Method, apparatus and computer storage medium for traffic determination

Abstract

The application discloses a method, device and equipment for determining network flow and a computer storage medium. Network flow data to be detected is acquired, and the network flow data to be detected comprises a plurality of feature data. A first mutual information value between the plurality of feature data is calculated. Based on the first mutual information value between the plurality of feature data, feature data with a first mutual information value greater than or equal to a first threshold value is acquired from the plurality of feature data as a first target feature set. The first target feature set is input into a first model and a second model in a target model for classification. The second model is used to perform secondary classification on the classification result of the first model, so that the probability of false classification is reduced, and the accuracy of detecting attack flow is improved.

Description

Technical Field

[0001] This field relates to the field of information security technology, and in particular to a method, apparatus, device, computer storage medium, and computer program product for determining traffic flow. Background Technology

[0002] Cloud computing, as a mature technology, is widely used in various aspects of life. Thanks to the powerful resource storage and computing capabilities of cloud servers, users and businesses have gained immense convenience in their work. However, there are currently numerous malicious attacks on cloud computing platforms by hackers, posing a challenge to ensuring the data security of cloud computing platform users.

[0003] In related technologies, intrusion detection algorithms are commonly used to detect whether access traffic is malicious. However, intrusion detection algorithms still misclassify some access traffic, resulting in relatively low accuracy in detecting malicious traffic. Summary of the Invention

[0004] This disclosure provides a method, apparatus, device, computer storage medium, and computer program product for determining traffic flow, which can improve the accuracy of detecting attack traffic.

[0005] In a first aspect, embodiments of this disclosure provide a method for determining traffic flow, the method comprising:

[0006] Acquire network traffic data to be detected, which includes multiple feature data.

[0007] Calculate the first mutual information value among multiple feature data, which represents the degree of correlation between any two feature data among the multiple feature data;

[0008] Based on the first mutual information value among multiple feature data, feature data with a first mutual information value greater than or equal to a first threshold are selected from the multiple feature data as the first target feature set;

[0009] The first target feature set is input into the first model in the target model, and the first model is used to classify the first target feature set to determine the initial predicted target result and the initial predicted non-target result.

[0010] The initial predicted target result and the initial predicted non-target result are input into the second model in the target model. The second model is then used to perform a secondary classification of the initial predicted target result and the initial predicted non-target result to obtain the current predicted target result.

[0011] In one feasible implementation, based on a first mutual information value among multiple feature data, feature data with a first mutual information value greater than or equal to a first threshold are obtained from the multiple feature data as a first target feature set, including:

[0012] Obtain the first number of first feature data whose first mutual information value is greater than or equal to a first threshold;

[0013] When the first quantity equals the second threshold, the first feature data is obtained as the first target feature set.

[0014] In one feasible implementation, after obtaining a first number of first feature data whose first mutual information value is greater than or equal to a first threshold, the method further includes:

[0015] If the first quantity is greater than the second threshold, determine the second feature data whose first mutual information value of the first feature data is greater than or equal to the target first threshold; wherein the target first threshold is greater than the first threshold.

[0016] If the number of second feature data is equal to the second threshold, the second feature data is determined as the second target feature set.

[0017] In one feasible implementation, before inputting the first target feature set into a first model in the target model, classifying the first target feature set using the first model, and determining the initial predicted target result and the initial predicted non-target result, the method further includes:

[0018] Acquire historical target traffic data and historical non-target traffic data. The amount of historical target traffic data is less than the amount of historical non-target traffic data. The historical target traffic data includes multiple historical target sub-traffic data with different feature types. The feature types are determined based on the feature data.

[0019] By inputting the feature data of multiple historical target sub-traffic data into the generative adversarial network model, multiple oversampled sample sets of corresponding historical target sub-traffic data are obtained.

[0020] The target model is trained based on a sample set consisting of historical non-target traffic data and an oversampled sample set of multiple historical target sub-traffic data.

[0021] In one feasible implementation, feature data from multiple historical target sub-traffic data are input into a generative adversarial network model to obtain multiple corresponding oversampled sample sets of historical target sub-traffic data, including:

[0022] Construct a generator network model and a discriminator network model, and combine the generator network model and the discriminator network model to obtain a generative adversarial network model;

[0023] Based on the discriminator network model, the sample data generated by the generator network model is distinguished from the historical target sub-flow data to obtain the trained generative adversarial network model.

[0024] By utilizing the feature data of multiple historical target sub-traffic data, the hyperparameters of the trained generative adversarial network model are adjusted to obtain the target generative adversarial network model.

[0025] Based on the target generative adversarial network model, multiple target sub-traffic data with different feature types are generated;

[0026] Multiple target sub-flow data with different feature types are merged with the corresponding historical target sub-flow data to obtain multiple oversampled sample sets of corresponding historical target sub-flow data.

[0027] In one feasible implementation, before training the target model based on a sample set of historical non-target traffic data and an oversampled sample set of multiple historical target sub-traffic data, the method further includes:

[0028] The similarity between feature data of oversampled sample sets of different historical target sub-flow data is obtained by using the Jaccard coefficient.

[0029] If the similarity is greater than the third threshold, obtain the number of samples in the oversampled sample set of the historical target sub-traffic data corresponding to the similarity.

[0030] If the number of samples in the oversampled sample set of the historical target sub-traffic data corresponding to the similarity is less than the fourth threshold, the number of samples in the oversampled sample set of the historical target sub-traffic data corresponding to the similarity is merged to obtain the combined oversampled sample set of the historical target sub-traffic data.

[0031] The target model is trained based on a sample set consisting of historical non-target traffic data and an oversampled sample set of multiple historical target sub-traffic data, including:

[0032] The target model is trained based on a sample set consisting of historical non-target traffic data, an oversampled sample set of multiple historical target sub-traffic data, and an oversampled sample set combining historical target sub-traffic data.

[0033] In one feasible implementation, the target model is trained based on a sample set consisting of historical non-target traffic data and an oversampled sample set of multiple historical target sub-traffic data, including:

[0034] The sample set consisting of historical non-target traffic data and the oversampled sample set of multiple historical target sub-traffic data are input into the first model in the target model. The first model is used to classify the sample set to determine the predicted target result and the predicted non-target result.

[0035] The predicted target result and the predicted non-target result are input into the second model in the target model. The second model is used to perform secondary classification on the predicted target result and the predicted non-target result to obtain the first predicted target result.

[0036] In one feasible implementation, the first model includes a support vector machine model. Before inputting a sample set consisting of historical non-target traffic data and an oversampled sample set of multiple historical target sub-traffic data into the first model in the target model, and using the first model to classify the sample set to determine the predicted target result and the predicted non-target result, the method further includes:

[0037] The parameters of the particle swarm optimization algorithm are initialized and the fitness of multiple particles is obtained. Each particle represents the penalty parameters and kernel parameters of a set of support vector machine models. The parameters of the particle swarm optimization algorithm include inertia weights.

