An online drift detection and adaptive sustainable network traffic classification method

Abstract

The application discloses a kind of online drift detection and sustainable network traffic classification method of adaptation, first, original model is built, traffic data engineering and traffic feature engineering are completed, and classification model is trained;Then carry out drift detection, whether network traffic data has occurred drift is detected by drift detector, if data has occurred drift, collect the network traffic after change as new data, using improved old knowledge distillation and deviation correction method, carry out the continuous learning after data drift;Finally, with the new model after adjustment replaces old model, completes network traffic data drift model automatic detection and update after.The method of the application can monitor the change of network traffic data in real time, timely find the occurrence of data drift, and use appropriate updating strategy to quickly adapt to new data distribution, maintain good performance;At the same time, data selection and storage are considered, the resource waste caused by storing all data is reduced, and the real-time performance and sensitivity of the updated model are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network traffic analysis, in particular to an online drift detection and adaptive sustainable network traffic classification method. BACKGROUND

[0002] As an important means of network management and security, network traffic classification (TC) has been highly concerned by the academic and industrial circles since the late 1990s, and has achieved good application in QoS / QoE management, network resource optimization, congestion control, intrusion detection, etc. With the rapid development of new generation network technologies (B5G / 6G, Internet of Things, space-ground integrated network, etc.), network technology is developing towards high autonomy of "self-healing, self-management, self-optimization and self-protection", and network traffic classification technology, as one of the decision-making means of network service and security management, plays a key role. Many studies have applied AI technology to network traffic classification, which has greatly improved the classification performance compared with traditional machine learning.

[0003] With the ubiquitous access of massive heterogeneous terminals, the network presents high "dynamicity", "heterogeneity" and "complexity", which brings a series of new challenges to network traffic classification technology. In particular, the frequent upgrade of active applications, the continuous emergence of new applications and the continuous withdrawal of silent applications have always hindered the application of AI technology in traffic classification, which is prone to cause data drift problem, leading to the decline of traffic classification model performance and the inability to keep up with the pace of application dynamics. Therefore, it is urgent to study the network traffic data distribution drift problem and provide effective drift detection and response methods to enable the model to quickly adapt to new data distribution and maintain good performance. SUMMARY

[0004] The problem to be solved by the present application is to provide an online drift detection and adaptive sustainable network traffic classification method to solve the problem of lack of effective network traffic data drift detection and processing methods, to monitor the changes of network traffic data in real time, to discover the occurrence of data drift in time, and to use appropriate update strategy to quickly adapt to new data distribution.

[0005] The present application adopts the following technical scheme: an online drift detection and adaptive sustainable network traffic classification method, characterized in that it comprises the following steps:

[0006] S1, constructing an original model: based on the input network traffic data, performing data processing, completing traffic data engineering and traffic feature engineering; and training a classification model using the processed traffic data to obtain an original model for identifying the application category to which the traffic data belongs;

[0007] S2, drift detection: based on the trained original model, the continuously input network traffic is identified and classified; whether the network traffic data has drifted is detected by a drift detector, and if the data has drifted, model updating is started;

[0008] S3, training data integration: after detecting that the data has drifted, the changed network traffic is collected as new data, the new training data set is obtained by repeating step S1, and the training data of the last time is used as old data samples, representative samples are selected and reserved as old training set, and the new training set is combined with the old training set for model updating;

[0009] S4, model updating: the training data set obtained in step S3 is used to update the model, the model is adjusted by fine-tuning, improved old knowledge distillation and bias correction methods are used for continuous learning after data drift; the new model after adjustment replaces the old model, and the traffic identification is performed, and the drift detection is continuously performed by repeating step S2 to complete the automatic detection and updating of the model after the network traffic data drift.

[0010] Specifically, in step S1, the traffic data engineering includes traffic collection, preprocessing and traffic labeling.

[0011] The traffic collection collects network traffic data in the served network, including the header information and payload of the data packet.

[0012] The preprocessing includes traffic purification and flow recombination, removes noise data in the flow data, filters the packets irrelevant to flow feature extraction, and forms complete TCP / UDP flow and session flow.

