Threat event detection method and system based on Mallat wavelet transform

Abstract

The invention discloses a threat event detection method and system based on Mallat wavelet transform. The method comprises the following steps: sampling a network data packet, and preprocessing obtained original data to obtain multiple groups of training data; performing multi-scale-based Mallat wavelet transform on each group of training data to obtain a scale representation sequence of each group of training data under different frequency components; training the Transform deep learning model by using the scale representation sequences of each group of training data under different frequency components to obtain a final classification and recognition model; and identifying a threat event mode in the acquired network flow information by using the classification identification final model. Decomposing an original time sequence into a scaling sequence of multi-scale time / frequency component structure mode features through wavelet transform; the time frequency features of different scales are aggregated through a Transform model; on the basis of enhancing the multi-scale feature extraction capability, the key information extraction capability is improved, so that the network threat event pattern recognition precision is improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a threat event detection method and system based on Mallat wavelet transform. Background Art

[0002] From the perspective of network architecture, network traffic is the basis of all research, and the behavioral characteristics of the network can often be reflected by the dynamic characteristics of the traffic it carries. Any network anomaly will have an impact on the traffic pattern and related data packets. This anomaly may cause the transmission mode (time delay, packet distribution, data flow, duration) of some messages to change suddenly, thereby partially changing the network traffic pattern.

[0003] Traditional anomaly detection methods include rule-based and statistical techniques, but they usually rely on knowledge in specific fields and assumptions about data distribution, and cannot handle more complex time series data well. The most commonly used feature matching detection method in the industry is to perform feature analysis on collected network data packets, make a deterministic description of the known attack or intrusion network data packet features, form corresponding event patterns, and then perform corresponding pattern recognition and matching.

[0004] Considering the packet process of network traffic, it has relatively significant characteristics in both time and frequency domains, but the existing pattern recognition method only considers its time domain characteristics and lacks analysis of its frequency domain characteristics, which makes it insensitive to attack methods with frequency characteristics such as DoS and its variants, and easily causes legitimate user background traffic to interfere with the extraction of attack features.

[0005] Based on this, a new solution is needed. Summary of the invention

[0006] The main purpose of the present invention is to provide a threat event detection method and system based on Mallat wavelet transform, aiming at the disadvantage that the existing network threat detection method directly processes the collected time series data and its feature analysis only includes the time domain pattern characteristics.

[0007] To achieve the above object, the present invention provides a threat event detection method based on Mallat wavelet transform, comprising:

[0008] Sampling network data packets and preprocessing the obtained raw data to obtain multiple sets of training data, wherein the raw data includes network traffic information based on time series in an attack state and a non-attack state;

[0009] Perform multi-scale Mallat wavelet transform on each set of training data to obtain the scale representation sequence of each set of training data at different frequency components;

[0010] Using the scale representation sequences under the different frequency components of each set of training data to train the Transformer deep learning model to obtain a final classification and recognition model; and

[0011] The classification and identification final model is used to identify threat event patterns in the collected network traffic information.

[0012] In the threat event detection method based on Mallat wavelet transform provided by the present invention, in the step of sampling network data packets and preprocessing the obtained raw data, the preprocessing of the raw data includes missing value filling, outlier processing, normalization processing and feature dimensionality reduction.

[0013] In the threat event detection method based on Mallat wavelet transform provided by the present invention, the step of performing multi-scale Mallat wavelet transform on the training data to obtain a scale representation sequence of the training data at different frequency components includes:

[0014] Calculate the scale space of the training data for wavelet decomposition, where the minimum decomposition scale J of the scale space is min =1, maximum decomposition scale J max The calculation formula is as follows:

[0015] J max =log2N-3

[0016] Where N is the length of the time series v(k) of the training data to be analyzed;

[0017] Based on the scale space, using the Mallat algorithm to perform discrete wavelet transform on the training data to obtain multiple groups of wavelet coefficients in the scale space;

[0018] Multi-resolution processing is performed on the time series of the training data to be analyzed according to the multiple groups of wavelet coefficients in the scale space to obtain a scale representation sequence of the training data at different frequency components.

