Model training and network traffic detection method and device, electronic equipment, storage medium and computer program product

Abstract

A model training and network traffic detection method and device, electronic equipment, storage medium and computer program product are disclosed. The method comprises: obtaining network traffic sample data; determining one or more first clusters and one or more second clusters using the network traffic sample data, each first cluster containing at least two first network traffic sample data of uplink transmission, and each second cluster containing one or more second network traffic sample data of downlink transmission; performing feature extraction on the one or more first clusters and the one or more second clusters to obtain a first sequence, a second sequence and a third sequence respectively, the first sequence representing data distribution of the one or more first clusters, the second sequence representing data distribution of the one or more second clusters, and the third sequence containing data length features of the one or more first clusters and the one or more second clusters; and training a first model using the first sequence, the second sequence and the third sequence.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a model training and network traffic detection method, apparatus, electronic device, storage medium and computer program product. Background Technology

[0002] With the development and widespread adoption of internet applications and IoT devices, users are becoming increasingly aware of privacy protection. To ensure communication security and privacy, data encryption technology is used to encrypt network traffic, ensuring that data cannot be easily eavesdropped on during transmission. However, this also provides opportunities for attackers, who can use encrypted traffic to conceal their activities and avoid detection and identification.

[0003] Traditional network security devices typically detect abnormal traffic (also known as malicious traffic) by decrypting the traffic. However, this method requires decrypting the network traffic, which is difficult to implement and consumes a lot of computing resources, leading to increased network throughput and latency. In addition, the decrypted traffic may be stolen in the form of logs or temporary storage files.

[0004] Therefore, without decrypting network traffic, the method of detecting abnormal traffic based on traditional statistical analysis and artificial intelligence algorithms has gradually become the mainstream. However, related abnormal traffic detection solutions suffer from low detection accuracy. Summary of the Invention

[0005] To address the related technical issues, embodiments of this application provide a model training and network traffic detection method, apparatus, electronic device, storage medium, and computer program product.

[0006] The technical solution of this application embodiment is implemented as follows:

[0007] This application provides a model training method, including:

[0008] Obtain network traffic sample data;

[0009] Using the network traffic sample data, one or more first clusters and one or more second clusters are determined, each first cluster containing at least two uplink first network traffic sample data, and each second cluster containing one or more downlink second network traffic sample data;

[0010] Feature extraction is performed on the one or more first clusters and the one or more second clusters to obtain a first sequence, a second sequence and a third sequence, respectively. The first sequence represents the data distribution of the one or more first clusters, the second sequence represents the data distribution of the one or more second clusters, and the third sequence contains the data length features of the one or more first clusters and the one or more second clusters.

[0011] The first model is trained using the first sequence, the second sequence, and the third sequence. The first model is used to detect network traffic data to be detected.

[0012] In the above scheme, the step of extracting features from the one or more first clusters and the one or more second clusters to obtain a first sequence, a second sequence, and a third sequence, respectively, includes:

[0013] Determine a fourth sequence corresponding to the one or more first clusters, the fourth sequence representing the time interval between the one or more first clusters;

[0014] The fourth sequence is fitted to obtain the first sequence.

[0015] In the above scheme, the fitting process of the fourth sequence to obtain the first sequence includes:

[0016] The fourth sequence is fitted based on the Wechsler distribution to obtain the first sequence.

[0017] In the above scheme, the step of extracting features from the one or more first clusters and the one or more second clusters to obtain a first sequence, a second sequence, and a third sequence, respectively, includes:

[0018] A fifth sequence and a sixth sequence are determined for each of the one or more second clusters, wherein the fifth sequence represents the time interval between the one or more second clusters, and the sixth sequence represents the number of second network traffic sample data corresponding to each of the one or more second clusters;

[0019] The fifth sequence is fitted to obtain a fitted fifth sequence, and the sixth sequence is fitted to obtain a fitted sixth sequence.

[0020] The second sequence is obtained by using the fitted fifth sequence and the fitted sixth sequence. In the above scheme, the fitting process of the fifth sequence to obtain the fitted fifth sequence includes:

[0021] The fifth sequence is fitted based on a non-homogeneous Poisson distribution to obtain a fitted fifth sequence.

[0022] In the above scheme, the fitting process of the sixth sequence to obtain the fitted sixth sequence includes:

[0023] Based on the power-law distribution, the sixth sequence is fitted to obtain the fitted sixth sequence.

[0024] In the above scheme, the step of extracting features from the one or more first clusters and the one or more second clusters to obtain a first sequence, a second sequence, and a third sequence, respectively, includes:

[0025] Determine the first data length corresponding to each of the one or more first clusters and the second data length corresponding to each of the one or more second clusters;

[0026] The third sequence is obtained using the determined first and second data lengths.

[0027] In the above scheme, training the first model using the first sequence, the second sequence, and the third sequence includes:

[0028] Based on collaborative teaching technology, the first model is trained using the first sequence, the second sequence, and the third sequence.

[0029] This application also provides a network traffic detection method, including:

[0030] Acquire network traffic data to be detected;

[0031] Feature extraction is performed on the network traffic data to be detected to obtain a seventh sequence, which represents the data distribution of the network traffic data to be detected.

[0032] Using the seventh sequence and the first model, the network traffic data to be detected is detected to obtain the detection result. The first model is obtained according to any of the above model training methods.

[0033] This application embodiment also provides a model training apparatus, including:

[0034] The first acquisition unit is used to acquire network traffic sample data;

[0035] The determining unit is configured to use the network traffic sample data to determine one or more first clusters and one or more second clusters, each first cluster containing at least two uplink first network traffic sample data, and each second cluster containing one or more downlink second network traffic sample data.

[0036] The first extraction unit is used to extract features from the one or more first clusters and the one or more second clusters to obtain a first sequence, a second sequence and a third sequence, respectively. The first sequence represents the data distribution of the one or more first clusters, the second sequence represents the data distribution of the one or more second clusters, and the third sequence contains the data length features of the one or more first clusters and the one or more second clusters.

[0037] The training unit is used to train a first model using the first sequence, the second sequence, and the third sequence. The first model is used to detect network traffic data to be detected.

[0038] This application embodiment also provides a network traffic detection device, including:

[0039] The second acquisition unit is used to acquire network traffic data to be detected;

[0040] The second extraction unit is used to extract features from the network traffic data to be detected to obtain a seventh sequence, wherein the seventh sequence represents the data distribution of the network traffic data to be detected.

[0041] The detection unit is used to detect the network traffic data to be detected using the seventh sequence and the first model, and to obtain the detection result. The first model is obtained according to any of the above model training methods.

