Malicious traffic classification method, device, equipment and medium based on big data

Abstract

The present invention relates to the field of data processing technology, and discloses a malicious traffic classification method, device, equipment and medium based on big data, including: obtaining a traffic gray matter map set corresponding to a traffic data set to be classified; performing feature extraction on each traffic gray matter map in the traffic gray matter map data set to obtain a traffic feature map set; performing global information extraction on each traffic feature map in the traffic feature map set to obtain a global traffic feature map set; performing local information extraction on each traffic feature map in the traffic feature map set to obtain a local traffic feature map set; performing fusion processing on each global traffic feature map in the global traffic feature map set and each local traffic feature map in the local traffic feature map set to obtain a fused traffic feature map set; performing full connection processing on each fused traffic feature map in the fused traffic feature map set to obtain a malicious traffic classification probability, which can effectively improve the accuracy of the malicious traffic classification process.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a malicious traffic classification method, device, equipment and medium based on big data. Background Art

[0002] With the continuous maturity of Internet technology and the continuous development of network technology, network traffic data has suddenly increased, and there is no shortage of malicious traffic. Among them, malicious traffic refers to traffic that uses network attack methods to damage or endanger network equipment, network resources or network services. Malicious traffic not only threatens the security and health of the network, but also causes problems such as user privacy leakage and property loss. At present, the detection and classification of network malicious traffic has become an important issue in the field of network security. However, existing technical means cannot achieve the purpose of accurately detecting and classifying network malicious traffic. Therefore, how to accurately detect and classify network malicious traffic has become a problem that needs to be solved urgently. Summary of the invention

[0003] The present invention provides a malicious traffic classification method, device, equipment and medium based on big data to solve the technical problem of accurately detecting and classifying malicious network traffic.

[0004] In the first aspect, a malicious traffic classification method based on big data is provided, including:

[0005] Obtain a set of traffic gray matter graphs corresponding to the set of traffic data to be classified;

[0006] Extract features from each flow gray matter map in the flow gray matter map data set to obtain a flow feature map set;

[0007] Extracting global information from each traffic feature graph in the traffic feature graph set to obtain a global traffic feature graph set;

[0008] Extracting local information from each flow feature graph in the flow feature graph set to obtain a local flow feature graph set;

[0009] Fusing each global traffic feature graph in the global traffic feature graph set with each local traffic feature graph in the local traffic feature graph set to obtain a fused traffic feature graph set;

[0010] Each fused traffic feature graph in the fused traffic feature graph set is fully connected to obtain the malicious traffic classification probability.

[0011] In a second aspect, a malicious traffic classification device based on big data is provided, including:

[0012] An acquisition module, used to acquire a set of traffic gray matter maps corresponding to a set of traffic data to be classified;

[0013] The first processing module is used to extract features from each flow gray matter map in the flow gray matter map data set to obtain a flow feature map set;

[0014] The second processing module is used to extract global information from each flow characteristic graph in the flow characteristic graph set to obtain a global flow characteristic graph set;

[0015] The third processing module is used to extract local information from each flow feature graph in the flow feature graph set to obtain a local flow feature graph set;

[0016] A fourth processing module is used to fuse each global traffic feature graph in the global traffic feature graph set with each local traffic feature graph in the local traffic feature graph set to obtain a fused traffic feature graph set;

[0017] The fifth processing module is used to perform full connection processing on each fused traffic feature graph in the fused traffic feature graph set to obtain the malicious traffic classification probability.

[0018] In a third aspect, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned malicious traffic classification method based on big data when executing the computer program.

[0019] In a fourth aspect, a computer-readable storage medium is provided, which stores a computer program. When the computer program is executed by a processor, the steps of the above-mentioned malicious traffic classification method based on big data are implemented.

[0020] In the scheme implemented by the above-mentioned malicious traffic classification method, device, equipment and medium based on big data, a traffic gray matter map set corresponding to the traffic data set to be classified is obtained, and each traffic gray matter map in the traffic gray matter map data set is feature extracted to obtain a traffic feature map set, so as to perform global information extraction on each traffic feature map in the traffic feature map set to obtain a global traffic feature map set, and perform local information extraction on each traffic feature map in the traffic feature map set to obtain a local traffic feature map set, so that each global traffic feature map in the global traffic feature map set can be fused with each local traffic feature map in the local traffic feature map set to obtain a fused traffic feature map set, and then each fused traffic feature map in the fused traffic feature map set can be fully connected to obtain a malicious traffic classification probability, which is conducive to achieving the purpose of accurately detecting and classifying network malicious traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0022] Figure 1 It is a schematic diagram of an application environment of a malicious traffic classification method based on big data in one embodiment of the present invention;

[0023] Figure 2 It is a flow chart of a malicious traffic classification method based on big data in one embodiment of the present invention;

[0024] Figure 3 It is a structural schematic diagram of a malicious traffic classification device based on big data in one embodiment of the present invention;

[0025] Figure 4 is a schematic diagram of a structure of a computer device in one embodiment of the present invention;

[0026] Figure 5 It is another structural schematic diagram of a computer device in one embodiment of the present invention. DETAILED DESCRIPTION

[0027] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0029] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments.

[0030] At present, the methods for classifying network malicious traffic are mainly divided into two categories, one is rule-based and the other is machine learning-based. Among them, although the rule-based method is more professional and has good interpretability, it requires a lot of human resources to research and design relevant rules and is difficult to adapt to the ever-changing network environment. Based on these shortcomings and the rapid development of machine learning in recent years, the classification of network malicious traffic based on machine learning methods has become a hot topic in this field. However, how to better utilize machine learning, such as deep learning in machine learning, to make up for the shortcomings of traditional machine learning, and better apply deep learning to the prediction of network malicious traffic classification has become a hot issue in current research.

[0031] The malicious traffic classification method based on big data provided by the embodiment of the present invention can be applied in the following aspects: Figure 1 In an application environment, the client communicates with the server through a network. Exemplarily, taking the scenario of malicious traffic classification for a set of traffic data to be classified as an example, the target user can upload a set of traffic gray matter graphs corresponding to the set of traffic data to be classified through the client. Among them, the target user can be a manager or R&D personnel of the network malicious traffic classification process, and this application does not limit this. Correspondingly, the server can obtain the set of traffic gray matter graphs corresponding to the set of traffic data to be classified uploaded by the target user through the client, so as to extract features of each traffic gray matter graph in the acquired traffic gray matter graph data set to obtain a set of traffic feature graphs, extract global information from each traffic feature graph in the set of traffic feature graphs to obtain a set of global traffic feature graphs, and extract local information from each traffic feature graph in the set of traffic feature graphs to obtain a set of local traffic feature graphs, thereby fusing each global traffic feature graph in the set of global traffic feature graphs with each local traffic feature graph in the set of local traffic feature graphs to obtain a set of fused traffic feature graphs, and then fully connect each fused traffic feature graph in the set of fused traffic feature graphs to obtain a malicious traffic classification probability, and feed back the malicious traffic classification probability to the client. Accordingly, the client can receive the malicious traffic classification probability from the server, and can display the malicious traffic classification probability on the client for the target user to query or browse. By adopting the malicious traffic classification method based on big data provided by this application, the accuracy of the network malicious traffic classification process can be improved.

[0032] The client may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, and portable wearable devices. The server may be implemented by an independent server or a server cluster consisting of multiple servers. The present invention is described in detail below through specific embodiments.

[0033] See also Figure 2 As shown, Figure 2 A flowchart of a malicious traffic classification method based on big data provided by an embodiment of the present invention includes the following steps:

[0034] S10: Obtain a set of traffic gray matter maps corresponding to the set of traffic data to be classified.