[0038] The first fitness is obtained by summing the fitness of multiple particles.

[0039] Divide the first fitness by the number of particles to obtain the average fitness of the population.

[0040] Randomly select two particles from a pool of particles;

[0041] The lowest historical fitness value among the two particles is used as the target fitness value, and the lowest historical fitness value of a particle is determined based on multiple fitness values ​​obtained through multiple iterations.

[0042] The second fitness is obtained by dividing the fitness of each particle by the average fitness of the population.

[0043] The second fitness level is compared with the fifth threshold to obtain the comparison result;

[0044] If the comparison result indicates that the second fitness is greater than or equal to the fifth threshold, the position corresponding to the smaller fitness of the two particle fitnesss is arbitrarily selected as the updated position of the particle.

[0045] Obtain the target fitness after particle position update;

[0046] If the target fitness is less than the fitness threshold, obtain the penalty parameter and kernel parameter corresponding to the target fitness as the optimal penalty parameter and optimal kernel parameter;

[0047] The optimized support vector machine model is obtained based on the optimal penalty parameters and the optimal kernel parameters.

[0048] In one feasible implementation, initializing the parameters of the particle swarm optimization algorithm and obtaining the fitness of multiple particles includes:

[0049] The inertia weights are updated by using the correspondence between the number of iterations and the random number.

[0050] In one feasible implementation, initializing the parameters of the particle swarm optimization algorithm and obtaining the fitness of multiple particles includes:

[0051] The fitness of a particle is assessed by the ratio of the number of classification errors by the corresponding support vector machine model to the total number of classification errors.

[0052] In one feasible implementation, the second model includes an isolated forest model. The predicted target result and the predicted non-target result are input into the second model within the target model. The second model then performs a secondary classification of the predicted target result and the predicted non-target result to obtain a first predicted target result, including:

[0053] The predicted target result and the predicted non-target result are input into the isolated forest model in the target model. The isolated forest model is used to obtain outliers in the predicted target result and the predicted non-target result respectively. Outliers correspond to one prediction result.

[0054] Obtain all points in the predicted target result except for outliers to obtain the second predicted target result;

[0055] The isolated forest model is used to perform secondary classification on outliers in the predicted target results and the predicted non-target results, and the first outlier in the predicted result is the predicted target result.

[0056] The results of the first outlier and the second prediction target are combined to obtain the first prediction target result.

[0057] Secondly, embodiments of this disclosure provide a flow rate determination apparatus, the apparatus comprising:

[0058] The acquisition module is used to acquire network traffic data to be detected, which includes multiple feature data.

[0059] The calculation module is used to calculate the first mutual information value between multiple feature data, which represents the degree of correlation between any two feature data among the multiple feature data;

[0060] The acquisition module is also used to acquire feature data whose first mutual information value is greater than or equal to a first threshold from multiple feature data as a first target feature set based on the first mutual information value between multiple feature data;

[0061] The determination module is used to input the first target feature set into the first model in the target model, use the first model to classify the first target feature set, and determine the initial predicted target result and the initial predicted non-target result;

[0062] The acquisition module is also used to input the initial predicted target result and the initial predicted non-target result into the second model in the target model, and use the second model to perform secondary classification of the initial predicted target result and the initial predicted non-target result to obtain the current predicted target result.

[0063] Thirdly, embodiments of this disclosure provide a flow determination device, the device including a processor and a memory storing computer program instructions; the processor reads and executes the computer program instructions to implement the flow determination method as described in any of the first aspects.

[0064] Fourthly, embodiments of this disclosure provide a computer-readable storage medium storing computer program instructions that, when executed by a processor, implement a flow determination method as described in any of the first aspects.

[0065] Fifthly, embodiments of this disclosure provide a computer program product, including a computer program that, when executed by a processor, implements a method for determining traffic flow as described in any of the first aspects.

[0066] This disclosure provides a method, apparatus, device, computer storage medium, and computer program product for determining network traffic. The method involves acquiring network traffic data to be detected, which includes multiple feature data. A first mutual information value is calculated among the multiple feature data, representing the degree of correlation between any two feature data. Based on the first mutual information value, feature data with a first mutual information value greater than or equal to a first threshold is selected as a first target feature set. Using the first threshold to filter feature data with larger first mutual information values ​​improves the accuracy of the classification results. The first target feature set is input into a first model within a target model, and the first model is used to classify the first target feature set to determine an initial predicted target result and an initial predicted non-target result. The initial predicted target result and the initial predicted non-target result are input into a second model within the target model, and the second model is used to perform a secondary classification of the initial predicted target result and the initial predicted non-target result to obtain the current predicted target result. By using the second model to perform a secondary classification of the classification results of the first model, the probability of misclassification can be reduced, improving the accuracy of detecting attack traffic. Attached Figure Description

[0067] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments of the present invention will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0068] Figure 1This is a flowchart illustrating a method for determining traffic flow according to an embodiment of this disclosure;

[0069] Figure 2 This is a flowchart illustrating a method for obtaining a first target feature set according to an embodiment of this disclosure;

[0070] Figure 3 This is a flowchart illustrating a method for training a target model according to an embodiment of this disclosure;

[0071] Figure 4 This is a schematic diagram of the structure of a flow rate determination device provided in an embodiment of this disclosure;

[0072] Figure 5 This is a schematic diagram of the structure of a flow rate determination device provided in an embodiment of this disclosure. Detailed Implementation

[0073] The features and exemplary embodiments of various aspects of the present invention will now be described in detail. To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are merely intended to explain the present invention and not to limit the present invention. For those skilled in the art, the present invention can be practiced without some of these specific details. The following description of the embodiments is merely to provide a better understanding of the present invention by illustrating examples of the invention.

[0074] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0075] Before describing the technical solutions provided by the embodiments of this disclosure, in order to facilitate understanding of the embodiments of this disclosure, this disclosure will specifically explain the problems existing in the related technologies:

[0076] Currently, cloud computing platforms provide cloud services to a large number of users. However, there are numerous instances of hackers maliciously attacking cloud computing platforms through attack traffic, damaging their security and availability.

[0077] In related technologies, classifiers are typically trained using pre-prepared labeled data to obtain a trained intrusion detection algorithm. This algorithm is then used to determine whether the traffic data to be detected is attack traffic. However, misclassification still occurs when using intrusion detection algorithms to classify traffic data. Furthermore, since attack traffic constitutes only a very small portion of normal traffic, some attack types are present in very few datasets used to train the classifier. Models trained on these datasets cannot effectively detect these minority attack types, resulting in low accuracy in detecting attack traffic by intrusion detection algorithms.

[0078] In view of the inventors’ above-mentioned research findings, the present disclosure provides a method, apparatus, device, computer storage medium and computer program product for determining flow rate, which can solve at least one of the above-mentioned technical problems existing in the related art.