[0042] This application also provides an electronic device, including: a processor and a communication interface; wherein,

[0043] The processor is configured to: acquire network traffic sample data through a communication interface; determine one or more first clusters and one or more second clusters using the network traffic sample data, each first cluster containing at least two uplink transmitted first network traffic sample data, and each second cluster containing one or more downlink transmitted second network traffic sample data; extract features from the one or more first clusters and the one or more second clusters to obtain a first sequence, a second sequence, and a third sequence, wherein the first sequence characterizes the data distribution of the one or more first clusters, the second sequence characterizes the data distribution of the one or more second clusters, and the third sequence contains the data length features of the one or more first clusters and the one or more second clusters; and train a first model using the first sequence, the second sequence, and the third sequence, wherein the first model is used to detect the network traffic data to be detected.

[0044] or,

[0045] The network traffic data to be detected is obtained through the communication interface; features are extracted from the network traffic data to be detected to obtain a seventh sequence, which represents the data distribution of the network traffic data to be detected; and the network traffic data to be detected is detected using the seventh sequence and a first model to obtain a detection result, wherein the first model is obtained according to any of the above model training methods.

[0046] This application also provides an electronic device, including: a processor and a memory for storing a computer program capable of running on the processor.

[0047] When the processor runs the computer program, it executes the steps of implementing any of the above-described model training methods or the steps of implementing any of the above-described network traffic detection methods.

[0048] This application embodiment also provides a storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of any of the above-described model training methods, or the steps of any of the above-described network traffic detection methods.

[0049] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the above-described model training methods or the steps of any of the above-described network traffic detection methods.

[0050] The model training and network traffic detection method, apparatus, electronic device, storage medium, and computer program product provided in this application embodiment include: acquiring network traffic sample data; using the network traffic sample data to determine one or more first clusters and one or more second clusters, each first cluster containing at least two uplink transmission first network traffic sample data, and each second cluster containing one or more downlink transmission second network traffic sample data; performing feature extraction on the one or more first clusters and the one or more second clusters to obtain a first sequence, a second sequence, and a third sequence, wherein the first sequence characterizes the data distribution of the one or more first clusters, the second sequence characterizes the data distribution of the one or more second clusters, and the third sequence contains the data length features of the one or more first clusters and the one or more second clusters; and training a first model using the first sequence, the second sequence, and the third sequence, wherein the first model is used to detect the network traffic data to be detected. The technical solution provided in this application divides network traffic into uplink clusters corresponding to the uplink phase and downlink clusters corresponding to the downlink phase. It then analyzes network traffic in units of traffic clusters, characterizing (or extracting) the distribution and length features of network traffic in the uplink and downlink clusters respectively. The model is then trained using these characterized distribution and length features, enabling it to better distinguish between abnormal and normal traffic. This effectively improves the accuracy of network traffic detection using the model. Furthermore, since analyzing network traffic in units of traffic clusters is less affected by network fluctuations and adversarial attacks, the model's accuracy in detecting network traffic can be guaranteed even in complex network environments and under adversarial attacks, demonstrating strong robustness. Attached Figure Description

[0051] Figure 1 This is a schematic flowchart of the model training method in an embodiment of this application;

[0052] Figure 2 This is a schematic diagram of the structure of the first and second clusters in the embodiments of this application;

[0053] Figure 3 This is a schematic diagram of the structure of the fourth sequence in the embodiment of this application;

[0054] Figure 4 This is a schematic diagram of the structure of the fifth and sixth sequences in the embodiments of this application;

[0055] Figure 5 This is a flowchart illustrating the network traffic detection method according to an embodiment of this application;

[0056] Figure 6 This is a schematic diagram illustrating the method flow for malicious traffic detection, an application example of this application.

[0057] Figure 7 This is a schematic diagram of the model training device structure according to an embodiment of this application;

[0058] Figure 8 This is a schematic diagram of the network traffic detection device according to an embodiment of this application;

[0059] Figure 9 This is a schematic diagram of the electronic device structure according to an embodiment of this application. Detailed Implementation

[0060] The present application will now be described in further detail with reference to the accompanying drawings and embodiments.

[0061] Since encrypted traffic technology only encrypts the payload information of network traffic, while flow characteristics (such as packet size, transmission time, etc.) are transmitted in plaintext, data features can be extracted from network traffic and trained on a model based on machine learning. This model can then distinguish the behavioral characteristics of abnormal and normal traffic, thereby achieving accurate identification of network traffic.

[0062] One related abnormal traffic detection scheme analyzes the behavioral differences between abnormal and normal traffic and extracts data features from encrypted traffic. These extracted features are then input into an artificial intelligence model to classify and detect abnormal traffic. Specifically, the scheme analyzes the traffic data to be tested to determine the differences in distribution characteristics between encrypted and normal data. The encrypted traffic is then converted into grayscale images and input into a deep neural network model. The magnitude of the distribution characteristic differences and the volume of traffic are used as distinguishing labels to classify the encrypted traffic, thereby identifying abnormal encrypted traffic.

[0063] The above scheme uses different data distribution rates to comprehensively evaluate the differences in traffic data distribution. However, the difference rate cannot fully reflect the differences in data distribution. Attackers can reduce the difference rate between abnormal traffic and normal traffic distribution through packet padding techniques. At the same time, in a real network environment, network latency and packet loss will change the difference rate of data, thereby affecting the accuracy and robustness of abnormal traffic detection.

[0064] Another related anomaly traffic detection approach involves transforming the raw traffic data into graph data and then using an artificial intelligence model to identify anomalies in the corresponding raw traffic data. Specifically, known anomalies and normal encrypted traffic are analyzed to extract distinguishing features, which are then used to train a graph model (such as the GraphSAGE graph model). Finally, the graph model is used to detect (or identify) malicious encrypted traffic.

[0065] In the above scheme, the graph model is trained using statistical feature data of traffic and image feature data of grayscale images generated by traffic transformation. The statistical features come from the Internet Protocol (IP) packet header, and the grayscale image comes from the encrypted payload of the IP packet. However, the statistical features of the header of abnormal traffic are often similar to those of normal traffic, and the grayscale image constructed from the encrypted payload can only contain some features of normal traffic. This leads to low accuracy in network traffic detection and a high false alarm rate.

[0066] In summary, the relevant abnormal traffic detection solutions suffer from low detection accuracy and poor robustness.

[0067] Based on this, in various embodiments of this application, the concepts of uplink clusters and downlink clusters are defined for the uplink and downlink phases of network traffic, respectively, and the clustering features of network traffic in the uplink and downlink phases are extracted. Then, the model is trained by combining the packet length sequences of the uplink and downlink clusters, enabling the model to better distinguish between malicious and normal traffic, thereby improving the accuracy of network traffic detection. In addition, traffic clusters are less affected by network fluctuations and adversarial attacks, making the model robust. At the same time, the time complexity of network traffic detection is low, enabling rapid response and timely alerts.