[0013] The traffic labeling labels the traffic data as a specific application or service as a real label of the flow data for model training.

[0014] Specifically, in step S1, the traffic feature engineering includes feature extraction, selection, expression and compression.

[0015] The features are extracted from the original packet to form a key feature set containing multiple bidirectional flows, the automatic encoder and principal component analysis dimension reduction method are used to compress the key features to reduce the original model parameters; the feature set for training the original model is formed by feature expression; and the original model is obtained by training through the CNN classification model, and the effective identification of the application category to which the traffic belongs is performed.

[0016] The key features include packet-level features, flow-level features and statistical features; the feature expression method includes two-dimensional vector, image, byte sequence and graph.

[0017] In particular, step S1 also divides the original model into two types of data storage, namely short-term memory S and long-term memory L, to store network traffic data; the short-term memory S stores the traffic data instances obtained in the last time interval, and the long-term memory L stores the traffic data samples of each category so far, which are used to train and update the original model.

[0018] Specifically, the drift detector in step S2 is based on drift detection of the improved Beta distribution, uses a distance function to quantify the difference between the historical data distribution and the new data distribution, and detects drift by detecting changes in the model confidence distribution, including the following sub-steps:

[0019] S2.1. For a new data sample i, obtain the feature vector X i , calculate the confidence s of the current model for data sample i i , will s i Add to the short-term memory S, where S uses a sliding window and N represents the current length of S;

[0020] S2.2, set the parameter Δ, and for each data k from Δ to N-Δ in S, divide S into two sub-windows S a and S b , S a The latest data is in (s1﹕s k ) is S b ,(s k+1 ﹕s N ) is S a ;

[0021] When the drift detection trigger calculation condition is reached, calculate S a and S b The average value of the confidence level is m a and m b ; When m a ≤λ×m b When , the change point is searched, and λ represents the sensitivity to the change;

[0022] S2.3, respectively estimate S a and S b The Beta distribution parameter (α a ,β a ) and (α b ,β b ), calculate the sum of the absolute values ​​of the log-likelihood ratios P k , the formula is as follows:

[0023]

[0024] Among them, s iS, a, b > 0 are two shape parameters of the Beta distribution, a represents the shape of the distribution, which determines the trend of the probability density function; b represents the range of the distribution, which determines the width of the probability density function.

[0025] The function f(s i |a, b) is a probability density function, and the formula is as follows:

[0026]

[0027] The function B(a, b) is a Beta function, which is used for normalization to ensure that the total probability is 1, and the formula is as follows:

[0028]

[0029] Where the function G represents the Gamma function, and ds i is the integral representation of s i .

[0030] S2.4, for all data k in a, calculate P k , take the maximum value P k of P f , set the threshold T h as -log(l), if P f > T h , it is determined that drift occurs, otherwise no drift occurs.

[0031] Specifically, in step S3, the selection of old data samples includes: applying intra-application clustering and intra-cluster sampling;

[0032] According to the clustering rule, the data is clustered within the application to capture the inherent communication mode of the application, and all data of each application is clustered into multiple clusters;

[0033] Intra-cluster sampling is performed on each cluster to select samples that best represent the overall data distribution from each identified communication mode cluster; the samples selected from different clusters by each application are combined and stored as the retained data of the application, and the remaining data is discarded to reduce redundant storage;

[0034] The clustering rule is to cluster network stream data with the same {destination IP, destination port, protocol} tuple into a cluster.

[0035] Specifically, the intra-cluster sampling selects samples in the following manner: calculating the average feature vector, determining the number of samples K to be selected, and for all integers j from 1 to K, selecting the sample B j :

[0036]

[0037] Wherein, argmin represents the variable value when the objective function takes the minimum value, z is the current cluster, M' represents the old model which has not been updated yet, D' represents the entire old data set, ξ is the index mapping function, η is the average feature vector; The final selected representative sample in the cluster z is: B z ={B1, B2,..., B k}.

