A multi-session mode abnormal traffic classification method and system based on double information coding

Abstract

The application provides a multi-session mode abnormal traffic classification method and system based on double information coding, which solves the problem of insufficient accuracy of existing abnormal traffic classification methods; including: traffic data preprocessing: retaining traffic conforming to protocol semantics generated by normal network communication behavior of users, and unifying byte length of traffic data; single traffic data feature extraction: obtaining content information and position information of traffic data, and inputting the mutual connection into an SAE encoder to obtain traffic features; parallel session traffic feature extraction: obtaining summation, average and centralized features of the same size of each feature of the communication behavior in longitudinal space-time sequence; feature fusion and classification: fusing traffic features obtained by single traffic data feature extraction and longitudinal features obtained by parallel session traffic feature extraction, deep learning traffic type probability, and alarming possible abnormal behavior. The application is widely applied to the traffic classification technical field of network security.

Description

Technical Field

[0001] This application relates to a traffic classification method, and more specifically, to a multi-session pattern abnormal traffic classification method based on dual-information coding. Background Technology

[0002] Network traffic classification can help discover potential abnormal behavior and is an important means of ensuring internet security. However, with the development of traffic encryption technology and the increasing emphasis on user privacy, it has become increasingly difficult to extract effective features for traffic detection. Existing deep learning-based traffic classification methods mainly need to overcome the following two problems.

[0003] First, bytes at different positions in traffic data often have different meanings and influence each other. In the feature extraction process, in addition to representing the data content itself, if the positional information of each byte of traffic data can be taken into consideration, introducing the contextual relationship of bytes into the deep neural network, an accurate traffic classification model can be trained. Second, existing attack methods employ a variety of communication transmission methods. In the process of detecting abnormal behavior, in addition to utilizing the basic features within a single session, if the spatiotemporal correlation features between multiple sessions can be integrated, the differences between each stage of the attack can be more clearly characterized, effectively improving the accuracy of network traffic classification. Summary of the Invention

[0004] To address the inaccuracy of existing abnormal traffic classification methods, this application adopts the following technical solution: This invention provides a multi-session mode abnormal traffic classification method based on dual-information coding, comprising:

[0005] Traffic data preprocessing: Preserve traffic that conforms to protocol semantics generated by users' normal network communication behavior, and standardize the byte length of traffic data;

[0006] Single-flow data feature extraction: Obtain the content and location information of the flow data, connect them together, and input them into the SAE encoder to obtain flow features;

[0007] Parallel session traffic feature extraction: Based on the length of all heterogeneous features of session traffic belonging to the same communication behavior, dynamically select the sampling step size and window size to obtain the sum, average, and clustered features of each feature of the communication behavior with the same size in the longitudinal spatiotemporal order.

[0008] Feature fusion and classification: The system fuses traffic features extracted from single traffic data with vertical features extracted from parallel session traffic, uses deep learning to determine the probability of traffic type, and alerts to possible abnormal behaviors.

[0009] Preferably, traffic generated by the user's normal network communication behavior that conforms to the protocol semantics is retained. The specific implementation process is as follows:

[0010] Iterate through the traffic data set and filter out traffic records with empty content;

[0011] Read the data link layer content and filter out traffic records that do not contain IP header information at the data link layer.

[0012] Read the data IP layer content and filter out traffic records that do not contain network protocols in the data IP layer;

[0013] Iterate through the traffic data set and filter out traffic records that lack three-way handshake rule verification.

[0014] Preferably, the byte length of the traffic data is standardized, and the specific implementation process is as follows:

[0015] For the retained traffic data set X, the m-th traffic data record is denoted as X. m X m The content of the nth byte is denoted as

[0016] Set the maximum byte length of traffic data (Max). When the traffic data X... m If the number of bytes is less than the maximum, pad it with 0 bytes until it reaches the maximum. When traffic data X m If the number of bytes is greater than Max, truncate the excess bytes until the last byte is...

[0017] Preferably, the feature extraction of single-flow data is implemented as follows:

[0018] S1. Perform max-min normalization on each byte of traffic data to obtain byte content information, thus limiting the content of traffic data bytes to the same order of magnitude;

[0019] S2. Obtain byte position information through position encoding, and transform the byte's context information into a dimension that can be connected with the byte content information;

[0020] S3. Connect the content information and location information of the traffic data to obtain traffic information, and input it into the SAE encoder to obtain traffic characteristics.

