Network traffic analysis method based on adaptive response large-scale model

Abstract

The present application discloses a network traffic analysis method based on an adaptive response large-scale model, which uses a network sniffer to monitor network traffic values ​​in real time, and uses deep learning-based artificial intelligence technology to perform time series analysis on network traffic data, and infers the network traffic time series characteristics of the current time period under an ideal state based on the network traffic time series characteristic pattern of the historical time period, and then based on the comparative analysis between the inferred network traffic time series characteristics and the actual network traffic time series characteristics, intelligently judges whether there is a network anomaly. In this way, the accuracy and efficiency of network traffic anomaly detection can be improved, the real-time analysis of large-scale network traffic can be effectively responded to, and the network security defense capability can be enhanced.

Description

Technical Field

[0001] The present application relates to the field of intelligent analysis, and more specifically, to a network traffic analysis method based on an adaptive response large-scale model. Background Art

[0002] With the rapid development and popularization of Internet technology, the network has become an indispensable infrastructure in modern society, and the scale of network traffic has also increased exponentially. Whether it is professional tasks, academic research or leisure and entertainment, people's various daily activities are highly dependent on the network, which has led to a sharp increase in the complexity and diversity of network traffic. At the same time, network security issues have become increasingly prominent. For example, network attacks, illegal intrusions, data leaks and other incidents have occurred frequently, posing a serious threat to personal privacy, corporate security and even national interests. Therefore, real-time and accurate detection and prediction of abnormal network traffic status, timely discovery and defense of potential network security threats have become an important topic in current network management and security research.

[0003] Traditional network traffic analysis methods are mainly based on simple statistical analysis and rule matching. However, this method may be effective when processing simple, static network traffic data, but when faced with large-scale, dynamically changing network traffic, its accuracy and real-time performance are severely limited, making it difficult to effectively deal with the analysis and management of large-scale network traffic.

[0004] Therefore, a network traffic analysis method based on adaptive response large-scale model is expected. Summary of the invention

[0005] In order to solve the above technical problems, the present application is proposed. The embodiment of the present application provides a network traffic analysis method based on an adaptive response large-scale model, which uses a network sniffer to monitor the network traffic value in real time, and uses artificial intelligence technology based on deep learning to perform time series analysis on network traffic data, and infers the network traffic time series characteristics of the current time period under an ideal state based on the network traffic time series characteristic pattern of the historical time period, and then based on the comparative analysis between the inferred network traffic time series characteristics and the actual network traffic time series characteristics, intelligently judges whether there is a network anomaly. In this way, the accuracy and efficiency of network traffic anomaly detection can be improved, the real-time analysis of large-scale network traffic can be effectively responded to, and the network security defense capability can be enhanced.

[0006] According to one aspect of the present application, a network traffic analysis method based on an adaptive response large-scale model is provided, which includes:

[0007] Get a time series of network traffic values ​​collected by a network sniffer;

[0008] Sequentially segmenting the time series of the network flow value based on a predetermined time scale to obtain a set of time subsequences of the network flow value, wherein the last time subsequence of the network flow value in the set of time subsequences of the network flow value is used as the time subsequence of the reasoning verification network flow value, and the other time subsequences of the network flow value in the set of time subsequences of the network flow value are used as the time subsequences of the detection network flow value;

[0009] Performing a time domain propagation aggregation analysis of the local time series correlation characteristics of network traffic on the set of time subsequences of the detected network traffic values ​​to obtain a network traffic time series aggregation representation vector;

[0010] Based on the network traffic time series aggregation representation vector, inferring to obtain a priori guided network traffic time series reasoning representation vector;

[0011] Sequentially encode the time subsequence of the inference verification network flow value to obtain an inference verification network flow time series associated implicit feature vector;

[0012] Based on the feature offset between the implicit feature vector associated with the reasoning verification network traffic timing and the priori guided network traffic timing reasoning representation vector, it is determined whether there is a network anomaly.

[0013] Compared with the prior art, the network traffic analysis method based on the adaptive response large-scale model provided by the present application monitors the network traffic value in real time through a network sniffer, and uses artificial intelligence technology based on deep learning to perform time series analysis on the network traffic data, and infers the network traffic time series characteristics of the current time period under an ideal state based on the network traffic time series characteristic pattern of the historical time period, and then based on the comparative analysis between the inferred network traffic time series characteristics and the actual network traffic time series characteristics, intelligently judges whether there is a network anomaly. In this way, the accuracy and efficiency of network traffic anomaly detection can be improved, the real-time analysis of large-scale network traffic can be effectively responded to, and the network security defense capability can be enhanced. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] By describing the embodiments of the present application in more detail in conjunction with the accompanying drawings, the above and other purposes, features and advantages of the present application will become more apparent. The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0015] Figure 1 It is a flowchart of a network traffic analysis method based on an adaptive response large-scale model according to an embodiment of the present application;

