprehensive evaluation platform, but also helps to demonstrate the potential and advantages of the new method in practical applications.

[0049] Step 2, pre-process the collected network traffic data and store it in a structured form.

[0050] Data preprocessing is a crucial step in network traffic data analysis, especially when dealing with raw pcap files. This process involves converting raw network traffic data into a more structured and easily analyzable format. First, specialized network data collection and analysis tools such as Wireshark or tcpdump are used to read the raw data in the pcap file. These tools can capture network packets and store information in binary form, including source and destination addresses, transport layer protocols, etc.

[0051] Secondly, the network traffic data is preprocessed, which mainly analyzes the collected raw network traffic data and extracts the key attributes of network traffic. The preprocessing process mainly involves screening data related to security event detection, data cleaning, etc. The network traffic data related to security event detection is screened, i.e. advanced data analysis techniques are used to identify features and patterns related to security events, such as packet size, request frequency, etc., while removing data unrelated to security events. The key attributes extracted by the embodiments of the present application include but are not limited to packet size, duration, source IP address, destination IP address, port number, protocol type (such as TCP, UDP, etc.), and possible flag bits (such as SYN, ACK, etc.). These attributes are crucial for understanding the behavior patterns of network traffic. Data cleaning mainly eliminates noise and redundant information in the data set, such as removing incomplete or damaged data packets, removing duplicate data, removing format error data, etc., to ensure the quality and accuracy of subsequent analysis data.

[0052] Step 3: Feature extraction of structured network traffic data.

[0053] Feature extraction is a key step in processing structured network traffic data, and its purpose is to extract information from raw network traffic data that is crucial for understanding network behavior and detecting security events. In this process, the present application extracts a series of key features from structured network traffic data, including not only basic network attributes such as traffic size, duration and protocol type, but also more complex statistical information such as average packet size, proportion of different types of packets in traffic, and trends in traffic over time. In addition, feature extraction may involve more advanced analysis, such as behavior-based features, which may include session establishment and termination patterns, traffic burst behavior, and comparison of normal and abnormal traffic patterns. These advanced features can help deep learning models more accurately identify potential security threats in the network, such as DDoS attacks, port scans or other malicious behavior.

[0054] During the entire feature extraction process, not only the accuracy and relevance of the data, but also the efficiency of data processing and analysis should be considered. Selecting the appropriate feature set can significantly improve the efficiency of model training and the performance of the final detection system. Therefore, feature extraction is not only the basis for improving data analysis quality, but also a key step in building an efficient and accurate network security event detection system. In the embodiments of the present application, the key features extracted from each network flow data processed in step 3 include at least network flow collection time, source IP address, destination IP address, source port, destination port, protocol type, and network traffic statistical information. The features extracted for each network flow data can be represented by a d-dimensional vector, where d represents the number of features.

[0055] The application also standardizes the extracted feature data. In the embodiment of the application, the standardized data is mainly the standardization of IP addresses and port numbers. For example, the IP address may need to be converted into a unified representation, and the port number may need to be mapped to a standard service type. The features after standardization are timestamped to realize the reorganization of time series data. The standardized features are reorganized into time series data according to their timestamps, ensuring that each data instance can reflect its continuity and dynamic change in time. For example, scattered data packets are reorganized into complete flows according to sessions or connections, or time point snapshots are combined into continuous time series, and the data is time-synchronized and serialized.

[0056] The cleaning improves the quality and accuracy of the data, the standardization eliminates the differences between data from different sources or collected at different times to ensure the consistency and comparability of the extracted feature data in the feature space, and the reorganization of time series data helps to capture and understand the behavior patterns of network traffic, especially complex security events such as horizontal movement and data penetration, laying a solid foundation for subsequent pattern recognition and training of machine learning models. In general, the data preprocessing and feature extraction stage is an important step to convert the original network traffic data into a clear, ordered, and useful data set for in-depth analysis.

[0057] Step 4: Dividing the collected network traffic data into event windows.