[0038] Specifically, in step S4, the improved old knowledge distillation and bias correction method is used for continuous learning after data drift, and the method includes the following sub-steps:

[0039] S4.1, model fine-tuning is performed, the input layer and hidden layer parameters θ c of the neural network model are frozen, the softmax layer parameters θ f are unfrozen, and a new model is initialized, the classification probability score applied to the old data is corrected using the bias layer, the distillation loss Loss d is calculated according to the classification probability, the parameters θ d are updated according to Loss f ;

[0040] S4.2, after fine-tuning, the parameters θ c are unfrozen, the new model is trained, the cross-entropy loss is used as the classification loss Loss c , the total loss is combined with the distillation loss and the classification loss, the model parameters θ c and θ f are updated according to the total loss, and the total loss formula is as follows,

[0041]

[0042] Wherein, C' is the number of old data applications, C is the total number of new and old data applications:

[0043] The model parameters θ c and θ f are updated:

[0044]

[0045] S4.3, a new classification model capable of identifying new data categories and reducing catastrophic forgetting is obtained through optimization loss function training; the old model is replaced by the adjusted new model for traffic identification, and the step S2 is repeated to continuously perform model automatic detection and update, thereby realizing model automatic detection and update after network traffic data drift.

[0046] The technical scheme of the application also provides an electronic device, which comprises:

[0047] one or more processors;

[0048] a storage device having one or more programs stored thereon;

[0049] When the one or more programs are executed by the one or more processors, the one or more processors implement any of the above-mentioned online drift detection and adaptive sustainable network traffic classification methods.

[0050] The technical solution of the present invention also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps in any of the above-mentioned online drift detection and adaptive sustainable network traffic classification methods are implemented.

[0051] Compared with the prior art, the present invention adopts the above technical solution and has the following technical effects:

[0052] The sustainable network traffic classification method proposed in this paper monitors changes in network traffic data in real time, promptly detecting data drift. Using appropriate update strategies, it enables the model to quickly adapt to new data distributions and maintain good performance. It also considers data selection and storage, minimizing the resource waste associated with storing all data and the reduced real-time performance and sensitivity associated with using all data to update the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 It is a flowchart of the sustainable network traffic classification method of the present invention;

[0054] Figure 2 It is a schematic diagram of the short-term memory sliding window and its partitioning in the present invention;

[0055] Figure 3 The router reasoning performance monitoring and the latest real-time traffic identification information of the embodiment of the present invention;

[0056] Figure 4 The number of correctly identified and incorrectly identified instances according to the present invention;

[0057] Figure 5 The precision, recall rate, and F1 score of the traffic recognition results of the embodiment of the present invention;

[0058] Figure 6 This is the confusion matrix of the recognition results of the embodiment of the present invention. DETAILED DESCRIPTION

[0059] In order to make the purposes, technical solutions and advantages of the present application clearer, the technical solutions of the application are further described in detail below in combination with the drawings. The described embodiments are only a part of the embodiments involved in the present application. All non-innovative embodiments of other researchers in the field on the basis of the embodiments belong to the protection scope of the present application. Meanwhile, the step numbers in the embodiments are only set for the convenience of description and explanation, and the order between the steps is not limited in any way. The execution order of each step in the embodiments can be adaptively adjusted according to the understanding of those skilled in the art.

[0060] The online drift detection and adaptive sustainable network traffic classification method of the present application, as shown in Figure 1 includes 4 steps: original model training, drift detection, training data integration and model updating.

[0061] S1, original model training: based on the input network traffic data, data processing is performed, traffic data engineering and traffic feature engineering are completed; and the processed data is used to train a classification model to obtain an original model capable of identifying the application category to which the traffic belongs, which specifically includes the following implementation steps:

[0062] S101: traffic data engineering, including traffic collection, preprocessing and labeling. Collect traffic data in the served network, including the header information and payload of the data packet. Traffic collection can be realized in different ways, such as deploying probes on network devices, installing clients on terminal devices, using software defined network (SDN, Software Defined Network) technology at the network edge or core, etc. The collected traffic data is preprocessed, including traffic distilling and flow recombination, to remove noise data such as background traffic, redundant packets, etc. in the flow data, filter packets irrelevant to flow feature extraction, and form complete TCP / UDP flows and session flows. Traffic labeling, i.e. marking the traffic as what kind of application or service, is used as the true label of the flow data for model training.