[0068] This application provides a model training method applicable to electronic devices, such as... Figure 1 As shown, the method includes:

[0069] Step 101: Obtain network traffic sample data;

[0070] Step 102: Using the network traffic sample data, determine one or more first clusters and one or more second clusters, each first cluster containing at least two uplink first network traffic sample data, and each second cluster containing one or more downlink second network traffic sample data;

[0071] Step 103: Perform feature extraction on the one or more first clusters and the one or more second clusters to obtain a first sequence, a second sequence and a third sequence, respectively. The first sequence represents the data distribution of the one or more first clusters, the second sequence represents the data distribution of the one or more second clusters, and the third sequence contains the data length features of the one or more first clusters and the one or more second clusters.

[0072] Step 104: Train the first model using the first sequence, the second sequence, and the third sequence. The first model is used to detect network traffic data to be detected.

[0073] In practical applications, the electronic device may include a device capable of performing steps 101 to 104, such as a server, laptop, tablet, or desktop computer. Furthermore, the first cluster may be referred to as an uplink cluster or uplink traffic cluster, and correspondingly, the first network traffic sample data may be referred to as uplink data, uplink traffic session, or uplink data packet, etc.; the second cluster may be referred to as a downlink cluster or downlink traffic cluster, and correspondingly, the second network traffic sample data may be referred to as downlink data, downlink traffic session, or downlink data packet, etc. This application embodiment does not limit this specific terminology.

[0074] In practical applications, in step 101, the electronic device can obtain the network traffic sample data and corresponding sample data features from the network. The sample data features may include one or more of the following: data size, transmission time, and transmission direction (e.g., uplink or downlink transmission) corresponding to the network traffic sample data (or at least one of these). For example, the electronic device can collect and statistically analyze network traffic within a preset time period to obtain the network traffic sample data.

[0075] Here, due to the complex and ever-changing network environment, the network traffic sample data may be corrupted or retransmitted. Therefore, the electronic device can preprocess the network traffic sample data to better classify abnormal traffic in the network traffic sample data.

[0076] For example, when the sample data features include the transmission direction corresponding to the network traffic sample data, the electronic device can determine the interaction process corresponding to the network traffic sample data based on the transmission direction, and then determine meaningless data and / or duplicate data in the network traffic sample data based on the interaction process; then, the electronic device can remove the determined meaningless data and duplicate data.

[0077] In practical applications, in step 102, the electronic device can divide the preprocessed network traffic sample data into different transmission stages, and obtain one or more first clusters and one or more second clusters based on the divided transmission stages. The transmission stages may include a handshake stage, an uplink stage (also called a traffic uplink stage), and a downlink stage (also called a traffic downlink stage). The uplink stage is mainly used for uplink transmission of the first network traffic sample data; that is, the uplink stage alternately transmits the first network traffic sample data and the second network traffic sample data, with the first network traffic sample data dominating. The downlink stage is mainly used for downlink transmission of the second network traffic sample data; that is, the downlink stage alternately transmits the first network traffic sample data and the second network traffic sample data, with the second network traffic sample data dominating.

[0078] For example, such as Figure 2As shown, for network traffic sample data between a client and a server, the electronic device can divide the network traffic sample data into a handshake phase, an uplink phase, and a downlink phase based on the transmission direction. In the uplink phase, to improve data transmission efficiency, the client establishes a high-throughput Transmission Control Protocol (TCP) connection with the server and requests multiple resources from the server. Thus, in the uplink phase, if at least two first network traffic sample data points with an uplink transmission direction are continuously transmitted (which can be understood as continuous uplink transmission without downlink transmission, such as three consecutive transmissions of the first network traffic sample data), the electronic device can mark the at least two consecutively transmitted first network traffic sample data points as a first cluster. Correspondingly, in the downlink phase, if one or more second network traffic sample data points with a downlink transmission direction are continuously transmitted, the electronic device can mark the one or more consecutively transmitted second network traffic sample data points as a second cluster.

[0079] It should be noted that, in the presence of multiple uplink phases, the electronic device can determine one or more first clusters corresponding to each uplink phase; in the presence of multiple downlink phases, the electronic device can determine one or more second clusters corresponding to each downlink phase.

[0080] In practical applications, after determining the one or more first clusters, the electronic device can extract features from the first clusters to obtain the distribution features corresponding to the one or more first clusters.

[0081] Specifically, in one embodiment, the step of extracting features from the one or more first clusters and the one or more second clusters to obtain a first sequence, a second sequence, and a third sequence, respectively, includes:

[0082] Determine a fourth sequence corresponding to the one or more first clusters, the fourth sequence representing the time interval between the one or more first clusters;

[0083] The fourth sequence is fitted to obtain the first sequence.

[0084] In practical applications, the fourth sequence can be referred to as the time interval sequence of the first cluster, which can reflect the time interval between two adjacent first clusters (also known as inter-cluster distance) and the intra-cluster time interval of each first cluster (also known as intra-cluster distance); the first sequence can contain the aggregation features of one or more first clusters, and the aggregation features can be understood as the features extracted when there are abnormal situations (such as sudden outbreaks or aggregations) in the first cluster.

[0085] In practical applications, the electronic device can determine the time interval between two adjacent first clusters and the intra-cluster time interval of each first cluster based on the transmission time of the first network traffic sample data corresponding to the one or more first clusters. The time interval between two adjacent first clusters can be defined as the distance between the transmission time of the last first network traffic sample data in a first cluster (also known as the traffic session time) and the transmission time of the first first network traffic sample data in the next first cluster. The intra-cluster time interval of a first cluster can be defined as 0.

[0086] For example, such as Figure 3 As shown, in the presence of four first clusters, the electronic device can determine the time interval between the first cluster 1 and the first cluster 2 as x1, the time interval between the first cluster 2 and the first cluster 3 as x2, and the time interval between the first cluster 3 and the first cluster 4 as x3 based on the transmission time of the first network traffic sample data corresponding to the four first clusters, thereby obtaining the fourth sequence, which can be represented as {0,0,x1,0,x2,0,0,0,x3,0,0}.