[0019] In the threat event detection method based on Mallat wavelet transform provided by the present invention, the steps of training the Transformer deep learning model using the scale representation sequence under different frequency components to obtain the final classification and recognition model include:

[0020] Position encoding is performed on the scale representation sequence to obtain an input feature vector sequence;

[0021] Splitting the input feature vector sequence into training set data and test set data;

[0022] The training set data is input into the Transformer classification model for training, and an initial classification recognition model for identifying threat event behaviors is obtained;

[0023] The test set data is used to test the initial classification and recognition model and to modify the model parameters. When the preset index parameters are reached, the final classification and recognition model is output.

[0024] In the threat event detection method based on Mallat wavelet transform provided by the present invention, the step of using the classification and recognition final model to identify the threat event pattern in the collected network traffic information includes:

[0025] The time series data of the collected network traffic information is subjected to multi-scale Mallat wavelet transform to obtain the scale representation sequence under different frequency components;

[0026] The obtained scale representation sequence is input into the final classification recognition model to obtain the recognition classification result.

[0027] In addition, to achieve the above object, the present invention also provides a threat event detection system based on Mallat wavelet transform, comprising:

[0028] A data preprocessing module is used to sample network data packets and preprocess the obtained raw data to obtain multiple sets of training data, wherein the raw data includes network traffic information based on time series in attack state and non-attack state;

[0029] The wavelet transform module is used to perform multi-scale Mallat wavelet transform on each set of training data to obtain the scale representation sequence of each set of training data at different frequency components;

[0030] A model training module, used to train the Transformer deep learning model using the scale representation sequences under the different frequency components of each set of training data to obtain a final classification and recognition model; and

[0031] The classification and identification module is used to identify threat event patterns in the collected network traffic information using the classification and identification final model.

[0032] In the threat event detection system based on Mallat wavelet transform provided by the present invention, the wavelet transform module includes:

[0033] A scale space calculation unit is used to calculate the scale space of the training data for wavelet decomposition, wherein the minimum decomposition scale J of the scale space is min =1, maximum decomposition scale J max The calculation formula is as follows:

[0034] Jmax =log2N-3

[0035] Where N is the length of the time series v(k) of the training data to be analyzed;

[0036] A wavelet coefficient calculation unit, configured to perform discrete wavelet transform on the training data based on the scale space using the Mallat algorithm to obtain multiple groups of wavelet coefficients in the scale space;

[0037] The processing unit is used to perform multi-resolution processing on the time series of the training data to be analyzed according to the multiple groups of wavelet coefficients in the scale space to obtain the scale representation sequence of the training data at different frequency components.

[0038] In the threat event detection system based on Mallat wavelet transform provided by the present invention, the model training module also includes:

[0039] A position encoding unit, used for performing position encoding on the scale representation sequence to obtain an input feature vector sequence;

[0040] A data splitting unit, used for splitting the input feature vector sequence into training set data and test set data;

[0041] A training unit is used to input the training set data into the Transformer classification model for training, so as to obtain an initial classification recognition model for identifying threat event behaviors;

[0042] The testing unit is used to test the initial classification and recognition model and modify the model parameters using the test set data, and output the final classification and recognition model when the preset index parameters are reached.

[0043] In the threat event detection system based on Mallat wavelet transform provided by the present invention, the classification and identification module includes:

[0044] A data processing unit, used for performing multi-scale Mallat wavelet transform on the time series data of the collected network traffic information to obtain scale representation sequences under different frequency components;

[0045] The recognition unit is used to input the obtained scale representation sequence into the classification recognition final model to obtain the recognition classification result.

[0046] The present invention also provides a threat event detection device based on Mallat wavelet transform, comprising a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of the threat event detection method based on Mallat wavelet transform as described above are implemented.

[0047] The threat event detection system and method based on Mallat wavelet transform provided by the present invention have the following beneficial effects: in the present invention, the Mallat wavelet transform algorithm is used to perform local transformation on the input data in space and frequency, effectively extracting fine-grained representative information from the signal data, and the Transformer deep learning neural network is used in combination to fully learn the deep representative features and train to obtain a network threat pattern recognition model, thereby improving the classification performance of the model, having a higher threat event pattern recognition capability, and having strong generalization ability and robustness. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art are briefly introduced below. Obviously, the drawings in the following description are only embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on the provided drawings without creative work:

[0049] Figure 1 FIG. 1 is a flowchart of a threat event detection method based on Mallat wavelet transform provided by an embodiment of the present invention;

[0050] Figure 2 Shown is the principle diagram of Mallat wavelet transform;

[0051] Figure 3 FIG. 1 is a schematic diagram of a threat event detection system based on Mallat wavelet transform according to an embodiment of the present invention. DETAILED DESCRIPTION

[0052] In order to facilitate understanding of the present invention, the present invention will be described more fully below with reference to the relevant drawings. Typical embodiments of the present invention are given in the drawings. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein. On the contrary, the purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive.

