A network attack detection method based on time embedding representation and frequency domain information

Abstract

The present invention discloses a network attack detection method based on time embedding and frequency domain information; the method learns the distribution pattern of normal traffic based on the time domain and frequency domain characteristics of the traffic, and detects the attack traffic accordingly. First, the traffic acquisition and processing module acquires and parses the original bit stream, then the traffic feature extraction module extracts its features, and then the feature learning module learns the frequency domain features of the traffic and the time series features after time embedding respectively, and finally the threat detection module fully integrates the two parts of features, and uses them to reconstruct and score the traffic as anomalies. This method integrates the distribution characteristics of the traffic sequence in the time domain and frequency domain, reduces the impact of noise data, and strengthens the correlation of the time series features of the traffic, so it can effectively improve the accuracy of detection.

Description

Technical Field

[0001] The present invention relates to the field of network attack traffic detection, and in particular to a network attack detection method based on time embedding representation and frequency domain information. Background Art

[0002] In recent years, with the continuous development of information and communications technologies, internet applications have experienced explosive growth, and the frequency and scale of intrusions targeting computer networks have also shown a gradual increase. Network intrusions refer to unauthorized or illegal requests to access computer network resources. Common types of network attacks include denial of service attacks, distributed denial of service attacks, ransomware attacks, network backdoors, brute force attacks, and side-channel attacks. These attacks typically aim to compromise the integrity, confidentiality, or availability of network information resources.

[0003] In addition to firewalls, data encryption, and antivirus software, common network intrusion protection strategies include intrusion detection systems (IDS). Currently, network intrusion detection systems are primarily divided into two research directions: signature-based intrusion detection and anomaly-based intrusion detection. The former identifies malicious behavior within the network by detecting known attack patterns or features. While highly accurate, it also suffers from three significant shortcomings: first, signature matching requires significant hardware resources; second, the signature library must be updated in real time by a team of experts; and third, it can only match attack patterns already in the signature library and cannot detect unknown attacks. In contrast, anomaly-based intrusion detection identifies potential security threats or abnormal activity within the network by identifying traffic or events that do not conform to normal behavior patterns. Therefore, it is more suitable for detecting unknown attacks.

[0004] In recent years, research on anomaly-based network intrusion detection has made significant progress, but several challenges remain. First, there is the reliance on high-quality training data. Traffic labeling in real networks is time-consuming and requires significant expertise. Therefore, we employ an unsupervised training approach that eliminates the need for data labeling. Second, there is sensitivity to noisy data. Traffic is often subject to noise during transmission, influenced by the transmission medium and channel. This noisy data hinders the model from learning normal traffic behavior, preventing it from forming a clear decision boundary and ultimately impacting attack identification performance. To address this, we filter noisy sessions during traffic parsing and perform FFT on the extracted feature samples to remove noise. Finally, existing work fails to adequately capture the temporal characteristics of traffic. Traffic is bursty, so network sessions not only have a sequential order but also contain varying temporal intervals. This information is crucial for learning normal traffic behavior. To this end, we compute session timestamps and use them to construct time embedding codes to enhance the temporal characteristics of traffic. Summary of the Invention

[0005] The purpose of the present invention is to address the deficiencies of the prior art and provide a network attack detection method based on time embedding representation and frequency domain information.

[0006] The object of the present invention is achieved through the following technical solutions:

[0007] A network attack detection method based on time embedding representation and frequency domain information includes the following steps:

[0008] Step 1: Obtain network traffic data from the network card interface or local log file through the traffic collection and processing module, and standardize its format into pcap type;

[0009] Step 2: Use the feature extraction module to parse the raw network traffic, extract session-by-session features, and perform data cleaning.

[0010] Step 3: Construct temporal embedded representations using the extracted session features;

[0011] Step 4: Learn the time domain and frequency domain feature distribution of traffic through the feature learning module; the feature learning module consists of two embedding layers and two stacked N layers of Transformer encoders, namely embedding layer i, embedding layer ii, frequency domain encoder and time domain encoder, where the feature dimension of each encoder is d model , the number of heads of the multi-head self-attention mechanism is H; in the frequency domain encoder part, the data in the input window is fast Fourier transformed, and the frequency domain distribution characteristics of the traffic session are introduced into the encoder, and then the feature dimension is converted into d through the embedding layer i modelFinally, the frequency domain encoder accepts this part of the embedding representation as input; the time domain encoder part converts the data of the input window into the feature dimension d through the embedding layer ⅱ model , and then added bit by bit with the time embedding code, and the final embedding representation is used as the input of the time domain encoder;

[0012] Step 5: The feature representations of the two encoders are fused through the threat detection module, and the traffic feature reconstruction error is calculated. The threat detection module consists of a normalization layer and a fully connected layer. It fuses the results output by the feature learning module by bit-by-bit addition, then reconstructs the features through the normalization layer and the fully connected layer, and calculates the reconstruction error using the mean square error.