[0087] In practical applications, the distribution of the fourth sequence corresponding to the first cluster of normal network traffic sample data approximates an exponential distribution, meaning the probability of each occurrence of the first cluster follows a Poisson distribution, and the fourth sequence is approximately stable, indicating that the distribution of the first network traffic sample data does not change over time. In contrast, the distribution of the fourth sequence corresponding to the first cluster of abnormal network traffic sample data approximates a stretched exponential distribution, and the fourth sequence is unstable. Therefore, based on these characteristics, a Wechsler distribution can be used to fit the fourth sequence to distinguish between abnormal and normal network traffic sample data. The Wechsler distribution can fit both normal and abnormal network traffic sample data.

[0088] Specifically, in one embodiment, the fitting process of the fourth sequence to obtain the first sequence includes:

[0089] The fourth sequence is fitted based on the Wechsler distribution to obtain the first sequence.

[0090] The fitting process for the fourth sequence can be understood as converting the fourth sequence into the first sequence. For example, by using a sliding time window of a preset length, the fourth sequence within the sliding time window is converted into the corresponding first sequence.

[0091] For example, the electronic device may use a sliding time window of fixed length (e.g., length 20) to fit the fourth sequence based on a zero-inflated Wechsler distribution. The probability density function of the zero-inflated Wechsler distribution can be expressed as:

[0092] g(x)=(1-θ)δ(x)+θf(x)(1-δ(x)) (1)

[0093] Where θ represents the zero inflation coefficient of the distribution, δ(x) represents the Dirac function, and f(x) represents the Weyke probability function, which can be specifically expressed as:

[0094]

[0095] Where γ represents the proportion parameter of the Wechsler distribution. It is represented as the shape parameter of the Wechsler distribution.

[0096] Thus, the electronic device can obtain the first sequence, which can be represented as: in, This can be understood as the data distribution of the first cluster within the nth sliding time window.

[0097] It should be noted that, in the presence of multiple uplink stages, the electronic device can merge one or more first clusters corresponding to the multiple uplink stages, and extract features from the merged one or more first clusters to obtain the first sequence.

[0098] In practical applications, the electronic device can also perform feature extraction of the second cluster to obtain the distribution features corresponding to the one or more second clusters.

[0099] Specifically, in one embodiment, the step of extracting features from the one or more first clusters and the one or more second clusters to obtain a first sequence, a second sequence, and a third sequence, respectively, includes:

[0100] A fifth sequence and a sixth sequence are determined for each of the one or more second clusters, wherein the fifth sequence represents the time interval between the one or more second clusters, and the sixth sequence represents the number of second network traffic sample data corresponding to each of the one or more second clusters;

[0101] The fifth sequence is fitted to obtain a fitted fifth sequence, and the sixth sequence is fitted to obtain a fitted sixth sequence.

[0102] The second sequence is obtained by using the fifth and sixth sequences after fitting.

[0103] In practical applications, the fifth sequence can be called the time interval sequence of the second cluster, which can reflect the time interval between two adjacent second clusters; the sixth sequence can be called the traffic session number sequence or the intra-cluster session sequence, which can contain the number of second network traffic sample data corresponding to each second cluster; the second sequence can contain the aggregation features of the one or more second clusters, which can be understood as the features extracted when there are abnormal situations (such as bursts or aggregations) in the second cluster.

[0104] In practical applications, the electronic device can determine the time interval between two adjacent second clusters based on the transmission time of the second network traffic sample data corresponding to the one or more second clusters; wherein, the time interval between two adjacent second clusters can be defined as the distance between the transmission time of the first second network traffic sample data in one second cluster and the transmission time of the first second network traffic sample data in the next second cluster. Simultaneously, the electronic device can count the number of second network traffic samples within each second cluster, thereby generating the sixth sequence.

[0105] For example, such as Figure 4 As shown, in the presence of five second clusters, the electronic device, based on the transmission time of the second network traffic sample data corresponding to the five second clusters, can determine the time interval between second cluster 1 and second cluster 2 as x1, the time interval between second cluster 2 and second cluster 3 as x2, the time interval between second cluster 3 and second cluster 4 as x3, and the time interval between second cluster 4 and second cluster 5 as x4, thus obtaining the fifth sequence, which can be represented as {x1, x2, x3, x4}. Simultaneously, the electronic device can count the number of second network traffic samples in each of the five second clusters, thus obtaining the sixth sequence, which can be represented as {n1, n2, n3, n4, n5}.

[0106] In practical applications, since the distribution of the fifth sequence corresponding to the second cluster of normal network traffic sample data is different from that of the fifth sequence corresponding to the second cluster of abnormal network traffic sample data, a non-homogeneous Poisson distribution can be used to fit the fifth sequence in order to distinguish between abnormal network traffic sample data and normal network traffic sample data.

[0107] Specifically, in one embodiment, the fitting process of the fifth sequence to obtain the fitted fifth sequence includes:

[0108] The fifth sequence is fitted based on a non-homogeneous Poisson distribution to obtain a fitted fifth sequence.

[0109] The fitting process of the fifth sequence based on the non-homogeneous Poisson distribution can be understood as fitting the fifth sequence using a non-homogeneous clustering Poisson process. For example, a sliding time window of fixed length can be used to fit the fifth sequence.

[0110] For example, the electronic device can use a sliding time window of the same fixed length as the first cluster (e.g., a length of 20) to fit the fifth sequence based on a non-homogeneous Poisson distribution, resulting in a fitted fifth sequence. The fitted fifth sequence includes a scaling parameter β and a shape parameter ω associated with the non-homogeneous Poisson distribution. The fitted fifth sequence can be represented as {(β1,ω1),(β2,ω2),(β3,ω3),...,(β...} n ,ω n )}.

[0111] In practical applications, since the sixth sequence is a discrete sequence, the electronic device can use a power-law distribution to fit the sixth sequence in order to distinguish between abnormal network traffic sample data and normal network traffic sample data.

[0112] Specifically, in one embodiment, the fitting process of the sixth sequence to obtain the fitted sixth sequence includes:

[0113] Based on the power-law distribution, the sixth sequence is fitted to obtain the fitted sixth sequence.

[0114] The power-law distribution can be expressed as: Where p(x) represents the probability of an element appearing in the sixth sequence, x represents an element in the sixth sequence, α represents the shape parameter of the power-law distribution, and x(α, x) represents the probability of an element appearing in the sixth sequence. min ) represents the normalization constant.

[0115] Here, fitting the sixth sequence based on the power-law distribution can be understood as using maximum likelihood estimation to calculate the value of α corresponding to each element in the sixth sequence, thereby obtaining the fitted sixth sequence. Then, the electronic device can merge the fitted fifth sequence and the fitted sixth sequence to obtain the second sequence, which can be represented as {(α,β1,ω1),(α,β2,ω2),(α,β3,ω3),...,(α,β... n ,ω n )}.