[0053] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0054] Aiming at the disadvantage that the existing network threat detection method directly processes the collected time series data and its feature analysis only contains the time domain pattern features, the present invention uses Mallat wavelet transform to map the original data to the time / frequency domain space for analysis, and decomposes the original time series into scaled sequences containing multi-scale time / frequency component structure pattern features through multi-level high and low frequency wavelet transforms; then, through the feature extraction capability of the deep learning model Transformer, the time-frequency features of different scales are aggregated; on the basis of enhancing the multi-scale feature extraction capability, the key information extraction capability is improved, thereby improving the accuracy of network threat event pattern recognition.

[0055] In order to better understand the above-mentioned technical scheme, the above-mentioned technical scheme will be described in detail below in conjunction with the accompanying drawings and specific implementation methods. It should be understood that the embodiments of the present invention and the specific features in the embodiments are detailed descriptions of the technical scheme of the present application, rather than limitations on the technical scheme of the present application. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments can be combined with each other.

[0056] Figure 1 FIG. 1 is a flowchart of a threat event detection method based on Mallat wavelet transform provided by an embodiment of the present invention. Figure 1 As shown, the threat event detection method based on Mallat wavelet transform includes the following steps:

[0057] Step S1, sampling network data packets, and preprocessing the obtained raw data to obtain multiple sets of training data, wherein the raw data includes network traffic information based on time series in attack state and non-attack state;

[0058] Specifically, in one embodiment of the present invention, for a network environment in an attack state and a non-attack state, a detection router samples network data packets at a certain frequency to obtain network traffic information based on a time series as training data for subsequent model training.

[0059] Specifically, in one embodiment of the present invention, the collected raw data is preprocessed to reduce the influence of interference and noise in the signal, wherein the preprocessing of the data includes:

[0060] (1) Missing value filling

[0061] Due to data corruption or failure to record data, the raw data obtained by sampling often has many missing values. In the original data set, the "NaN" item represents missing values ​​and needs to be handled during the preprocessing process. The present invention uses the deep learning library component Datawig to interpolate the raw data obtained by sampling to avoid missing values ​​in the raw data.

[0062] (2) Outlier processing

[0063] An outlier is an individual value in a data set whose value is significantly different from the rest of the observed values, also known as an outlier. The present invention adopts a box plot as an outlier processing method, where a value less than Q1-1.5IQR or greater than Q3+1.5IQR is defined as an outlier.

[0064] (3) Normalization

[0065] Since the data range in the original data varies greatly, it is not conducive to network training. Therefore, each column of the original data needs to be normalized. The same column of data is normalized to between (0, 1). The normalization formula is:

[0066]

[0067] Where x is any column of data value in the original data set; x min The minimum value obtained by counting the entire column; x max is the maximum value; x * is the normalized data value.

[0068] (4) Feature Dimensionality Reduction

[0069] In order to remove the influence of redundant information in the data set on the detection accuracy, the present invention introduces a feature extraction network F as the front network of the learning model to perform feature dimension reduction. The network consists of two fully connected layers, and its purpose is to map redundant low-level features to high-level features. The calculation process of the feature extraction network F is shown in the formula below.

[0070] y=σ(x′)=σ(F(x * ))

[0071] Among them, x * is the normalized data obtained; the characteristic length is The feature extraction network outputs its high-level feature vector x′; the feature length is d x ,set up σ is the activation function.

[0072] The unactivated feature vector x′ of the output layer is used as a high-level mapping, and a new feature dataset D is obtained by training the network F on the entire original dataset, where the feature dataset D is composed of features of length d. x The feature vector data v(k) is composed of.