[0013] Furthermore, step 2 is specifically as follows: parsing the original network traffic through the feature extraction module, extracting quintuple information packet by packet, and classifying the data packets to obtain network sessions; at the same time, deleting network sessions with less than 3 data packets; then, the feature extraction module converts the network sessions into feature vectors containing 28 features. After feature extraction, invalid feature values ​​are replaced with 0, so that each feature vector with a length of 28 represents a complete network session, and a sliding window is used to construct the input of the subsequent model. The sliding step size is set to S and the window size is set to W, that is, each input window has W feature sequences with a length of 28.

[0014] Furthermore, the five-tuple information includes source IP address, destination IP address, source port number, destination port number, and transport layer protocol.

[0015] Furthermore, the 28 features are: source port, transport layer protocol, destination port, session duration, number of forward packets, number of backward packets, total size of forward packets, total size of backward packets, maximum forward packet size, minimum forward packet size, average size of forward packets, standard deviation of forward packet size, maximum backward packet size, minimum backward packet size, average size of backward packets, standard deviation of backward packet size, average byte rate of session, packet transmission rate of session, number of packets with urg identifier, number of packets with push identifier, number of packets with reset identifier, number of packets with syn identifier, number of packets with ack identifier, number of packets with fin identifier, number of forward packets with payload, number of backward packets with payload, total size of forward payload, total size of backward payload.

[0016] Furthermore, the step 3 is specifically as follows:

[0017] First, extract the feature of the session duration dimension within the input window, represented as a vector T, whose length is the window W, and i represents the sequence number of the session sequence within the window. Calculate the session timestamp vector T'. The specific calculation method is:

[0018]

[0019] Scaling the value of T' yields T", which is calculated as:

[0020]

[0021] Then, the sin / cos position encoding method in the Transformer structure is used to replace the original incremental position information with the timestamp information of each session. The calculation method is as follows:

[0022]

[0023] Among them, d model is the word embedding dimension of Transformer, TE (i,2j) and TE (i,2j+1) They represent the temporal embedded representations of the 2j-th and 2j+1-th dimensions at time scale i, respectively, and j is the dimension index.

[0024] Furthermore, the step 5 is specifically as follows: using the reconstruction error as the training loss in the training phase, the loss function is as follows:

[0025]

[0026] Where n represents the number of samples, x represents the true value of the i-th sample, Represents the model's predicted value for the i-th sample;

[0027] In the attack detection phase, the reconstruction error is used as the anomaly score, which is calculated as follows:

[0028]

[0029] Where n represents the number of samples, x represents the true value of the i-th sample, Represents the model's predicted value for the i-th sample.

[0030] A network attack detection system based on time embedding representation and frequency domain information for implementing the above method comprises:

[0031] Traffic collection and processing module, used to obtain network traffic data from the network card interface or local log files, and standardize its format into pcap type;

[0032] Feature extraction module, used to parse raw network traffic, extract session-by-session features, and perform data cleaning;

[0033] A feature learning module is used to learn the time domain and frequency domain feature distribution of traffic. The feature learning module consists of two embedding layers and two N-layer stacked Transformer encoders.

[0034] The threat detection module is used to fuse the feature representations of the two encoders and calculate the traffic feature reconstruction error; the threat detection module consists of a normalization layer and a fully connected layer.

[0035] The beneficial effects of the present invention are:

[0036] 1. Detecting unknown attacks. The model of this invention uses unsupervised training and is not limited to existing fixed attack patterns. It learns the behavior and distribution patterns of normal traffic, marks traffic that deviates from the normal traffic distribution, and finally calculates the anomaly score of the traffic based on the reconstruction error. Traffic exceeding a preset threshold is defined as attack traffic.