[0021] Preferably, step S1 is specifically implemented as follows:

[0022] Found a traffic data X m The largest byte in the content The smallest byte of content

[0023] For X m Each byte Perform max-min normalization to obtain the content information of the byte. The normalization formula is:

[0024] Preferably, step S2 is implemented in the following ways:

[0025] The position information POS at this byte is calculated using the position encoding formula, which is: Where d is the dimension of the byte content, and i is the value of the dimension of the byte content.

[0026] Preferably, step S3 is specifically implemented as follows:

[0027] Connection byte Content information Byte information is obtained from the location information POS.

[0028] Using traffic data X m Each byte of information constitutes the complete traffic information Q m and Q m The flow data X is obtained by inputting the SAE encoder. m Traffic characteristics X m .

[0029] Preferably, parallel session traffic feature extraction is implemented as follows:

[0030] S1. Generate a set of flow characteristics in a longitudinal spatiotemporal sequence:

[0031] Traffic data X with the same source IP address and destination IP address m Rank its flow characteristics Y m As a set of conversation features, one feature within the set is denoted as Y. n ;

[0032] S2. Sum sampling yields the longitudinal summation feature Z of the conversation feature set. sum :

[0033] Given a set of traffic flows of type a, for Y n Step size is Summation sampling yields a longitudinal summation feature of suitable size b.

[0034] The sum of all features within the set constitutes the sum of the longitudinal features Z of the session feature set. sum ;

[0035] S3. Average sampling to obtain the longitudinal average feature Z of the conversation feature set. avg :

[0036] For Y n Step size is The average sampling yields a suitable longitudinal average feature of size b.

[0037] The longitudinal average feature Z of all features within the set constitutes the longitudinal average feature Z of the conversation feature set. avg ;

[0038] S4. Centralized sampling to obtain the vertical centralized features Z of the conversation feature set. con :

[0039] For Y n Step size is By sampling the concentrated data, we obtain a longitudinal concentrated feature of appropriate size b.

[0040] The vertically aggregated features of all features within the set constitute the vertically aggregated features Z of the conversation feature set. con ;

[0041] S5. Connecting the longitudinal summation feature Z sum Longitudinal average feature Z avg Vertical centralization characteristics Z con The vertical feature Z of the conversation feature set is obtained. m The vertical feature of each traffic data point within the session is Z. m ;

[0042] S6: Perform steps S2 to S5 for each session feature set to obtain the vertical feature Z of the traffic data set.

[0043] Preferably, the feature fusion and classification are implemented as follows:

[0044] For traffic data X m Fusion traffic characteristics X m and longitudinal feature Z m The total characteristic H is obtained. m ;

[0045] The total characteristic H m Input the data into the classifier to calculate the traffic data X. m The probability of the type to which it belongs.

[0046] This invention also provides a multi-session mode abnormal traffic classification system based on dual-information encoding, comprising:

[0047] Traffic data preprocessing module: used to retain traffic that conforms to protocol semantics generated by users' normal network communication behavior, and to standardize the byte length of traffic data;

[0048] Single-flow data feature extraction module: used to obtain the content information and location information of the flow data, and after connecting them, input them into the SAE encoder to obtain the flow features;

[0049] Parallel Session Traffic Feature Extraction Module: Based on the lengths of all heterogeneous features of session traffic belonging to the same communication behavior, this module dynamically selects the sampling step size and window size to obtain the sum, average, and clustered features of each feature of the communication behavior with the same magnitude in the longitudinal spatiotemporal order. These features are then interconnected to obtain the longitudinal feature Z of the session feature set. m ;

[0050] Feature fusion and classification module: It fuses the traffic features obtained from the single traffic data feature extraction module with the vertical features obtained from the parallel session traffic feature extraction module, uses deep learning to determine the probability of traffic type, and alerts to possible abnormal behaviors.

