A method, system and computer device for detecting encrypted malicious traffic

Abstract

The present invention relates to the field of encryption technology, and in particular to a method for detecting encrypted malicious traffic. The present invention can generate diversified training data by combining random noise vectors with malicious traffic samples, which helps the model learn more features. The bidirectional model can simultaneously consider context information and extract richer feature representations, which helps capture complex patterns and time series relationships in encrypted traffic. By combining bidirectional feature extraction, forged sample generation and adversarial training, a multi-level learning framework is formed to avoid dependence on a single algorithm. By combining time series features and local spatial features, the model can effectively capture the dynamic changes and spatial correlation of traffic, improve the accuracy of detection, and through real-time traffic monitoring and confidence scoring, the method effectively solves the limitations of existing encrypted malicious traffic detection and enhances the real-time, dynamic adaptability and detection accuracy of the system.

Description

Technical Field

[0001] The present invention relates to the field of encryption technology, and in particular to a detection method, system and computer equipment for encrypted malicious traffic. Background Art

[0002] In recent years, with the rapid development of technologies such as industrial Internet and network-cloud integration, end-to-end key aspects such as networks, terminals, and clouds have further evolved, and current network capabilities have continued to increase. However, it also brings network security risks to critical infrastructure, posing severe challenges to existing technical architectures and security protection systems. Malicious traffic detection is mainly based on deep packet inspection, machine learning, and deep learning methods. Based on deep packet inspection, by checking the content of each data packet, identifying and analyzing the information it carries, it can detect potential threats or application features. The detection method based on machine learning is mainly based on the statistical characteristics and behavioral characteristics of the traffic, such as packet size, packet interval time, transmission duration, interaction frequency, and interaction duration, so as to effectively identify malicious traffic. The detection method based on deep learning is to automatically extract useful features from the original network traffic, and then classify the malicious traffic through a classifier.

[0003] Existing encrypted malicious traffic detection methods usually rely on a single algorithm for feature representation to achieve a certain degree of malicious traffic detection. However, these algorithms have limitations when faced with data with a wide variety of encryption protocols, obvious data imbalance, and strong disguise of network attacks. They only simply learn the feature differences between normal behavior and attack samples. Summary of the invention

[0004] The main purpose of the present invention is to provide a method for detecting encrypted malicious traffic, aiming to solve the technical problems in the prior art.

[0005] The present invention provides a method for detecting encrypted malicious traffic, comprising:

[0006] Obtaining a random noise vector and a network data set, and extracting a plurality of malicious traffic samples and normal traffic samples from the network data set;

[0007] Combining a plurality of the malicious traffic samples with a random noise vector to obtain a data training set, and inputting the data training set into a generator to obtain an input sequence;

[0008] Obtaining a bidirectional output feature according to the input sequence, and obtaining a forged sample according to the bidirectional output feature;

[0009] Obtaining adversarial samples according to the forged samples and the normal traffic samples, and obtaining training data according to the adversarial samples;

[0010] Acquire global context information of the training data, and acquire a plurality of key local features according to the global context information;

[0011] Acquire multiple time series features and local spatial features of the training data, and construct a detection classification model based on the multiple time series features, local spatial features and key local features;

[0012] Acquire real-time traffic, and input the real-time traffic into a detection classification model to obtain a confidence detection score;

[0013] Determining whether the confidence detection score is greater than a preset threshold;

[0014] If the confidence detection score is greater than a preset threshold, the real-time traffic is determined to be malicious traffic;

[0015] If the confidence detection score is not greater than a preset threshold, the real-time traffic is determined to be normal traffic.

[0016] Preferably, the step of combining the plurality of malicious traffic samples with a random noise vector to obtain a data training set, and inputting the data training set into a generator to obtain an input sequence comprises:

[0017] Acquire multiple malicious traffic samples, and convert the multiple malicious traffic samples into malicious traffic structured data;

[0018] Acquire malicious traffic key features of a plurality of the malicious traffic structured data, wherein the malicious traffic key features include at least one of a protocol type, a traffic duration, a packet count, a source and a destination port, and a source and a destination IP address;

[0019] Standardizing the plurality of malicious traffic key features to obtain a plurality of malicious traffic numerical features, and combining the plurality of malicious traffic numerical features into a malicious traffic feature vector;

[0020] Obtaining a dimension of a malicious traffic feature vector, and obtaining a random noise vector according to the dimension;

[0021] The random noise vector and the malicious traffic feature vector are concatenated to obtain a data training set;

[0022] Obtaining a generation speed and available memory of the generator, and determining an input sample batch according to the generation speed and available memory;

[0023] Dividing the data training set into a plurality of loading input samples according to the input sample batches;

[0024] Input multiple loading input samples into the generator in sequence to obtain an input sequence.