[0037] 2. Noise resistance. The presence of a large amount of noise data in the network can interfere with detection results. This invention first filters out invalid noise conversations in the network in the feature extraction module. It then uses Fast Fourier Transformation (FFT) to denoise the extracted traffic features, filtering out noise data caused by network instability, delays, and other factors, thereby improving the detection model's overall noise resistance.

[0038] 3. Better detection performance. First, the present invention adopts the Transformer encoder. Compared with network structures such as recurrent neural networks, long short-term memory networks, and autoencoders, the self-attention mechanism is more conducive to capturing the global relationship of sequences. Secondly, the time information embedding coding strengthens the timing and interval information between network sessions and has richer timing features. Finally, the frequency domain encoder introduces the frequency domain information of traffic distribution. By fusing the time domain and frequency domain features, the model can fully explore the global correlation and time domain and frequency domain distribution laws of network sessions to achieve better detection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is the overall architecture diagram of the present invention. DETAILED DESCRIPTION

[0040] The present invention will be described in detail below with reference to the accompanying drawings. Unless there is any conflict, the features of the following embodiments and implementations may be combined with each other.

[0041] See also Figure 1The present invention provides a network attack detection method based on time embedding and frequency domain information. The method learns the distribution pattern of normal traffic based on the time domain and frequency domain characteristics of the traffic, and detects attack traffic accordingly. First, the traffic acquisition and processing module collects and parses the original bit stream, then the traffic feature extraction module extracts its features, and then the feature learning module learns the frequency domain features of the traffic and the time series features after time embedding respectively. Finally, the threat detection module fully integrates the two parts of features and uses them to reconstruct and score the traffic as anomalies. This method integrates the distribution characteristics of the traffic sequence in the time domain and frequency domain, reduces the impact of noise data, and strengthens the correlation of the time series features of the traffic, so it can effectively improve the detection accuracy.

[0042] The method specifically comprises the following steps:

[0043] Step 1: The traffic collection and processing module obtains network traffic data from the network interface or local log file and formats it as a PCAP file. PCAP is a file type created by network traffic capture tools such as Wireshark and TCPDump. It contains raw network traffic data that can be analyzed to help understand network behavior, identify problems, and detect malicious activity. The magic number at the beginning of the file is '0xA1B2C3D4'. Classic PCAP files have a magic number at the beginning to verify whether the file is in a valid PCAP file format and to determine the byte order.

[0044] Step 2: The feature extraction module parses the raw network traffic, extracts features from each session, and performs data cleaning. First, the feature extraction module parses the raw network traffic, specifically extracting five-tuple information packet by packet: source IP address, destination IP address, source port number, destination port number, and transport layer protocol. This information is then used to classify packets into network sessions. Sessions with fewer than three packets are also deleted. Extensive research has shown that these sessions are often noise and invalid, making them insignificant for network attack detection.

[0045] Then, the feature extraction module converts the network session into a feature vector form containing 28 features, where the 28 features are: source port, transport layer protocol, destination port, session duration, number of forward packets, number of backward packets, total size of forward packets, total size of backward packets, maximum forward packet size, minimum forward packet size, average size of forward packets, standard deviation of forward packet size, maximum backward packet size, minimum backward packet size, average size of backward packets, standard deviation of backward packet size, average byte rate of the session, packet transmission rate of the session, number of packets with urg identifier, number of packets with push identifier, number of packets with reset identifier, number of packets with syn identifier, number of packets with ack identifier, number of packets with fin identifier, number of forward packets with payload, number of backward packets with payload, total size of forward payload, and total size of backward payload. After feature extraction, invalid feature values ​​are replaced with 0. In this way, each feature vector of length 28 represents a complete network session. The input of the subsequent model is constructed using a sliding window method. The sliding step size is set to S and the window size is set to W. That is, each input window has W feature sequences of length 28.