[0051] This invention provides a method and system for classifying abnormal traffic in a multi-session mode based on dual-information encoding. Under the premise of unified effective communication traffic format, it utilizes data encoding technology and spatial pyramid pooling to simultaneously process the byte content of traffic records, contextual associations, and vertical spatiotemporal order relationships to determine the probability of abnormal behavior traffic and promptly protect network security. The beneficial effects are as follows:

[0052] 1) Reduce the cost of feature extraction and improve the efficiency of model training by increasing traffic data preprocessing;

[0053] 2) In the process of single-traffic data feature identification, both the content and location information of the traffic data bytes are considered simultaneously. For the information represented by the byte content, the influence of dimensional differences between different data is eliminated. For the information represented by the byte location, the order relationship of the data in the context is preserved, connecting the content and location information. The learned traffic features contain the contextual association of the data, enabling the training of a more effective classification model and more accurate identification of abnormal traffic behavior.

[0054] 3) Integrating single-traffic data features with parallel session traffic features (i.e., multi-session spatiotemporal features) can characterize the longitudinal spatiotemporal relationship of behavioral stages, enrich the methods for representing sample information, assist classifiers in effectively identifying potential network threats, and improve the probability of detecting abnormal behavior types. Attached Figure Description

[0055] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0056] Figure 1 A flowchart of a multi-session mode abnormal traffic classification method based on dual information encoding provided by the present invention;

[0057] Figure 2 This invention provides a structural diagram of a multi-session mode abnormal traffic classification system based on dual information encoding. Detailed Implementation

[0058] To make the technical problems, technical solutions, and beneficial effects to be solved by this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and are not intended to limit the scope of this application.

[0059] It should be noted that the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0060] Please see Figure 1 This is a flowchart illustrating a multi-session mode abnormal traffic classification method based on dual-information coding according to an embodiment of this application. For ease of explanation, only the parts relevant to this embodiment are shown, which are described in detail below:

[0061] In one embodiment, a multi-session pattern abnormal traffic classification method based on dual-information coding includes:

[0062] Traffic data preprocessing: Preserve traffic that conforms to protocol semantics generated by users' normal network communication behavior, and standardize the byte length of traffic data;

[0063] Single-flow data feature extraction: Obtain the content and location information of the flow data, connect them together, and input them into the SAE encoder to obtain flow features;

[0064] Parallel session traffic feature extraction: Utilizing the spatial pyramid pooling concept, based on the length of all heterogeneous features of session traffic belonging to the same communication behavior, the sampling step size and window size are dynamically selected to obtain the sum, average, and concentrated features of each feature of the communication behavior with the same size in the longitudinal spatiotemporal order;

[0065] Feature fusion and classification: The system fuses traffic features extracted from single traffic data with vertical features extracted from parallel session traffic, uses deep learning to determine the probability of traffic type, and alerts to possible abnormal behaviors.

[0066] In one embodiment, regarding traffic data preprocessing, traffic that conforms to protocol semantics and is generated by the user's normal network communication behavior is retained, specifically including the following:

[0067] Iterate through the traffic data set and filter out traffic records with empty content;

[0068] Read the data link layer content and filter out traffic records that do not contain IP header information at the data link layer.

[0069] Read the data IP layer content and filter out traffic records that do not contain network protocols in the data IP layer;

[0070] Iterate through the traffic data set and filter out traffic records that lack three-way handshake rule verification.

[0071] Furthermore, the byte length of traffic data is standardized by specifying the byte length of traffic data through padding or truncation, so that feature extraction can be performed on the standardized data later. The specific process is as follows:

[0072] For the retained traffic data set X, the m-th traffic data record is denoted as X. m X m The content of the nth byte is denoted as

[0073] Set the maximum byte length of traffic data (Max). When the traffic data X... m If the number of bytes is less than the maximum, pad it with 0 bytes until it reaches the maximum. When traffic data X m If the number of bytes is greater than Max, truncate the excess bytes until the last byte is...

[0074] The specific implementation process for feature extraction from single-flow data is as follows:

[0075] S1. Perform max-min normalization on each byte of the traffic data to obtain byte content information, thus limiting the content of the traffic data bytes to the same order of magnitude; the specific process includes:

[0076] Found a traffic data X m The largest byte in the content The smallest byte of content

[0077] For X m Each byte Perform max-min normalization to obtain the content information of the byte. The normalization formula is:

[0078] S2. Obtain byte position information through position encoding, and transform the byte's context information into a dimension that can be concatenated with the byte's content information; the specific process includes:

[0079] The position information POS at this byte is calculated using the position encoding formula, which is: Where d is the dimension of the byte content, and i is the value of the dimension of the byte content;

[0080] S3. Connect the content information and location information of the traffic data to obtain traffic information, and input it into the SAE encoder to obtain traffic feature Y. m The specific process includes:

[0081] Connection byte Content information Byte information is obtained from the location information POS.