[0116] It should be noted that, in the presence of multiple downlink phases, the electronic device can merge one or more second clusters corresponding to the multiple downlink phases, and extract features from the merged one or more second clusters to obtain the second sequence.

[0117] In practical applications, the electronic device can also extract features from the first cluster and the second cluster to obtain the data length features corresponding to the first cluster and the second cluster.

[0118] Specifically, in one embodiment, the step of extracting features from the one or more first clusters and the one or more second clusters to obtain a first sequence, a second sequence, and a third sequence, respectively, includes:

[0119] Determine the first data length corresponding to each of the one or more first clusters and the second data length corresponding to each of the one or more second clusters;

[0120] The third sequence is obtained using the determined first and second data lengths.

[0121] Wherein, the first data length can be understood as the data length (i.e., data size) of all first network traffic sample data in the first cluster, and the second data length can be understood as the length of all second network traffic sample data in the second cluster; the third sequence can be called a packet length column or a data packet length sequence, which is not limited in this embodiment of the application.

[0122] In practical applications, the electronic device can determine the first data length based on the data length of the first network traffic sample data corresponding to one or more first clusters, and simultaneously determine the second data length based on the data length of the second network traffic sample data corresponding to one or more second clusters. Then, by merging the first data length and the second data length, the third sequence can be obtained. In order to distinguish the first data length and the second data length in the third sequence, the first data length and the second data length can be marked with positive and negative values ​​respectively. For example, the first data length can be marked with a positive value and the second data length with a negative value, or vice versa.

[0123] In practical applications, in step 103, the electronic device can train the first model by combining the three obtained sequences and co-teaching technology.

[0124] Specifically, in one embodiment, training the first model using the first sequence, the second sequence, and the third sequence includes:

[0125] Based on collaborative teaching technology, the first model is trained using the first sequence, the second sequence, and the third sequence.

[0126] The first model can be called a traffic classification detection model, a deep learning classification model, or a deep learning traffic classification model, etc. The first model can include a machine learning-based detector based on a multilayer perceptron (MLP). The specific type of the first model is not limited in this application embodiment, as long as its function is implemented.

[0127] In practical applications, based on collaborative teaching technology, the electronic device can use the first sequence, the second sequence, and the third sequence to train the first model; wherein, through collaborative teaching technology, the influence of a small number of noise labels in the first sequence, the second sequence, and the third sequence can be eliminated, thereby enhancing the robustness of the first model to network traffic data detection.

[0128] Based on the model training method described above, this application also provides a network traffic detection method, applied to electronic devices, such as... Figure 5 As shown, it includes the following steps:

[0129] Step 501: Obtain the network traffic data to be detected;

[0130] Step 502: Extract features from the network traffic data to be detected to obtain a seventh sequence, wherein the seventh sequence represents the data distribution of the network traffic data to be detected;

[0131] Step 503: Using the seventh sequence and the first model, the network traffic data to be detected is detected to obtain the detection result. The first model is obtained according to the model training method provided in the embodiments of this application.

[0132] In practical applications, the electronic device may also include a device capable of performing steps 501 to 503.

[0133] In practical applications, in step 501, the electronic device can obtain the network traffic data to be detected and the corresponding data features from the network. The data features may include one or more of the data size, transmission direction and transmission time of the network traffic data to be detected (or at least one of them). The network traffic data to be detected can be understood as encrypted network traffic data.

[0134] Next, based on the data characteristics, the electronic device can extract features from the network traffic data to be detected to obtain the seventh sequence; wherein, when the network traffic data to be detected includes network traffic data with the transmission direction being uplink, features can be extracted from the uplink network traffic data based on the Wechsler distribution to convert the uplink network traffic data into the seventh sequence; when the network traffic data to be detected includes network traffic data with the transmission direction being downlink, features can be extracted from the downlink network traffic data based on the non-homogeneous Poisson distribution and the power-law distribution to convert the downlink network traffic data into the seventh sequence.

[0135] In practical applications, after obtaining the seventh sequence, the network traffic data to be detected can be detected by inputting the seventh sequence into the first model, and a detection result can be obtained; wherein, the detection result indicates whether the network traffic data to be detected is normal network traffic data or abnormal network traffic data (also known as malicious network traffic data).

[0136] The model training and network traffic detection method provided in this application includes: acquiring network traffic sample data; using the network traffic sample data to determine one or more first clusters and one or more second clusters, each first cluster containing at least two uplink transmission first network traffic sample data, and each second cluster containing one or more downlink transmission second network traffic sample data; performing feature extraction on the one or more first clusters and the one or more second clusters to obtain a first sequence, a second sequence, and a third sequence, wherein the first sequence characterizes the data distribution of the one or more first clusters, the second sequence characterizes the data distribution of the one or more second clusters, and the third sequence contains the data length features of the one or more first clusters and the one or more second clusters; and training a first model using the first sequence, the second sequence, and the third sequence, wherein the first model is used to detect the network traffic data to be detected. The technical solution provided in this application divides network traffic into uplink clusters corresponding to the uplink phase and downlink clusters corresponding to the downlink phase. It then analyzes network traffic in units of traffic clusters, characterizing (or extracting) the distribution and length features of network traffic in the uplink and downlink clusters respectively. The model is then trained using these characterized distribution and length features, enabling it to better distinguish between abnormal and normal traffic. This effectively improves the accuracy of network traffic detection using the model. Furthermore, since analyzing network traffic in units of traffic clusters is less affected by network fluctuations and adversarial attacks, the model's accuracy in detecting network traffic can be guaranteed even in complex network environments and under adversarial attacks, demonstrating strong robustness.

[0137] The following section provides a more detailed description of this application with reference to application examples.

[0138] This application proposes a deep learning-based malicious encrypted traffic detection scheme based on the clustered distribution characteristics of traffic sessions. First, by analyzing network sample traffic, a network session interaction process is divided into three stages: the handshake stage, the uplink data packet stage, and the downlink data packet stage. Next, uplink and downlink clusters are defined in the uplink and downlink stages, and the distribution of these clusters is fitted using a zero-inflation model and an extreme value model, respectively, to extract the clustered feature sequences of the traffic sessions. Simultaneously, the long feature sequences of uplink and downlink traffic data packets are extracted. Finally, a deep learning classification model is trained based on the extracted feature sequences to detect malicious traffic.