[0063] S102: traffic feature engineering, including feature extraction (Feature Extraction), selection (Feature Selection), representation (Feature Representation) and compression (Feature Reduction). Representative traffic features are extracted from the original packets to form a set of key features containing multiple bidirectional flows, set FF={ff1, ff2, ff3…ffj}.

[0064] The key features include: packet-level (Packet-Level) features, flow-level (Flow-Level) features, statistical features.

[0065] Packet-level features: including packet payload / raw bytes, and other packet-level features such as pkt len, inter-arrival-time, etc. Flow-level features: including flow type (IEC104, Modbus, etc.), flow duration, and the number of packets in the flow, etc. Statistical features: mean or std deviation of the relevant features, etc.

[0066] According to certain principles, the most representative and high-contribution features are selected, and dimension reduction methods such as auto-encoder and principal component analysis (PCA) are used to compress the features, further reducing the model parameters and the complexity of model training.

[0067] After forming the traffic features for model training, a suitable way is selected to express the traffic feature information, including two-dimensional vector, image, byte sequence, graph, etc., to form a feature set for model training.

[0068] In order to store the above traffic data, two types of data storage are divided in the device, short-term memory S and long-term memory L. The short-term memory S is used to store the data instances obtained by the device in the last time interval, and these latest data will be saved for a period of time and processed to check whether the drift occurs. The long-term memory L stores the training data samples of each category so far, and these information will be saved for a long time, which is used to train and update the model, so that the model can learn all the categories.

[0069] S103: Model training and evaluation: using the training data set formed by the above steps, input into the CNN classification model for training. Select appropriate learning methods and training methods, including supervised, semi-supervised, unsupervised, weakly supervised, etc., and centralized / distributed training, federated learning, etc. Define the corresponding evaluation criteria (Performance Evaluation Metrics), including accuracy, precision, recall, F1 score, etc., to evaluate the pros and cons of the model, and ensure that a required original model that can effectively identify the application category of the traffic is obtained.

[0070] S2, drift detection: based on the current trained model, classify the continuously input network traffic; at the same time, the drift detector detects whether the data has drifted; if the detection result does not exceed the threshold, continue to use the current model parameters for traffic identification; if it exceeds the threshold, it is determined that the data has drifted, and the model update is started.

[0071] Specifically, the drift detector adopts a drift detection method based on an improved Beta distribution, uses a distance function to quantify the difference between the historical data distribution and the new data distribution, detects drift by detecting the distribution change of the confidence of the model, and does not require data labels as input. The steps are as follows:

[0072] S201: every time a new data instance (X i , y i ) is available, its feature vector X i is obtained, and the confidence of the current model for it s i is calculated. The current model is used to predict this sample X i is the probability of each class P(c j |X), where c j is one of all possible classes, Y={c1, c2,..., c m}. Taking the maximum value of P(c j |X) is the confidence of the model for the sample s i . Add s i to the short-term memory S, S uses a sliding window, N represents the length of the current S, and the maximum size N max is set. Once the maximum size of S is reached, adding a new element to S means deleting the oldest element.

[0073] S202: set the parameter Δ, N represents the length of the current S, and for each data k in S from Δ to N-Δ, divide S into two sub-windows S a and S b (S a is the latest data), (s1﹕s k ) is S b , and (s k+1 ﹕s N ) is S a , as shown in Figure 2 . It is unnecessary to perform detection calculation every time a new confidence value is inserted, and it will cause high calculation cost, large delay, resource waste and other problems. Therefore, the trigger link of the calculation is set, and the steps are as follows:

[0074] S2021: determine whether each sub-window S a and S b contains at least Δ elements to maintain the statistical properties of a distribution, i.e., there are at least 2Δ elements in S; if so, proceed to the next step.

[0075] S2022: set a random number r between 0 and 1, and determine whether is true, which means that the higher the confidence, the lower the possibility of performing drift detection; if so, proceed to the next step.