[0025] Preferably, the step of obtaining a bidirectional output feature according to the input sequence, and obtaining a forged sample according to the bidirectional output feature comprises:

[0026] Inputting the input sequence into a bidirectional long short-term memory network model;

[0027] The forward part of the bidirectional long short-term memory network model processes the input sequence step by step from the starting time step to the ending time step of the input sequence to obtain the forward output feature;

[0028] The reverse part of the bidirectional long short-term memory network model processes the input sequence step by step from the end time step to the start time step of the input sequence to obtain the reverse output features;

[0029] Connecting the reverse output feature and the forward output feature to obtain a bidirectional output feature;

[0030] The bidirectional output features are input into the generator to obtain a forged sample.

[0031] Preferably, the step of obtaining adversarial samples according to the forged samples and the normal traffic samples, and obtaining training data according to the adversarial samples comprises:

[0032] Inputting the forged sample and the normal traffic sample into the discriminator to obtain a discriminant output value;

[0033] Determining whether the discrimination output value reaches a preset output value;

[0034] If the discriminant output value does not reach the preset output value, it is determined that the authenticity of the forged sample is low, and the binary cross entropy loss is used to obtain the generator loss;

[0035] The back-propagation algorithm is used to update the weight of the generator according to the generator loss until the discriminant output value output by the discriminator reaches the preset output value, and the forged sample at this time is marked as an adversarial sample;

[0036] If the discrimination output value reaches a preset output value, the authenticity of the forged sample is determined to be high, and the forged sample is marked as an adversarial sample;

[0037] Obtaining public traffic data, and cleaning the public traffic data to obtain standard traffic data;

[0038] The adversarial sample is appended and merged at the end of the standard traffic data to obtain training data.

[0039] Preferably, the step of obtaining a plurality of time series features and local spatial features of the training data, and constructing a detection classification model according to the plurality of time series features, local spatial features and key local features comprises:

[0040] Acquire first feature information of the training data, wherein the first feature information includes process noise, observation noise, multiple state vectors, multiple observation values, and multiple time series data;

[0041] Acquire multiple time series features according to the process noise, observation noise, multiple state vectors, multiple observation values ​​and multiple time series data;

[0042] Dividing the training data into a plurality of time windows according to a preset time length, and extracting second feature information of each of the time windows, wherein the second feature information includes a plurality of average flow rates, fluctuation degrees, maximum values, and minimum values;

[0043] Aggregate multiple average flows, fluctuations, maximums and minimums of multiple time windows to obtain multiple local spatial features;

[0044] Dividing the plurality of time series features, local spatial features and key local features into a training set and a validation set according to a preset ratio;

[0045] A preset detection classification model is constructed according to the time series features, local spatial features and key local features, wherein the preset detection classification model is:

[0046] ;

[0047] Among them, P(G) represents the evaluation value, α represents the first model parameter, a represents the time series weight, S(T) represents the time series feature, b represents the local spatial weight, J(T) represents the local spatial feature, c represents the key local weight, and G(T) represents the key local feature;

[0048] Multiple time series features, local spatial features, and key local features in the training set are sequentially input into a preset detection classification model for training, and are verified based on multiple time series features, local spatial features, and key local features in the verification set to obtain multiple prediction training results;

[0049] The model parameters of the preset detection classification model are adjusted according to the multiple prediction training results to obtain the detection classification model, wherein the detection classification model is:

[0050] ;

[0051] Among them, Z(P) represents the confidence detection score, β represents the second model parameter, a represents the time series weight, S(T) represents the time series feature, b represents the local spatial weight, J(T) represents the local spatial feature, c represents the key local weight, and G(T) represents the key local feature.