[0035] The set of traffic data to be classified may include one or more traffic data to be classified, and the traffic data to be classified may be used to represent network traffic data that has not yet been distinguished between malicious traffic and normal traffic. The set of traffic gray matter graphs may include one or more traffic gray matter graphs, and the traffic gray matter graphs may be used to represent feature graphs obtained after preprocessing the traffic data to be classified, such as preprocessing the data into gray matter graph format.

[0036] S20: Extract features from each flow gray matter map in the flow gray matter map data set to obtain a flow feature map set.

[0037] Among them, the flow feature map set may include one or more flow feature maps, and the flow feature map can be used to represent the feature map obtained after feature extraction of the flow gray matter map and conversion into a vector representation.

[0038] S30: Extract global information from each traffic feature graph in the traffic feature graph set to obtain a global traffic feature graph set.

[0039] Among them, the global traffic feature graph set may include one or more global traffic feature graphs, and the global traffic feature graph may be used to represent the feature graph obtained after global information extraction from the traffic feature graph. Optionally, the server may use a global information extraction module (or a global information acquisition module) to achieve the purpose of global information extraction from the traffic feature graph, and this application does not limit this.

[0040] It should be understood that performing global information extraction on each flow characteristic graph in the flow characteristic graph set to obtain a global flow characteristic graph set refers to a process of performing global information extraction on the flow characteristic graph. Among them, step S30, that is, performing global information extraction on each flow characteristic graph in the flow characteristic graph set to obtain a global flow characteristic graph set, includes the following steps:

[0041] S31: Performing dimension expansion processing on each flow feature graph in the flow feature graph set to obtain a high-dimensional flow feature graph set;

[0042] S32: performing a one-dimensional convolution operation on each high-dimensional flow feature graph in the high-dimensional flow feature graph set to obtain a first feature matrix Q;

[0043] S33: performing linear transformation processing on each high-dimensional flow feature graph in the high-dimensional flow feature graph set to obtain a second feature matrix K and a third feature matrix V;

[0044] S34: According to the first characteristic matrix and the second characteristic matrix, the first characteristic matrix is ​​updated to obtain a fourth characteristic matrix;

[0045] S35: Perform self-attention calculation according to the fourth feature matrix, the second feature matrix and the third feature matrix to obtain a set of global traffic feature maps.

[0046] Among them, the high-dimensional traffic feature map set may include one or more high-dimensional traffic feature maps, which can be used to represent the feature map after dimensional expansion. Optionally, the server can standardize the traffic feature map as a feature map with a dimension size of 28*28, divide it into 49 blocks of 4*4 size, and add a classification token (CLS) code at the beginning of the vector, and then expand its dimension to 256 dimensions through linear transformation to obtain the above-mentioned high-dimensional traffic feature map, which is not limited in this application.

[0047] In some models, such as Bidirectional Encoder Representations from Transformers (BERT), CLS encoding is used as a classification flag. In text classification tasks, the BERT model inserts a special CLS tag at the beginning of the input text, so that the model encodes the text and the CLS tag to obtain a feature map, and by processing the feature vector corresponding to the CLS tag, the classification result of the text can be obtained. The role of CLS encoding is to represent the semantic information of the entire text and is used for classification tasks. It can be regarded as a global feature representation that integrates information from various parts of the text. By using CLS encoding, the model can better capture the overall semantics of the text and improve the accuracy of classification, which is not limited in this application.

[0048] The first feature matrix can be used to indicate the feature matrix obtained after performing a one-dimensional convolution operation on the high-dimensional flow feature map. The second feature matrix can be used to indicate the feature matrix obtained after performing a dot multiplication operation (such as dot multiplication with a linear transformation matrix 1) on the high-dimensional flow feature map. The third feature matrix can be used to indicate the feature matrix obtained after performing a dot multiplication operation (such as dot multiplication with a linear transformation matrix 2) on the high-dimensional flow feature map.

[0049] The fourth characteristic matrix can be used to indicate the characteristic matrix obtained after the first characteristic matrix is ​​updated. Optionally, the server can perform a correlation operation based on the first characteristic matrix and the second characteristic matrix to update the first characteristic matrix and obtain the fourth characteristic matrix.

[0050] It should be understood that updating the first characteristic matrix to obtain the fourth characteristic matrix according to the first characteristic matrix and the second characteristic matrix refers to the process of updating the first characteristic matrix. In step S34, that is, updating the first characteristic matrix to obtain the fourth characteristic matrix according to the first characteristic matrix and the second characteristic matrix, includes the following steps:

[0051] S341: Obtain N eigenvectors from the second eigenmatrix to obtain a first eigenvector set; N is a positive integer;

[0052] S342: performing maximum pooling processing on each first eigenvector in the first eigenvector set and the first eigenmatrix to obtain a maximum pooling eigenvector;

[0053] S343: performing average pooling processing on each first eigenvector in the first eigenvector set and the first eigenmatrix to obtain an average pooled eigenvector;

[0054] S344: performing minimum pooling processing on each first eigenvector in the first eigenvector set and the first eigenmatrix to obtain a minimum pooling eigenvector;

[0055] S345: Determine a selection parameter set according to the maximum pooling feature vector, the average pooling feature vector, and the minimum pooling feature vector;

[0056] S346: Arrange each selection parameter in the selection parameter set in descending order, and determine the first M selection parameters as a fourth characteristic matrix; M is a positive integer.

[0057] The first feature vector set may include one or more first feature vectors, which may be used to indicate feature vectors obtained from the second feature matrix. Optionally, the server may randomly extract N (e.g., 20) feature vectors from the second feature matrix as the first feature vector set, which is not limited in this application.

[0058] The maximum pooling feature vector can be used to indicate the feature vector obtained after the first feature vector is subjected to the maximum pooling process. The average pooling feature vector can be used to indicate the feature vector obtained after the first feature vector is subjected to the average pooling process. The minimum pooling feature vector can be used to indicate the feature vector obtained after the first feature vector is subjected to the minimum pooling process. The selection parameter set may include one or more selection parameters, which can be used to indicate the parameters determined according to the maximum pooling feature vector, the average pooling feature vector and the minimum pooling feature vector.

[0059] Optionally, the server determines the process of selecting a parameter set based on the maximum pooling feature vector, the average pooling feature vector, and the minimum pooling feature vector, as shown in the following formula:

[0060]

[0061] Among them, choose can be used to indicate the selection of a parameter set; Q can be used to indicate the first characteristic matrix Q; K' can be used to indicate the fourth characteristic matrix, T can be used to indicate the operation of transposing, d' can be used to indicate the dimension of the fourth characteristic matrix of the vector; max_col() can be used to indicate the operation of performing maximum pooling processing by row, mean_col() can be used to indicate the operation of performing average pooling processing by row, and min_col() can be used to indicate the operation of performing minimum pooling processing by row.

[0062] The server can further arrange the selection parameters in the selection parameter set, such as in descending order, to determine a fourth characteristic matrix from the selection parameters arranged in descending order, such as determining the first M (such as 25) selection parameters as the fourth characteristic matrix. This application does not impose any restrictions on this.

[0063] Optionally, if there is a value in the fourth feature matrix whose absolute value is less than a preset threshold, the server can remove it. Furthermore, the server can perform a one-dimensional convolution on the second feature matrix with an unchanged number of channels to obtain an updated feature matrix (such as called the fifth feature matrix), and repeat the above steps S341-S346 to calculate the selection parameters again to obtain a new feature matrix (such as called the sixth feature matrix), so as to make a union of the feature matrix obtained last time and the sixth feature matrix obtained this time, and re-sort them to determine the final fourth feature matrix, which is not limited in this application. Among them, after training through the actual model training process, it can be known that the preset threshold can be 0.47, which is not limited in this application.