[0046] Step 3: Construct a temporal embedded representation using the extracted session features. First, extract the session duration feature within the input window and represent it as a vector T, whose length is the window W. i represents the sequence number of the session within the window, ranging from 1 to W. Then, calculate the session timestamp vector T'. The specific calculation method is:

[0047]

[0048] In order to constrain the size of the session timestamp to a reasonable range, it is necessary to scale the value of T' to obtain T", the method is:

[0049]

[0050] Then, the sin / cos position encoding method in the Transformer structure is used to replace the original incremental position information with the timestamp information of each session. The method is as follows:

[0051]

[0052] Among them, d model is the word embedding dimension of Transformer, TE (i,2j) and TE (i,2j+1) They represent the time embedded representation of the 2jth and 2j+1th dimensions on time scale i respectively; j is the dimension index, which ranges from 0 to d model / 2; i is the sequence number of the session sequence within the window. Compared to the original incremental sin / cos positional encoding, the improved embedded encoding strengthens the temporal association of sessions in terms of order and interval, rather than simply reflecting the sequential relationship between sessions.

[0053] Step 4: The feature learning module learns the time domain and frequency domain feature distribution of the traffic respectively. This module consists of two embedding layers and two stacked N layers of Transformer encoders, namely embedding layer i, embedding layer ii, frequency domain encoder and time domain encoder, where the feature dimension of each encoder is d model , the number of heads of the multi-head self-attention mechanism is H, to ensure that d model can be divided by H. In the frequency domain encoder part, the data in the input window is first fast Fourier transformed. This step is to remove the noise in the network and introduce the frequency domain distribution characteristics of the traffic session into the encoder. Then, the feature dimension is converted to d through the embedding layer i. model Finally, the frequency domain encoder accepts this part of the embedded representation as input. In the time domain encoder, the data of the input window is first converted into the feature dimension d by the embedding layer ii. model , and then added bit by bit with the temporal embedding code, and the final embedding representation is used as the input of the time domain encoder.

[0054] Step 5: The threat detection module fuses the feature representations of the two encoders and calculates the traffic feature reconstruction error. This module consists of a normalization layer and a fully connected layer. It fuses the outputs of the feature learning module by bit-by-bit addition. It then reconstructs the features through the normalization layer and the fully connected layer, and calculates the reconstruction error using mean squared error.

[0055] During the training phase, the reconstruction error is used as the training loss, and the loss function is as follows:

[0056]

[0057] Where n represents the number of samples, x represents the true value of the i-th sample in the window, Represents the model's predicted value for the i-th sample. When minimizing the loss function, the model parameters are updated through backpropagation, allowing the model to better fit the behavior pattern and distribution law of normal traffic through training, and the threshold of the abnormal score is obtained based on the training loss or experience.

[0058] In the attack detection phase, the reconstruction error is used as the anomaly score. The anomaly score calculation is as follows:

[0059]

[0060] Where n represents the number of samples, x represents the true value of the i-th sample, Represents the model's predicted value for the i-th sample. Traffic with anomaly scores greater than 3δ of the mean of the training anomaly scores can be considered attack traffic.

[0061] The present invention also provides a network attack detection system based on time embedding representation and frequency domain information for implementing the above method, comprising:

[0062] Traffic collection and processing module, used to obtain network traffic data from the network card interface or local log files, and standardize its format into pcap type;

[0063] Feature extraction module, used to parse raw network traffic, extract session-by-session features, and perform data cleaning;

[0064] A feature learning module is used to learn the time domain and frequency domain feature distribution of traffic. The feature learning module consists of two embedding layers and two N-layer stacked Transformer encoders.

[0065] The threat detection module is used to fuse the feature representations of the two encoders and calculate the traffic feature reconstruction error; the threat detection module consists of a normalization layer and a fully connected layer.

[0066] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

[0067] The above embodiments are intended only to illustrate the design concepts and features of the present invention. Their purpose is to enable those skilled in the art to understand the contents of the present invention and implement them accordingly. The scope of protection of the present invention is not limited to the above embodiments. Therefore, any equivalent changes or modifications made based on the principles and design concepts disclosed in the present invention are within the scope of protection of the present invention.