[0052] Preferably, the step of obtaining multiple time series features according to the process noise, observation noise, multiple state vectors, multiple observation values ​​and multiple time series data includes:

[0053] Acquire a state transfer matrix according to the multiple time series features;

[0054] Obtaining an observation matrix according to the mapping of each state vector to the corresponding observation value;

[0055] The corresponding prediction covariance is calculated according to the process noise, the state transfer matrix and each state vector, wherein the calculation formula is:

[0056] ;

[0057] Among them, Y(X) represents the prediction covariance, Z(J) represents the state transfer matrix, Z(X) represents the state covariance, and G(Z) represents the process noise;

[0058] Obtaining a corresponding Kalman gain according to the observation noise and each prediction covariance;

[0059] Acquire a predicted state vector according to the state covariance and the state transfer matrix;

[0060] The corresponding time series features are calculated according to the predicted state vector, the observation matrix, each observation value and each Kalman gain, wherein the calculation formula is:

[0061] ;

[0062] Among them, S(T) represents the time series characteristics, Y(Z) represents the predicted state vector, K(Z) represents the Kalman gain, G(Z) represents the observation matrix, and G(C) represents the observation value.

[0063] The present application also provides a detection system for encrypted malicious traffic, including:

[0064] An extraction module, used to obtain a random noise vector and a network data set, and extract a plurality of malicious traffic samples and normal traffic samples from the network data set;

[0065] A first input module, used for combining a plurality of the malicious traffic samples with a random noise vector to obtain a data training set, and inputting the data training set into a generator to obtain an input sequence;

[0066] A first acquisition module, configured to acquire a bidirectional output feature according to the input sequence, and acquire a forged sample according to the bidirectional output feature;

[0067] A second acquisition module, used to acquire adversarial samples according to the forged samples and the normal traffic samples, and to acquire training data according to the adversarial samples;

[0068] A third acquisition module is used to acquire global context information of the training data, and acquire a plurality of key local features according to the global context information;

[0069] A construction module, used to obtain multiple time series features and local spatial features of the training data, and to construct a detection classification model based on the multiple time series features, local spatial features and key local features;

[0070] A second input module is used to obtain real-time traffic and input the real-time traffic into the detection classification model to obtain a confidence detection score;

[0071] A judgment module, used to judge whether the confidence detection score is greater than a preset threshold;

[0072] If the confidence detection score is greater than a preset threshold, the real-time traffic is determined to be malicious traffic;

[0073] If the confidence detection score is not greater than a preset threshold, the real-time traffic is determined to be normal traffic.

[0074] Preferably, the first input module comprises:

[0075] A conversion unit, used to obtain a plurality of malicious traffic samples and convert the plurality of malicious traffic samples into malicious traffic structured data;

[0076] A first acquisition unit, configured to acquire a plurality of malicious traffic key features of the malicious traffic structured data, wherein the malicious traffic key features include at least one of a protocol type, a traffic duration, a packet count, a source and a destination port, and a source and a destination IP address;

[0077] A combining unit, configured to perform standardization processing on a plurality of malicious traffic key features to obtain a plurality of malicious traffic numerical features, and combine the plurality of malicious traffic numerical features into a malicious traffic feature vector;

[0078] A second acquisition unit, used to acquire a dimension of a malicious traffic feature vector, and acquire a random noise vector according to the dimension;

[0079] A concatenation unit, used for concatenating the random noise vector and the malicious traffic feature vector to obtain a data training set;

[0080] A determination unit, used to obtain a generation speed and available memory of the generator, and determine an input sample batch according to the generation speed and available memory;

[0081] A separation unit, used for dividing the data training set into a plurality of loading input samples according to the input sample batches;

[0082] The input unit is used to input multiple loaded input samples into the generator in sequence to obtain an input sequence.

[0083] The present invention also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above-mentioned method for detecting encrypted malicious traffic when executing the computer program.

[0084] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned method for detecting encrypted malicious traffic are implemented.