[0079] This embodiment utilizes a hybrid model for traffic data detection and classification. For example, traffic data to be detected is acquired, and mutual information values ​​are calculated based on the feature data of the traffic data. Features of traffic data with high mutual information values ​​are selected as the target feature set. The target feature set is input into a first model to perform initial classification of the traffic data, obtaining the initial classification result. A second model is then used to perform secondary classification on the misclassified results from the initial classification, thereby improving the accuracy of the target model's classification.

[0080] Furthermore, the classification accuracy varies depending on the penalty parameters and kernel parameters of the support vector machine (SVM) model. Therefore, an improved particle swarm optimization algorithm can be used to obtain the optimal penalty and kernel parameters for the SVM model, thus achieving a more accurate result.

[0081] In addition, due to the insufficient number of samples in some attack traffic data, it is difficult to effectively train a model capable of recognizing this type of traffic data. Therefore, generative adversarial networks can be used to oversample the minority class samples in the dataset, ensuring a sufficient number of minority class samples and improving the classification accuracy of the hybrid model.

[0082] The method for determining traffic flow provided in the embodiments of this disclosure will be described below.

[0083] Figure 1 A flowchart illustrating a method for determining traffic flow according to an embodiment of this disclosure is shown. Figure 1 The method may include the following steps S110-S150.

[0084] S110: Obtain network traffic data to be detected.

[0085] The target model in the terminal receives network traffic data sent by the user terminal, where the network traffic data to be detected includes multiple feature data.

[0086] In one example, network traffic data may include data characteristics such as source IP address, destination IP address, port number, and transport protocol.

[0087] S120: Calculate the first mutual information value between multiple feature data.

[0088] The first mutual information value represents the degree of correlation between any two feature data among multiple feature data.

[0089] In one embodiment, a first mutual information value between multiple feature data can be calculated using a mutual information analysis method.

[0090] In one example, the expression for calculating the mutual information value is shown in formula (1):

[0091] MI(X,Y)=∑ x∈X ∑ y∈Y P(x,y)log(P(x,y) / P(x)P(y)) (1)

[0092] Where MI(X,Y) represents the mutual information between variables X and Y, P(x,y) represents the probability that variables X and Y occur simultaneously, P(x) represents the probability that variable X occurs, and P(y) represents the probability that variable Y occurs.

[0093] S130: Based on the first mutual information value between multiple feature data, obtain feature data whose first mutual information value is greater than or equal to a first threshold from the multiple feature data as the first target feature set.

[0094] After calculating the first mutual information value among multiple feature data, the terminal removes feature data whose first mutual information value is less than a first threshold from the multiple feature data, and selects feature data whose first mutual information value is greater than or equal to the first threshold as the first target feature set.

[0095] Among them, a first mutual information value greater than or equal to a first threshold indicates a strong correlation between feature data, while a first mutual information value less than the first threshold indicates a weak correlation between feature data.

[0096] In one embodiment, if the mutual information value between feature data A and feature data B is 0.05, which is less than the first threshold of 0.5, then the correlation between feature data A and feature data B is considered to be weak.

[0097] S140: Input the first target feature set into the first model in the target model, use the first model to classify the first target feature set, and determine the initial predicted target result and the initial predicted non-target result.

[0098] After obtaining the first target feature set, the terminal inputs the first target feature set into the first model in the target model. The first model classifies the traffic data according to the first target feature set, and determines the initial prediction target result and the initial prediction non-target result.

[0099] Among them, the initial predicted target result represents attack traffic, and the initial predicted non-target result represents normal traffic.

[0100] S150: Input the initial predicted target result and the initial predicted non-target result into the second model in the target model, and use the second model to perform secondary classification on the initial predicted target result and the initial predicted non-target result to obtain the current predicted target result.

[0101] After obtaining the initial target prediction result and the initial non-target prediction result, the target model inputs these results into the second model. The second model reclassifies the initial target prediction result and the initial non-target prediction result, and then summarizes the classified results to obtain the current target prediction result.

[0102] The current prediction target result represents the final predicted attack traffic.

[0103] This embodiment of the disclosure acquires network traffic data to be detected, which includes multiple feature data. A first mutual information value is calculated among the multiple feature data, representing the degree of correlation between any two feature data. Based on the first mutual information value, feature data with a first mutual information value greater than or equal to a first threshold are selected as a first target feature set. Using the first threshold to filter feature data with larger first mutual information values ​​improves the accuracy of the classification results. The first target feature set is input into a first model in the target model, and the first model is used to classify the first target feature set to determine the initial predicted target result and the initial predicted non-target result. The initial predicted target result and the initial predicted non-target result are input into a second model in the target model, and the second model is used to perform a secondary classification of the initial predicted target result and the initial predicted non-target result to obtain the current predicted target result. By using the second model to perform a secondary classification of the classification result of the first model, the probability of misclassification can be reduced, improving the accuracy of detecting attack traffic.

[0104] In one embodiment, such as Figure 2 As shown, step S130, based on the first mutual information value among multiple feature data, obtains feature data whose first mutual information value is greater than or equal to a first threshold as the first target feature set, and may include steps S131-S132:

[0105] S131: Obtain the first number of first feature data whose first mutual information value is greater than or equal to the first threshold.

[0106] After calculating the first mutual information value among multiple feature data, the terminal removes feature data whose first mutual information value is less than a first threshold, and retains feature data whose first mutual information value is greater than or equal to the first threshold. It then calculates the number of feature data whose first mutual information value is greater than or equal to the first threshold.

[0107] S132: When the first quantity is equal to the second threshold, the first feature data is obtained as the first target feature set.

[0108] If the number of feature data whose first mutual information value is greater than or equal to the first threshold is equal to the second threshold, then the feature data whose first mutual information value is greater than or equal to the first threshold shall be used as the first target feature set.

[0109] In one example, if the number of feature data with a first mutual information value greater than or equal to a first threshold is 100 and the second threshold is 100, then the feature data with a first mutual information value greater than or equal to the first threshold can be used as the first target feature set.

[0110] This embodiment of the disclosure uses feature data of a first quantity equal to a second threshold as the first target feature set, reduces feature data with low mutual information values, improves the data quality of the training dataset, and thus improves the accuracy of model classification.

[0111] In one embodiment, after obtaining the first number of first feature data whose first mutual information value is greater than or equal to the first threshold in step S131, steps S133-S134 are further included.

[0112] S133: If the first quantity is greater than the second threshold, determine the second feature data whose first mutual information value of the first feature data is greater than or equal to the target first threshold; wherein the target first threshold is greater than the first threshold.

[0113] If the number of feature data whose first mutual information value is greater than or equal to the first threshold is greater than the second threshold, then the second feature data whose first mutual information value is greater than or equal to the target first threshold is obtained.

[0114] S134: If the number of second feature data is equal to the second threshold, determine the second feature data as the second target feature set.

[0115] If the number of second feature data is equal to the second threshold, then the second feature data is used as the second target feature set.