[0076] S2023: When concept drift occurs, the confidence value will decrease, so only the negative direction change of confidence needs to be detected. Calculate S a and the average value of confidence in S b , respectively, m a and m b , then when m a ≤λ×m b , search for a change point and perform subsequent detection calculation. Where λ is the sensitivity to change, which can be set according to the size, the greater λ, the more sensitive to the negative direction change of confidence.

[0077] S203: Estimate the parameters (a a , β a ) and (α b , β b ) of the Beta distribution of S a and S b respectively using parameter estimation method, and calculate the sum P k of the absolute value of log-likelihood ratio using parameters, as follows:

[0078]

[0079] Where f(s i |α,β) is the probability density function, s i ∈S, and its calculation formula is as follows:

[0080]

[0081]

[0082] Calculate the difference between all P k , the probability density function in S a and S b , the greater the value of P k . Take the maximum value as P f , and k max is the corresponding k value, and set the threshold T h as -log(λ). If P f >T h , a change is detected at point k max , the model is updated, and the short-term memory S is cleared; otherwise, no drift occurs, and the current model parameters are used for traffic identification.

[0083] S3, training data integration: After detecting data drift, collect the changed traffic as new data, and perform data processing in step 1 to obtain a new training set for model training.

[0084] The last training data on the model as old data set, in order to prevent model catastrophic forgetting, need to use old data and new data together to update the model, but if through replay the whole existing sample to reacquire the forgotten knowledge, there are two defects: on the one hand, it is redundant work, on the other hand, the storage space is limited, and it is impossible to completely store the increasing data samples. Therefore, the old data is selected for sample selection, and a small number of representative samples are selected and retained as the old training set, which is combined with the new training set for model updating.

[0085] Old data sample selection mainly includes two key steps: application intra clustering and intra cluster sampling, as follows:

[0086] S301: application intra clustering. Each module of the application communicates with the external server to realize its function, and this communication is usually associated with a specific network destination, such as server IP address and port. Over time, these communication destinations tend to remain relatively stable, so the inherent communication patterns of these applications can be captured based on the following rules: flow data with the same {destination IP, destination port, protocol} tuple is clustered into a cluster.

[0087] According to the clustering rule, the data is clustered within the application, and the minimum data amount of each cluster is set to n. All data of each application is clustered into multiple clusters z, and the cluster Z of each application is {z1, z2,..., z m}. This step ensures that different communication patterns inherent in each application are identified. If the number of samples in some clusters is less than n, or some samples may not be clustered, these samples are merged into a comprehensive cluster.

[0088] S302: intra cluster sampling. Intra cluster sampling is performed on each cluster after clustering, and samples that best represent the overall data distribution of each identified communication pattern cluster are selected. Finally, the samples selected from different clusters of each application are combined and stored as the reserved data of the application, and the remaining data is discarded. While retaining a subset of samples as examples, the risk of eliminating the relationship and difference between classes is minimized, reducing the computational and storage overhead.

[0089] For each cluster, the specific sampling steps are as follows:

[0090] S3021: In order to better obtain the characteristics of the cluster, first use the current model M' to calculate its average feature vector η:

[0091] η=mean(∑ m∈z M′(ξ(m,D′)))

[0092] Where z is the current cluster, M' represents the old model that has not been updated yet, D' represents the entire old data set, and ξ is the index mapping function.

[0093] The samples closest to the current average feature vector are iteratively selected to ensure that the selected sample set maximally reflects the feature distribution of the original data.

[0094] S3022: To ensure fair processing of sample selection for all applications, define K, representing the number of representative samples selected from each cluster:

[0095]

[0096] Where ceil() is a mathematical function that rounds a number to the nearest integer, represents the average number of samples in the class, τ% is the sample retention rate, len() is a quantity measurement function, z is the current cluster, and c is the current class.

[0097] S3023: After determining the number of samples K to be selected, for all integers j from 1 to K, select a sample B j :

[0098]

[0099] Where argmin represents the variable value that minimizes the objective function, and all B j are calculated, and the final representative sample B z selected in the cluster z is k {B1, B2,..., B c}.