[0085] The beneficial effects of the present invention are as follows: by combining random noise vectors with malicious traffic samples, the present invention can generate diversified training data, which helps the model learn more features and improve its generalization ability. Malicious traffic samples combined with random noise can enable the model to better identify network attacks with strong disguises and enhance the robustness of the model to disguised attacks. By generating new input sequences through the generator, multiple feature representation methods can be integrated. The bidirectional model LSTM can simultaneously consider contextual information and extract richer feature representations, which helps to capture complex patterns and time series relationships in encrypted traffic. Forged samples are generated based on bidirectional output features, which can enrich the data set and help the model better learn diversified traffic patterns. By combining bidirectional feature extraction, forged sample generation and adversarial training, a multi-level learning framework is formed, which avoids dependence on a single algorithm. By obtaining global context information and multiple local features, it can more comprehensively capture the complex patterns of traffic data. Combining time series features and local spatial features, the model can effectively capture the dynamic changes and spatial correlation of traffic, improve the accuracy of detection, and process traffic characteristics under different encryption protocols. It is helpful to identify potential malicious traffic generated by different encryption methods. Through real-time traffic monitoring and confidence scoring, this method effectively solves the limitations of existing encrypted malicious traffic detection and enhances the real-time, dynamic adaptability and detection accuracy of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0086] Figure 1 The figure is a schematic diagram of a method flow according to an embodiment of the present invention.

[0087] Figure 2 FIG. 1 is a schematic diagram of a device structure according to an embodiment of the present invention.

[0088] Figure 3 A schematic diagram of the internal structure of a computer device according to an embodiment of the present application.

[0089] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0090] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0091] like Figure 1-Figure 3 As shown, the present application provides a method for detecting encrypted malicious traffic, including:

[0092] S1. Obtain a random noise vector and a network data set, and extract multiple malicious traffic samples and normal traffic samples from the network data set;

[0093] S2, combining the plurality of malicious traffic samples with a random noise vector to obtain a data training set, and inputting the data training set into a generator to obtain an input sequence;

[0094] S3, obtaining a bidirectional output feature according to the input sequence, and obtaining a forged sample according to the bidirectional output feature;

[0095] S4. Obtaining adversarial samples according to the forged samples and the normal traffic samples, and obtaining training data according to the adversarial samples;

[0096] S5. Obtain global context information of the training data, and obtain multiple key local features according to the global context information;

[0097] S6. Acquire multiple time series features and local spatial features of the training data, and construct a detection classification model based on the multiple time series features, local spatial features and key local features;

[0098] S7. Obtain real-time traffic, and input the real-time traffic into a detection classification model to obtain a confidence detection score;

[0099] S8, determining whether the confidence detection score is greater than a preset threshold;

[0100] If the confidence detection score is greater than a preset threshold, the real-time traffic is determined to be malicious traffic;

[0101] If the confidence detection score is not greater than a preset threshold, the real-time traffic is determined to be normal traffic.