[0116] In one example, the first threshold is 0.3, and the target first threshold is 0.5. If the number of feature data with a first mutual information value greater than or equal to the first threshold is 200, and the second threshold is 50, then the second feature data with a first mutual information value greater than or equal to 0.5 is obtained. If the number of second feature data is equal to 50, then the second feature data is used as the second target feature set.

[0117] This embodiment of the disclosure uses a second set of second feature data, equal to a second threshold, as the second target feature set. This reduces feature data with low mutual information values, improves the data quality of the training dataset, and thus improves the accuracy of model classification.

[0118] In one embodiment, such as Figure 3 As shown, before step S140 inputs the first target feature set into the first model in the target model, uses the first model to classify the first target feature set, and determines the initial predicted target result and the initial predicted non-target result, steps S210-S230 are also included.

[0119] S210: Obtain historical target traffic data and historical non-target traffic data.

[0120] Historical target traffic data represents historical attack traffic data, while historical non-target traffic data represents historical normal traffic data. The amount of historical target traffic data is less than the amount of historical non-target traffic data. Historical target traffic data includes multiple historical target sub-traffic data with different feature types, and the feature types are determined based on the feature data.

[0121] In one example, historical target sub-traffic data with different feature types can be target sub-traffic data such as virtual machine escape attack sample traffic data, virtual machine inter-isolation disruption sample traffic data, resource contention attack sample traffic data, denial-of-service attack sample traffic data, data leakage sample traffic data, identity theft sample traffic data, and social engineering sample traffic data.

[0122] S220: Input the feature data of multiple historical target sub-traffic data into the generative adversarial network model to obtain multiple oversampled sample sets of corresponding historical target sub-traffic data.

[0123] After obtaining the feature data of multiple historical target sub-traffic data, the feature data of multiple historical target sub-traffic data are input into the generative adversarial network model to obtain multiple oversampled sample sets of corresponding historical target sub-traffic data.

[0124] In this case, the number of historical target sub-traffic data in the oversampled sample set is greater than the number of historical target sub-traffic data before inputting into the generative adversarial network model.

[0125] In one example, by inputting traffic data from 50 data breach samples into a generative adversarial network model, an oversampled sample set containing traffic data from 100 data breach samples can be obtained.

[0126] S230: Train the target model based on a sample set composed of historical non-target traffic data and an oversampled sample set of multiple historical target sub-traffic data.

[0127] After oversampling the historical target sub-flow data, the target model is trained based on the sample set composed of historical non-target flow data and the oversampled sample set of multiple historical target sub-flow data.

[0128] In this embodiment of the disclosure, by using a generative adversarial model to oversample the historical target sub-traffic data, the amount of historical target sub-traffic data is increased, the sample data in the dataset is balanced, and the accuracy of model classification is improved.

[0129] In one embodiment, step S220 inputs the feature data of multiple historical target sub-traffic data into the generative adversarial network model to obtain multiple corresponding oversampled sample sets of historical target sub-traffic data, which may include steps S221-S225.

[0130] S221: Construct the generator network model and the discriminator network model.

[0131] The generator network model and the discriminator network model are combined to obtain the generative adversarial network model.

[0132] S222: Based on the discriminator network model, the sample data generated by the generator network model is distinguished from the historical target sub-traffic data to obtain the trained generative adversarial network model.

[0133] In one embodiment, the generator network model receives a random noise vector as input and generates sample data. The discriminator network model distinguishes the generated sample data from the labeled data. The generator network model and the discriminator network model repeatedly play against each other, eventually resulting in a trained generative adversarial network model.

[0134] S223: By utilizing the feature data of multiple historical target sub-traffic data, the hyperparameters of the trained generative adversarial network model are adjusted to obtain the target generative adversarial network model.

[0135] After obtaining a trained generative adversarial network (GAN) model, the hyperparameters of the GAN model are adjusted to obtain a target GAN model, so that the data characteristics of the sample data generated by the target GAN model are close to the characteristics of the historical target sub-flow data.

[0136] S224: Based on the target generative adversarial network model, generate multiple target sub-traffic data with different feature types.

[0137] S225: Merge multiple target sub-flow data with different feature types with the corresponding historical target sub-flow data to obtain multiple oversampled sample sets of corresponding historical target sub-flow data.

[0138] After generating target sub-traffic data with different feature types using a target generative adversarial network model, these data can be merged with the corresponding historical target sub-traffic data to obtain multiple oversampled sample sets of the corresponding historical target sub-traffic data.

[0139] In this embodiment of the disclosure, by adjusting the hyperparameters of the generative adversarial network, target sub-traffic data is generated, increasing the number of target sub-traffic data in the dataset, balancing the sample data in the dataset, and improving the accuracy of model classification.

[0140] In one embodiment, before step S30, which trains the target model based on a sample set composed of historical non-target traffic data and an oversampled sample set of multiple historical target sub-traffic data, steps S310-S340 are also included.

[0141] S310: Using the Jaccard coefficient, obtain the similarity between the feature data of the oversampled sample set of different historical target sub-flow data.

[0142] The similarity between the feature data of oversampled sample sets of different historical target sub-traffic data represents the similarity of attack types between historical target sub-traffic data. The Jaccard coefficient is used to characterize the similarity of attack types between historical target sub-traffic data.

[0143] In one example, the feature data includes attack vectors, affected system components, and the consequences of the attack.

[0144] S320: When the similarity is greater than the third threshold, obtain the number of samples in the oversampled sample set of the historical target sub-traffic data corresponding to the similarity.

[0145] The third threshold represents the similarity threshold. If the similarity between the feature data of oversampled sample sets of different historical target sub-traffic data is greater than the third threshold, the oversampled sample sets will be merged.

[0146] In one example, if the similarity between the feature data of the virtual machine vulnerability sample set and the access attack sample set is 0.4, which is greater than the third threshold of 0.3, then the virtual machine vulnerability sample set and the access attack sample set are considered to be similar, and the sample count of each of the virtual machine vulnerability sample set and the access attack sample set is obtained.

[0147] S330: If the number of samples in the oversampled sample set of the historical target sub-traffic data corresponding to the similarity is less than the fourth threshold, merge the number of samples in the oversampled sample set of the historical target sub-traffic data corresponding to the similarity to obtain the combined oversampled sample set of the historical target sub-traffic data.

[0148] The fourth threshold represents the threshold for the number of samples.

[0149] In one example, if the set of virtual machine vulnerability samples and the set of access attack samples are similar, and the number of virtual machine vulnerability samples is 30 and the number of access attack samples is 20, both less than the fourth threshold of 60, then the set of virtual machine vulnerability samples and the set of access attack samples can be merged.

[0150] S340: Train the target model based on a sample set composed of historical non-target traffic data, an oversampled sample set of multiple historical target sub-traffic data, and an oversampled sample set combining historical target sub-traffic data.

[0151] After merging target sub-flow data with insufficient sample size, the sample set composed of historical non-target flow data, the oversampled sample set of historical target sub-flow data with sufficient sample size, and the oversampled sample set of combined historical target sub-flow data can be input into the target model for training.