[0100] Finally, for the old data set, the representative sample B z selected in the application c is z∈Z . All representative samples of the applications are combined, which is the retained part of the old data sample, and are combined with the new data set as the training data set for the next model update.

[0101] S4, Model update: Update the model using the training data set obtained in step 3 to alleviate the problem of catastrophic forgetting of the model. However, completely retraining the model requires a large amount of computational resources and time, reducing the real-time performance and sensitivity of the model. Therefore, the model fine-tuning method is adopted, using improved old knowledge distillation and bias correction techniques to ensure continuous learning after data drift, with the following specific steps:

[0102] S401: Assuming a CNN classification model is used, multiple convolutional layers are connected, and in order to output prediction probabilities, a fully connected layer is used as a classifier layer. The parameters H' = θ' of the old model M' are θ' c , θ' f , θ' c represent the parameters of the convolutional layer, and θ' f represent the parameters of the fully connected layer. First, θ' c is frozen, and θ' f is not frozen, which means that during the subsequent model fine-tuning, the parameters θ' c will not be updated, nor will the gradient be calculated. The freezing formula of the parameter is: where L is the loss function, and θ is the frozen parameter.

[0103] S402: Model fine-tuning. Define the old data samples in the training set as X', the number of samples as S', and the number of old application categories contained as C'. The total number of samples in the training set is X, the total number of samples is S, and the total number of categories contained is C.

[0104] S4021: Initialize the new model M, and get the classification probability (i.e., the prediction score) p' = M(X') for X' in the training set. Then use the bias layer to correct the score, p = A x p' + B, A and B are two parameter matrices of the bias layer, and p is the final classification probability obtained by the model M.

[0105] S4022: The old model automatically finds the parameters of the old application, and calculates the distillation loss according to the classification probability of the old application in the new model. This distillation loss makes the neural network retain as much knowledge as possible about the old application in the classifier.

[0106] Define the distillation loss Loss d :

[0107]

[0108] Update the model parameters θ f :

[0109]

[0110] The number of rounds of fine-tuning can be defined as needed, and once the fine-tuning is complete, the neural parameter θ' c will be unfrozen. The unfreezing formula of the parameter is: α is the degree of unfreezing the parameter, and when α = 1, the unfreezing is complete.

[0111] S403: Model training. Use cross-entropy loss as the classification loss Loss c to ensure the classification accuracy of the new class.

[0112]

[0113] where y ic is the true label of the ith sample, which is 1 if the sample belongs to class c, otherwise 0; p ic is the predicted probability that the ith sample belongs to class c.

[0114] Finally, the total loss combines the distillation loss and the classification loss, as follows:

[0115]

[0116] Update the model parameters θ c and θ f :

[0117]

[0118] Through the training of the loss function as described above, a new classification model is obtained which can identify new data categories and reduce catastrophic forgetting.

[0119] Finally, the new model is replaced by the old model, which is used for subsequent traffic identification, and returns to step S2 to continue the automatic detection and update of the model, realizing the automatic detection and update of the model after the drift of network traffic data.

[0120] In particular, in an embodiment of the present application, the above sustainable network traffic classification method is deployed in a home router to identify what application category the real-time traffic data in the router belongs to, classify mobile phone applications, and especially focus on identifying game traffic for subsequent game acceleration.

[0121] Specifically, for the classification of real-time traffic data in the router, first, in the original model construction stage, use automatic scripts and manual collection to capture network raw traffic using PCAPDroid and Wireshark, extract traffic features using CICFlowMeter, and perform data processing for training a deep learning model. Then, the model is solidified into the router, and the packet capture and inference module is started, which can identify the application category to which the traffic generated by the terminal device connected under the router network belongs in real time, and visualize the real-time results on the front-end web page. At the same time, the drift detection module is started to monitor the model recognition effect, and when drift is detected, the new and old training data are integrated to update the model to ensure the accuracy of classification. Finally, the relevant achievements are deployed in the home router to provide acceleration services for popular applications (games, live streaming, videos, etc.) within the home.