[0102] As described in the above steps S1-S8, in recent years, with the rapid development of technologies such as industrial Internet and network-cloud integration, end-to-end key aspects such as networks, terminals, and clouds have further evolved, and current network capabilities have continued to increase. However, it also brings network security risks to critical infrastructure and poses severe challenges to existing technical architectures and security protection systems. Malicious traffic detection is mainly based on deep packet inspection, machine learning, and deep learning methods. Existing encrypted malicious traffic detection methods usually rely on a single algorithm for feature representation to achieve a certain degree of malicious traffic detection. However, these algorithms have limitations when faced with a variety of encryption protocols, obvious data imbalance, and data with strong disguise of network attacks. They only simply learn the feature differences between normal behavior and attack samples. The present invention extracts multiple malicious traffic samples and normal traffic samples from a network data set, merges the multiple malicious traffic samples with a random noise vector to obtain a data training set, and inputs the data training set into a generator to obtain an input sequence, wherein a random noise vector generally refers to a random change or interference introduced in data processing. By combining the random noise vector with the malicious traffic sample, diversified training data can be generated. This diversity helps the model learn more features, thereby improving its generalization ability. By means of synthesis, sample balance can be performed between normal traffic and malicious traffic, which helps to reduce the bias of the model to a certain type of sample, thereby improving the accuracy of detection. The present invention extracts more complex features through a generator, thereby improving the adaptability to a variety of encryption protocols. Malicious traffic samples combined with random noise can enable the model to better identify network attacks with strong disguise, thereby enhancing the robustness of the model to disguised attacks. A new input sequence is generated by the generator, which can integrate a variety of feature representation methods, thereby avoiding the limitation of relying on a single algorithm and enhancing the comprehensive performance of the model. Synthetic data can, to a certain extent, Reduce the need for a large number of real malicious traffic samples, save the cost of data collection and annotation, improve the efficiency of model training, obtain bidirectional output features based on the input sequence, and obtain forged samples based on the bidirectional output features, obtain adversarial samples based on forged samples and normal traffic samples, and obtain training data based on adversarial samples. Among them, the bidirectional output feature refers to the fact that in the bidirectional recurrent neural network, feature extraction can be performed from past and future context information at the same time. The input sequence refers to the time series data or feature vector received by the model. In this way, the use of the bidirectional model LSTM can simultaneously consider context information and extract richer feature representations, which helps to capture complex patterns and timing relationships in encrypted traffic. Generating forged samples based on the bidirectional output features can enrich the data set and help the model better learn diverse traffic patterns. Through adversarial samples, the robustness of the model to network attacks can be enhanced. Combining bidirectional feature extraction, forged sample generation and adversarial training, a multi-level learning framework is formed, which avoids dependence on a single algorithm, thereby improving the effectiveness of detection. By obtaining the global context information of the training data,And obtain multiple key local features based on global context information, obtain multiple time series features and local spatial features of training data, and build a detection classification model based on multiple time series features, local spatial features and key local features. In this way, by obtaining global context information and multiple local features, where global context information means that when processing data, not only local features but also features of the entire data set or sequence are considered, the model can more comprehensively capture the complex patterns of traffic data, thereby improving the ability to identify malicious traffic. Combining time series features and local spatial features, the model can effectively capture the dynamic changes and spatial correlation of traffic, improve the accuracy of detection, and can process traffic features under different encryption protocols, which is helpful to identify potential malicious traffic generated by different encryption methods. ,By obtaining real-time traffic and inputting the real-time traffic into the detection classification model, a confidence detection score is obtained, wherein the confidence detection score is the confidence level of the prediction result calculated by the model when making a prediction. By judging whether the confidence detection score is greater than a preset threshold, if the confidence detection score is greater than the preset threshold, the real-time traffic is judged to be malicious traffic, otherwise, the real-time traffic is judged to be normal traffic. Through the confidence detection score, the judgment of the traffic can be quantified. The preset threshold can be adjusted according to the specific network environment and requirements, so as to adapt to different security strategies and balance the risks of false positives and false negatives. Through real-time traffic monitoring and confidence scoring, this method effectively solves the limitations of existing encrypted malicious traffic detection and enhances the real-time, dynamic adaptability and detection accuracy of the system. ,

[0103] In one embodiment, the step S2 of combining the plurality of malicious traffic samples with a random noise vector to obtain a data training set and inputting the data training set into a generator to obtain an input sequence includes:

[0104] S21, obtaining multiple malicious traffic samples, and converting the multiple malicious traffic samples into malicious traffic structured data;

[0105] S22, obtaining a plurality of malicious traffic key features of the malicious traffic structured data, wherein the malicious traffic key features include at least one of a protocol type, a traffic duration, a packet count, a source and a destination port, and a source and a destination IP address;

[0106] S23, performing standardization processing on the multiple malicious traffic key features to obtain multiple malicious traffic numerical features, and combining the multiple malicious traffic numerical features into a malicious traffic feature vector;

[0107] S24, obtaining a dimension of a malicious traffic feature vector, and obtaining a random noise vector according to the dimension;

[0108] S25, concatenating the random noise vector and the malicious traffic feature vector to obtain a data training set;

[0109] S26, obtaining a generation speed and available memory of the generator, and determining an input sample batch according to the generation speed and available memory;

[0110] S27, dividing the data training set into a plurality of loading input samples according to the input sample batches;

[0111] S28. Input multiple loaded input samples into the generator in sequence to obtain an input sequence.