[0073] Step S2, performing a multi-scale Mallat wavelet transform on each set of training data to obtain a scale representation sequence of each set of training data at different frequency components;

[0074] Specifically, in one embodiment of the present invention, the network traffic information obtained by sampling network data packets is a time series, usually a discrete value, and its feature analysis only contains time domain pattern features, which makes it insensitive to attack methods with frequency characteristics such as DoS and its variants. Therefore, in the present invention, before performing feature analysis, the collected original time series is multi-scaled by wavelet transform. Wavelet transform is a tool that can analyze signals in both time domain and frequency domain. It has unique advantages in time / frequency localization and is very suitable for signal anomaly detection. In the present invention, Mallat algorithm is used as a means to implement wavelet transform, and its core is to achieve signal decomposition and reconstruction through discrete convolution and second-order downsampling process. The basic principle is to obtain approximate coefficients and detail coefficients by low-pass and high-pass filtering the signal, and then continue to decompose the approximate coefficients until the required number of decomposition layers is reached. Therefore, step S2 includes:

[0075] (1) Calculate the scale space of wavelet decomposition of the preprocessed sequence v(k) to determine the scale space for decomposing the signal [J min ,J max ], let the minimum decomposition scale J min =1, maximum decomposition scale J max The calculation formula is as follows:

[0076] J max =log2N-3

[0077] Where N is the length of the time series v(k) of the training data to be analyzed.

[0078] (2) Use the Mallat algorithm to perform scale-space-based [J min ,J max ] to perform discrete wavelet transform and obtain the scale space [J min ,J max ], the decomposition process is as follows Figure 2 The specific calculation method is as follows:

[0079] If v(k) is the discrete sampling data of the signal, if The multiscale Mallat algorithm calculates the wavelet coefficients through discrete convolution and second-order downsampling process, the formula is as follows:

[0080]

[0081] Where N is the number of discrete sampling data; h, g are the filter impulse responses, i.e., the filter coefficients of each column; c j,k For v(k) in 2 jThe approximation at the resolution is called the low-frequency coefficient of the signal, which is the approximate coefficient at scale j and j+1 and needs to be further decomposed; d j,k For υ(k) in 2 j The discrete details at the resolution are called the high-frequency coefficients of the signal. This part, as the detail value coefficients at scales j and j+1, maintains the information we need in the sequence.

[0082] like Figure 2 As shown, starting from layer j = 1, the wavelet coefficient scale sequence C = c is obtained after J layers of decomposition. J+1 ,d J+1 ,d J ,…,d1.

[0083] (3) In scale space [J min ,J max ], assuming that N wavelet transforms are performed, the following N groups of wavelet coefficient scale sequences will be obtained:

[0084] C1(c 11 ,c 12 ,…,c 1n ),

[0085] C2(c 21 ,c 22 ,…,c 2n ),

[0086] …

[0087] C N (c N1 ,c N2 ,…,c Nn ),

[0088] The combined scale sequence is: c 11 ,c 12 ,…,c 1n ,c 21 ,c 22 ,…,c 2n ,…,c N1 ,c N2 ,…,c Nn .

[0089] In the present invention, the pre-processed feature vector data υ(k) is subjected to a multi-scale Mallat wavelet transform to obtain the required wavelet coefficients at different scales. Then, the original time series information can be subjected to multi-resolution processing according to the wavelet coefficients at different scales, so that the converted sequence has both time / frequency domain characteristics. The original data is mapped to the time / frequency domain space for analysis by using the Mallat wavelet transform, and the original time series is decomposed into a scaled sequence containing the multi-scale time / frequency component structure pattern characteristics by multi-level high and low frequency wavelet transforms.

[0090] Step S3, training the Transformer deep learning model using the scale representation sequences under the different frequency components of each set of training data to obtain a final classification and recognition model;

[0091] Specifically, in one embodiment of the present invention, after the original time series is decomposed into scaled components of different frequencies by Mallat wavelet transform, the scaled coefficient features under different frequency classifications are combined as the input data of the network model, and then the Transformer deep learning model is used to efficiently extract multidimensional features to construct a final model for classification and identification of network traffic, so as to achieve accurate identification of threat events in the network. The input of the constructed final classification and identification model is a combination of feature vectors such as the scaled wavelet coefficients of different frequency domains after the time series data is transformed by wavelet, and the output is the identification and classification results of network activities. Therefore, step S3 includes:

[0092] The specific steps can be broken down into:

[0093] (1) Positionally encode the scale representation sequence obtained in step S2 to make it a feature vector sequence that meets the input requirements of the Transformer model. The specific encoding method is as follows:

[0094] In order to meet the requirements of the Transformer model input, the position information needs to be embedded into the input symbol sequence features. Through a fully connected layer, the symbol sequence characteristics obtained under different wavelet scale divisions are encoded accordingly. The position encoding calculation formula is as follows:

[0095]

[0096] Among them: pos refers to the position of a feature at a certain moment in a sequence, and its value range is [0, maximum sequence length]; d xis the feature dimension; i represents the index of the dimension in the position encoding vector, and its value range is [0,...,dx]. The period of the position embedding function varies from 2π to 10 000×2π, and each position will get a combination of sin and cos functions with different periods in the encoding dimension, thus generating unique texture position information, and finally enabling the model to learn the dependency between positions and the time-frequency characteristics of the symbol sequence.

[0097] (2) The feature vector data set obtained in step (1) is split into a training set and a test set according to a certain ratio (e.g., 7:3). The training set is input into the designed Transformer classification model for training to obtain an initial classification recognition model that can identify threat event behaviors. The initial model is then tested with the test set. The initial model is judged according to pre-set indicator parameters (e.g., recall rate, precision rate, and F1). If the set indicator requirements are met, it can be used as the final model for threat event recognition in the actual online environment. Otherwise, the model parameters are adjusted for retesting until the test results meet the set indicator requirements.

[0098] The present invention uses the deep learning model Transformer to perform pattern discovery and identification of network threat events from both the time and frequency domains, which not only effectively alleviates the interference of legitimate user background traffic on attack feature extraction, but also has a good effect on DoS and its variant attacks. By converting the original time series data with only time domain information into data with time and frequency domain information, the classification performance of the model is improved, with higher threat event pattern recognition capabilities, and strong generalization and robustness.

[0099] Step S4: using the classification and identification final model to identify threat event patterns in the collected network traffic information.

[0100] Specifically, in one embodiment of the present invention, for the time series data of network traffic information collected in reality, the same Mallat wavelet transform method is used to obtain the corresponding wavelet coefficients, and the wavelet coefficients are used as the scale division standard to generate the corresponding scale sequence as the input feature vector input into the trained classification recognition final model, so as to realize abnormal diagnosis of the feature vector of suspicious traffic. Therefore, step S4 includes: performing a multi-scale Mallat wavelet transform based on the time series data of the collected network traffic information to obtain a scale representation sequence under different frequency components; inputting the obtained scale representation sequence into the classification recognition final model to obtain the recognition classification result.

[0101] The present invention decomposes the collected time series structure from the frequency domain perspective through multi-scale wavelets to obtain time series representations with high and low frequency components at different levels, then independently encodes the time feature structure under each frequency component, and then fuses all feature codes as the input feature vector of the deep learning model (such as Transformer), trains to obtain the final classification and recognition model for detecting threat events, and then uses the model to detect and classify threat events on data in the actual network. Through the Mallat wavelet transform method, the multi-scale analysis of the original time series workflow data from the time / frequency domain space is completed, and the definition of threat events is realized through the method of pattern discovery, so as to cooperate with the protection system to complete the identification and defense of threat events.

[0102] The present invention also provides a threat event detection system based on Mallat wavelet transform, such as Figure 3 As shown, it includes: a data preprocessing module 310, which is used to sample network data packets and preprocess the obtained raw data to obtain multiple groups of training data, wherein the raw data includes network traffic information based on time series in attack state and non-attack state; a wavelet transform module 320, which is used to perform multi-scale Mallat wavelet transform on each group of training data to obtain a scale representation sequence of each group of training data under different frequency components; a model training module 330, which is used to train the Transformer deep learning model using the scale representation sequence of each group of training data under the different frequency components to obtain a final classification and recognition model; and a classification and recognition module 340, which is used to use the final classification and recognition model to identify threat event patterns in the collected network traffic information.