[0122] After verification, this method can accurately identify real-time traffic data and provide real-time monitoring of router performance to ensure that resource consumption meets demand. The front-end visualization of the classification results is as followsFigures 3-6 As shown, Figure 3 For router inference performance monitoring and latest real-time traffic identification information, Figure 4 For the number of correct and incorrect identification instances, Figure 5 For the accuracy, recall rate and F1 score of traffic identification results, Figure 6 For the identification result confusion matrix. The results show that the overall identification accuracy reaches 93%, the inference resource occupation is reasonable, and the standard of quasi-commercial can be reached.

[0123] In the embodiments of the present application, an electronic device is also provided, which comprises: one or more processors; a storage device having one or more programs stored thereon; and when the one or more programs are executed by the one or more processors, the one or more processors implement the line drift detection and adaptive sustainable network traffic classification method described in any of the above embodiments.

[0124] In the embodiments of the present application, a computer readable storage medium having a computer program stored thereon is also provided, and when the program is executed by a processor, the steps of the line drift detection and adaptive sustainable network traffic classification method in any of the above embodiments are implemented.

[0125] The above is only the preferred embodiment of the present application, and it should be pointed out that for ordinary skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, and these improvements and refinements should also be considered as the protection scope of the present application.

Claims

1. An online drift detection and adaptive sustainable network traffic classification method, characterized in that The steps include: S1. Build the original model: Based on the input network traffic data, perform data processing to complete traffic data engineering and traffic feature engineering. Then use the processed traffic data to train the classification model to obtain the original model that identifies the application category to which the traffic data belongs. S2, Drift Detection: Based on the trained original model, it identifies and classifies the continuously input network traffic; Use a drift detector to detect whether network traffic data drifts. If the data drifts, start model update. The drift detector is based on drift detection of an improved Beta distribution, uses a distance function to quantify the difference between the historical data distribution and the new data distribution, and detects drift by detecting changes in the model confidence distribution. The drift detector includes the following sub-steps: S2.

1. For a new data sample i, obtain the feature vector X i , calculate the confidence s of the current model for data sample i i , will s i Add to the short-term memory S, where S uses a sliding window and N represents the current length of S; S2.2, set the parameter Δ, and for each data k from Δ to N-Δ in S, divide S into two sub-windows S a and S b , S a The latest data is in (s1﹕s k ) is S b ,(s k+1 ﹕s N ) is S a ; When the drift detection trigger calculation condition is reached, calculate S a and S b The average value of the confidence level is m a and m b ; When m a ≤λ×m b When , the change point is searched, and λ represents the sensitivity to the change; S2.3, respectively estimate S a and S b The Beta distribution parameter (α a ,β a ) and (α b ,β b ), calculate the sum of the absolute values ​​of the log-likelihood ratios P k , the formula is as follows: Among them, s i ∈S, α, β>0, are the two shape parameters of the Beta distribution. α represents the shape of the distribution and determines the trend of the probability density function; β represents the range of the distribution and determines the width of the probability density function. Function f(s i |α,β) is the probability density function, and the formula is as follows: Function B(α,β) is the Beta function, which is used for normalization to ensure that the total probability is 1. The formula is as follows: Among them, the function Γ represents the Gamma function, ds i For s i The integral representation of ; S2.

4. For all data k within Δ≤k≤N-Δ, calculate P after the conditions for triggering drift detection calculation are met. k , take P k The maximum value P f , set the threshold T h = -log(λ), if P f >T h , it is determined that drift occurs, otherwise no drift occurs; S3, training data integration: After detecting data drift, collect the changed network traffic as new data, repeat step S1 to obtain a new training data set, and use the previous training data as the old data samples. Perform sample selection on the old data samples, select representative samples and retain them as the old training set, which is merged with the new training set for model update; S4. Model update: Update the model using the training dataset obtained in step S3. Adjust the model through fine-tuning, using improved old knowledge distillation and bias correction methods to perform continuous learning after data drift. This includes the following sub-steps: S4.