[0112] As described in the above steps S21-S28, the present invention converts a plurality of malicious traffic samples into malicious traffic structured data, wherein the malicious traffic structured data generally refers to network traffic data organized in a specific format and structure, and the data is used to identify and analyze potential network attacks or malicious activities, and obtains malicious traffic key features of the plurality of malicious traffic structured data, wherein the malicious traffic key features include at least one of the protocol type, traffic duration, packet count, source and destination ports, and source and destination IP addresses, performs standardization processing on the plurality of malicious traffic key features to obtain a plurality of malicious traffic numerical features, and combines the plurality of malicious traffic numerical features into a malicious traffic feature vector, by converting the malicious traffic samples into structured data. Data can ensure the consistency and comparability of data, which is convenient for subsequent analysis and processing. By extracting key features such as protocol type, traffic duration, and packet count, the model can focus on the most relevant information and enhance the ability to identify malicious traffic. Through standardization, the impact of different dimensions between features is eliminated, ensuring that the contribution of each feature to the result is balanced during model training, thereby improving the performance of the model. Combining multiple malicious traffic numerical features into feature vectors can form a richer feature representation and enhance the model's ability to learn complex traffic patterns. The detection of multiple key features can improve the accuracy of the model. Through the generation of structured data and feature vectors, limited malicious traffic samples can be better utilized to alleviate the impact of data imbalance. By obtaining the dimension of the malicious traffic feature vector and obtaining the random noise vector based on the dimension, the data training set is obtained by splicing the random noise vector and the malicious traffic feature vector. By adding random noise, not only the diversity of the data is increased, but also the model can be more adaptable to data fluctuations and noise in the real environment, thereby enhancing its robustness and being more resistant to disguised attacks. The spliced ​​data set increases the number of samples, especially when malicious traffic samples are scarce, helping to balance the ratio of positive and negative samples and improve the model training effect. By combining noise with feature vectors, new feature combinations can be created, so that the model can learn more potential patterns and improve detection capabilities. The spliced ​​data set has expanded the training samples to a certain extent. scale, so that the model can learn more comprehensively, thereby improving the overall performance. By obtaining the dimension of the feature vector to generate random noise, it is ensured that the generated training samples are consistent with the original data in dimension, which is conducive to the effective training of the model. The input sample batch is determined according to the generation speed of the generator and the available memory. The data training set is divided into multiple loaded input samples according to the input sample batch. The input sequence is obtained by inputting multiple loaded input samples into the generator in sequence. The input sample batch is adjusted according to the available memory to avoid memory overflow, improve the stability and efficiency of the system, and ensure the feasibility of processing large-scale data. By dividing the data set into multiple small batches, data can be loaded into the generator faster, reducing waiting time, thereby improving the overall data generation efficiency.Multiple loaded input samples can be processed sequentially in the generator, which improves the utilization rate of the model for samples during training and ensures that the model learns important features faster. By dividing the batches reasonably, it can ensure that different types of samples are balanced as much as possible in each batch, thereby improving the model's learning ability for rare categories and improving the impact of data imbalance. Loading and processing samples batch by batch makes the model training process more transparent, easy to analyze and debug, and improves the interpretability of the model.

[0113] In one embodiment, the step S3 of acquiring bidirectional output features according to the input sequence and acquiring a forged sample according to the bidirectional output features includes:

[0114] S31, inputting the input sequence into a bidirectional long short-term memory network model;

[0115] S32, gradually processing the input sequence from the starting time step to the ending time step of the input sequence through the forward part of the bidirectional long short-term memory network model to obtain a forward output feature;

[0116] S33, gradually processing the input sequence from the end time step to the start time step of the input sequence through the reverse part of the bidirectional long short-term memory network model to obtain reverse output features;

[0117] S34, connecting the reverse output feature and the forward output feature to obtain a bidirectional output feature;

[0118] S35. Input the bidirectional output feature into a generator to obtain a forged sample.

[0119] As described in the above steps S31-S35, the present invention inputs the input sequence into the bidirectional long short-term memory network model, and gradually processes the input sequence from the starting time step to the ending time step of the input sequence through the forward part of the bidirectional long short-term memory network model to obtain the forward output feature, and gradually processes the input sequence from the ending time step to the starting time step of the input sequence through the reverse part of the bidirectional long short-term memory network model to obtain the reverse output feature, and then connects the reverse output feature and the forward output feature to obtain the bidirectional output feature, and inputs the bidirectional output feature into the generator to obtain the forged sample. The bidirectional long short-term memory network (Bi-LSTM) model can simultaneously extract information from the forward and reverse directions of the sequence, capture richer contextual information in the time series, and more accurately identify and distinguish normal traffic from malicious traffic, thereby reducing the probability of false positives and false negatives. Because the attack pattern may have a complex dependency in time, by connecting the forward and reverse output features, the generated bidirectional output features can more comprehensively describe the input sequence, which helps to improve the model's learning ability for complex data patterns. By inputting the bidirectional output features into the generator, more forged samples can be generated, increasing the diversity of the data set.