[0103] Furthermore, in one embodiment of the present invention, the wavelet transform module 320 includes: a scale space calculation unit, which is used to calculate the scale space of the training data for wavelet decomposition, wherein the minimum decomposition scale J of the scale space is min =1, maximum decomposition scale J max The calculation formula is as follows:

[0104] J max =log2N-3

[0105] Wherein, N is the length of the time series σ(k) of the training data to be analyzed; the wavelet coefficient calculation unit is used to perform discrete wavelet transform on the training data based on the scale space using the Mallat algorithm to obtain multiple groups of wavelet coefficients on the scale space; the processing unit is used to perform multi-resolution processing on the time series of the training data to be analyzed according to the multiple groups of wavelet coefficients on the scale space to obtain the scale representation sequence of the training data under different frequency components. By using the Mallat wavelet transform method, the original collected network time series data is locally transformed in time and frequency, and multi-resolution representative information is extracted from the signal data in different frequency bands, completing the analysis of the original time series workflow data from the time-frequency domain space, decomposing the original data into scaled sequence data with different frequency components, independently characterizing each component information, and optimizing the original data input method.

[0106] Furthermore, in one embodiment of the present invention, the model training module 330 includes: a position encoding unit, used to perform position encoding on the scale representation sequence to obtain an input feature vector sequence; a data splitting unit, used to split the input feature vector sequence into training set data and test set data; a training unit, used to input the training set data into the Transformer classification model for training to obtain an initial classification recognition model for identifying threat event behaviors; a testing unit, used to test the initial classification recognition model and modify model parameters using the test set data, and output the final classification recognition model when the preset indicator parameters are reached.

[0107] Furthermore, in one embodiment of the present invention, the classification and identification module 340 includes: a data processing unit, which is used to perform a multi-scale Mallat wavelet transform on the time series-based data of the collected network traffic information to obtain a scale representation sequence under different frequency components; and an identification unit, which is used to input the obtained scale representation sequence into the classification and identification final model to obtain an identification and classification result.

[0108] The threat event detection method and system based on Mallat wavelet transform provided by the present invention have the following effects: for the problem that traditional anomaly detection methods including rule-based and statistical technologies can only capture shallow features of original input signals, resulting in limited accuracy and performance improvement in the classification of network traffic identification technology, the Mallat wavelet transform algorithm is used to locally transform the input data in space and frequency, effectively extract fine-grained representative information from the signal data, and the Transformer deep learning neural network is used in combination to fully learn deep representative features and train to obtain a network threat pattern recognition model, thereby improving the classification performance of the model, having a higher threat event pattern recognition capability, and having strong generalization capability and robustness.

[0109] The embodiment of the present invention further provides a threat event detection device based on Mallat wavelet transform, which may include:

[0110] Memory for storing computer programs;

[0111] The processor can implement the following steps when executing the computer program stored in the above memory:

[0112] Sampling network data packets, and preprocessing the obtained raw data to obtain multiple groups of training data, wherein the raw data includes network traffic information based on time series in attack state and non-attack state; performing multi-scale Mallat wavelet transform on each group of training data to obtain a scale representation sequence of each group of training data under different frequency components; using the scale representation sequence of each group of training data under the different frequency components to train a Transformer deep learning model to obtain a final classification and recognition model; and using the final classification and recognition model to identify threat event patterns in the collected network traffic information.

[0113] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0114] Similarly, it should be understood that in order to streamline the present disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the intention that the claimed invention requires more features than those explicitly recited in each claim. More specifically, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present invention.

[0115] In addition, those skilled in the art will appreciate that, although some embodiments herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present invention and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.

[0116] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc., does not indicate any order. These words may be interpreted as names.

Claims

1. A threat event detection method based on Mallat wavelet transform, characterized in that: The following steps are involved: Sampling network data packets and preprocessing the obtained raw data to obtain multiple sets of training data, wherein the raw data includes network traffic information based on time series in an attack state and a non-attack state; Perform multi-scale Mallat wavelet transform on each set of training data to obtain the scale representation sequence of each set of training data at different frequency components; The Transformer deep learning model is trained using the scale representation sequences under the different frequency components of each set of training data to obtain a final classification and recognition model; as well as The classification and identification final model is used to identify threat event patterns in the collected network traffic information.

2. The threat event detection method based on Mallat wavelet transform according to claim 1, characterized in that: In the step of sampling network data packets and preprocessing the obtained raw data, the preprocessing of the raw data includes missing value filling, outlier processing, normalization processing and feature dimension reduction.