[0082] Using traffic data X m Each byte of information constitutes the complete traffic information Q m and Q m The flow data X is obtained by inputting the SAE encoder. m Flow characteristics Y m .

[0083] In one embodiment, regarding parallel session traffic feature extraction: based on the lengths of all heterogeneous features of session traffic belonging to the same communication behavior (different types of structural features extracted from the single traffic data features above), the sampling step size and window size are dynamically selected to obtain the sum, average, and clustered features of each feature of the communication behavior with the same size in the longitudinal spatiotemporal order; the specific implementation process is as follows:

[0084] S1. Generate a set of flow characteristics in a longitudinal spatiotemporal sequence:

[0085] Traffic data X with the same source IP address and destination IP address m Rank its flow characteristics Y m As a set of conversation features, one feature within the set is denoted as Y. n ;

[0086] S2. Sum sampling yields the longitudinal summation feature Z of the conversation feature set. sum :

[0087] Given a set of traffic flows of type a, for Y n Step size is Summation sampling yields a longitudinal summation feature of suitable size b.

[0088] The sum of all features within the set constitutes the sum of the longitudinal features Z of the session feature set. sum ;

[0089] S3. Average sampling to obtain the longitudinal average feature Z of the conversation feature set. avg :

[0090] For Y n Step size is The average sampling yields a suitable longitudinal average feature of size b.

[0091] The longitudinal average feature Z of all features within the set constitutes the longitudinal average feature Z of the conversation feature set. avg ;

[0092] S4. Centralized sampling to obtain the vertical centralized features Z of the conversation feature set. con :

[0093] For Y n Step size is By sampling the concentrated data, we obtain a longitudinal concentrated feature of appropriate size b.

[0094] The vertically aggregated features of all features within the set constitute the vertically aggregated features Z of the conversation feature set. con ;

[0095] S5. Connecting the longitudinal summation feature Z sum Longitudinal average feature Z avg Vertical centralization characteristics Z con The vertical features Z of the conversation feature set are obtained. m The vertical feature of each traffic data point within the session is also Z. m ;

[0096] S6: Perform steps S2 to S5 for each session feature set to obtain the vertical feature Z of the traffic data set.

[0097] In one embodiment, the specific implementation process for feature fusion and classification is as follows:

[0098] S1: For traffic data X m , integrate traffic characteristics X m and longitudinal feature Z m The total characteristic H is obtained. m ;

[0099] S2: Total characteristic H m Input the data into the classifier to calculate the traffic data X. m The probability of the type to which it belongs. Specifically, the total feature H mThe input is fed into a fully connected layer, and the traffic data X is calculated using the softmax function. m The probability of the type to which it belongs.

[0100] Please see Figure 2 The second aspect of this application provides a multi-session mode abnormal traffic classification system based on dual information coding, including a traffic data preprocessing module, a single traffic data feature extraction module, a parallel session traffic feature extraction module, and a feature fusion and classification module.

[0101] Traffic data preprocessing module: used to retain traffic that conforms to protocol semantics generated by users' normal network communication behavior, and to standardize the byte length of traffic data;

[0102] Single-flow data feature extraction module: used to obtain the content information and location information of the flow data, and after connecting them, input them into the SAE encoder to obtain the flow features;

[0103] Parallel Session Traffic Feature Extraction Module: Based on the lengths of all heterogeneous features of session traffic belonging to the same communication behavior, this module dynamically selects the sampling step size and window size to obtain the sum, average, and clustered features of each feature of the communication behavior with the same magnitude in the longitudinal spatiotemporal order. These features are then interconnected to obtain the longitudinal feature Z of the session feature set. m ;

[0104] Feature fusion and classification module: It fuses the traffic features obtained from the single traffic data feature extraction module with the vertical features obtained from the parallel session traffic feature extraction module, uses deep learning to determine the probability of traffic type, and alerts to possible abnormal behaviors.

[0105] It should be noted that the multi-session mode abnormal traffic classification system based on dual-information coding in this embodiment is an embodiment of the system corresponding to the aforementioned multi-session mode abnormal traffic classification method based on dual-information coding. Therefore, for the specific implementation of the software methods in each module of the abnormal traffic classification system, please refer to... Figure 1 The specific implementation examples are not described in detail here.