[0016] Figure 2A data flow diagram of a network traffic analysis method based on an adaptive response large-scale model according to an embodiment of the present application;

[0017] Figure 3 It is a flowchart of the training phase of the network traffic analysis method based on the adaptive response large-scale model according to an embodiment of the present application;

[0018] Figure 4 This is a flowchart of sub-step S3 of the network traffic analysis method based on the adaptive response large-scale model according to an embodiment of the present application. DETAILED DESCRIPTION

[0019] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0020] As shown in this application and claims, unless the context clearly indicates an exception, the words "a", "an", "an" and / or "the" do not refer to the singular and may also include the plural. Generally speaking, the terms "include" and "comprise" only indicate the inclusion of the steps and elements that have been clearly identified, and these steps and elements do not constitute an exclusive list. The method or device may also include other steps or elements.

[0021] Although the present application makes various references to certain modules in the system according to the embodiments of the present application, any number of different modules can be used and run on the user terminal and / or server. The modules are only illustrative, and different aspects of the system and method can use different modules.

[0022] Flowcharts are used in the present application to illustrate the operations performed by the system according to the embodiments of the present application. It should be understood that the preceding or following operations are not necessarily performed accurately in order. On the contrary, various steps may be processed in reverse order or simultaneously as required. Meanwhile, other operations may also be added to these processes, or a certain step or several steps of operations may be removed from these processes.

[0023] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0024] Traditional network traffic analysis methods are mainly based on simple statistical analysis and rule matching. However, this method may be effective when processing simple, static network traffic data, but when facing large-scale, dynamically changing network traffic, its accuracy and real-time performance are severely limited, making it difficult to effectively deal with the analysis and management of large-scale network traffic. Therefore, a network traffic analysis method based on an adaptive response large-scale model is expected.

[0025] In the technical solution of the present application, a network traffic analysis method based on an adaptive response large-scale model is proposed. Figure 1 A flowchart of a network traffic analysis method based on an adaptive response large-scale model according to an embodiment of the present application. Figure 2 : is a data flow diagram of a network traffic analysis method based on an adaptive response large-scale model according to an embodiment of the present application. Figure 1 and Figure 2 As shown, according to an embodiment of the present application, a network traffic analysis method based on an adaptive response large-scale model includes the following steps: S1, obtaining a time series of network traffic values ​​collected by a network sniffer; S2, segmenting the time series of the network traffic values ​​based on a predetermined time scale to obtain a set of time subsequences of network traffic values, wherein the last time subsequence of the network traffic value in the set of time subsequences of the network traffic value is used as the time subsequence of the network traffic value for inference verification, and the other time subsequences of the network traffic value in the set of time subsequences of the network traffic value are used as the time subsequences of the network traffic value for detection. Column; S3, perform time domain propagation aggregation analysis of network traffic local timing correlation features on the set of time subseries of the detected network traffic values ​​to obtain a network traffic timing aggregation representation vector; S4, based on the network traffic timing aggregation representation vector, infer and obtain a priori guided network traffic timing reasoning representation vector; S5, perform sequence encoding on the time subsequences of the reasoning verification network traffic values ​​to obtain a reasoning verification network traffic timing correlation implicit feature vector; S6, determine whether there is a network anomaly based on the feature offset between the reasoning verification network traffic timing correlation implicit feature vector and the priori guided network traffic timing reasoning representation vector.

[0026] In particular, the S1 and S2 obtain the time series of network traffic values ​​collected by the network sniffer; and the time series of the network traffic values ​​is segmented based on a predetermined time scale to obtain a set of time subsequences of network traffic values, wherein the last time subsequence of the network traffic value in the set of time subsequences of the network traffic value is used as the time subsequence of the network traffic value for inference verification, and the other time subsequences of the network traffic value in the set of time subsequences of the network traffic value are used as the time subsequences of the network traffic value for detection. Considering that the network traffic data is continuous time series data, directly analyzing the entire time series may require huge computational effort, making it difficult to process in real time, and may lose abnormal information such as short-term fluctuations and emergencies in the network traffic. Therefore, in the technical solution of the present application, the time series of the network traffic value is further segmented based on a predetermined time scale to decompose large-scale network traffic data into multiple time subsequences of network traffic values, thereby significantly reducing the amount of data processed at a single time and improving processing speed and efficiency. At the same time, considering that the anomaly of network traffic is often sudden and short-lived, the anomaly detection of network traffic needs to be real-time. Therefore, in the technical solution of the present application, the time subsequence of the last network traffic value in the set of the time subsequences of the network traffic value is used as the time subsequence of the network traffic value for inference verification, and the time subsequences of other network traffic values ​​in the set of the time subsequences of the network traffic value are used as the time subsequences for detecting the network traffic value. That is, the network traffic data of the earlier time period is used as the detection data, and the network traffic data of the latest time period is inferred and verified, so as to detect the anomaly of the network traffic in the latest time period in real time, thereby ensuring the real-time and effectiveness of anomaly detection.