[0139] Specifically, such as Figure 6 As shown, the detection system in the deep learning malicious encrypted traffic detection scheme includes a traffic data collection and preprocessing module, a traffic feature extraction module, and a traffic classification and detection module. The process of detecting malicious traffic through the detection system includes the following steps:

[0140] Step 601: The traffic data collection and preprocessing module collects traffic data from the network (i.e., the network traffic sample data mentioned above);

[0141] Step 602: The traffic data collection and preprocessing module performs deduplication and data filling of the traffic data;

[0142] Here, the traffic data collection and preprocessing module can remove duplicate and meaningless packets from the traffic data and fill in missing traffic data, thereby enabling better classification of malicious traffic.

[0143] Step 603: The traffic feature extraction module divides the uplink and downlink traffic clusters;

[0144] In practical applications, the preprocessed network traffic is divided into three stages: the handshake stage, the uplink stage, and the downlink stage. In the uplink stage, there may be one or more uplink traffic clusters, each containing only uplink data packets (i.e., the first network traffic sample data mentioned above). When at least three uplink data packets (i.e., the first network traffic sample data mentioned above) are transmitted consecutively, the traffic feature extraction module marks the corresponding uplink traffic cluster as an uplink cluster (i.e., the first cluster mentioned above). In the downlink stage, when there are consecutively transmitted downlink data packets, the traffic feature extraction module marks them as a downlink cluster (i.e., the second cluster mentioned above).

[0145] Step 604a: The traffic feature extraction module extracts the clustered feature sequence of the uplink traffic (i.e., the first sequence mentioned above);

[0146] Here, for the uplink cluster, the time interval sequence of the uplink cluster (i.e. the fourth sequence mentioned above) is defined as the intra-cluster spacing and inter-cluster distance. Based on the zero-inflation Wechsler distribution, a fixed-length sliding time window is used to fit the time interval sequence of the uplink cluster to obtain the clustering feature sequence of the uplink cluster.

[0147] Step 604b: The traffic feature extraction module extracts the long sequence of traffic packets (i.e., the third sequence mentioned above);

[0148] In practical applications, the traffic feature extraction module counts the packet length data of traffic session data packets in the uplink and downlink clusters to form a non-zero packet length sequence.

[0149] Step 604c: The traffic feature extraction module extracts the clustered feature sequence of downlink traffic;

[0150] Here, for downlink clusters, the time interval sequence of downlink clusters (i.e., the fifth sequence mentioned above) is defined as the inter-cluster distance. Simultaneously, the number of network traffic within each downlink cluster is counted to obtain the traffic session count sequence (i.e., the sixth sequence mentioned above). Then, the traffic feature extraction module, based on a non-homogeneous clustering Poisson process, uses a fixed-length sliding time window to fit the time interval sequence of downlink clusters to obtain the clustering feature sequence of downlink clusters. Finally, a power-law distribution is used to fit the traffic session count sequence, thus obtaining the clustering feature sequence of downlink clusters (i.e., the second sequence mentioned above).

[0151] Step 605: The traffic classification and detection module trains a deep learning traffic classification model;

[0152] In practical applications, after obtaining three feature sequences, a machine learning-based detector built on co-teaching and MLP is trained on the feature dataset to classify the encrypted traffic to be detected (i.e., the network traffic data to be detected mentioned above).

[0153] Step 606: The traffic classification and detection module obtains the traffic discrimination results.

[0154] Here, after the deep learning traffic classification model is trained, the encrypted traffic to be detected is converted into a feature vector sequence (i.e., the seventh sequence mentioned above), and then input into the detector model for direct judgment to obtain the traffic discrimination result.

[0155] In the application examples of this application, by defining the concepts of uplink and downlink traffic clusters, the aggregation characteristics of traffic in the uplink and downlink stages are characterized respectively. Combined with the packet length sequence within the cluster, the difference between malicious traffic and normal traffic can be better identified, thereby improving the detection accuracy. In addition, since traffic clusters are less affected by network fluctuations and adversarial attacks, high accuracy can be guaranteed even in complex network environments and adversarial attacks. The method is robust, meaning that the above scheme can be applied to the classification of various types of traffic data.

[0156] Secondly, during the model training process, by combining clustering features and co-teaching techniques, a high-accuracy model can still be trained even when faced with low-quality traffic data, such as traffic datasets with few traffic labels and a lot of label noise. This avoids the process of manually labeling traffic data, reduces costs, and has a wide range of applications.

[0157] To implement the model training method of this application embodiment, this application embodiment also provides a model training device, which is installed on an electronic device, such as... Figure 7 As shown, the device includes:

[0158] The first acquisition unit 701 is used to acquire network traffic sample data;

[0159] The determining unit 702 is used to determine one or more first clusters and one or more second clusters using the network traffic sample data, wherein each first cluster contains at least two uplink transmission first network traffic sample data, and each second cluster contains one or more downlink transmission second network traffic sample data.

[0160] The first extraction unit 703 is used to extract features from the one or more first clusters and the one or more second clusters to obtain a first sequence, a second sequence and a third sequence, respectively. The first sequence represents the data distribution of the one or more first clusters, the second sequence represents the data distribution of the one or more second clusters, and the third sequence contains the data length features of the one or more first clusters and the one or more second clusters.

[0161] Training unit 704 is used to train a first model using the first sequence, the second sequence and the third sequence, wherein the first model is used to detect network traffic data to be detected.

[0162] In one embodiment, the first extraction unit 703 is configured to:

[0163] Determine a fourth sequence corresponding to the one or more first clusters, the fourth sequence representing the time interval between the one or more first clusters;

[0164] The fourth sequence is fitted to obtain the first sequence.

[0165] In one embodiment, the first extraction unit 703 is used to fit the fourth sequence based on the Wechsler distribution to obtain the first sequence.

[0166] In one embodiment, the first extraction unit 703 is configured to:

[0167] A fifth sequence and a sixth sequence are determined for each of the one or more second clusters, wherein the fifth sequence represents the time interval between the one or more second clusters, and the sixth sequence represents the number of second network traffic sample data corresponding to each of the one or more second clusters;

[0168] The fifth sequence is fitted to obtain a fitted fifth sequence, and the sixth sequence is fitted to obtain a fitted sixth sequence.

[0169] The second sequence is obtained by using the fifth and sixth sequences after fitting.

[0170] In one embodiment, the first extraction unit 703 is used to fit the fifth sequence based on a non-homogeneous Poisson distribution to obtain a fitted fifth sequence.

[0171] In one embodiment, the first extraction unit 703 is used to perform fitting processing on the sixth sequence based on a power-law distribution to obtain a fitted sixth sequence.

[0172] In one embodiment, the first extraction unit 703 is configured to:

[0173] Determine the first data length corresponding to each of the one or more first clusters and the second data length corresponding to each of the one or more second clusters;

[0174] The third sequence is obtained using the determined first and second data lengths.