[0106] This invention provides a method and system for classifying abnormal traffic in a multi-session mode based on dual-information coding, which has the following advantages:

[0107] 1) Reduce the cost of feature extraction and improve the efficiency of model training by increasing traffic data preprocessing;

[0108] 2) In the process of single-traffic data feature identification, both the content and location information of the traffic data bytes are considered simultaneously. For the information represented by the byte content, the influence of dimensional differences between different data is eliminated. For the information represented by the byte location, the order relationship of the data in the context is preserved, connecting the content and location information. The learned traffic features contain the contextual association of the data, enabling the training of a more effective classification model and more accurate identification of abnormal traffic behavior.

[0109] 3) Integrating single-traffic data features with parallel session traffic features (i.e., multi-session spatiotemporal features) can characterize the longitudinal spatiotemporal relationship of behavioral stages, enrich the methods for representing sample information, assist classifiers in effectively identifying potential network threats, and improve the probability of detecting abnormal behavior types.

[0110] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for classifying abnormal traffic in a multi-session mode based on dual-information coding, characterized in that: include: Traffic data preprocessing: Preserve traffic that conforms to protocol semantics generated by users' normal network communication behavior, and standardize the byte length of traffic data; Single-flow data feature extraction: Obtain the content and location information of the flow data, connect them together, and input them into the SAE encoder to obtain flow features; Parallel session traffic feature extraction: Based on the length of all heterogeneous features of session traffic belonging to the same communication behavior, dynamically select the sampling step size and window size to obtain the sum, average, and clustered features of each feature of the communication behavior with the same size in the longitudinal spatiotemporal order. Feature fusion and classification: The traffic features obtained from single traffic data feature extraction and the vertical features obtained from parallel session traffic feature extraction are fused together, and the probability of traffic type is determined by deep learning to detect abnormal behavior. The specific implementation process for extracting features from single-flow data is as follows: S1. Perform max-min normalization on each byte of traffic data to obtain byte content information, thus limiting the content of traffic data bytes to the same order of magnitude; S2. Obtain byte position information through position encoding, and transform the byte's context information into a dimension that can be connected with the byte content information; S3. Connect the content information and location information of the traffic data to obtain traffic information, and input it into the SAE encoder to obtain traffic characteristics; The parallel session traffic feature extraction process is implemented as follows: 1) Generate a set of flow characteristics in the longitudinal spatiotemporal sequence: Traffic data with the same source IP address and destination IP address Analyze their flow characteristics in chronological order As a set of conversation features, a feature within the set is denoted as... ; 2) Summation sampling yields the longitudinal summation features of the conversation feature set. : Given a set of traffic flows, Step size is Summation sampling yields a longitudinal summation feature of size b. ; The sum of all features within the set constitutes the sum of the features in the conversation feature set. ; 3) Average sampling to obtain the longitudinal average features of the conversation feature set. : right Step size is The average sampling yields a longitudinal average feature of size b. ; The longitudinal average of all features within the set constitutes the longitudinal average of the session feature set. ; 4) Centralized sampling to obtain the vertical centralized features of the conversation feature set. : right Step size is The concentrated sampling yields a longitudinal concentrated feature of size b. ; The vertically aggregated features of all features within the set constitute the vertically aggregated features of the conversation feature set. ; 5) Connecting the longitudinal summation features Longitudinal average characteristics Vertical concentration characteristics The vertical features of the conversation feature set are obtained. The vertical characteristics of each traffic data point within the session are as follows: ; 6) Perform steps 2) to 5) for each session feature set to obtain the longitudinal feature Z of the traffic data set.

2. The multi-session mode abnormal traffic classification method based on dual-information coding as described in claim 1, characterized in that: The specific implementation process for retaining traffic that conforms to protocol semantics generated by normal user network communication behavior is as follows: Iterate through the traffic data set and filter out traffic records with empty content; Read the data link layer content and filter out traffic records that do not contain IP header information at the data link layer. Read the data IP layer content and filter out traffic records that do not contain network protocols in the data IP layer; Iterate through the traffic data set and filter out traffic records that lack three-way handshake rule verification.