[0027] In particular, the step S3 performs a time domain propagation aggregation analysis of the local time series correlation characteristics of the network traffic on the set of time subsequences of the detected network traffic values ​​to obtain a network traffic time series aggregation representation vector. In particular, in a specific example of the present application, Figure 4 As shown, S3 includes: S31, inputting each time subsequence of the detected network traffic value in the set of time subsequences of the detected network traffic value into a sequence encoder based on a bidirectional gated cyclic unit to obtain a set of local temporal implicit correlation feature vectors of the detected network traffic; S32, inputting the set of local temporal implicit correlation feature vectors of the detected network traffic into a node feature propagation network based on a node energy decay mechanism to obtain the network traffic temporal aggregation representation vector.

[0028] Specifically, in S31, each time subsequence of the detected network flow value in the set of time subsequences of the detected network flow value is input into a sequence encoder based on a bidirectional gated cyclic unit to obtain a set of local temporal implicit correlation feature vectors of the detected network flow. Considering that network flow data has significant time series characteristics, that is, there is a temporal dependency between data points, therefore, in order to capture the correlation change pattern of network flow data in the time dimension, a sequence encoder based on a bidirectional gated cyclic unit (BiGRU) is further used to perform temporal encoding on each time subsequence of the detected network flow value, so as to utilize the GRU units in the forward and reverse directions in the bidirectional gated cyclic unit, and simultaneously capture the forward dependency and backward dependency in the time subsequence of the detected network flow value, and mine the temporal implicit correlation features of the network flow within the local time range, thereby obtaining a set of local temporal implicit correlation feature vectors of the detected network flow.

[0029] Specifically, the S32 inputs the set of implicitly associated feature vectors of the local time series of the detected network traffic into the node feature propagation network based on the node energy decay mechanism to obtain the network traffic time series aggregation representation vector. Considering that the network traffic data not only has short-term local correlation in the time dimension, but also has long-term dependencies in the global scope. Therefore, in order to obtain the global dynamic change pattern and trend of network traffic, it is necessary to further integrate the information of the set of implicitly associated feature vectors of the local time series of the detected network traffic. In the technical solution of the present application, a node feature propagation network based on the node energy decay mechanism is used to carry out feature propagation and fusion to obtain the network traffic time series aggregation representation vector. Specifically, the node feature propagation network introduces a node energy attenuation mechanism, which performs information propagation fusion of each time node by calculating the energy intensity of the local temporal implicit correlation feature vectors of each detection network traffic, and adopts an attenuation strategy in the propagation process. The energy attenuation coefficient is generated based on the spatial span between the local temporal implicit correlation feature vectors of each detection network traffic and the current local temporal implicit correlation feature vector of the detection network traffic (that is, the last feature vector in the set of feature vectors), simulating the attenuation characteristics of node energy with time and space, so that the network traffic characteristics of earlier time points are gradually weakened during the propagation process, while the network traffic characteristics of closer time points are strengthened, so that in the fusion process, more emphasis can be placed on the recent network traffic status, effectively capturing the dynamic change trend of network traffic within the global time range, and realizing the temporal and spatial aggregation representation of node features, thereby improving the model's ability to understand dynamic network data.

[0030] In an embodiment of the present application, the set of the local timing implicitly associated feature vectors of the detected network traffic is input into a node feature propagation network based on a node energy decay mechanism to obtain the network traffic timing aggregation representation vector, including: calculating the node energy statistical paradigm value of each local timing implicitly associated feature vector of the detected network traffic based on the maximum value, average value and variance of each local timing implicitly associated feature vector of the detected network traffic in the set of the local timing implicitly associated feature vectors of the detected network traffic to obtain a sequence of node energy statistical paradigm values, wherein the node energy statistical paradigm value corresponding to the current local timing implicitly associated feature vector of the detected network traffic in the sequence of node energy statistical paradigm values ​​is used as the current node energy statistical paradigm value, and other node energy statistical paradigm values ​​are used as historical node energy statistical paradigm values ​​to obtain a sequence of current node energy statistical paradigm values ​​and historical node energy statistical paradigm values; and statistically analyzing the local timing implicitly associated feature vectors of the detected network traffic in the set of the local timing implicitly associated feature vectors of the detected network traffic with the current detection network traffic. The node propagation space span values ​​between the local time series implicit correlation feature vectors are used to obtain a sequence of node propagation space span values; based on the sequence of node propagation space span values ​​and the sequence of historical node energy statistical paradigm values, the node energy propagation attenuation coefficient values ​​of other local time series implicit correlation feature vectors of the detection network traffic in the set of local time series implicit correlation feature vectors of the detection network traffic are determined to obtain a sequence of node energy propagation attenuation coefficient values, wherein the node energy propagation attenuation coefficient values ​​are inversely correlated with the historical node energy statistical paradigm values; using the sequence of node energy propagation attenuation coefficient values ​​as a weight sequence, the weighted sum of all other local time series implicit correlation feature vectors of the detection network traffic in the set of local time series implicit correlation feature vectors of the detection network traffic is calculated to obtain a historical node energy attenuation time series aggregation feature vector; the current node energy statistical paradigm value is integrated to calculate the weighted sum of the historical node energy attenuation time series aggregation feature vector and the current local time series implicit correlation feature vector of the detection network traffic to obtain the network traffic time series aggregation representation vector.