3. The threat event detection method based on Mallat wavelet transform as claimed in claim 2, characterized in that: The step of performing a multi-scale Mallat wavelet transform on the training data to obtain a scale representation sequence of the training data at different frequency components includes: Calculate the scale space of the training data for wavelet decomposition, where the minimum decomposition scale J of the scale space is min =1, maximum decomposition scale J max The calculation formula is as follows: I max =log2N-3 Where N is the length of the time series v(k) of the training data to be analyzed; Based on the scale space, using the Mallat algorithm to perform discrete wavelet transform on the training data to obtain multiple groups of wavelet coefficients in the scale space; Multi-resolution processing is performed on the time series of the training data to be analyzed according to the multiple groups of wavelet coefficients in the scale space to obtain a scale representation sequence of the training data at different frequency components.

4. The threat event detection method based on Mallat wavelet transform as claimed in claim 3, characterized in that: The steps of training the Transformer deep learning model using the scale representation sequence under different frequency components to obtain the final classification and recognition model include: Position encoding is performed on the scale representation sequence to obtain an input feature vector sequence; Splitting the input feature vector sequence into training set data and test set data; The training set data is input into the Transformer classification model for training, and an initial classification recognition model for identifying threat event behaviors is obtained; The test set data is used to test the initial classification and recognition model and to modify the model parameters. When the preset index parameters are reached, the final classification and recognition model is output.

5. The threat event detection method based on Mallat wavelet transform as claimed in claim 4, characterized in that: The steps of using the classification and identification final model to identify threat event patterns in the collected network traffic information include: Perform multi-scale Mallat wavelet transform on the time series data of the collected network traffic information to obtain the scale representation sequence under different frequency components; The obtained scale representation sequence is input into the final classification recognition model to obtain the recognition classification result.

6. A threat event detection system based on Mallat wavelet transform, characterized in that: include: A data preprocessing module is used to sample network data packets and preprocess the obtained raw data to obtain multiple sets of training data, wherein the raw data includes network traffic information based on time series in attack state and non-attack state; The wavelet transform module is used to perform multi-scale Mallat wavelet transform on each set of training data to obtain the scale representation sequence of each set of training data at different frequency components; A model training module is used to train the Transformer deep learning model using the scale representation sequences under the different frequency components of each set of training data to obtain a final classification and recognition model; as well as The classification and identification module is used to identify threat event patterns in the collected network traffic information using the classification and identification final model.

7. The threat event detection system based on Mallat wavelet transform as claimed in claim 6, characterized in that: The wavelet transform module comprises: A scale space calculation unit is used to calculate the scale space of the training data for wavelet decomposition, wherein the minimum decomposition scale J of the scale space is min =1, maximum decomposition scale J max The calculation formula is as follows: I max =log2N-3 Where N is the length of the time series υ(k) of the training data to be analyzed; A wavelet coefficient calculation unit, configured to perform discrete wavelet transform on the training data based on the scale space using the Mallat algorithm to obtain multiple groups of wavelet coefficients in the scale space; The processing unit is used to perform multi-resolution processing on the time series of the training data to be analyzed according to the multiple groups of wavelet coefficients in the scale space to obtain the scale representation sequence of the training data at different frequency components.

8. The threat event detection system based on Mallat wavelet transform as claimed in claim 7, characterized in that: The model training module includes: A position encoding unit, used for performing position encoding on the scale representation sequence to obtain an input feature vector sequence; A data splitting unit, used for splitting the input feature vector sequence into training set data and test set data; A training unit is used to input the training set data into the Transformer classification model for training, so as to obtain an initial classification recognition model for identifying threat event behaviors; The testing unit is used to test the initial classification and recognition model and modify the model parameters using the test set data, and output the final classification and recognition model when the preset index parameters are reached.

9. The threat event detection system based on Mallat wavelet transform as claimed in claim 8, characterized in that: The classification recognition module comprises: A data processing unit, used for performing a multi-scale Mallat wavelet transform on the time series data of the collected network traffic information to obtain a scale representation sequence under different frequency components; The recognition unit is used to input the obtained scale representation sequence into the classification recognition final model to obtain the recognition classification result.

10. A threat event detection device based on Mallat wavelet transform, characterized in that: The invention comprises a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of the threat event detection method based on Mallat wavelet transform as claimed in any one of claims 1 to 5 are implemented.

Images