[0152] The embodiments of this disclosure, by merging oversampled sample sets of historical target sub-traffic data with high similarity and training the model, enable the model to generalize to previously unseen attack types, thereby improving the model's applicability and robustness.

[0153] In one embodiment, step S230, which trains the target model based on a sample set of historical non-target traffic data and an oversampled sample set of multiple historical target sub-traffic data, may include steps S231-S232.

[0154] S231: Input the sample set consisting of historical non-target traffic data and the oversampled sample set of multiple historical target sub-traffic data into the first model in the target model, and use the first model to classify the sample set to determine the predicted target result and the predicted non-target result.

[0155] After receiving a sample set consisting of historical non-target traffic data and an oversampled sample set of multiple historical target sub-traffic data, the target model uses the first model for classification processing to obtain predicted target results and predicted non-target results. Specifically, predicted target results represent traffic data predicted as attack-type, while predicted non-target results represent traffic data predicted as normal-type.

[0156] S232: Input the predicted target result and the predicted non-target result into the second model in the target model, and use the second model to perform secondary classification on the predicted target result and the predicted non-target result to obtain the first predicted target result.

[0157] After the first model outputs the predicted target result and the predicted non-target result, the second model performs a secondary classification on the predicted target result and the predicted non-target result to obtain the first predicted target result. The first predicted target result represents traffic data that is predicted to be of the attack type after secondary classification.

[0158] In one embodiment, a second model can be used to perform secondary classification of the benefit points in the predicted target results and the predicted non-target results.

[0159] This embodiment of the disclosure uses a first model to classify a sample set consisting of historical non-target traffic data and an oversampled sample set of multiple historical target sub-traffic data, and then uses a second model to perform secondary classification on the classification results of the first model, thereby improving the accuracy of the target model classification.

[0160] In one embodiment, before step S231 inputs the sample set composed of historical non-target traffic data and the oversampled sample set of multiple historical target sub-traffic data into the first model in the target model, and uses the first model to classify the sample set to determine the predicted target result and the predicted non-target result, steps S401-S411 are also included.

[0161] S401: Initialize the parameters of the particle swarm optimization algorithm and obtain the fitness of multiple particles.

[0162] The particle represents the penalty parameters and kernel parameters of a set of support vector machine models, while the parameters of the particle swarm algorithm include inertial weights.

[0163] S402: Sum the fitness of multiple particles to obtain the first fitness.

[0164] S403: Divide the first fitness by the number of particles to obtain the average fitness of the population.

[0165] S404: Randomly select two particles from a plurality of particles.

[0166] S405: Use the lowest historical fitness value among the two particles as the target fitness.

[0167] The historical minimum fitness of a particle is determined based on multiple fitness values ​​obtained through multiple iterations.

[0168] S406: Divide the fitness of each particle by the average fitness of the population to obtain the second fitness.

[0169] S407: Compare the second fitness with the fifth threshold to obtain the comparison result.

[0170] S408: If the comparison result indicates that the second fitness is greater than or equal to the fifth threshold, arbitrarily select the position corresponding to the smaller fitness of the two particle fitnesss as the updated position of the particle.

[0171] S409: Obtain the target fitness after particle position update.

[0172] S410: When the target fitness is less than the fitness threshold, obtain the penalty parameter and kernel parameter corresponding to the target fitness as the optimal penalty parameter and optimal kernel parameter.

[0173] S411: The parameter-adjusted support vector machine model is obtained based on the optimal penalty parameters and the optimal kernel parameters.

[0174] In one embodiment, before using the first model for classification, an improved particle swarm optimization (PSO) algorithm can be used to select the optimal penalty parameters and optimal kernel parameters for the first model. First, the parameters of the improved PSO algorithm are initialized, and the initial fitness of particles representing different penalty parameters and kernel parameters is calculated. Based on the fitness of each particle, the population average fitness is then calculated. The particle fitness and the population average fitness are compared, and then an adaptive strategy is used to update the particle positions. The final target fitness is obtained after the final example position update. The penalty parameters and kernel parameters corresponding to the target fitness are then used as the optimal penalty parameters and optimal kernel parameters.

[0175] In one example, the expression for calculating the random optimal position of a particle is shown in Equation (2):

[0176]

[0177] Among them, SPbest i (t) represents the random best of particle i at the t-th iteration. fit(x) represents the fitness of the particle, CPbest represents the best candidate individual, and Pbest represents the best candidate individual. i The optimal position for particle i.

[0178] In one example, the expression for updating the particle velocity is shown in Equation (3).

[0179] V i (t+1)=ω(t) V i (t)+2r1(SPbest i (t)-X i (t))+ 2r2(Mbest(t)-X i (t)) (3)

[0180] Where r1 and r2 are random numbers between 0 and 1, ω(t) represents the inertia weight, Mbest represents the global optimal position, and X i (t) represents the current position of particle i at time t, V i (t+1) and V i (t) represents the velocities at times t and t+1, respectively.

[0181] In one example, the position update expression based on the adaptive policy is shown in Equation (4):

[0182]

[0183] Where ω(t) represents the inertia weight, X i (t) and X i (t+1) represents the current position of particle i at time t and time t+1, respectively, rand represents a random number, and V i (t+1) and V i (t) represents the velocity at times t and t+1, respectively, and Gbest(t) represents the individual's best position.

[0184] In this embodiment of the disclosure, the classification accuracy of the first model is improved by using an improved particle swarm optimization algorithm to select the optimal parameters of the first model.

[0185] In one embodiment, step S401, which initializes the parameters of the particle swarm optimization algorithm and obtains the fitness of multiple particles, may include step S4011.

[0186] S4011: Update the inertia weights by using the correspondence between the number of iterations and the random number to obtain the updated inertia weights.

[0187] In one embodiment, a Logistic chaotic map can be used to introduce inertial weights to dynamically update the inertial weights.

[0188] In one example, the expression for the Logistic chaotic map is shown in Equation (5).

[0189] r(t+1) = 4r(t)(1-r(t)) (5)

[0190] Where r(x) is a random number between 0 and 1, and t is the current iteration number.

[0191] In this embodiment of the disclosure, by utilizing the correspondence between the number of iterations and random numbers to update the inertia weights, the search strategy of the particle swarm optimization algorithm can be improved, and the ability to dynamically balance global search and local search can be enhanced.

[0192] In one embodiment, step S401, which initializes the parameters of the particle swarm optimization algorithm and obtains the fitness of multiple particles, may include step S4012.

[0193] S4012: Evaluate the fitness of a particle based on the ratio of the number of classification errors by the support vector machine model corresponding to the particle to the total number of classification errors.

[0194] In one embodiment, the fitness of a particle can be evaluated using the error rate. The evaluation rate is equal to the number of classification errors made by the support vector machine model divided by the total number of classifications.

[0195] In this embodiment of the disclosure, the fitness of a particle is evaluated by using the ratio of the number of classification errors in the support vector machine model corresponding to the particle to the total number of classification errors. This can effectively obtain the optimal parameters of the model and improve the accuracy of model classification.