[0031] Among them, the process of calculating the node energy statistical normal form value of each local timing implicit correlation feature vector of the detected network traffic based on the maximum value, average value and variance of each local timing implicit correlation feature vector of the detected network traffic in the set of local timing implicit correlation feature vectors of the detected network traffic to obtain a sequence of node energy statistical normal form values ​​includes: calculating the weighted sum between the variance of the local timing implicit correlation feature vector of the detected network traffic and the regular term to obtain a first intermediate term, and calculating the square of the difference between the maximum value of the local timing implicit correlation feature vector of the detected network traffic and its mean, the variance of the local timing implicit correlation feature vector of the detected network traffic and the weighted sum between the regular term to obtain a second intermediate term; calculating the first intermediate term divided by the second intermediate term to obtain the node energy statistical normal form value.

[0032] More specifically, based on the sequence of node propagation space span values ​​and the sequence of historical node energy statistical paradigm values, the process of determining the node energy propagation attenuation coefficient values ​​of other detected network traffic local timing implicitly associated feature vectors in the set of detected network traffic local timing implicitly associated feature vectors to obtain a sequence of node energy propagation attenuation coefficient values ​​includes: using a preset attenuation constant as a weight, calculating the weighted sum of each node propagation space span value in the sequence of node propagation space span values ​​and its own exponential function value with a natural constant as the base to obtain a sequence of spatial span attenuation factors; calculating the corresponding division results of each historical node energy statistical paradigm value in the sequence of historical node energy statistical paradigm values ​​and each spatial span attenuation factor in the sequence of spatial span attenuation factors to obtain the sequence of node energy propagation attenuation coefficient values.

[0033] In summary, in the above embodiment, the set of the local time series implicit correlation feature vectors of the detected network traffic is input into the node feature propagation network based on the node energy decay mechanism to obtain the network traffic time series aggregation representation vector, including: processing the set of the local time series implicit correlation feature vectors of the detected network traffic with the following time series propagation fusion formula to obtain the network traffic time series aggregation representation vector, wherein the time series propagation fusion formula is:

[0034] X={x1,x2,...x k-1 ,x k}

[0035]

[0036]

[0037] Wherein, X represents the set of implicitly associated feature vectors of the local time series of the detected network traffic, the value of k is the number of feature vectors in the set of implicitly associated feature vectors of the local time series of the detected network traffic, and x1, x2, x i 、x k-1 and x k respectively represent the first, second, ith, k-1th and current detected network traffic local time series implicit correlation feature vectors in the set of detected network traffic local time series implicit correlation feature vectors, represents the mth eigenvalue of the local time series implicit correlation feature vector of the i-th detected network traffic, the value of L is the length of the local time series implicit correlation feature vector of the i-th detected network traffic, μ i is the mean of the eigenvalues ​​of the implicit correlation eigenvector of the local time series of the i-th detected network traffic, σ 2 i is the variance of each eigenvalue of the implicit correlation eigenvector of the local time series of the i-th detected network traffic, max(x i ) represents the maximum value of each eigenvalue of the local time series implicit correlation eigenvector of the i-th detected network traffic, ∈ is a regular term, is the node energy statistical paradigm value of the i-th detection network traffic local time series implicit correlation feature vector, Count(x k →x i ) represents the node propagation space span value between the i-th detected network traffic local time series implicit correlation feature vector and the current detected network traffic local time series implicit correlation feature vector, γ and δ are different preset attenuation constants, a and b are different weight hyperparameters, is the energy statistical paradigm value of the current node, x k+1 A time series aggregation representation vector representing the network traffic.

[0038] It is worth mentioning that in other specific examples of the present application, the set of time subseries of the detected network traffic values ​​can also be subjected to time domain propagation aggregation analysis of local timing correlation features of network traffic to obtain a network traffic timing aggregation representation vector by other means, for example: inputting a set of time subseries of the detected network traffic values; performing feature extraction on each time subsequence; using a graph neural network or a propagation mechanism to propagate the extracted local timing correlation features in the time domain; summarizing and aggregating the propagated and aggregated features to obtain a network traffic timing aggregation representation of each time subsequence to obtain the network traffic timing aggregation representation vector.