[0058] The embodiment of the application collects network traffic data at a frequency of 1 second, and the obtained network stream data is in units of seconds. The embodiment of the application divides the UNSW-NB15 data set into event windows to adapt to the needs of multi-instance learning. In the UNSW-NB15 data set, each network stream is labeled with a minimum time unit of one second. The embodiment of the application defines the data set as a multi-instance data set Z = {(B1, y1), (B2, y2), …, (B N , y N )}, where each B i represents a network event within one minute, and each B i contains 60 network stream instances S j , S j represents the network traffic data at the jth second within the minute; y i represents the label of the network event B i . The embodiment of the application uses "bag" to represent the set of network stream instances contained in each minute, and each bag represents the set of network stream instances corresponding to each minute. A d-dimensional feature vector is extracted for each network stream instance.

[0059] The embodiment of the present application performs second-by-second statistical analysis on network events in each bag. If malicious traffic exceeds 50% in a certain second, the second is marked as 1; otherwise, it is marked as 0. The proportion of seconds marked as 1 in each bag B i is calculated as r j , and B i is assigned a label accordingly, as follows:

[0060] a) If r j ≤ 0.45, mark B i as a low-risk security event, represented by label E1, i.e., y i = E1.

[0061] b) If 0.45 < r j < 0.75, mark B i as a medium-risk security event, represented by label E2.

[0062] c) If r j ≥ 0.75, mark B i as a high-risk security event, represented by label E3.

[0063] This labeling strategy takes into account the frequency and intensity of malicious network flows at different times, aiming to more accurately predict different levels of continuous security events, reflecting the behavior patterns and strategies of attackers, while considering the characteristics of various types of attacks such as DDoS attacks and data theft, thus helping to more comprehensively understand and respond to network security threats.

[0064] In this step, unlike the fine-grained instances in the prior art where each network flow is given a label, the present method first divides the network traffic data with time sequence characteristics into instances, each instance corresponding to network traffic within a specific time window, referred to as a bag, and corresponding to the embodiment of the present application, each bag is the network traffic within 1 second, which can be 1 or multiple instances. The present method uses a label reflecting the security event of the communication behavior in the time period for the coarse-grained instance, i.e., the bag containing several network flow instances. Such division method can capture the network behavior within each time window, reflecting the dynamic changes and overall trends of network traffic. It should be noted that the size of the time window selected for the division of coarse-grained instances will directly affect the accuracy of subsequent model recognition, so the size of the time window needs to be optimized. In the embodiment of the present application, a bag is set as a 1-minute time window, which contains all the network flow instances collected within 1 minute. Each network flow instance is 1 second long, which has a higher recognition accuracy in the subsequent model.

[0065] Step 5, multi-instance data graph representation.

[0066] The whole process of multi-instance data representation is divided into two stages, as shown in Figure 2 , each stage adopts special data conversion techniques. The first stage is "time-slice Simple-MI conversion", which applies the Simple-MI algorithm to process network traffic of different time slices in a bag to generate time-hierarchical packets. The second stage is "bag-to-image conversion using GAF", which converts these structured data packets into multi-channel images using the Gramian Angular Field (GAF) method. This step-by-step process is crucial for converting time series network data into image-based formats, facilitating the application of complex image classification techniques to predict network security events. Through this method, time series data is transformed into intuitive image form, preserving important temporal relationships in the original sequence.

[0067] (1) The process of time-sliced Simple-MI conversion is as follows:

[0068] Input: data set containing multi-instance network flow. In the previous step, the network traffic in each bag is time-sliced, and each slice is the traffic data within a time window. Use the Simple-MI algorithm to convert the multi-instance data in each time window into a single-instance data set. Use the Simple-MI algorithm to process the feature data in each time window, such as calculating the average, median and sum of all network flow instances in each time window, and corresponding conversion to obtain the features of each time window instance.

[0069] For each divided instance (bag), use the Simple-MI algorithm to map the data within the instance into a fixed-dimensional vector. This step simplifies the multi-dimensional network flow data into a form that can be effectively processed by machine learning models, reducing complexity while preserving key information. The embodiment of the present invention has 60 seconds in 1 minute, so each bag B i becomes a fixed-dimensional vector with a dimension of 60.