1. Fine-tune the model and set the neural network model input layer and hidden layer parameters θ c Freeze, softmax layer parameters θ f Do not freeze and initialize the new model, use the bias layer to correct the classification probability score applied to the old data, and calculate the distillation loss Loss based on the classification probability d , according to Loss d Update parameter θ f ; S4.

2. After fine-tuning, unfreeze the parameter θ c , train a new model and use cross entropy loss as the classification loss Loss c , the total loss combines the distillation loss and the classification loss, and the model parameters θ are updated according to the total loss c and θ f , the total loss formula is as follows, Where C′ is the number of old data applications, and C is the total number of new and old data applications: Update model parameters θ c and θ f : S4.

3. By optimizing the loss function training, a new classification model is obtained that can identify new data categories and reduce catastrophic forgetting; the old model is replaced with the adjusted new model to perform traffic identification, and step S2 is repeated to continuously perform drift detection. After the network traffic data drift is completed, the model is automatically detected and updated.

2. The online drift detection and adaptive sustainable network traffic classification method according to claim 1 is characterized in that In step S1, the traffic data engineering includes: traffic collection, preprocessing and traffic labeling; The traffic collection collects network traffic data in the served network, including header information and payload of data packets; The preprocessing includes flow purification and flow reassembly, removing noise data in the flow data, filtering packets irrelevant to flow feature extraction, and forming complete TCP / UDP flows and session flows; The traffic annotation marks the traffic data as a specific application or service, which is used as the real label of the flow data for model training.

3. The online drift detection and adaptive sustainable network traffic classification method according to claim 1 is characterized in that: In step S1, the traffic feature engineering includes: feature extraction, selection, expression and compression; Feature extraction is performed from the original packets to form a key feature set containing multiple bidirectional flows. Automatic encoding machines and principal component analysis dimensionality reduction methods are used to compress the key features and reduce the original model parameters. Feature expression is used to form a feature set that can be used for original model training. This is then trained using a CNN classification model to obtain the original model, effectively identifying the application category to which the traffic belongs. The key features include: packet-level features, flow-level features, and statistical features; the ways of expressing the features include: two-dimensional vectors, images, byte sequences, and graphs.

4. The online drift detection and adaptive sustainable network traffic classification method according to claim 1 is characterized in that: In step S1, two types of data storage are divided in the original model, namely short-term memory S and long-term memory L, to store network traffic data; the short-term memory S stores the traffic data instances obtained in the last time interval, and the long-term memory L stores the traffic data samples of each category so far, which are used to train and update the original model.

5. The online drift detection and adaptive sustainable network traffic classification method according to claim 1 is characterized in that In step S3, the selection of old data samples includes: applying intra-clustering and intra-cluster sampling; Based on the clustering rules, the data is clustered within the application to capture the inherent communication patterns of the application and all the data of each application are clustered into multiple clusters. Perform intra-cluster sampling on each cluster, selecting the sample that best represents the overall data distribution from each identified communication pattern cluster; merge the samples selected from different clusters for each application and store them as the retained data for that application, while discarding the remaining data to reduce redundant storage; The clustering rule is: clustering network flow data with the same {destination IP, destination port, protocol} tuple into one cluster.

6. The online drift detection and adaptive sustainable network traffic classification method according to claim 5, characterized in that: The method of selecting samples in the cluster is as follows: calculate the average eigenvector, determine the number of samples K to be selected, and for all integers j from 1 to K, select the sample B closest to the current average eigenvector. j : Where argmin represents the variable value that minimizes the objective function, z is the current cluster, M' represents the old model that has not been updated yet, D' represents the entire old data set, ξ is the index mapping function, and η is the average feature vector; the representative sample finally selected in cluster z is: B z ={B1, B2, ..., B k }.

7. An electronic device, characterized in that: include: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the online drift detection and adaptive sustainable network traffic classification method according to any one of claims 1 to 6.

8. A computer-readable storage medium, characterized in that A computer program is stored thereon, and when the program is executed by a processor, the steps in the online drift detection and adaptive sustainable network traffic classification method according to any one of claims 1 to 6 are implemented.

Images