Claims

1. A network attack detection method based on time embedding representation and frequency domain information, characterized in that: The following steps are involved: Step 1: Obtain network traffic data from the network card interface or local log file through the traffic collection and processing module, and standardize its format into pcap type; Step 2: Use the feature extraction module to parse the raw network traffic, extract session-by-session features, and perform data cleaning. Step 3: Construct temporal embedded representations using the extracted session features; Step 4: Learn the time domain and frequency domain feature distribution of traffic through the feature learning module; The feature learning module consists of two embedding layers and two stacked N-layer Transformer encoders, respectively called embedding layer i, embedding layer ii, frequency domain encoder and time domain encoder, where the feature dimension of each encoder is d model , the number of heads of the multi-head self-attention mechanism is H; in the frequency domain encoder part, the data in the input window is fast Fourier transformed, and the frequency domain distribution characteristics of the traffic session are introduced into the encoder, and then the feature dimension is converted into d through the embedding layer i model Finally, the frequency domain encoder accepts this part of the embedding representation as input; the time domain encoder part converts the data of the input window into the feature dimension d through the embedding layer ⅱ model , and then added bit by bit with the time embedding code, and the final embedding representation is used as the input of the time domain encoder; Step 5: The feature representations of the two encoders are fused through the threat detection module, and the traffic feature reconstruction error is calculated. The threat detection module consists of a normalization layer and a fully connected layer. It fuses the results output by the feature learning module by bit-by-bit addition, then reconstructs the features through the normalization layer and the fully connected layer, and calculates the reconstruction error using the mean square error.

2. The network attack detection method based on time embedding representation and frequency domain information according to claim 1 is characterized in that: Step 2 specifically includes: parsing the original network traffic through a feature extraction module, extracting quintuple information packet by packet, and classifying the data packets to obtain network sessions; simultaneously deleting network sessions with fewer than three data packets; then, converting the network sessions into feature vectors containing 28 features by the feature extraction module. After feature extraction, invalid feature values ​​are replaced with 0, so that each feature vector of length 28 represents a complete network session. A sliding window is used to construct the input of the subsequent model, with the sliding step size set to S and the window size set to W, i.e., each input window has W feature sequences of length 28.

3. The network attack detection method based on time embedding representation and frequency domain information according to claim 2 is characterized in that: The five-tuple information includes source IP address, destination IP address, source port number, destination port number, and transport layer protocol.

4. The network attack detection method based on time embedding representation and frequency domain information according to claim 2 is characterized in that: The 28 features are: source port, transport layer protocol, destination port, session duration, number of forward packets, number of backward packets, total size of forward packets, total size of backward packets, maximum forward packet size, minimum forward packet size, average size of forward packets, standard deviation of forward packet size, maximum backward packet size, minimum backward packet size, average size of backward packets, standard deviation of backward packet size, average byte rate of session, packet transmission rate of session, number of packets with urg flag, number of packets with push flag, number of packets with reset flag, number of packets with syn flag, number of packets with ack flag, number of packets with fin flag, number of forward packets with payload, number of backward packets with payload, total size of forward payload, total size of backward payload.

5. The network attack detection method based on time embedding representation and frequency domain information according to claim 1 is characterized in that: The step 3 is specifically as follows: First, extract the feature of the session duration dimension within the input window, represented as a vector T, whose length is the window W, and i represents the sequence number of the session sequence within the window. Calculate the session timestamp vector T'. The specific calculation method is: Scaling the value of T' yields T", which is calculated as: Then, the sin / cos position encoding method in the Transformer structure is used to replace the original incremental position information with the timestamp information of each session. The calculation method is as follows: Among them, d model is the word embedding dimension of Transformer, TE (i,2j) and TE (i,2+1) They represent the temporal embedded representations of the 2j-th and 2j+1-th dimensions at time scale i, respectively, and j is the dimension index.

6. The network attack detection method based on time embedding representation and frequency domain information according to claim 1 is characterized in that: The step 5 is specifically as follows: using the reconstruction error as the training loss in the training phase, the loss function is as follows: Where n represents the number of samples, x represents the true value of the i-th sample, Represents the model's predicted value for the i-th sample; In the attack detection phase, the reconstruction error is used as the anomaly score, which is calculated as follows: Where n represents the number of samples, x represents the true value of the i-th sample, Represents the model's predicted value for the i-th sample.

7. A network attack detection system based on time embedding representation and frequency domain information that implements the method according to claim 1, characterized in that: include: Traffic collection and processing module, used to obtain network traffic data from the network card interface or local log files, and standardize its format into pcap type; Feature extraction module, used to parse raw network traffic, extract session-by-session features, and perform data cleaning; A feature learning module is used to learn the time domain and frequency domain feature distribution of traffic. The feature learning module consists of two embedding layers and two N-layer stacked Transformer encoders. Threat detection module, which is used to fuse the feature representations of the two encoders and calculate the traffic feature reconstruction error; The threat detection module consists of a normalization layer and a fully connected layer.

Images