[0070] The embodiment of the present invention uses the Simple-MI algorithm to divide the multi-instance network flow data set into aggregates. One implementation is shown in Algorithm 1:

[0071]

[0072] Let the multi-instance network flow data set Z, where bag B i contains n i network flow instances, each with d features extracted as in step 3. The original network flow data set can be represented as: Z = {(B1, y1), (B2, y2), …, (B N , y N). To capture the variation of network traffic in different sub-time periods, it is necessary to analyze the network flow instances in each of the k sub-time windows contained in bag B i , where the time windows are denoted as K = {t1, t2,... t k}. The embodiment of the present application contains 60 time windows in each bag, i.e. 60 sub-bags.

[0073] Simple-MI uses a set of feature functions to aggregate the instances in different time windows t i into a fixed dimension. For each feature dimension of the sub-bag, the embodiment of the present application uses the following feature function to calculate three kinds of statistical information of the sub-bag in each feature dimension:

[0074]

[0075] where three calculation functions are contained, as follows:

[0076] to calculate the feature average of all network flow instances of the jth second of sub-bag b i of bag B i,j ; |b i,h | represents the number of network flow instances contained in sub-bag b i,j , and x represents the feature value;

[0077] f median (b i,j ), to calculate the feature median of sub-bag b i,j of bag B i ;

[0078] to calculate the feature sum of all network flow instances of b i,j of bag B i .

[0079] In Algorithm 1, the three functions above are used to calculate the statistical values of the sub-bag in different features, and thus the feature vector M i,j of the sub-bag containing different numbers of network flow instances is aggregated, where the dimension of the feature vector M i,j of each sub-bag is Therefore, each bag B i can be represented as the feature vector M of bag B i . In Algorithm 1, Φ(b i,j , f l ) = f l (b i,j ), and the vector M i,jStandardization is performed as follows:

[0080]

[0081] Among them, M i,j,l For vector M i,j The l-th statistical characteristic, M′ i,j,l For M i,j,l The standardized value, min(M) i,:l ) and max(M i,:,l (These are bags B) i eigenvector M i The minimum and maximum values ​​in the l-th statistical characteristic.

[0082] Finally, we arrive at bag B. i The standardized fixed-dimensional feature matrix M′ i In this way, the dataset Z is transformed into a dataset Z′={(M′1,y1),(M′2,y2),…,(M′…}. N ,y N )}.

[0083] This invention uses the SimpleMI algorithm to transform the network flow data within each sub-packet into a vector with fixed dimensions. This fine-grained division and transformation can capture the detailed features of the network flow within each time window and represent them in vector form, providing a detailed data foundation for subsequent analysis.

[0084] (2) Use GAF to convert the feature matrix of the package into an image.

[0085] To deeply explore the spatiotemporal characteristics of the network flow in each bag, this invention employs the GAF algorithm. This algorithm transforms the network flow feature sequence of each bag into a multi-channel image. In this transformation process, each feature is treated as a sequence and converted into a channel of the multi-channel image. Therefore, the network flow data of the entire bag is represented as a multi-channel image rich in information, where each channel represents a specific feature of the network flow, enabling a comprehensive and in-depth representation of the spatiotemporal characteristics of the network flow in image form.

[0086] In the method of the present application, each feature dimension of the bag is converted into a channel in the multi-channel image, and the feature sequence under the same dimension is converted into an image representation using the GAF algorithm, and then a multi-channel image can be obtained. In the embodiment of the present application, the multi-instance network stream is aggregated according to each second by the Simple-MI algorithm, so that a one-minute coarse-grained feature is represented as a vector with 60 seconds, and the feature dimension is expanded from the original network stream feature dimension to 3d dimension, and each dimension is a feature sequence with a time length of 60 seconds.