[0196] In one embodiment, step S232 inputs the predicted target result and the predicted non-target result into the second model in the target model, and uses the second model to perform secondary classification on the predicted target result and the predicted non-target result to obtain the first predicted target result, which may include steps S2321-S2324.

[0197] S2321: Input the predicted target result and the predicted non-target result into the isolated forest model in the target model, and use the isolated forest model to obtain the outliers in the predicted target result and the predicted non-target result respectively.

[0198] Outliers correspond to one type of prediction result.

[0199] After receiving the target prediction and non-target prediction results, the Isolation Forest model identifies outliers in both predictions. Outliers represent predictions whose locations significantly deviate from the rest of the predictions.

[0200] S2322: Obtain all points in the predicted target result except for outliers to obtain the second predicted target result.

[0201] After obtaining the prediction target results, the Isolation Forest model calculates the number of all points except for outliers.

[0202] S2323: Use the isolated forest model to perform secondary classification on outliers of predicted target results and predicted non-target results, and obtain the first outlier of predicted target results.

[0203] The Isolation Forest model classifies outliers in both the target prediction result and the non-target prediction result, and the classified prediction result obtained from the outliers in both the target prediction result and the non-target prediction result is the first outlier in the target prediction result.

[0204] S2324: Combine the results of the first outlier and the second prediction target to obtain the first prediction target result.

[0205] The isolated forest model combines the results of the first outlier and the second prediction target to obtain the first prediction target result.

[0206] In this embodiment of the disclosure, by using an isolated forest model to classify outliers in the predicted target results and predicted non-target results, the probability of misclassification by the target model is reduced and the accuracy of target model classification is improved.

[0207] like Figure 4 As shown in the embodiments of this disclosure, a flow rate determination device 500 is also provided, the flow rate determination device 500 comprising:

[0208] The acquisition module 501 is used to acquire network traffic data to be detected, which includes multiple feature data.

[0209] The calculation module 502 is used to calculate the first mutual information value between multiple feature data, wherein the first mutual information value represents the degree of correlation between any two feature data among the multiple feature data;

[0210] The acquisition module 501 is also used to acquire feature data whose first mutual information value is greater than or equal to a first threshold from multiple feature data as a first target feature set based on the first mutual information value between multiple feature data;

[0211] The determination module 503 is used to input the first target feature set into the first model in the target model, use the first model to classify the first target feature set, and determine the initial predicted target result and the initial predicted non-target result;

[0212] The acquisition module 501 inputs the initial predicted target result and the initial predicted non-target result into the second model in the target model, and uses the second model to perform secondary classification on the initial predicted target result and the initial predicted non-target result to obtain the current predicted target result.

[0213] In some embodiments, the acquisition module 501 is specifically used for:

[0214] Obtain the first number of first feature data whose first mutual information value is greater than or equal to a first threshold;

[0215] When the first quantity equals the second threshold, the first feature data is obtained as the first target feature set.

[0216] In some embodiments, the determining module 503 is specifically used for:

[0217] If the first quantity is greater than the second threshold, determine the second feature data whose first mutual information value of the first feature data is greater than or equal to the target first threshold; wherein the target first threshold is greater than the first threshold.

[0218] If the number of second feature data is equal to the second threshold, the second feature data is determined as the second target feature set.

[0219] In some embodiments, the traffic determination apparatus further includes a training module, which is specifically used to acquire historical target traffic data and historical non-target traffic data, wherein the number of historical target traffic data is less than the number of historical non-target traffic data, and the historical target traffic data includes multiple historical target sub-traffic data with different feature types, wherein the feature types are determined based on the feature data.

[0220] By inputting the feature data of multiple historical target sub-traffic data into the generative adversarial network model, multiple oversampled sample sets of corresponding historical target sub-traffic data are obtained.

[0221] The target model is trained based on a sample set consisting of historical non-target traffic data and an oversampled sample set of multiple historical target sub-traffic data.

[0222] In some embodiments, the acquisition module 501 is specifically used for:

[0223] Construct a generator network model and a discriminator network model, and combine the generator network model and the discriminator network model to obtain a generative adversarial network model;

[0224] Based on the discriminator network model, the sample data generated by the generator network model is distinguished from the historical target sub-flow data to obtain the trained generative adversarial network model.

[0225] By utilizing the feature data of multiple historical target sub-traffic data, the hyperparameters of the trained generative adversarial network model are adjusted to obtain the target generative adversarial network model.

[0226] Based on the target generative adversarial network model, multiple target sub-traffic data with different feature types are generated;

[0227] Multiple target sub-flow data with different feature types are merged with the corresponding historical target sub-flow data to obtain multiple oversampled sample sets of corresponding historical target sub-flow data.

[0228] In some embodiments, the flow determination apparatus further includes a merging module, which is specifically used to obtain the similarity between feature data of oversampled sample sets of different historical target sub-flow data using Jaccard coefficients.

[0229] If the similarity is greater than the third threshold, obtain the number of samples in the oversampled sample set of the historical target sub-traffic data corresponding to the similarity.

[0230] If the number of samples in the oversampled sample set of the historical target sub-traffic data corresponding to the similarity is less than the fourth threshold, the number of samples in the oversampled sample set of the historical target sub-traffic data corresponding to the similarity is merged to obtain the combined oversampled sample set of the historical target sub-traffic data.

[0231] The target model is trained based on a sample set consisting of historical non-target traffic data and an oversampled sample set of multiple historical target sub-traffic data, including:

[0232] The target model is trained based on a sample set consisting of historical non-target traffic data, an oversampled sample set of multiple historical target sub-traffic data, and an oversampled sample set combining historical target sub-traffic data.

[0233] In some embodiments, the acquisition module 501 is specifically used for:

[0234] The sample set consisting of historical non-target traffic data and the oversampled sample set of multiple historical target sub-traffic data are input into the first model in the target model. The first model is used to classify the sample set to determine the predicted target result and the predicted non-target result.

[0235] The predicted target result and the predicted non-target result are input into the second model in the target model. The second model is used to perform secondary classification on the predicted target result and the predicted non-target result to obtain the first predicted target result.

[0236] In some embodiments, the acquisition module 501 is specifically used for:

[0237] The parameters of the particle swarm optimization algorithm are initialized and the fitness of multiple particles is obtained. Each particle represents the penalty parameters and kernel parameters of a set of support vector machine models. The parameters of the particle swarm optimization algorithm include inertia weights.

[0238] The first fitness is obtained by summing the fitness of multiple particles.

[0239] Divide the first fitness by the number of particles to obtain the average fitness of the population.

[0240] Randomly select two particles from a pool of particles;

[0241] The lowest historical fitness value among the two particles is used as the target fitness value, and the lowest historical fitness value of a particle is determined based on multiple fitness values ​​obtained through multiple iterations.

[0242] The second fitness is obtained by dividing the fitness of each particle by the average fitness of the population.