[0064] Optionally, if after two calculations to select parameters, there are still less than M values ​​whose absolute values ​​are greater than or equal to the preset threshold, the remaining values ​​can be left blank, and this application does not impose any restrictions on this. The server can randomly select the mean, maximum, or minimum value in the first feature matrix with a probability of 0.5, 0.3, or 0.2 to fill the vacant values ​​in the fourth feature matrix, and this application does not impose any restrictions on this.

[0065] For steps S341-S346, the server obtains N feature vectors from the second feature matrix to obtain a first feature vector set. Each first feature vector in the first feature vector set can be subjected to maximum pooling processing with the first feature matrix to obtain a maximum pooling feature vector, and each first feature vector in the first feature vector set can be subjected to average pooling processing with the first feature matrix to obtain an average pooling feature vector, and each first feature vector in the first feature vector set can be subjected to minimum pooling processing with the first feature matrix to obtain a minimum pooling feature vector. Thus, a selection parameter set can be determined based on the maximum pooling feature vector, the average pooling feature vector, and the minimum pooling feature vector, and each selection parameter in the selection parameter set can be arranged in descending order to determine the first M selection parameters as a fourth feature matrix, which is beneficial for determining a more accurate malicious traffic classification result based on the fourth feature matrix in subsequent steps.

[0066] After determining the fourth characteristic matrix, the server can perform self-attention calculation based on the fourth characteristic matrix, the second characteristic matrix and the third characteristic matrix to obtain a set of global traffic feature maps. Optionally, the server can repeat the above steps S32-S35 multiple times, such as after repeating the operation 12 times, taking out the CLS column (i.e., the first column) in the feature vector as the above global traffic feature map set, and this application does not limit this.

[0067] For steps S31-S35, the server performs dimension expansion processing on each traffic feature map in the traffic feature map set to obtain a high-dimensional traffic feature map set, performs a one-dimensional convolution operation on each high-dimensional traffic feature map in the high-dimensional traffic feature map set to obtain a first feature matrix, and performs linear transformation processing on each high-dimensional traffic feature map in the high-dimensional traffic feature map set to obtain a second feature matrix and a third feature matrix, thereby updating the first feature matrix according to the first feature matrix and the second feature matrix to obtain a fourth feature matrix, and then performing self-attention calculation according to the fourth feature matrix, the second feature matrix and the third feature matrix to obtain a global traffic feature map set, which is beneficial in subsequent steps. Based on the global traffic feature map set, a more accurate malicious traffic classification probability can be determined, so as to effectively improve the accuracy of the malicious traffic classification process.

[0068] S40: Extract local information from each traffic feature graph in the traffic feature graph set to obtain a local traffic feature graph set.

[0069] Among them, the local traffic feature graph set may include one or more local traffic feature graphs, and the local traffic feature graph may be used to represent the feature graph obtained after local information extraction from the traffic feature graph. Optionally, the server may use a local information extraction module (or a local information acquisition module) to achieve the purpose of local information extraction from the traffic feature graph, and this application does not limit this.

[0070] It should be understood that extracting local information from each flow feature graph in the flow feature graph set to obtain a local flow feature graph set refers to a process of extracting local information from the flow feature graph. In step S40, extracting local information from each flow feature graph in the flow feature graph set to obtain a local flow feature graph set includes the following steps:

[0071] S41: performing linear transformation processing on each flow characteristic graph in the flow characteristic graph set to obtain a linear flow characteristic graph set;

[0072] S42: performing convolution operations of different convolution layers on each linear flow feature graph in the linear flow feature graph set to obtain a convolution flow feature graph set;

[0073] S43: Obtain a reference first-layer convolutional flow feature map subset, a reference second-layer convolutional flow feature map subset, and a reference third-layer convolutional flow feature map subset from the convolutional flow feature map set;

[0074] S44: fusing each reference first-layer convolutional flow feature map in the reference first-layer convolutional flow feature map subset with each reference second-layer convolutional flow feature map in the reference second-layer convolutional flow feature map subset to obtain a target second-layer convolutional flow feature map set;

[0075] S45: fusing each reference third-layer convolutional flow feature map in the reference third-layer convolutional flow feature map subset with each target second-layer convolutional flow feature map in the target second-layer convolutional flow feature map set to obtain a target third-layer convolutional flow feature map set;

[0076] S46: Determine the target third-layer convolutional flow feature map set as a local flow feature map set.

[0077] Among them, the linear traffic feature graph set may include one or more linear traffic feature graphs, which can be used to indicate the feature graph obtained after the traffic feature graph is subjected to linear transformation processing. Optionally, the server can standardize the traffic feature graph into a feature graph with a dimension size of 28*28, and expand the dimension to 256 dimensions by linear transformation to obtain the above-mentioned linear traffic feature graph, and this application does not impose any restrictions on this.

[0078] The convolutional flow feature map set may include one or more convolutional flow feature maps, which can be used to indicate the feature map obtained after the linear flow feature map is convolved at different convolutional layers. Optionally, the server can perform a two-dimensional convolution operation on the linear flow feature map with the number of channels halved successively, and store the data obtained after the operation in each convolutional layer, which is not limited in this application.

[0079] The reference first layer convolution flow feature map subset may include one or more reference first layer convolution flow feature maps, and the reference first layer convolution flow feature map can be used to indicate the feature map stored in the first layer convolution layer. The reference second layer convolution flow feature map subset may include one or more reference second layer convolution flow feature maps, and the reference second layer convolution flow feature map can be used to indicate the feature map stored in the second layer convolution layer. The reference third layer convolution flow feature map subset may include one or more reference third layer convolution flow feature maps, and the reference third layer convolution flow feature map can be used to indicate the feature map stored in the third layer convolution layer. Optionally, the present application takes the number of convolution layers as 3 as an example for illustration, which does not constitute a limitation to the present application.

[0080] The target second-layer convolutional flow feature map set may include one or more target second-layer convolutional flow feature maps, which can be used to indicate the feature map stored in the second convolutional layer after fusion and update based on the reference first-layer convolutional flow feature map and the reference second-layer convolutional flow feature map. Optionally, taking the first convolutional layer as the current convolutional layer as an example, the second convolutional layer may be the previous convolutional layer of the current convolutional layer, and the present application does not impose any restrictions on this. In other words, the server can fuse and update the data stored in the previous convolutional layer of the current convolutional layer based on the data stored in the current convolutional layer and the data stored in the previous convolutional layer of the current convolutional layer to obtain a more accurate target second-layer convolutional flow feature map set, and the present application does not impose any restrictions on this.

[0081] It should be understood that fusing each reference first-layer convolutional flow feature map in the reference first-layer convolutional flow feature map subset with each reference second-layer convolutional flow feature map in the reference second-layer convolutional flow feature map subset to obtain a target second-layer convolutional flow feature map set refers to the process of updating the first feature matrix. Among them, step S44, that is, fusing each reference first-layer convolutional flow feature map in the reference first-layer convolutional flow feature map subset with each reference second-layer convolutional flow feature map in the reference second-layer convolutional flow feature map subset to obtain a target second-layer convolutional flow feature map set, includes the following steps:

[0082] S441: performing deconvolution processing on each first-layer convolution flow feature map in the first-layer convolution flow feature map subset to obtain a deconvolution flow feature map set;

[0083] S442: performing local attention extraction on each deconvolution flow feature map in the deconvolution flow feature map set and each second-layer convolution flow feature map in the second-layer convolution flow feature map subset to obtain a local attention flow feature map set;

[0084] S443: performing global attention extraction on each deconvolution flow feature map in the deconvolution flow feature map set and each second-layer convolution flow feature map in the second-layer convolution flow feature map subset to obtain a global attention flow feature map set;

[0085] S444: Activate each local attention flow feature map in the local attention flow feature map set and each global attention flow feature map in the global attention flow feature map set to obtain flow feature weight data;

[0086] S445: Determine a target second-layer convolutional flow feature map set based on the deconvolutional flow feature map set, the second-layer convolutional flow feature map subset, and the flow feature weight data.