[0039] In particular, the S4, based on the network traffic timing aggregation representation vector, infers the prior-guided network traffic timing reasoning representation vector. In the technical solution of the present application, the network traffic timing aggregation representation vector is input into the decoder-based network traffic timing reasoner to obtain the prior-guided network traffic timing reasoning representation vector. That is, the network traffic timing aggregation representation vector is input into the decoder-based network traffic timing reasoner for processing, so as to utilize the powerful fitting ability of the decoder model to automatically learn the inherent laws and change patterns of the network traffic timing aggregation representation vector, and decode and predict the network traffic timing aggregation representation vector based on the learned prior knowledge, so as to infer the network traffic timing characteristics of the current time period under the ideal state, and generate the prior-guided network traffic timing reasoning representation vector.

[0040] In particular, the S5 performs sequence encoding on the time subsequence of the reasoning verification network traffic value to obtain the time series correlation implicit feature vector of the reasoning verification network traffic. In the technical solution of the present application, the time subsequence of the reasoning verification network traffic value is input into the sequence encoder based on the bidirectional gated cyclic unit for sequence encoding, so as to use the gating mechanism to control the flow of information, and at the same time capture the bidirectional time series dependency of the reasoning verification network traffic value in the time dimension, and mine the time series implicit correlation features of the network traffic value actually monitored within the current time range, so as to obtain the local time series implicit correlation feature vector of the reasoning verification network traffic.

[0041] In particular, the S6 determines whether there is a network anomaly based on the feature offset between the implicit feature vector associated with the timing of the network traffic and the prior-guided network traffic timing reasoning representation vector. That is, the actual monitored network traffic timing features are compared and analyzed with the network traffic timing features under the ideal state inferred by the decoder to determine whether the network traffic is abnormal. In the technical solution of the present application, the cosine similarity between the implicit feature vector associated with the timing of the network traffic and the prior-guided network traffic timing reasoning representation vector is calculated as the ideal-actual offset coefficient to quantitatively evaluate the degree of deviation between the current network traffic state and the ideal state. Then, based on the comparison between the ideal-actual offset coefficient and the predetermined threshold, it is determined whether there is a network anomaly. If the offset coefficient exceeds the preset threshold, the system determines that there is an abnormality in the current network traffic, triggers the abnormal alarm mechanism, and pushes the relevant information to the network security management personnel for further processing.

[0042] In the above technical solution of the present application, the reasoning verification network traffic timing association implicit feature vector represents the sequence context semantic association feature of the time subsequence of the reasoning verification network traffic value, and the a priori guided network traffic timing reasoning representation vector is obtained by decoding the network traffic timing aggregation representation obtained by sequence encoding the set of time subsequences of the detected network traffic values ​​and node feature propagation based on the node energy decay mechanism. Therefore, the a priori guided network traffic timing reasoning representation vector will have a priori-posteriori probability causal association missing due to the encoding-decoding structure relative to the reasoning verification network traffic timing association implicit feature vector, so that when mapping to the common cosine similarity domain, there is a mapping association missing, which affects the calculation accuracy of the cosine similarity.

[0043] Therefore, during the training process, the applicant of the present application optimizes the prior-guided network traffic timing reasoning representation vector and the reasoning verification network traffic timing association implicit feature vector based on the predicted cosine similarity at each iteration, that is, when the model is updated based on the back propagation parameter based on gradient descent based on the difference loss function between the true cosine similarity and the predicted cosine similarity, including:

[0044] Probabilize each eigenvalue of the prior-guided network traffic timing reasoning representation vector and the reasoning verification network traffic timing associated implicit eigenvalue vector based on a probability activation function, such as a softmax function, to obtain each probabilized eigenvalue;

[0045] determining an epistemic symbol value based on a comparison of the respective probabilized feature values ​​with the predicted cosine similarity, wherein the epistemic symbol value is equal to one, zero, and negative one, respectively, in response to the respective probabilized feature values ​​being greater than, equal to, and less than the predicted cosine similarity;

[0046] After multiplying each of the probabilized feature values ​​by the cognitive symbol value and the feature mean of each of the probabilized feature values, respectively, the first product and the second product are multiplied by a first weight and a second weight as hyperparameters to obtain a first weighted product and a second weighted product; and

[0047] The difference between the first weighted product and the second weighted product is calculated and the absolute value is taken to obtain an optimized eigenvalue.