[0087] In the process of converting the feature sequence into an image using GAF, the method of the present application adopts two key methods: GASF (Gramian Angular Summation Field) and GADF (Gramian Angular Difference Field). First, the feature values of each feature sequence under the same dimension are normalized to the amplitude interval of [-1, 1] to adapt to the angle value in the polar coordinate system. Then, the normalized feature sequence is mapped to the polar coordinate system, and the amplitude of the feature is encoded as the cosine of the angle, and the time axis is encoded as the radius. Then, the feature sequence is converted into two kinds of images using GASF and GADF respectively. Let the angles of the i-th and j-th feature values in the feature sequence mapped to the polar coordinate system be θ i and θ j In GASF, the cosine value of the angle sum of the normalized data is calculated to form a Gramian matrix, denoted as GASF(i,j) = cos(θ i + θ j ), i,j = 1,2,…d. And GADF focuses on the difference between angles, and the matrix formed is denoted as GADF(i,j) = sin(θ i - θ j ), i,j = 1,2,…d. (i,j) represents the image coordinates. The numerical values of the obtained GASF matrix and GADF matrix are directly imaged as gray-scale images or mapped as pseudo-color images. Finally, a multi-channel GASF image and a multi-channel GADF image are obtained.

[0088] The present application converts the network traffic feature sequence into an image form by the GAF algorithm, retains the basic characteristics of time series data, and increases the visualization and analysis dimension of data, providing a strong foundation for subsequent image processing and classification tasks. Through this method, the features of network traffic data are effectively extracted and converted into images, so that image recognition technology can be used for deep learning analysis.

[0089] Step 6: Construct a deep learning model for the target task, train the model, and input the real-time network traffic data preprocessed and feature-extracted in the above steps into the deep learning model for target task detection.

[0090] The method of the present application converts network traffic data into image format, and then uses deep learning technology to predict and detect network security events. The deep learning part of the present application mainly relies on convolutional neural networks (CNN). CNN can effectively identify patterns and features in images when processing these multi-channel images, so as to detect signs of network security events from the converted network traffic images.

[0091] When constructing a deep learning model, since it is specifically used to process multi-channel image data of network traffic, it is ensured that the model can accept input data matching the number of channels of the multi-channel image. When designing the convolutional layer of the deep learning model, the input channel parameter of the first convolutional layer must be set to the number of channels of the image. This ensures that the features of each channel can be captured and analyzed by the model. For example, if each multi-channel image has 10 channels, the input channel number of the first layer of CNN should also be set to 10. Such a setting allows the model to process each channel individually, so as to learn the features of each channel and combine the information of all channels for comprehensive analysis.

[0092] In the training phase of the deep learning model, not only does the model learn to extract features from each individual channel, but it also learns to understand the relationship between different channels. During training, the model is "fed" with a large amount of multi-channel image data, each image accompanied by a corresponding label indicating normal or abnormal traffic. The features learned by the deep learning model through these data include not only patterns within a single channel, but also dynamic relationships across channels. Through this multi-dimensional learning, the model can generate advanced features with keen insights into network security threats.

[0093] In the model training phase, the embodiments of the present application use appropriate machine learning or deep learning models, such as ResNet networks. The training phase optimizes model parameters to adapt to training data, so that the model can effectively identify and classify network security events. After training, the trained model is saved as an offline model. In the testing phase, this offline model is used to make predictions on the test set. This step is a key step in verifying the performance of the model. By applying the model to a test set different from the training data, the ability of the model to identify specific types of network security events in real-world scenarios can be evaluated. The output of the model usually includes the category of security events, the likelihood score, etc. These results are crucial for understanding and dealing with network security threats.

[0094] Further, the use of the method in real-time traffic monitoring, anomaly pattern detection, and security incident response is described, which are the core parts of a network security system.

[0095] (1) Real-time traffic monitoring: Based on the method, a high-efficiency real-time network traffic monitoring system is realized. The core of the system lies in the continuous capture of network traffic data and the immediate preprocessing and imaging of these data. In the preprocessing stage, the system will perform a series of operations such as denoising, standardization, time series analysis, etc. on the traffic data, which lays the foundation for converting the data into an analyzable image format. Subsequently, according to the previously defined conversion rules, the preprocessed data is mapped to the image, and the image generated by each traffic instance is transmitted to the deep learning model for analysis in real time. The optimization of this process aims to minimize the delay, so as to realize the real-time reflection of the network status and provide a time window for emergency response. The deep learning model used by the system is used to detect the network status.