[0087] Among them, the deconvolution flow feature map set may include one or more deconvolution flow feature maps, and the deconvolution flow feature map can be used to indicate the feature map obtained after the first layer of convolution flow feature map is deconvolved. Optionally, the server can perform a two-dimensional deconvolution operation on the first layer of convolution flow feature map by multiplying the number of channels by 2 to obtain the above-mentioned deconvolution flow feature map set, and this application does not limit this.

[0088] The local attention flow feature map set may include one or more local attention flow feature maps, which can be used to indicate the feature map obtained after local attention extraction of the deconvolution flow feature map and the second layer convolution flow feature map. Optionally, the server can use a local attention extraction module (such as a local_att module) to implement the operation of local attention extraction. Optionally, the design of the local_attn module can be to first repeat twice through a two-dimensional convolution layer and an activation function (such as an Elu activation function) with half the number of channels, and then through a two-dimensional convolution layer and an activation function (such as a Gelu function) with doubled number of channels, and finally through a two-dimensional convolution layer with doubled number of channels to ensure that the input dimension and the output dimension are the same.

[0089] The global attention flow feature map set may include one or more global attention flow feature maps, which can be used to indicate the feature map obtained after the deconvolution flow feature map and the second layer convolution flow feature map are subjected to global attention extraction. Optionally, the server can use a global attention extraction module (such as a global_att module) to implement the operation of global attention extraction. Optionally, the design of the global_att module can be to first perform average pooling and maximum pooling in the height and width dimensions to obtain the sum of the two, and then complete the same operation as the aforementioned local_attn, which is not limited in this application.

[0090] The traffic feature weight data can be used to indicate the weight data obtained after activating the local attention traffic feature map and the global attention traffic feature map. Optionally, the process of the server obtaining the traffic feature weight data can be referred to the following formula:

[0091] x i =(transconv_i+h_list[i-1])

[0092] weight = Sigmoid(local_attn(x i )+global_attn(x i ))

[0093] Among them, x iIt can be used to represent a temporary variable, which is used to indicate the feature map obtained by adding each deconvolution flow feature map in the deconvolution flow feature map set and each second-layer convolution flow feature map in the second-layer convolution flow feature map subset; i can be used to indicate the index of the convolution layer; transconv_i can be used to represent the deconvolution flow feature map set; h_list[i-1] can be used to represent the second-layer convolution flow feature map subset; weight can be used to represent feature weight data; Sigmoid() can be used to represent the operation of activation processing through the activation function Sigmoid function; local_attn() can be used to represent the operation of local attention extraction through the local attention extraction module; global_attn() can be used to represent the operation of global attention extraction through the local attention extraction module.

[0094] After determining the traffic feature weight data, the server can multiply the value of the traffic feature weight data by the deconvolution traffic feature map and the second-layer convolution traffic feature map to achieve the fusion of the two. Optionally, the server determines the target second-layer convolution traffic feature map set based on the deconvolution traffic feature map set, the second-layer convolution traffic feature map subset and the traffic feature weight data, as shown in the following formula:

[0095] h_list[i-1]′=transconv_i*weight+h_list[[i-1]*(1-weight)

[0096] Among them, h_list[i-1]′ can be used to represent the target second-layer convolution flow feature map set; transconv_i can be used to represent the deconvolution flow feature map set; weight can be used to represent feature weight data; h_list[i-1] can be used to represent the second-layer convolution flow feature map subset.

[0097] For steps S441-S445, the server obtains a deconvolution flow feature map set by deconvolution processing on each first-layer convolution flow feature map in the first-layer convolution flow feature map subset, and performs local attention extraction on each deconvolution flow feature map in the deconvolution flow feature map set and each second-layer convolution flow feature map in the second-layer convolution flow feature map subset to obtain a local attention flow feature map set, and performs global attention extraction on each deconvolution flow feature map in the deconvolution flow feature map set and each second-layer convolution flow feature map in the second-layer convolution flow feature map subset to obtain a global attention flow feature map set, so that each local attention flow feature map in the local attention flow feature map set and each global attention flow feature map in the global attention flow feature map set can be activated to obtain flow feature weight data, and then the target second-layer convolution flow feature map set can be determined according to the deconvolution flow feature map set, the second-layer convolution flow feature map subset and the flow feature weight data, which is conducive to obtaining more accurate malicious traffic classification results.

[0098] The target third-layer convolutional flow feature map set may include one or more target third-layer convolutional flow feature maps, which can be used to indicate a feature map stored in the third convolutional layer after fusion and update based on a reference third-layer convolutional flow feature map and a target second-layer convolutional flow feature map. It should be noted that the server obtains the target third-layer convolutional flow feature map set. For the relevant content of the server obtaining the target second-layer convolutional flow feature map set, please refer to the detailed steps for the server to obtain the target second-layer convolutional flow feature map set, which will not be repeated in this application.

[0099] Optionally, the server may use a feature fusion module (such as an AFF module) to implement the fusion processing operation, which is not limited in this application. Optionally, the server obtains the target second-layer convolution flow feature map set based on the feature fusion module, as shown in the following formula:

[0100] h_list[i-1]′=AFF(h_list[i], h_list[[i-1])

[0101] Among them, h_list[i-1]′ can be used to represent the target second-layer convolutional flow feature map set; AFF() can be used to represent the operation through the feature fusion module; h_list[i] can be used to represent the first-layer convolutional flow feature map subset; h_list[i-1] can be used to represent the second-layer convolutional flow feature map subset.

[0102] It is understandable that the server can traverse from the current convolution layer and use the output of the feature fusion module after the traversal as a set of local traffic feature maps, and this application does not limit this. That is to say, in the case of three convolution layers, the server can update the data of the second convolution layer based on the data stored in the first convolution layer and the data stored in the second convolution layer; and update the data of the third convolution layer based on the updated data of the second convolution layer and the data stored in the third convolution layer, so as to determine the updated data of the third convolution layer as a set of local traffic feature maps, and this application does not limit this.

[0103] For steps S41-S46, the server performs linear transformation processing on each traffic feature graph in the traffic feature graph set to obtain a linear traffic feature graph set, and performs convolution operations of different convolution layers on each linear traffic feature graph in the linear traffic feature graph set to obtain a convolutional traffic feature graph set, so as to obtain a reference first-layer convolutional traffic feature graph subset, a reference second-layer convolutional traffic feature graph subset and a reference third-layer convolutional traffic feature graph subset from the convolutional traffic feature graph set, and fuse each reference first-layer convolutional traffic feature graph in the reference first-layer convolutional traffic feature graph subset with each reference second-layer convolutional traffic feature graph in the reference second-layer convolutional traffic feature graph subset to obtain a target second-layer convolutional traffic feature graph set, so that each reference third-layer convolutional traffic feature graph in the reference third-layer convolutional traffic feature graph subset can be fused with each target second-layer convolutional traffic feature graph in the target second-layer convolutional traffic feature graph set to obtain a target third-layer convolutional traffic feature graph set, and then the target third-layer convolutional traffic feature graph set can be determined as a local traffic feature graph set, which is conducive to obtaining more accurate malicious traffic classification results.

[0104] S50: Fusing each global traffic feature graph in the global traffic feature graph set with each local traffic feature graph in the local traffic feature graph set to obtain a fused traffic feature graph set.