[0243] The second fitness level is compared with the fifth threshold to obtain the comparison result;

[0244] If the comparison result indicates that the second fitness is greater than or equal to the fifth threshold, the position corresponding to the smaller fitness of the two particle fitnesss is arbitrarily selected as the updated position of the particle.

[0245] Obtain the target fitness after particle position update;

[0246] If the target fitness is less than the fitness threshold, obtain the penalty parameter and kernel parameter corresponding to the target fitness as the optimal penalty parameter and optimal kernel parameter;

[0247] The optimized support vector machine model is obtained based on the optimal penalty parameters and the optimal kernel parameters.

[0248] In some embodiments, the acquisition module 501 is specifically used for:

[0249] The inertia weights are updated by using the correspondence between the number of iterations and the random number.

[0250] In some embodiments, the flow determination apparatus further includes an evaluation module for evaluating the fitness of a particle based on the ratio of the number of classification errors by the support vector machine model corresponding to the particle to the total number of classification errors.

[0251] In some embodiments, the acquisition module 501 is specifically used for:

[0252] The predicted target result and the predicted non-target result are input into the isolated forest model in the target model. The isolated forest model is used to obtain outliers in the predicted target result and the predicted non-target result respectively. Outliers correspond to one prediction result.

[0253] Obtain all points in the predicted target result except for outliers to obtain the second predicted target result;

[0254] The isolated forest model is used to perform secondary classification on outliers in the predicted target results and the predicted non-target results, and the first outlier in the predicted result is the predicted target result.

[0255] The results of the first outlier and the second prediction target are combined to obtain the first prediction target result.

[0256] Figure 4 Each module / unit in the illustrated device has the ability to implement Figure 1 The functions of each step performed by the application system and the corresponding technical effects it achieves are described briefly and will not be elaborated here.

[0257] Figure 5A schematic diagram of the hardware structure for flow determination provided in an embodiment of this disclosure is shown.

[0258] The device with a defined flow rate may include a processor 601 and a memory 602 storing computer program instructions.

[0259] Specifically, the processor 601 may include a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0260] Memory 602 may include mass storage for data or instructions. For example, and not limitingly, memory 602 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 602 may include removable or non-removable (or fixed) media. Where appropriate, memory 602 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 602 is non-volatile solid-state memory.

[0261] Memory 602 may include read-only memory (ROM), random access memory (RAM), disk storage media devices, optical storage media devices, flash memory devices, and electrical, optical, or other physical / tangible memory storage devices. Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to one aspect of this disclosure.

[0262] The processor 601 implements any of the flow determination methods in the above embodiments by reading and executing computer program instructions stored in the memory 602.

[0263] In one example, the device for determining the flow rate may further include a communication interface 603 and a bus 604. Wherein, as... Figure 5 As shown, the processor 601, memory 602, and communication interface 603 are connected through bus 604 and complete communication with each other.

[0264] The communication interface 603 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0265] Bus 604 includes hardware, software, or both, that couples components of an online data flow metering device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 604 may include one or more buses. Although specific buses are described and illustrated in embodiments of the invention, the invention contemplates any suitable bus or interconnect. Additionally, in conjunction with the flow determination method in the above embodiments, embodiments of this application also provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when these computer program instructions are executed by the processor, they implement any of the flow determination methods described in the above embodiments.

[0266] This application also provides a computer program product, including a computer program that, when executed by a processor, implements any of the traffic determination methods described in the above embodiments.

[0267] It should be clarified that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of the present invention.

[0268] The functional blocks shown in the above block diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this invention are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, read-only memory (ROM), flash memory, erasable read-only memory (EROM), floppy disks, compact disc read-only memory (CD-ROM), optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0269] It should also be noted that the exemplary embodiments mentioned in this invention describe methods or systems based on a series of steps or apparatus. However, this invention is not limited to the order of the steps described above; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0270] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0271] The above are merely specific embodiments of the present invention. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the protection scope of the present invention.

Claims

1. A method for determining flow rate, characterized in that, include: Acquire network traffic data to be detected, wherein the network traffic data to be detected includes multiple feature data; Calculate a first mutual information value among the plurality of feature data, wherein the first mutual information value characterizes the degree of correlation between any two feature data among the plurality of feature data; Based on the first mutual information value among the plurality of feature data, feature data whose first mutual information value is greater than or equal to a first threshold is obtained from the plurality of feature data as a first target feature set; The first target feature set is input into the first model in the target model, and the first model is used to classify the first target feature set to determine the initial predicted target result and the initial predicted non-target result. The initial predicted target result and the initial predicted non-target result are input into the second model in the target model. The second model is then used to perform a secondary classification of the initial predicted target result and the initial predicted non-target result to obtain the current predicted target result. When the first model includes a support vector machine model, before inputting the first target feature set into the first model of the target model and classifying the first target feature set using the first model, the method further includes: The parameters of the particle swarm optimization algorithm are initialized and the fitness of multiple particles is obtained, wherein the particles represent the penalty parameters and kernel parameters of a set of support vector machine models, and the parameters of the particle swarm optimization algorithm include inertial weights. The fitness of the multiple particles is summed to obtain the first fitness. Divide the first fitness by the number of the plurality of particles to obtain the average fitness of the population. Randomly select two particles from the plurality of particles; The lowest historical fitness value among the two particles is taken as the target fitness value, and the lowest historical fitness value of the particle is determined based on multiple fitness values ​​obtained through multiple iterations. The fitness of each of the multiple particles is divided by the average fitness of the population to obtain the second fitness; The second fitness is compared with the fifth threshold to obtain the comparison result; If the comparison result indicates that the second fitness is greater than or equal to the fifth threshold, the position corresponding to the smaller fitness of the two particle fitnesss is arbitrarily selected as the updated position of the particle. Obtain the target fitness after the particle position is updated; If the target fitness is less than the fitness threshold, the penalty parameter and kernel parameter corresponding to the target fitness are obtained as the optimal penalty parameter and optimal kernel parameter. Based on the optimal penalty parameters and optimal kernel parameters, a parameter-adjusted support vector machine model is obtained.

2. The method according to claim 1, characterized in that, The step of obtaining feature data whose first mutual information value is greater than or equal to a first threshold from the plurality of feature data as a first target feature set based on the first mutual information value among the plurality of feature data includes: Obtain the first number of first feature data whose first mutual information value is greater than or equal to the first threshold; When the first quantity equals the second threshold, the first feature data is obtained as the first target feature set.

3. The method according to claim 2, characterized in that, After obtaining a first number of first feature data whose first mutual information value is greater than or equal to the first threshold, the method further includes: If the first quantity is greater than the second threshold, determine second feature data whose first mutual information value of the first feature data is greater than or equal to a target first threshold; wherein the target first threshold is greater than the first threshold. If the number of the second feature data is equal to the second threshold, the second feature data is determined to be the second target feature set.