[0175] In one embodiment, the training unit 704 is used to train the first model using the first sequence, the second sequence, and the third sequence based on collaborative teaching technology.

[0176] In practical applications, the first acquisition unit 701 can be implemented by the communication interface in the model training device, and the determination unit 702, the first extraction unit 703 and the training unit 704 can be implemented by the processor in the model training device.

[0177] It should be noted that the model training device provided in the above embodiments is only illustrated by the division of the above-described program units during model training. In practical applications, the above processing can be assigned to different program units as needed, that is, the internal structure of the device can be divided into different program units to complete all or part of the processing described above. In addition, the model training device and the model training method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0178] To implement the network traffic detection method of this application embodiment, this application embodiment also provides a network traffic detection device, which is installed on an electronic device, such as... Figure 8 As shown, the device includes:

[0179] The second acquisition unit 801 is used to acquire network traffic data to be detected;

[0180] The second extraction unit 802 is used to extract features from the network traffic data to be detected to obtain a seventh sequence, wherein the seventh sequence represents the data distribution of the network traffic data to be detected.

[0181] The detection unit 803 is used to detect the network traffic data to be detected using the seventh sequence and the first model, and obtain the detection result. The first model is obtained based on the model training method provided in the embodiments of this application.

[0182] In practical applications, the second acquisition unit 801 can be implemented by the communication interface in the network traffic detection device; the second extraction unit 802 and the detection unit 803 can be implemented by the processor in the network traffic detection device.

[0183] It should be noted that the network traffic detection device provided in the above embodiments is only illustrated by the division of the above-described program units when performing network traffic detection. In practical applications, the above processing can be assigned to different program units as needed, that is, the internal structure of the device can be divided into different program units to complete all or part of the processing described above. In addition, the network traffic detection device and the network traffic detection method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0184] Based on the hardware implementation of the above program modules, and in order to implement the model training and network traffic detection methods of the embodiments of this application, the embodiments of this application also provide an electronic device, such as... Figure 9 As shown, the electronic device 900 includes:

[0185] The communication interface 901 enables interaction with other devices;

[0186] The processor 902 is connected to the communication interface 901 to enable interaction with other devices and to execute the methods provided by one or more of the above-mentioned technical solutions when running computer programs;

[0187] The computer program is stored in memory 903.

[0188] Specifically, during the model training process provided in this application embodiment, the processor 902 is used for:

[0189] Obtain network traffic sample data through communication interface 901;

[0190] Using the network traffic sample data, one or more first clusters and one or more second clusters are determined, each first cluster containing at least two uplink first network traffic sample data, and each second cluster containing one or more downlink second network traffic sample data;

[0191] Feature extraction is performed on the one or more first clusters and the one or more second clusters to obtain a first sequence, a second sequence and a third sequence, respectively. The first sequence represents the data distribution of the one or more first clusters, the second sequence represents the data distribution of the one or more second clusters, and the third sequence contains the data length features of the one or more first clusters and the one or more second clusters.

[0192] The first model is trained using the first sequence, the second sequence, and the third sequence. The first model is used to detect network traffic data to be detected.

[0193] In one embodiment, the processor 902 is configured to:

[0194] Determine a fourth sequence corresponding to the one or more first clusters, the fourth sequence representing the time interval between the one or more first clusters;

[0195] The fourth sequence is fitted to obtain the first sequence.

[0196] In one embodiment, the processor 902 is configured to fit the fourth sequence based on a Wechsler distribution to obtain the first sequence.

[0197] In one embodiment, the processor 902 is configured to:

[0198] A fifth sequence and a sixth sequence are determined for each of the one or more second clusters, wherein the fifth sequence represents the time interval between the one or more second clusters, and the sixth sequence represents the number of second network traffic sample data corresponding to each of the one or more second clusters;

[0199] The fifth sequence is fitted to obtain a fitted fifth sequence, and the sixth sequence is fitted to obtain a fitted sixth sequence.

[0200] The second sequence is obtained by using the fifth and sixth sequences after fitting.

[0201] In one embodiment, the processor 902 is configured to perform fitting processing on the fifth sequence based on a non-homogeneous Poisson distribution to obtain a fitted fifth sequence.

[0202] In one embodiment, the processor 902 is configured to perform fitting processing on the sixth sequence based on a power-law distribution to obtain a fitted sixth sequence.

[0203] In one embodiment, the processor 902 is configured to:

[0204] Determine the first data length corresponding to each of the one or more first clusters and the second data length corresponding to each of the one or more second clusters;

[0205] The third sequence is obtained using the determined first and second data lengths.

[0206] In one embodiment, the processor 902 is configured to train the first model using the first sequence, the second sequence, and the third sequence based on collaborative teaching technology.

[0207] In the network traffic detection process provided in this application embodiment, the processor 902 is used for:

[0208] The network traffic data to be detected is obtained through the communication interface 901;

[0209] Feature extraction is performed on the network traffic data to be detected to obtain a seventh sequence, which represents the data distribution of the network traffic data to be detected.

[0210] The network traffic data to be detected is detected using the seventh sequence and the first model to obtain the detection result. The first model is obtained based on the model training method provided in the embodiments of this application.

[0211] It should be noted that the specific processing procedures of the communication interface 901 and the processor 902 can be understood by referring to the above method.

[0212] Of course, in practical applications, the various components in electronic device 900 are coupled together through bus system 904. It can be understood that bus system 904 is used to realize the connection and communication between these components. In addition to a data bus, bus system 904 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, in... Figure 9 The general labeled all buses as Bus System 904.

[0213] The memory 903 in this embodiment is used to store various types of data to support the operation of the electronic device 900. Examples of such data include any computer program used to operate on the electronic device 900.

[0214] The methods disclosed in the embodiments of this application can be applied to the processor 902, or implemented by the processor 902. The processor 902 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware in the processor 902 or by instructions in the form of software. The processor 902 may be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor 902 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in the memory 903. The processor 902 reads the information in the memory 903 and combines its hardware to complete the steps of the aforementioned method.

[0215] In an exemplary embodiment, the electronic device 900 may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to perform the aforementioned method.

[0216] It is understood that the memory (memory 903) in this embodiment of the application can be volatile memory or non-volatile memory, or both. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), ferromagnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM); the magnetic surface memory can be disk storage or magnetic tape storage. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), SyncLink Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM).The memories described in the embodiments of this application are intended to include, but are not limited to, these and any other suitable types of memories.

[0217] In an exemplary embodiment, this application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, such as a memory 903 storing a computer program. This computer program can be executed by the processor 902 of the electronic device 900 to complete the steps of the aforementioned model training method or the steps of the aforementioned network traffic detection method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM.