[0105] Among them, the fused traffic feature graph set may include one or more fused traffic feature graphs, and the fused traffic feature graph may be used to indicate the feature graph obtained after the global traffic feature graph and the local traffic feature graph are fused. Optionally, the server may use a convergence module to implement the operation of fusing the global traffic feature graph with the local traffic feature graph, and this application does not limit this.

[0106] It should be understood that fusing each global traffic feature graph in the global traffic feature graph set with each local traffic feature graph in the local traffic feature graph set to obtain a fused traffic feature graph set refers to the process of fusing feature graphs of different scales. Among them, step S50, that is, fusing each global traffic feature graph in the global traffic feature graph set with each local traffic feature graph in the local traffic feature graph set to obtain a fused traffic feature graph set, includes the following steps:

[0107] S51: performing dimension transformation processing on each local flow feature map in the local flow feature map set to obtain a low-dimensional flow feature map set;

[0108] S52: Perform cross-attention calculation on each low-dimensional flow feature map in the low-dimensional flow feature map set and each global flow feature map in the global flow feature map set to obtain a cross-attention flow feature map set;

[0109] S53: constructing a feature parameter matrix based on each cross-attention flow feature map in the cross-attention flow feature map set and each global flow feature map in the global flow feature map set to obtain a feature parameter matrix set;

[0110] S54: Determine a fused flow feature map set based on a cross-attention flow feature map set, a global flow feature map set, and a feature parameter matrix set.

[0111] Among them, the low-dimensional traffic feature map set may include one or more low-dimensional traffic feature maps, which can be used to indicate the feature map obtained after the local traffic feature map is dimensionally transformed. Optionally, the server can transform the local traffic feature map from a three-dimensional vector to a two-dimensional vector, which is not limited in this application.

[0112] The cross-attention flow feature map set may include one or more cross-attention flow feature maps, which can be used to indicate the feature map obtained after the low-dimensional flow feature map and the global flow feature map are cross-attention calculated. Optionally, the specific content of the cross-attention calculation involved in this application can be found in the existing cross-attention calculation method, and this application will not be repeated here.

[0113] The feature parameter matrix set may include one or more feature parameter matrices, which can be used to indicate a learnable feature parameter matrix constructed based on a cross-attention flow feature map and a global flow feature map during model training.

[0114] Optionally, the server may perform matrix dot multiplication on the cross-attention flow feature map and the global flow feature map to construct a learnable feature parameter matrix corresponding to the dot product matrix (such as referred to as feature parameter matrix 1); the server may perform matrix concatenation on the cross-attention flow feature map and the global flow feature map to construct a learnable feature parameter matrix corresponding to the concatenated matrix (such as referred to as feature parameter matrix 2); the server may perform matrix addition on the cross-attention flow feature map and the global flow feature map to construct a learnable feature parameter matrix corresponding to the added matrix (such as referred to as feature parameter matrix 3); the server may take the maximum value of the cross-attention flow feature map and the global flow feature map according to the position to construct a learnable feature parameter matrix corresponding to the maximum value matrix (such as referred to as feature parameter matrix 4), and the present application does not impose any restrictions on this.

[0115] Optionally, the server determines a fusion flow feature map set based on a cross-attention flow feature map set, a global flow feature map set, and a feature parameter matrix set, as shown in the following formula:

[0116]

[0117] Among them, F can be used to represent the set of fused traffic feature maps; Elu can be used to represent the operation through the activation function Elu, the full name of the activation function Elu is Exponential Linear Unit, that is, exponential linear unit; W1 can be used to represent the feature parameter matrix 1 in the feature parameter matrix set; G can be used to represent the global traffic feature map set; G′ can be used to represent the cross-attention traffic feature map set, and T can be used to represent the transposition operation; GG′ T It can be used to represent the operation of matrix dot multiplication of the cross-attention flow feature map and the global flow feature map; W2 can be used to represent the feature parameter matrix 2 in the feature parameter matrix set; It can be used to represent the operation of matrix concatenating the cross-attention flow feature map and the global flow feature map; (G+G′) can be used to represent the operation of matrix addition of the cross-attention flow feature map and the global flow feature map; W3 can be used to represent the feature parameter matrix 3 in the feature parameter matrix set; W4 can be used to represent the feature parameter matrix 4 in the feature parameter matrix set; max(G, G′) can be used to represent the operation of taking the maximum value of the cross-attention flow feature map and the global flow feature map according to the position.

[0118] For steps S51-S54, the server performs dimensionality transformation processing on each local traffic feature map in the local traffic feature map set to obtain a low-dimensional traffic feature map set, and performs cross-attention calculation on each low-dimensional traffic feature map in the low-dimensional traffic feature map set and each global traffic feature map in the global traffic feature map set to obtain a cross-attention traffic feature map set, so that a feature parameter matrix can be constructed based on each cross-attention traffic feature map in the cross-attention traffic feature map set and each global traffic feature map in the global traffic feature map set to obtain a feature parameter matrix set, and then a fused traffic feature map set can be determined based on the cross-attention traffic feature map set, the global traffic feature map set and the feature parameter matrix set, which is beneficial for determining a more accurate malicious traffic classification result based on the fused traffic feature map set in subsequent steps, so as to effectively improve the accuracy of the malicious traffic classification process.

[0119] S60: Perform full connection processing on each fused traffic feature graph in the fused traffic feature graph set to obtain a malicious traffic classification probability.

[0120] Among them, the malicious traffic classification probability can be used to indicate the malicious traffic data in the set of traffic data to be classified, and the probability that the malicious traffic data belongs to a specific category. It should be noted that common network malicious traffic types include but are not limited to distributed denial of service (DDoS) attack traffic, malware propagation traffic, network scanning traffic, structured query language (SQL) injection and other attack traffic, and this application does not limit this.

[0121] It should be understood that the server can call the malicious traffic classification model to predict the above malicious traffic classification probability. Optionally, the server trains the initial malicious traffic classification model through training samples to obtain the malicious traffic classification model. The relevant process may include the following steps:

[0122] S61: Acquire a training sample, the training sample comprising: a training traffic data set to be classified, and a malicious traffic classification label corresponding to the training traffic data set to be classified; the malicious traffic classification label is used to indicate whether each training traffic data to be classified in the training traffic data set is malicious traffic data, and the specific category to which the malicious traffic data belongs;

[0123] S62: calling the initial malicious traffic classification model, performing malicious traffic classification processing on the training sample, and obtaining a training result;

[0124] S63: Based on the target loss function, the initial malicious traffic classification model is trained in a direction of reducing the difference between the training result and the malicious traffic classification label to obtain a malicious traffic classification model.

[0125] The training sample can be used to indicate the sample data involved in the training process. The training traffic data set to be classified can include one or more training traffic data to be classified, and the training traffic data to be classified can be used to indicate the traffic data that is not classified during the training process. The malicious traffic classification label can be used to indicate whether each training traffic data to be classified in the training traffic data set is malicious traffic data, and the specific category to which the malicious traffic data belongs.

[0126] The initial malicious traffic classification model can be used to indicate a malicious traffic classification model that has not been trained. The training result can be used to indicate the training result obtained after the initial malicious traffic classification model is trained through the training sample. It can be understood that the training result can be used to indicate whether each training traffic data to be classified in the training traffic data set is malicious traffic data, and the probability of the malicious traffic data belonging to a specific category.