[0048] It can be expressed as:

[0049]

[0050] f i are the probabilistic eigenvalues ​​of the priori guided network traffic timing reasoning representation vector and the reasoning verification network traffic timing associated implicit eigenvector, is the feature mean of each probabilistic feature value of the prior guided network traffic timing reasoning representation vector and the reasoning verification network traffic timing associated implicit feature vector, p is the training cosine similarity, sgn(v i ,p) is the cognitive symbol value, × means multiplication, |·| means taking the absolute value, α and β are the first weight and the second weight as hyperparameters, respectively, f i ' is the optimized eigenvalues ​​of the prior-guided network traffic timing reasoning representation vector and the reasoning verification network traffic timing associated implicit feature vector.

[0051] That is, by comparing the probabilistic amplitude of the eigenvalues ​​of the prior-guided network traffic timing reasoning representation vector and the reasoning verification network traffic timing association implicit feature vector with the predicted cosine similarity, the cosine similarity cognitive phase transformation response of the prior-guided network traffic timing reasoning representation vector and the reasoning verification network traffic timing association implicit feature vector is obtained, and the phase shift response of the eigenvalues ​​of the prior-guided network traffic timing reasoning representation vector and the reasoning verification network traffic timing association implicit feature vector relative to the cosine similarity representation of the feature as a whole is subjected to a feature distribution sequence invariance transformation based on differential distribution expansion, so as to realize the causal constraint of the posterior-prior feature distribution representation of the prior-guided network traffic timing reasoning representation vector and the reasoning verification network traffic timing association implicit feature vector, compensate for the mapping association loss when the prior-guided network traffic timing reasoning representation vector and the reasoning verification network traffic timing association implicit feature vector are mapped to the common cosine similarity domain, thereby improving the calculation accuracy of the cosine similarity.

[0052] It should be understood that before using the above-mentioned neural network model for inference, it is necessary to train the sequence encoder based on the bidirectional gated recurrent unit, the node feature propagation network based on the node energy decay mechanism, and the network traffic timing reasoner based on the decoder. That is to say, in the network traffic analysis method based on the adaptive response large-scale model of the present application, it also includes a training phase for training the sequence encoder based on the bidirectional gated recurrent unit, the node feature propagation network based on the node energy decay mechanism, and the network traffic timing reasoner based on the decoder.

[0053] Figure 3 FIG. 1 is a flowchart of the training phase of the network traffic analysis method based on the adaptive response large-scale model according to an embodiment of the present application. Figure 3As shown, according to the network traffic analysis method based on the adaptive response large-scale model of the embodiment of the present application, it includes: a training stage, including: S110, obtaining training data, the training data including the time series of training network traffic values ​​collected by the network sniffer, and the true value of the cosine similarity; S120, based on a predetermined time scale, the time series of the training network traffic values ​​is sequence-segmented to obtain a set of time subsequences of the training network traffic values, wherein the last time subsequence of the training network traffic value in the set of time subsequences of the training network traffic value is used as the time subsequence of the training reasoning verification network traffic value, and the other time subsequences of the training network traffic value in the set of time subsequences of the training network traffic value are used as the time subsequences of the training detection network traffic value; S130, the time subsequences of each training detection network traffic value in the set of time subsequences of the training detection network traffic value are respectively input into the sequence encoder based on the bidirectional gated cyclic unit to obtain a set of local temporal implicit correlation feature vectors of the training detection network traffic; S140, the set of local temporal implicit correlation feature vectors of the training detection network traffic is input into the node energy decay mechanism based on the node energy decay mechanism. The node feature propagation network is used to obtain the training network traffic timing aggregation representation vector; S150, the training network traffic timing aggregation representation vector is input into the decoder-based network traffic timing reasoning device to obtain the training prior-guided network traffic timing reasoning representation vector; S160, the time subsequence of the training reasoning verification network traffic value is input into the sequence encoder based on the bidirectional gated cyclic unit to obtain the training reasoning verification network traffic timing associated implicit feature vector; S170, the training reasoning verification network traffic timing associated implicit feature vector and the training prior-guided network traffic timing reasoning table are calculated. The training cosine similarity between the representation vectors; S180, calculating the difference between the training cosine similarity and the true value of the cosine similarity to obtain the difference loss function value; S190, using the difference loss function value to train the sequence encoder based on the bidirectional gated recurrent unit, the node feature propagation network based on the node energy decay mechanism and the network traffic timing reasoner based on the decoder, wherein in each round of iteration of the training, the training reasoning verification network traffic timing associated implicit feature vector and the training prior guided network traffic timing reasoning representation vector are iteratively optimized.