[0218] In an exemplary embodiment, this application also provides a computer program product, including a computer program that can be executed by a processor 902 of an electronic device 900 to complete the steps of the aforementioned model training method or the steps of the aforementioned network traffic detection method.

[0219] It should be noted that terms such as "first" and "second" are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0220] Furthermore, the technical solutions described in the embodiments of this application can be combined arbitrarily without conflict.

[0221] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application.

Claims

1. A model training method, characterized in that, include: Obtain network traffic sample data; Using the network traffic sample data, one or more first clusters and one or more second clusters are determined, each first cluster containing at least two uplink first network traffic sample data, and each second cluster containing one or more downlink second network traffic sample data; Feature extraction is performed on the one or more first clusters and the one or more second clusters to obtain a first sequence, a second sequence and a third sequence, respectively. The first sequence represents the data distribution of the one or more first clusters and contains the clustering features corresponding to the anomalies in the one or more first clusters. The second sequence represents the data distribution of the one or more second clusters and contains the clustering features corresponding to the anomalies in the one or more second clusters. The third sequence contains the data length features of the one or more first clusters and the one or more second clusters. The first model is trained using the first sequence, the second sequence, and the third sequence. The first model is used to detect network traffic data to be detected.

2. The method according to claim 1, characterized in that, The step of extracting features from the one or more first clusters and the one or more second clusters to obtain a first sequence, a second sequence, and a third sequence includes: Determine a fourth sequence corresponding to the one or more first clusters, the fourth sequence representing the time interval between the one or more first clusters; The fourth sequence is fitted to obtain the first sequence.

3. The method according to claim 2, characterized in that, The fitting process of the fourth sequence to obtain the first sequence includes: The fourth sequence is fitted based on the Wechsler distribution to obtain the first sequence.

4. The method according to claim 1, characterized in that, The step of extracting features from the one or more first clusters and the one or more second clusters to obtain a first sequence, a second sequence, and a third sequence includes: A fifth sequence and a sixth sequence are determined for each of the one or more second clusters, wherein the fifth sequence represents the time interval between the one or more second clusters, and the sixth sequence represents the number of second network traffic sample data corresponding to each of the one or more second clusters; The fifth sequence is fitted to obtain a fitted fifth sequence, and the sixth sequence is fitted to obtain a fitted sixth sequence. The second sequence is obtained by using the fifth and sixth sequences after fitting.

5. The method according to claim 4, characterized in that, The fitting process for the fifth sequence to obtain the fitted fifth sequence includes: The fifth sequence is fitted based on a non-homogeneous Poisson distribution to obtain a fitted fifth sequence.

6. The method according to claim 4, characterized in that, The fitting process for the sixth sequence to obtain the fitted sixth sequence includes: Based on the power-law distribution, the sixth sequence is fitted to obtain the fitted sixth sequence.

7. The method according to claim 1, characterized in that, The step of extracting features from the one or more first clusters and the one or more second clusters to obtain a first sequence, a second sequence, and a third sequence includes: Determine the first data length corresponding to each of the one or more first clusters and the second data length corresponding to each of the one or more second clusters; The third sequence is obtained using the determined first and second data lengths.

8. The method according to any one of claims 1 to 7, characterized in that, The step of training the first model using the first sequence, the second sequence, and the third sequence includes: Based on collaborative teaching technology, the first model is trained using the first sequence, the second sequence, and the third sequence.

9. A method for detecting network traffic, characterized in that, include: Acquire network traffic data to be detected; Feature extraction is performed on the network traffic data to be detected to obtain a seventh sequence, which represents the data distribution of the network traffic data to be detected. Using the seventh sequence and the first model, the network traffic data to be detected is detected to obtain a detection result, wherein the first model is obtained by the method according to any one of claims 1 to 8.

10. A model training device, characterized in that, include: The first acquisition unit is used to acquire network traffic sample data; The determining unit is configured to use the network traffic sample data to determine one or more first clusters and one or more second clusters, each first cluster containing at least two uplink first network traffic sample data, and each second cluster containing one or more downlink second network traffic sample data. The first extraction unit is used to extract features from the one or more first clusters and the one or more second clusters to obtain a first sequence, a second sequence, and a third sequence, respectively. The first sequence represents the data distribution of the one or more first clusters and includes clustering features corresponding to the anomalies in the one or more first clusters. The second sequence represents the data distribution of the one or more second clusters and includes clustering features corresponding to the anomalies in the one or more second clusters. The third sequence includes the data length features of the one or more first clusters and the one or more second clusters. The training unit is used to train a first model using the first sequence, the second sequence, and the third sequence. The first model is used to detect network traffic data to be detected.

11. A network traffic detection device, characterized in that, include: The second acquisition unit is used to acquire network traffic data to be detected; The second extraction unit is used to extract features from the network traffic data to be detected to obtain a seventh sequence, wherein the seventh sequence represents the data distribution of the network traffic data to be detected. The detection unit is used to detect the network traffic data to be detected using the seventh sequence and the first model, and to obtain a detection result, wherein the first model is obtained by the method according to any one of claims 1 to 8.

12. An electronic device, characterized in that, include: Processor and communication interface; among which, The processor is configured to: acquire network traffic sample data through a communication interface; determine one or more first clusters and one or more second clusters using the network traffic sample data, each first cluster containing at least two uplink transmitted first network traffic sample data, and each second cluster containing one or more downlink transmitted second network traffic sample data; extract features from the one or more first clusters and the one or more second clusters to obtain a first sequence, a second sequence, and a third sequence, wherein the first sequence characterizes the data distribution of the one or more first clusters and contains clustering features corresponding to anomalies in the one or more first clusters; the second sequence characterizes the data distribution of the one or more second clusters and contains clustering features corresponding to anomalies in the one or more second clusters; and the third sequence contains data length features of the one or more first clusters and the one or more second clusters; and train a first model using the first sequence, the second sequence, and the third sequence, wherein the first model is used to detect the network traffic data to be detected. or, The network traffic data to be detected is obtained through the communication interface; features are extracted from the network traffic data to be detected to obtain a seventh sequence, the seventh sequence representing the data distribution of the network traffic data to be detected; and the network traffic data to be detected is detected using the seventh sequence and a first model to obtain a detection result, wherein the first model is obtained by the method according to any one of claims 1 to 8.

13. An electronic device, characterized in that, include: The processor and the memory used to store computer programs that can run on the processor. When the processor is used to run the computer program, it performs the steps of the method according to any one of claims 1 to 8, or implements the steps of the method according to claim 9.

14. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8, or the steps of the method according to claim 9.

15. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8, or the steps of the method according to claim 9.

Images