[0127] Among them, the formula of the objective loss function is as follows:

[0128]

[0129] Among them, loss represents the target loss function; p nc represents the predicted probability that the malicious traffic category of the nth training sample is the cth category; N represents the number of training samples, n represents the index of the training sample; C represents the number of malicious traffic categories, that is, the number of specific categories to which the malicious traffic data belongs, and c represents the index of the malicious traffic category; γ is a hyperparameter, which represents the focusing degree coefficient; y nc Indicates that the malicious traffic category of the nth training sample is the true label of the cth category (i.e., 0 or 1); w c is a hyperparameter, representing the coefficient for balancing the importance of different categories; θ k is a hyperparameter, which represents the model parameter related to category c.

[0130] It is understandable that the server can perform supervised training on the initial malicious traffic classification model based on the target loss function in the direction of reducing the difference between the training results and the malicious traffic classification labels to obtain a malicious traffic classification model with more accurate prediction results, so that the server can use the malicious traffic classification model to make more accurate malicious traffic classification predictions for the classified traffic data set. This application does not impose any restrictions on this.

[0131] It can be seen that in the above scheme, the server obtains the traffic gray matter map set corresponding to the traffic data set to be classified, and extracts features of each traffic gray matter map in the traffic gray matter map data set to obtain a traffic feature map set, so as to extract global information from each traffic feature map in the traffic feature map set to obtain a global traffic feature map set, and extract local information from each traffic feature map in the traffic feature map set to obtain a local traffic feature map set, so that each global traffic feature map in the global traffic feature map set can be fused with each local traffic feature map in the local traffic feature map set to obtain a fused traffic feature map set, and then each fused traffic feature map in the fused traffic feature map set can be fully connected to obtain the malicious traffic classification probability, which is conducive to achieving the purpose of accurately detecting and classifying malicious network traffic.

[0132] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0133] In one embodiment, a malicious traffic classification device based on big data is provided, and the malicious traffic classification device based on big data corresponds one-to-one with the malicious traffic classification method based on big data in the above embodiment. Figure 3 As shown, the malicious traffic classification device based on big data includes an acquisition module 101, a first processing module 102, a second processing module 103, a third processing module 104, a fourth processing module 105 and a fifth processing module 106. The functional modules are described in detail as follows:

[0134] An acquisition module 101 is used to acquire a flow gray matter map set corresponding to a flow data set to be classified;

[0135] The first processing module 102 is used to extract features from each flow gray matter map in the flow gray matter map data set to obtain a flow feature map set;

[0136] The second processing module 103 is used to extract global information from each traffic feature graph in the traffic feature graph set to obtain a global traffic feature graph set;

[0137] The third processing module 104 is used to extract local information from each flow characteristic graph in the flow characteristic graph set to obtain a local flow characteristic graph set;

[0138] The fourth processing module 105 is used to fuse each global traffic feature graph in the global traffic feature graph set with each local traffic feature graph in the local traffic feature graph set to obtain a fused traffic feature graph set;

[0139] The fifth processing module 106 is used to perform full connection processing on each fused traffic feature graph in the fused traffic feature graph set to obtain a malicious traffic classification probability.

[0140] In one embodiment, the second processing module 103 is specifically used to perform dimensional expansion processing on each traffic feature graph in the traffic feature graph set to obtain a high-dimensional traffic feature graph set; perform a one-dimensional convolution operation on each high-dimensional traffic feature graph in the high-dimensional traffic feature graph set to obtain a first feature matrix; perform a linear transformation processing on each high-dimensional traffic feature graph in the high-dimensional traffic feature graph set to obtain a second feature matrix and a third feature matrix; update the first feature matrix according to the first feature matrix and the second feature matrix to obtain a fourth feature matrix; perform self-attention calculation according to the fourth feature matrix, the second feature matrix and the third feature matrix to obtain a global traffic feature graph set.

[0141] In one embodiment, the second processing module 103 is specifically used to obtain N eigenvectors from the second feature matrix to obtain a first eigenvector set; N is a positive integer; each first eigenvector in the first eigenvector set is subjected to maximum pooling processing with the first feature matrix to obtain a maximum pooling eigenvector; each first eigenvector in the first eigenvector set is subjected to average pooling processing with the first feature matrix to obtain an average pooling eigenvector; each first eigenvector in the first eigenvector set is subjected to minimum pooling processing with the first feature matrix to obtain a minimum pooling eigenvector; a selection parameter set is determined based on the maximum pooling eigenvector, the average pooling eigenvector and the minimum pooling eigenvector; each selection parameter in the selection parameter set is arranged in descending order, and the first M selection parameters are determined as a fourth feature matrix; M is a positive integer.

[0142] In one embodiment, the third processing module 104 is specifically used to perform linear transformation processing on each flow feature graph in the flow feature graph set to obtain a linear flow feature graph set; perform convolution operations of different convolution layers on each linear flow feature graph in the linear flow feature graph set to obtain a convolution flow feature graph set; obtain a reference first-layer convolution flow feature graph subset, a reference second-layer convolution flow feature graph subset and a reference third-layer convolution flow feature graph subset from the convolution flow feature graph set; fuse each reference first-layer convolution flow feature graph in the reference first-layer convolution flow feature graph subset with each reference second-layer convolution flow feature graph in the reference second-layer convolution flow feature graph subset to obtain a target second-layer convolution flow feature graph set; fuse each reference third-layer convolution flow feature graph in the reference third-layer convolution flow feature graph subset with each target second-layer convolution flow feature graph in the target second-layer convolution flow feature graph set to obtain a target third-layer convolution flow feature graph set; determine the target third-layer convolution flow feature graph set as a local flow feature graph set.

[0143] In one embodiment, the third processing module 104 is specifically used to perform deconvolution processing on each first-layer convolution flow feature map in the first-layer convolution flow feature map subset to obtain a deconvolution flow feature map set; perform local attention extraction on each deconvolution flow feature map in the deconvolution flow feature map set and each second-layer convolution flow feature map in the second-layer convolution flow feature map subset to obtain a local attention flow feature map set; perform global attention extraction on each deconvolution flow feature map in the deconvolution flow feature map set and each second-layer convolution flow feature map in the second-layer convolution flow feature map subset to obtain a global attention flow feature map set; perform activation processing on each local attention flow feature map in the local attention flow feature map set and each global attention flow feature map in the global attention flow feature map set to obtain flow feature weight data; determine the target second-layer convolution flow feature map set according to the deconvolution flow feature map set, the second-layer convolution flow feature map subset and the flow feature weight data.

[0144] In one embodiment, the fourth processing module 105 is specifically used to perform dimensionality transformation processing on each local traffic feature map in the local traffic feature map set to obtain a low-dimensional traffic feature map set; perform cross-attention calculation on each low-dimensional traffic feature map in the low-dimensional traffic feature map set and each global traffic feature map in the global traffic feature map set to obtain a cross-attention traffic feature map set; construct a feature parameter matrix based on each cross-attention traffic feature map in the cross-attention traffic feature map set and each global traffic feature map in the global traffic feature map set to obtain a feature parameter matrix set; determine a fused traffic feature map set based on the cross-attention traffic feature map set, the global traffic feature map set and the feature parameter matrix set.

[0145] In one embodiment, the fifth processing module 106 is specifically used to obtain a training sample, where the training sample includes: a training traffic data set to be classified, and a malicious traffic classification label corresponding to the training traffic data set to be classified; the malicious traffic classification label is used to indicate whether each training traffic data to be classified in the training traffic data set is malicious traffic data, and the specific category to which the malicious traffic data belongs; calling the initial malicious traffic classification model, performing malicious traffic classification processing on the training sample, and obtaining a training result; based on the target loss function, training the initial malicious traffic classification model in the direction of reducing the difference between the training result and the malicious traffic classification label, and obtaining a malicious traffic classification model;

[0146] Among them, the formula of the objective loss function is as follows:

[0147]

[0148] Among them, loss represents the target loss function; p ic represents the predicted probability that the malicious traffic category of the i-th training sample is the c-th category; γ is a hyperparameter, which represents the focusing coefficient; N represents the number of training samples, i represents the index of the training sample; C represents the number of malicious traffic categories, that is, the number of specific categories to which the malicious traffic data belongs, and c represents the index of the malicious traffic category; y ic Indicates that the malicious traffic category of the i-th training sample is the true label of the c-th category (i.e., 0 or 1); w c is a hyperparameter, representing the coefficient for balancing the importance of different categories; θ k is a hyperparameter, which represents the model parameter related to category c.