[0054] In summary, the network traffic analysis method based on the adaptive response large-scale model according to the embodiment of the present application is explained, which uses a network sniffer to monitor the network traffic value in real time, and uses artificial intelligence technology based on deep learning to perform time series analysis on network traffic data, and based on the network traffic time series feature pattern of the historical time period, infers the network traffic time series feature of the current time period under the ideal state, and then based on the comparative analysis between the inferred network traffic time series feature and the actual network traffic time series feature, intelligently judges whether there is a network anomaly. In this way, the accuracy and efficiency of network traffic anomaly detection can be improved, the real-time analysis of large-scale network traffic can be effectively responded to, and the network security defense capability can be enhanced.

[0055] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A network traffic analysis method based on an adaptive response large-scale model, characterized in that: include: Get a time series of network traffic values ​​collected by a network sniffer; Sequentially segmenting the time series of the network flow value based on a predetermined time scale to obtain a set of time subsequences of the network flow value, wherein the last time subsequence of the network flow value in the set of time subsequences of the network flow value is used as the time subsequence of the reasoning verification network flow value, and the other time subsequences of the network flow value in the set of time subsequences of the network flow value are used as the time subsequences of the detection network flow value; Performing a time domain propagation aggregation analysis of the local time series correlation characteristics of network traffic on the set of time subsequences of the detected network traffic values ​​to obtain a network traffic time series aggregation representation vector; Based on the network traffic time series aggregation representation vector, inferring to obtain a priori guided network traffic time series reasoning representation vector; Sequentially encode the time subsequence of the inference verification network flow value to obtain an inference verification network flow time series associated implicit feature vector; Determine whether there is a network anomaly based on the feature offset between the implicit feature vector associated with the reasoning verification network traffic timing and the prior guided network traffic timing reasoning representation vector; The method further comprises a training step: training a sequence encoder based on a bidirectional gated recurrent unit, a node feature propagation network based on a node energy decay mechanism, and a network traffic timing reasoner based on a decoder; The training step comprises: Acquire training data, wherein the training data includes a time series of training network traffic values ​​collected by a network sniffer and a true value of cosine similarity; Sequentially segmenting the time series of the training network flow value based on a predetermined time scale to obtain a set of time subsequences of the training network flow value, wherein the last time subsequence of the training network flow value in the set of time subsequences of the training network flow value is used as the time subsequence of the training reasoning verification network flow value, and the other time subsequences of the training network flow value in the set of time subsequences of the training network flow value are used as the time subsequences of the training detection network flow value; Inputting the time subsequences of each training detection network flow value in the set of time subsequences of the training detection network flow value into the sequence encoder based on the bidirectional gated recurrent unit to obtain a set of local temporal implicit correlation feature vectors of the training detection network flow; Inputting the set of implicitly associated feature vectors of the local time series of the training detection network traffic into the node feature propagation network based on the node energy decay mechanism to obtain a training network traffic time series aggregation representation vector; Inputting the training network traffic timing aggregate representation vector into the decoder-based network traffic timing reasoner to obtain a training priori guided network traffic timing reasoning representation vector; Inputting the time subsequence of the training, reasoning and verification network traffic value into the sequence encoder based on the bidirectional gated recurrent unit to obtain the training, reasoning and verification network traffic time series associated implicit feature vector; Calculating the training cosine similarity between the training reasoning verification network traffic time series associated implicit feature vector and the training priori guided network traffic time series reasoning representation vector; Calculating the difference between the training cosine similarity and the true value of the cosine similarity to obtain a difference loss function value; The difference loss function value is used to train the sequence encoder based on the bidirectional gated recurrent unit, the node feature propagation network based on the node energy decay mechanism, and the decoder-based network traffic timing reasoner, wherein in each round of iteration of the training, the training reasoning verification network traffic timing associated implicit feature vector and the training prior guided network traffic timing reasoning representation vector are iteratively optimized.

2. The network traffic analysis method based on the adaptive response large-scale model according to claim 1 is characterized in that: Performing a time domain propagation aggregation analysis of the local time series correlation characteristics of network traffic on the set of time subsequences of the detected network traffic values ​​to obtain a network traffic time series aggregation representation vector includes: Inputting each time subsequence of the detected network flow value in the set of time subsequences of the detected network flow value into a sequence encoder based on a bidirectional gated cyclic unit to obtain a set of implicit correlation feature vectors of the local temporal sequence of the detected network flow; The set of implicitly associated feature vectors of the local time series of the detected network traffic is input into a node feature propagation network based on a node energy decay mechanism to obtain a network traffic time series aggregation representation vector.