3. The multi-session mode abnormal traffic classification method based on dual-information coding as described in claim 2, characterized in that: The specific implementation process for the unified traffic data in bytes is as follows: For the retained traffic data set X, the m-th traffic data record is denoted as... , The content of the nth byte is denoted as ; Set the maximum byte length of traffic data (Max). If the number of bytes is less than the maximum, pad it with 0 bytes until it reaches the maximum. When traffic data If the number of bytes is greater than Max, truncate the excess bytes until the last byte is... .

4. The multi-session mode abnormal traffic classification method based on dual-information coding as described in claim 3, characterized in that: Step S1, specifically implemented as follows: Found a traffic data The largest byte in the content The smallest byte of content ; right Each byte Perform max-min normalization to obtain the content information of the byte. The normalization formula is: .

5. The multi-session mode abnormal traffic classification method based on dual-information coding as described in claim 4, characterized in that: Step S2, specifically implemented as follows: The position information POS at this byte is calculated using the position encoding formula, which is: , Where d is the dimension of the byte content, and i is the value of the dimension of the byte content.

6. The multi-session mode abnormal traffic classification method based on dual-information coding as described in claim 5, characterized in that: Step S3, specifically implemented as follows: Connection byte Content information Byte information is obtained from the location information POS. ; Utilizing traffic data Each byte of information constitutes a complete traffic information. and will The flow data is obtained by inputting the SAE encoder. Traffic characteristics .

7. The multi-session mode abnormal traffic classification method based on dual-information coding as described in claim 6, characterized in that: The feature fusion and classification process is implemented as follows: Traffic data Integrating traffic characteristics and longitudinal features To obtain the overall characteristics ; General characteristics Input the data into the classifier to calculate the traffic data. The probability of the type to which it belongs.

8. A multi-session mode abnormal traffic classification system based on dual-information coding, characterized in that, include: Traffic data preprocessing module: used to retain traffic that conforms to protocol semantics generated by users' normal network communication behavior, and to standardize the byte length of traffic data; Single-flow data feature extraction module: used to obtain the content information and location information of the flow data, and after connecting them, input them into the SAE encoder to obtain the flow features; Parallel Session Traffic Feature Extraction Module: Based on the lengths of all heterogeneous features of session traffic belonging to the same communication behavior, this module dynamically selects the sampling step size and window size to obtain the sum, average, and clustered features of each feature of the communication behavior in the longitudinal spatiotemporal order, and then connects them to obtain the longitudinal features of the session feature set. ; Feature fusion and classification module: fuses traffic features obtained from the single traffic data feature extraction module with vertical features obtained from the parallel session traffic feature extraction module, uses deep learning to determine the probability of traffic type, and alarms for abnormal behavior; The specific implementation process for extracting features from single-flow data is as follows: S1. Perform max-min normalization on each byte of traffic data to obtain byte content information, thus limiting the content of traffic data bytes to the same order of magnitude; S2. Obtain byte position information through position encoding, and transform the byte's context information into a dimension that can be connected with the byte content information; S3. Connect the content information and location information of the traffic data to obtain traffic information, and input it into the SAE encoder to obtain traffic characteristics; The parallel session traffic feature extraction process is implemented as follows: 1) Generate a set of flow characteristics in the longitudinal spatiotemporal sequence: Traffic data with the same source IP address and destination IP address Analyze their flow characteristics in chronological order As a set of conversation features, a feature within the set is denoted as... ; 2) Summation sampling yields the longitudinal summation features of the conversation feature set. : Given a set of traffic flows, Step size is Summation sampling yields a longitudinal summation feature of size b. ; The sum of all features within the set constitutes the sum of the features in the conversation feature set. ; 3) Average sampling to obtain the longitudinal average features of the conversation feature set. : right Step size is The average sampling yields a longitudinal average feature of size b. ; The longitudinal average of all features within the set constitutes the longitudinal average of the session feature set. ; 4) Centralized sampling to obtain the vertical centralized features of the conversation feature set. : right Step size is The concentrated sampling yields a longitudinal concentrated feature of size b. ; The vertically aggregated features of all features within the set constitute the vertically aggregated features of the conversation feature set. ; 5) Connecting the longitudinal summation features Longitudinal average characteristics Vertical concentration characteristics The vertical features of the conversation feature set are obtained. The vertical characteristics of each traffic data point within the session are as follows: ; 6) Perform steps 2) to 5) for each session feature set to obtain the longitudinal feature Z of the traffic data set.

Images