[0149] The present invention provides a malicious traffic classification device based on big data, which obtains a traffic gray map set corresponding to a traffic data set to be classified, and performs feature extraction on each traffic gray map in the traffic gray map data set to obtain a traffic feature map set, so as to perform global information extraction on each traffic feature map in the traffic feature map set to obtain a global traffic feature map set, and perform local information extraction on each traffic feature map in the traffic feature map set to obtain a local traffic feature map set, so that each global traffic feature map in the global traffic feature map set can be fused with each local traffic feature map in the local traffic feature map set to obtain a fused traffic feature map set, and then each fused traffic feature map in the fused traffic feature map set can be fully connected to obtain a malicious traffic classification probability, which is conducive to achieving the purpose of accurately detecting and classifying network malicious traffic.

[0150] For the specific definition of the malicious traffic classification device based on big data, please refer to the definition of the malicious traffic classification method based on big data above, which will not be repeated here. Each module in the above-mentioned malicious traffic classification device based on big data can be implemented in whole or in part through software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0151] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 4As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile and / or volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external client through a network connection. When the computer program is executed by the processor, it realizes the functions or steps on the server side of a malicious traffic classification method based on big data.

[0152] In one embodiment, a computer device is provided. The computer device may be a client, and its internal structure diagram may be as follows: Figure 5 As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external server via a network connection. When the computer program is executed by the processor, it implements the functions or steps on the client side of a malicious traffic classification method based on big data.

[0153] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the following steps are implemented:

[0154] Obtain a set of traffic gray matter maps corresponding to the set of traffic data to be classified;

[0155] Extract features from each flow gray matter map in the flow gray matter map data set to obtain a flow feature map set;

[0156] Extracting global information from each traffic feature graph in the traffic feature graph set to obtain a global traffic feature graph set;

[0157] Extracting local information from each flow feature graph in the flow feature graph set to obtain a local flow feature graph set;

[0158] Fusing each global traffic feature graph in the global traffic feature graph set with each local traffic feature graph in the local traffic feature graph set to obtain a fused traffic feature graph set;

[0159] Each fused traffic feature graph in the fused traffic feature graph set is fully connected to obtain the malicious traffic classification probability.

[0160] The present invention provides a computer device, which obtains a flow gray map set corresponding to a flow data set to be classified, and performs feature extraction on each flow gray map in the flow gray map data set to obtain a flow feature map set, so as to perform global information extraction on each flow feature map in the flow feature map set to obtain a global flow feature map set, and perform local information extraction on each flow feature map in the flow feature map set to obtain a local flow feature map set, so that each global flow feature map in the global flow feature map set can be fused with each local flow feature map in the local flow feature map set to obtain a fused flow feature map set, and then each fused flow feature map in the fused flow feature map set can be fully connected to obtain a malicious flow classification probability, which is conducive to achieving the purpose of accurately detecting and classifying network malicious flow.

[0161] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0162] Obtain a set of traffic gray matter graphs corresponding to the set of traffic data to be classified;

[0163] Extract features from each flow gray matter map in the flow gray matter map data set to obtain a flow feature map set;

[0164] Extracting global information from each traffic feature graph in the traffic feature graph set to obtain a global traffic feature graph set;

[0165] Extracting local information from each flow feature graph in the flow feature graph set to obtain a local flow feature graph set;

[0166] Fusing each global traffic feature graph in the global traffic feature graph set with each local traffic feature graph in the local traffic feature graph set to obtain a fused traffic feature graph set;

[0167] Each fused traffic feature graph in the fused traffic feature graph set is fully connected to obtain the malicious traffic classification probability.

[0168] The present invention provides a computer-readable storage medium, which obtains a flow gray map set corresponding to a flow data set to be classified, and performs feature extraction on each flow gray map in the flow gray map data set to obtain a flow feature map set, so as to perform global information extraction on each flow feature map in the flow feature map set to obtain a global flow feature map set, and perform local information extraction on each flow feature map in the flow feature map set to obtain a local flow feature map set, so that each global flow feature map in the global flow feature map set can be fused with each local flow feature map in the local flow feature map set to obtain a fused flow feature map set, and then each fused flow feature map in the fused flow feature map set can be fully connected to obtain a malicious flow classification probability, which is conducive to achieving the purpose of accurately detecting and classifying network malicious traffic.

[0169] It should be noted that the above functions or steps that can be implemented by the computer-readable storage medium or computer device can refer to the relevant descriptions on the server side and the client side in the aforementioned method embodiment. To avoid repetition, they will not be described one by one here.

[0170] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0171] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0172] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A malicious traffic classification method based on big data, characterized in that: The malicious traffic classification method based on big data includes: Obtain a set of traffic gray matter graphs corresponding to the set of traffic data to be classified; Extracting features from each flow gray matter map in the flow gray matter map data set to obtain a flow feature map set; Extracting global information from each flow characteristic graph in the flow characteristic graph set to obtain a global flow characteristic graph set; Extracting local information from each flow feature graph in the flow feature graph set to obtain a local flow feature graph set; Fusing each global traffic feature graph in the global traffic feature graph set with each local traffic feature graph in the local traffic feature graph set to obtain a fused traffic feature graph set; Performing full connection processing on each fused traffic feature graph in the fused traffic feature graph set to obtain a malicious traffic classification probability; The extracting global information from each flow characteristic graph in the flow characteristic graph set to obtain a global flow characteristic graph set includes: Performing dimension expansion processing on each flow feature graph in the flow feature graph set to obtain a high-dimensional flow feature graph set; Performing a one-dimensional convolution operation on each high-dimensional flow feature graph in the high-dimensional flow feature graph set to obtain a first feature matrix; Performing linear transformation on each high-dimensional flow feature graph in the high-dimensional flow feature graph set to obtain a second feature matrix and a third feature matrix; According to the first characteristic matrix and the second characteristic matrix, updating the first characteristic matrix to obtain a fourth characteristic matrix; Perform self-attention calculation according to the fourth feature matrix, the second feature matrix and the third feature matrix to obtain a set of global traffic feature maps; The updating process of the first characteristic matrix to obtain a fourth characteristic matrix according to the first characteristic matrix and the second characteristic matrix includes: Obtaining N eigenvectors from the second eigenmatrix to obtain a first eigenvector set; N is a positive integer; Performing maximum pooling processing on each first eigenvector in the first eigenvector set and the first eigenmatrix to obtain a maximum pooled eigenvector; Performing average pooling processing on each first eigenvector in the first eigenvector set and the first eigenmatrix to obtain an average pooled eigenvector; Performing minimum pooling processing on each first eigenvector in the first eigenvector set and the first eigenmatrix to obtain a minimum pooling eigenvector; Determining a selection parameter set according to the maximum pooling feature vector, the average pooling feature vector, and the minimum pooling feature vector; Arrange each selection parameter in the selection parameter set in descending order, and determine the first M selection parameters as the fourth characteristic matrix; M is a positive integer; The extracting local information from each flow feature graph in the flow feature graph set to obtain a local flow feature graph set includes: Performing linear transformation on each flow characteristic graph in the flow characteristic graph set to obtain a linear flow characteristic graph set; Performing convolution operations of different convolution layers on each linear flow feature graph in the linear flow feature graph set to obtain a convolution flow feature graph set; Obtaining a reference first-layer convolutional flow feature map subset, a reference second-layer convolutional flow feature map subset, and a reference third-layer convolutional flow feature map subset from the convolutional flow feature map set; Fusing each reference first-layer convolutional flow feature map in the reference first-layer convolutional flow feature map subset with each reference second-layer convolutional flow feature map in the reference second-layer convolutional flow feature map subset to obtain a target second-layer convolutional flow feature map set; Fusing each reference third-layer convolutional flow feature map in the reference third-layer convolutional flow feature map subset with each target second-layer convolutional flow feature map in the target second-layer convolutional flow feature map set to obtain a target third-layer convolutional flow feature map set; The target third-layer convolutional flow feature map set is determined as a local flow feature map set.