[0096] (2) Anomaly pattern detection: Based on the method or based on the above network traffic real-time monitoring, a deep learning model is constructed to identify and detect abnormal patterns in network traffic in real time. This process involves continuous analysis of traffic images to timely discover any variations that deviate from known normal behavior patterns, which may indicate potential security threats. The real-time analysis capability of the model is based on the recognition patterns it has learned from a large amount of historical data, which can distinguish abnormal behaviors such as DDoS attacks, network scanning, unauthorized access, etc. The key to real-time detection is speed and accuracy, so the model needs to be continuously optimized to adapt to new changes in network behavior and new types of emerging threats.

[0097] (3) Security incident response: When an abnormal pattern is detected by the deep learning model, a predefined security response mechanism is immediately activated. These response measures include but are not limited to sending automatic warning notifications to network administrators, implementing network traffic isolation to contain potential threat spread, and starting automated or manual further investigation processes. The design of the response mechanism aims to quickly and effectively mitigate threats, reduce the impact on network users and services, and collect enough information for post-analysis and adjustment of defense strategies. The rapidity of security incident response is crucial to protect network resources from damage, therefore, the system also includes real-time evaluation of the effectiveness of response measures to ensure timely updating and improvement of security measures.

[0098] In summary, the present application combines multi-instance learning, time series data processing, image conversion and deep learning techniques, providing an innovative and efficient method for network traffic data analysis and network security event prediction. This not only improves the accuracy of network security event detection, but also provides an effective solution for processing large-scale network data. In practical applications, it can cope with various network security challenges:

[0099] (a) Network security event detection and prediction: By converting network traffic data into image form, the present application uses deep learning and image processing techniques to analyze these images to discover potential network security threats. Specifically, it can effectively identify and predict security events such as unauthorized intrusion, abnormal traffic patterns, malware propagation, etc. This conversion mechanism not only improves the intuitiveness of data, allowing security analysts to more directly identify network anomalies, but also significantly improves the speed and accuracy of event detection through the assistance of image analysis techniques. In addition, the present application can also be applied to continuous network monitoring, through the time series analysis of converted images, to realize real-time assessment and prediction of network security posture, thereby providing strong technical support for network security management.

[0100] (b) Large-scale data processing: The present application can efficiently identify and analyze complex network traffic patterns by converting network traffic data into image format and applying image processing techniques. This method is particularly suitable for processing large-scale data sets. The uniqueness of this method is that it can capture and analyze the overall characteristics and trends of network traffic from a more macro perspective (i.e. coarse-grained view), rather than just focusing on microscopic detail analysis. When dealing with high-dimensional and large amounts of network data, the present application not only maintains high processing speed and accuracy, but also provides a macro view of network traffic patterns through coarse-grained analysis. This helps quickly identify overall traffic trends and abnormal patterns, suitable for applications that require real-time or near real-time data analysis. In addition, the method of the present application has good scalability, which can adapt to the growing amount of data and changing network environment. By analyzing from a coarse-grained perspective, this method not only handles current data load, but also adapts to future data growth, ensuring long-term effective analysis and processing of network traffic.

[0101] The method of the present application is applied to security event detection and compared with CCE, EM-DD, MIHI, SimpleMI, miFV, miVLAD multi-instance data representation methods, wherein the detection model uses DecisionTree, MLP, RandomForest, XGBoost, ResNet18 and ResNet50 models for testing. On the experimental data set UNSW-NB15, the experimental results are shown in Table 1.

[0102] Table 1 experimental results

[0103]

[0104]

[0105] In Table 1, Precision represents the precision rate, Recall represents the recall rate, and F1-Score is a weighted average of the precision rate and the recall rate. The experimental results show that the detection based on the MI-GAF, i.e., the above MI-GADF and MI-GASF modes, has the best accuracy and stability.

[0106] In addition to the technical features described in the specification, they are known to those skilled in the art. The present application omits the description of known components and known technologies to avoid redundancy and unnecessary limitation of the present application. The embodiments described in the above embodiments do not represent all embodiments consistent with the present application. Various modifications or variations made by those skilled in the art without creative labor on the basis of the technical solutions of the present application are still within the protection scope of the present application.