4. The method according to claim 1, characterized in that, Before inputting the first target feature set into the first model of the target model, classifying the first target feature set using the first model, and determining the initial predicted target result and the initial predicted non-target result, the method further includes: Acquire historical target traffic data and historical non-target traffic data, wherein the number of historical target traffic data is less than the number of historical non-target traffic data, and the historical target traffic data includes multiple historical target sub-traffic data with different feature types, wherein the feature types are determined based on the feature data; By inputting the feature data of multiple historical target sub-traffic data into the generative adversarial network model, multiple oversampled sample sets of corresponding historical target sub-traffic data are obtained. The target model is trained based on the sample set composed of the historical non-target traffic data and the oversampled sample set of the multiple historical target sub-traffic data.

5. The method according to claim 4, characterized in that, The step involves inputting the feature data of the multiple historical target sub-traffic data into a generative adversarial network model to obtain multiple corresponding oversampled sample sets of historical target sub-traffic data, including: A generator network model and a discriminator network model are constructed, and the generator network model and the discriminator network model are combined to obtain the generative adversarial network model; Based on the discriminator network model, the sample data generated by the generator network model is distinguished from the historical target sub-traffic data to obtain a trained generative adversarial network model. By using the feature data of the multiple historical target sub-traffic data, the hyperparameters of the trained generative adversarial network model are adjusted to obtain the target generative adversarial network model. Based on the target generative adversarial network model, multiple target sub-traffic data with different feature types are generated; The target sub-flow data with different feature types are merged with the corresponding historical target sub-flow data to obtain the oversampled sample set of the corresponding historical target sub-flow data.

6. The method according to claim 5, characterized in that, Before training the target model based on the sample set composed of the historical non-target traffic data and the oversampled sample set of the multiple historical target sub-traffic data, the method further includes: The similarity between feature data of oversampled sample sets of different historical target sub-flow data is obtained by using the Jaccard coefficient. If the similarity is greater than the third threshold, obtain the number of samples in the oversampled sample set of the historical target sub-traffic data corresponding to the similarity. If the number of samples in the oversampled sample set of the historical target sub-traffic data corresponding to the similarity is less than the fourth threshold, the number of samples in the oversampled sample set of the historical target sub-traffic data corresponding to the similarity is merged to obtain the combined oversampled sample set of the historical target sub-traffic data. The training of the target model based on the sample set composed of the historical non-target traffic data and the oversampled sample set of the multiple historical target sub-traffic data includes: The target model is trained based on the sample set composed of the historical non-target traffic data, the oversampled sample set of the multiple historical target sub-traffic data, and the oversampled sample set of the combined historical target sub-traffic data.

7. The method according to claim 4, characterized in that, The training of the target model based on the sample set composed of the historical non-target traffic data and the oversampled sample set of the multiple historical target sub-traffic data includes: The sample set consisting of the historical non-target traffic data and the oversampled sample set of the multiple historical target sub-traffic data are input into the first model in the target model. The first model is used to classify the sample set to determine the predicted target result and the predicted non-target result. The predicted target result and the predicted non-target result are input into the second model in the target model, and the second model is used to perform secondary classification on the predicted target result and the predicted non-target result to obtain the first predicted target result.

8. The method according to claim 1, characterized in that, The initialization of parameters for the particle swarm optimization algorithm and the acquisition of the fitness of multiple particles include: The inertial weights are updated by using the correspondence between the number of iterations and the random number, resulting in the updated inertial weights.

9. The method according to claim 1, characterized in that, The initialization of parameters for the particle swarm optimization algorithm and the acquisition of the fitness of multiple particles include: The fitness of a particle is evaluated by the ratio of the number of classification errors by the corresponding support vector machine model to the total number of classification errors.

10. The method according to claim 7, characterized in that, The second model includes an isolated forest model. The step of inputting the predicted target result and the predicted non-target result into the second model within the target model, and using the second model to perform a secondary classification of the predicted target result and the predicted non-target result to obtain a first predicted target result, includes: The predicted target result and the predicted non-target result are input into the isolated forest model in the target model. The isolated forest model is used to obtain outliers in the predicted target result and the predicted non-target result, respectively. Each outlier corresponds to a prediction result. Obtain all points in the predicted target result except for outliers to obtain the second predicted target result; The isolated forest model is used to perform secondary classification on the outliers of the predicted target result and the predicted non-target result, and the first outlier is obtained when the predicted result is the predicted target result. The first outlier and the second prediction target result are combined to obtain the first prediction target result.

11. A device for determining flow rate, characterized in that, The device includes: The acquisition module is used to acquire network traffic data to be detected, and the network traffic data to be detected includes multiple feature data. The calculation module is used to calculate a first mutual information value among the plurality of feature data, wherein the first mutual information value characterizes the degree of correlation between any two feature data among the plurality of feature data; The acquisition module is further configured to acquire feature data whose first mutual information value is greater than or equal to a first threshold from the plurality of feature data as a first target feature set based on the first mutual information value between the plurality of feature data; The determining module is used to input the first target feature set into the first model in the target model, use the first model to classify the first target feature set, and determine the initial predicted target result and the initial predicted non-target result; The acquisition module is further configured to input the initial prediction target result and the initial prediction non-target result into the second model in the target model, and use the second model to perform secondary classification on the initial prediction target result and the initial prediction non-target result to obtain the current prediction target result; The acquisition module is further configured to, when the first model includes a support vector machine model, before inputting the first target feature set into the first model in the target model and classifying the first target feature set using the first model, further include: The parameters of the particle swarm optimization algorithm are initialized and the fitness of multiple particles is obtained, wherein the particles represent the penalty parameters and kernel parameters of a set of support vector machine models, and the parameters of the particle swarm optimization algorithm include inertial weights. The fitness of the multiple particles is summed to obtain the first fitness. Divide the first fitness by the number of the plurality of particles to obtain the average fitness of the population. Randomly select two particles from the plurality of particles; The lowest historical fitness value among the two particles is taken as the target fitness value, and the lowest historical fitness value of the particle is determined based on multiple fitness values ​​obtained through multiple iterations. The fitness of each of the multiple particles is divided by the average fitness of the population to obtain the second fitness; The second fitness is compared with the fifth threshold to obtain the comparison result; If the comparison result indicates that the second fitness is greater than or equal to the fifth threshold, the position corresponding to the smaller fitness of the two particle fitnesss is arbitrarily selected as the updated position of the particle. Obtain the target fitness after the particle position is updated; If the target fitness is less than the fitness threshold, the penalty parameter and kernel parameter corresponding to the target fitness are obtained as the optimal penalty parameter and optimal kernel parameter. Based on the optimal penalty parameters and optimal kernel parameters, a parameter-adjusted support vector machine model is obtained.

12. A device for determining flow rate, characterized in that, The device includes: a processor and a memory storing computer program instructions; the processor reads and executes the computer program instructions to implement the flow determination method as described in any one of claims 1-10.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions that, when executed by a processor, implement the flow determination method as described in any one of claims 1-10.

14. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the flow determination method according to any one of claims 1-10.

Images