3. The network traffic analysis method based on the adaptive response large-scale model according to claim 2 is characterized in that: Inputting the set of implicitly associated feature vectors of the local time series of the detected network traffic into a node feature propagation network based on a node energy decay mechanism to obtain the network traffic time series aggregation representation vector, including: Based on the maximum value, average value and variance of each local timing implicit correlation feature vector of the detected network traffic in the set of the local timing implicit correlation feature vector of the detected network traffic, the node energy statistical paradigm value of each local timing implicit correlation feature vector of the detected network traffic is calculated to obtain a sequence of node energy statistical paradigm values, wherein the node energy statistical paradigm value corresponding to the current local timing implicit correlation feature vector of the detected network traffic in the sequence of node energy statistical paradigm values ​​is used as the current node energy statistical paradigm value, and other node energy statistical paradigm values ​​are used as historical node energy statistical paradigm values ​​to obtain a sequence of current node energy statistical paradigm values ​​and historical node energy statistical paradigm values; Counting the node propagation space span values ​​between each other local time series implicit correlation feature vector of the detected network traffic in the set of the local time series implicit correlation feature vector of the detected network traffic and the current local time series implicit correlation feature vector of the detected network traffic to obtain a sequence of node propagation space span values; Based on the sequence of the node propagation space span values ​​and the sequence of the historical node energy statistical paradigm values, determine the node energy propagation attenuation coefficient values ​​of other detection network traffic local time series implicit correlation feature vectors in the set of the detection network traffic local time series implicit correlation feature vectors to obtain a sequence of node energy propagation attenuation coefficient values, wherein the node energy propagation attenuation coefficient value is inversely correlated with the historical node energy statistical paradigm value; Taking the sequence of node energy propagation attenuation coefficient values ​​as a weight sequence, calculating the weighted sum of all other local time series implicit correlation feature vectors of the detected network traffic in the set of local time series implicit correlation feature vectors of the detected network traffic to obtain a historical node energy attenuation time series aggregate feature vector; The current node energy statistical paradigm value is integrated to calculate the weighted sum of the historical node energy decay time series aggregation feature vector and the current detected network traffic local time series implicit correlation feature vector to obtain the network traffic time series aggregation representation vector.

4. The network traffic analysis method based on the adaptive response large-scale model according to claim 3 is characterized in that: Based on the maximum value, average value and variance of each of the local time series implicit correlation feature vectors of the detected network traffic in the set of the local time series implicit correlation feature vectors of the detected network traffic, the node energy statistical normal form value of each of the local time series implicit correlation feature vectors of the detected network traffic is calculated to obtain a sequence of node energy statistical normal form values, including: Calculate the weighted sum between the variance of the local time series implicit correlation feature vector of the detected network traffic and the regular term to obtain a first intermediate term, and calculate the square of the difference between the maximum value and the mean value of the local time series implicit correlation feature vector of the detected network traffic, the variance of the local time series implicit correlation feature vector of the detected network traffic and the regular term to obtain a second intermediate term; The first intermediate term is divided by the second intermediate term to obtain the node energy statistical normal form value.

5. The network traffic analysis method based on adaptive response large-scale model according to claim 4 is characterized in that: Based on the sequence of the node propagation space span values ​​and the sequence of the historical node energy statistical paradigm values, determining the node energy propagation attenuation coefficient values ​​of each other detection network traffic local time series implicit correlation feature vector in the set of the detection network traffic local time series implicit correlation feature vector to obtain a sequence of node energy propagation attenuation coefficient values, including: Using a preset attenuation constant as a weight, calculating the weighted sum of each node propagation space span value in the sequence of node propagation space span values ​​and its own exponential function value with a natural constant as the base to obtain a sequence of space span attenuation factors; The corresponding division results of each historical node energy statistical normal value in the sequence of the historical node energy statistical normal value and each spatial span attenuation factor in the sequence of the spatial span attenuation factor are calculated to obtain the sequence of the node energy propagation attenuation coefficient values.

6. The network traffic analysis method based on adaptive response large-scale model according to claim 5 is characterized in that: Based on the network traffic time series aggregation representation vector, the prior guided network traffic time series reasoning representation vector is inferred, including: The network traffic timing aggregation representation vector is input into a decoder-based network traffic timing reasoning device to obtain the a priori guided network traffic timing reasoning representation vector.

7. The network traffic analysis method based on adaptive response large-scale model according to claim 6 is characterized in that: Sequentially encoding the time subsequence of the inference verification network traffic value to obtain an inference verification network traffic time series associated implicit feature vector includes: The time subsequence of the inference verification network traffic value is input into the sequence encoder based on the bidirectional gated cyclic unit to obtain the temporal correlation implicit feature vector of the inference verification network traffic.

8. The network traffic analysis method based on adaptive response large-scale model according to claim 7 is characterized in that: Determining whether there is a network anomaly based on the feature offset between the implicit feature vector associated with the reasoning verification network traffic timing and the priori guided network traffic timing reasoning representation vector includes: Calculate the cosine similarity between the reasoning verification network traffic timing association implicit feature vector and the prior guided network traffic timing reasoning representation vector as an ideal-actual offset coefficient; Based on the comparison between the ideal-actual deviation coefficient and a predetermined threshold, it is determined whether there is a network abnormality.

Images