Claims

1. A method for processing time-series network traffic data based on multi-instance learning, characterized in that, The method comprises the following steps: Step 1: preprocessing network traffic data, extracting network traffic features, and organizing time series feature data; The preprocessing comprises: screening network traffic data related to security event detection, cleaning noise and redundant information, then extracting features from the cleaned data, standardizing the feature data, and reorganizing the standardized features into time series data according to the timestamp; the extracted features include network stream collection time, source IP address, target IP address, source port, target port, protocol type, and network traffic statistical information; let the extracted feature dimension be d; Step 2: instantiating and image coding the extracted time series feature data, comprising: (2.1) First, according to the set bag time length, the network traffic data is coarsely divided, and then each bag is finely divided according to the set time window, which is divided into k sub-bags, each sub-bag contains all network stream instances in the corresponding time window, and the proportion of malicious traffic in the bag is calculated to assign a security event label to the bag; extract d-dimensional features of each network stream instance; (2.2) Then, for each sub-bag contained in the bag, the Simple-MI algorithm is used to calculate the statistics of all network flow instances of the sub-bag in each feature dimension, and the sub-bag features of the corresponding time window are aggregated, which are vectors, a set of functions for calculating statistics, denotes the number of functions in the set , and the bag features are obtained from the sub-bag features, which are vectors, and the dimension of the bag features is (2.3) constructing a multi-channel graph for each bag feature using the GAF algorithm, including: converting each feature dimension of the bag into one channel in the multi-channel graph, using the GAF algorithm to calculate the Gramian matrix for the feature sequence of length k in the same dimension, and converting it into an image, converting the bag features into an image group with a channel number of ​ Step 3: constructing a deep learning model for the target task, converting the real-time collected network traffic data into a multi-channel image sequence according to steps 1 and 2, and inputting the multi-channel image into the deep learning model for target task detection.

2. The method of claim 1, wherein, The step 2 further includes: marking each network flow instance in the bag as 1 if malicious traffic in the network flow instance exceeds 50%, or marking as 0 otherwise; and counting the proportion r of network flow instances marked as 1 in the bag j ; If r j ≤ 0.45, assign the bag a label of low risk safety event; if 0.45 < r j <0.75, assign the bag a label of medium risk safety event; If r j ≥ 0.75, assign the bag a label of high risk safety event.

3. The method according to claim 1 or 2, characterized in that, In step 2, the time window is set according to the time length corresponding to the collection frequency, there is at least one network stream instance in each time window, and all network stream instances in the time window are divided into a sub-bag.

4. The method according to claim 1 or 2, characterized in that, In step 2, the collection frequency is set to 1 second, the time window is set to 1 second, and the bag time length is set to 1 minute.

5. The method of claim 1, wherein, In step 2, the function set for calculating statistical data is as follows: For a dimension feature of a sub-bag, calculate the average value of the feature of all network flow instances of the sub-bag by f mean Calculate the average value of the feature of all network flow instances of the sub-bag by f median Calculate the median value of the feature of all network flow instances of the sub-bag by f sum Calculate the sum value of the feature of all network flow instances of the sub-bag.

6. The method of claim 1, wherein, In step 2, after obtaining the sub-bag features, the minimum and maximum values in the bag where the sub-bag is located are obtained for each statistical data in each feature dimension, and then each feature of the sub-bag is standardized.

7. The method of claim 1, wherein, In step 2, the GAF algorithm is used to calculate the Gramian matrix of the feature sequence and convert it into an image, comprising: First, normalize the feature values in the feature sequence to the amplitude interval [-1, 1], and map the normalized feature values to the polar coordinate system; Then, use GASF and GADF to calculate the polar angle of the feature values of the feature sequence, form the Gramian matrix, and mark it as GASF matrix and GADF matrix, which are directly imaged as gray-scale images or mapped as pseudo-color images.

8. The method of claim 1, wherein, In step 3, the input channel parameter of the first layer of the deep learning model is the number of channels of the multi-channel image converted from the network traffic data.

9. The method of claim 1, wherein, In step 1, the feature data is standardized, including: converting the IP address into a unified representation, and mapping the port number to a standard service type.

Images