2. The method for classifying malicious traffic based on big data according to claim 1 is characterized in that: The step of fusing each first-layer convolutional flow feature graph in the first-layer convolutional flow feature graph subset with each second-layer convolutional flow feature graph in the second-layer convolutional flow feature graph subset to obtain a target second-layer convolutional flow feature graph set includes: Deconvolution is performed on each first-layer convolution flow feature map in the first-layer convolution flow feature map subset to obtain a deconvolution flow feature map set; Performing local attention extraction on each deconvolution flow feature map in the deconvolution flow feature map set and each second-layer convolution flow feature map in the second-layer convolution flow feature map subset to obtain a local attention flow feature map set; Performing global attention extraction on each deconvolution flow feature map in the deconvolution flow feature map set and each second-layer convolution flow feature map in the second-layer convolution flow feature map subset to obtain a global attention flow feature map set; Activate each local attention flow feature map in the local attention flow feature map set and each global attention flow feature map in the global attention flow feature map set to obtain flow feature weight data; A target second-layer convolutional flow feature map set is determined according to the deconvolutional flow feature map set, the second-layer convolutional flow feature map subset and the flow feature weight data.

3. The method for classifying malicious traffic based on big data according to claim 2 is characterized in that: The step of fusing each global traffic feature graph in the global traffic feature graph set with each local traffic feature graph in the local traffic feature graph set to obtain a fused traffic feature graph set includes: Performing dimensionality transformation on each local flow feature graph in the local flow feature graph set to obtain a low-dimensional flow feature graph set; Perform cross-attention calculation on each low-dimensional flow feature graph in the low-dimensional flow feature graph set and each global flow feature graph in the global flow feature graph set to obtain a cross-attention flow feature graph set; Constructing a feature parameter matrix based on each cross-attention flow feature graph in the cross-attention flow feature graph set and each global flow feature graph in the global flow feature graph set to obtain a feature parameter matrix set; A fused flow feature map set is determined based on the cross-attention flow feature map set, the global flow feature map set and the feature parameter matrix set.

4. The method for classifying malicious traffic based on big data according to any one of claims 1 to 3, characterized in that: The malicious traffic classification probability is predicted by calling the malicious traffic classification model; The method further comprises: Acquire a training sample, wherein the training sample includes: a training traffic data set to be classified, and a malicious traffic classification label corresponding to the training traffic data set to be classified; the malicious traffic classification label is used to indicate whether each training traffic data to be classified in the training traffic data set is malicious traffic data, and the specific category to which the malicious traffic data belongs; Calling the initial malicious traffic classification model, performing malicious traffic classification processing on the training sample, and obtaining a training result; Based on the target loss function, the initial malicious traffic classification model is trained in a direction of reducing the difference between the training result and the malicious traffic classification label to obtain the malicious traffic classification model; Among them, the formula of the objective loss function is as follows: Among them, loss represents the target loss function; p ic represents the predicted probability that the malicious traffic category of the i-th training sample is the c-th category, γ is a hyperparameter, which represents the focusing coefficient, N represents the number of training samples, i represents the index of the training sample; C represents the number of malicious traffic categories, that is, the number of specific categories to which the malicious traffic data belongs, and c represents the index of the malicious traffic category; y ic Indicates that the malicious traffic category of the i-th training sample is the true label of the c-th category; w c is a hyperparameter, representing the coefficient for balancing the importance of different categories, θ k The hyperparameter represents the model parameter related to category c.

5. A malicious traffic classification device based on big data, characterized in that: The malicious traffic classification device based on big data includes: An acquisition module, used to acquire a set of traffic gray matter maps corresponding to a set of traffic data to be classified; A first processing module is used to extract features from each flow gray matter map in the flow gray matter map data set to obtain a flow feature map set; A second processing module is used to extract global information from each flow characteristic graph in the flow characteristic graph set to obtain a global flow characteristic graph set; A third processing module is used to extract local information from each flow characteristic graph in the flow characteristic graph set to obtain a local flow characteristic graph set; A fourth processing module, used for fusing each global traffic feature graph in the global traffic feature graph set with each local traffic feature graph in the local traffic feature graph set to obtain a fused traffic feature graph set; A fifth processing module, configured to perform full connection processing on each fused traffic feature graph in the fused traffic feature graph set to obtain a malicious traffic classification probability; The second processing module is specifically used to perform dimensional expansion processing on each flow feature map in the flow feature map set to obtain a high-dimensional flow feature map set; perform a one-dimensional convolution operation on each high-dimensional flow feature map in the high-dimensional flow feature map set to obtain a first feature matrix; perform a linear transformation processing on each high-dimensional flow feature map in the high-dimensional flow feature map set to obtain a second feature matrix and a third feature matrix; update the first feature matrix according to the first feature matrix and the second feature matrix to obtain a fourth feature matrix; perform self-attention calculation according to the fourth feature matrix, the second feature matrix and the third feature matrix to obtain a global flow feature map set; The second processing module is specifically used to obtain N eigenvectors from the second feature matrix to obtain a first eigenvector set; N is a positive integer; each first eigenvector in the first eigenvector set is subjected to maximum pooling processing with the first feature matrix to obtain a maximum pooling eigenvector; each first eigenvector in the first eigenvector set is subjected to average pooling processing with the first feature matrix to obtain an average pooling eigenvector; each first eigenvector in the first eigenvector set is subjected to minimum pooling processing with the first feature matrix to obtain a minimum pooling eigenvector; a selection parameter set is determined according to the maximum pooling eigenvector, the average pooling eigenvector and the minimum pooling eigenvector; each selection parameter in the selection parameter set is arranged in descending order, and the first M selection parameters are determined as a fourth feature matrix; M is a positive integer; The third processing module is specifically used to perform linear transformation processing on each flow feature graph in the flow feature graph set to obtain a linear flow feature graph set; perform convolution operations of different convolution layers on each linear flow feature graph in the linear flow feature graph set to obtain a convolution flow feature graph set; obtain a reference first-layer convolution flow feature graph subset, a reference second-layer convolution flow feature graph subset and a reference third-layer convolution flow feature graph subset from the convolution flow feature graph set; fuse each reference first-layer convolution flow feature graph in the reference first-layer convolution flow feature graph subset with each reference second-layer convolution flow feature graph in the reference second-layer convolution flow feature graph subset to obtain a target second-layer convolution flow feature graph set; fuse each reference third-layer convolution flow feature graph in the reference third-layer convolution flow feature graph subset with each target second-layer convolution flow feature graph in the target second-layer convolution flow feature graph set to obtain a target third-layer convolution flow feature graph set; determine the target third-layer convolution flow feature graph set as a local flow feature graph set.

6. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the malicious traffic classification method based on big data is implemented as described in any one of claims 1 to 4.

7. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the malicious traffic classification method based on big data as described in any one of claims 1 to 4 is implemented.

Images