[0120] In one embodiment, the step S4 of obtaining adversarial samples according to the forged samples and the normal traffic samples, and obtaining training data according to the adversarial samples includes:

[0121] S41, inputting the forged sample and the normal traffic sample into a discriminator to obtain a discriminant output value;

[0122] S42, determining whether the discrimination output value reaches a preset output value;

[0123] If the discriminant output value does not reach the preset output value, it is determined that the authenticity of the forged sample is low, and the binary cross entropy loss is used to obtain the generator loss;

[0124] The back-propagation algorithm is used to update the weight of the generator according to the generator loss until the discriminant output value output by the discriminator reaches the preset output value, and the forged sample at this time is marked as an adversarial sample;

[0125] If the discrimination output value reaches a preset output value, the authenticity of the forged sample is determined to be high, and the forged sample is marked as an adversarial sample;

[0126] S43, obtaining public flow data, and cleaning the public flow data to obtain standard flow data;

[0127] S44, appending and merging the adversarial sample to the end of the standard traffic data to obtain training data.

[0128] As described in the above steps S41-S44, the present invention obtains a discriminant output value by inputting a forged sample and a normal traffic sample into the discriminator, and judges whether the discriminant output value reaches a preset output value. If the discriminant output value does not reach the preset output value, it is judged that the authenticity of the forged sample is low. At this time, the binary cross entropy loss is used to obtain the generator loss, and the back propagation algorithm is used to update the weight of the generator according to the generator loss until the discriminant output value output by the discriminator reaches the preset output value, and the forged sample at this time is marked as an adversarial sample. If the discriminant output value reaches the preset output value, it is judged that the authenticity of the forged sample is high, and the forged sample is marked as an adversarial sample. The generator provides real-time feedback to continuously adjust the generator, helping the generator to continuously improve the quality of forged samples, so that the model is exposed to richer traffic features during training, thereby enhancing the ability to identify malicious traffic. Generating forged samples helps increase the number of samples of rare categories (such as specific types of malicious traffic). The authenticity of forged samples is marked by discriminating output values, so that the model can automatically adjust sample labels during training, reducing manual intervention and improving the degree of automation of training. The use of binary cross entropy loss function can effectively guide the optimization of the generator, making the generated forged samples closer to normal traffic in terms of features, thereby improving the accuracy of the discriminator. The forged samples generated by the generator are input into the discriminator to determine whether the forged samples are realistic enough, and adversarial samples are generated through multiple iterations to assist the discriminator in making judgments, so as to prevent the discriminator from being too powerful, causing the generator to be unable to obtain effective gradient information and thus fall into the local optimal problem. Through adversarial learning, the generator generates forged samples, and the discriminator tries to identify the forged samples. The two compete with each other to improve the quality of the samples generated by the generator, enhance the model's ability to detect network attacks, and make it more adaptable to complex network environments and diverse attack methods. By obtaining public traffic data and cleaning the public traffic data, the standard traffic is obtained. The adversarial samples are appended and merged at the end of the standard traffic data to obtain the training data. Since the public traffic data provides traffic samples in a real environment, it helps to generate more comprehensive training data and enhance the learning ability of the model. The adversarial samples are merged with the standard traffic data to enhance the feature representation ability of the data set, so that the model can better learn the subtle differences between normal traffic and malicious traffic. Since the training data contains both normal traffic and malicious traffic samples, the discrimination ability of the model is improved, thereby reducing the occurrence of false positives and false negatives. By cleaning the public traffic data, the quality of the training data is ensured, and the learning efficiency and effect of the model are improved.

[0129] In one embodiment, the step S6 of acquiring multiple time series features and local spatial features of the training data and constructing a detection classification model based on the multiple time series features, local spatial features and key local features includes:

[0130] S61, obtaining first feature information of the training data, wherein the first feature information includes process noise, observation noise, multiple state vectors, multiple observation values, and multiple time series data;

[0131] S62, obtaining multiple time series features according to the process noise, the observation noise, the multiple state vectors, the multiple observation values ​​and the multiple time series data;

[0132] S63, dividing the training data into a plurality of time windows according to a preset time length, and extracting second feature information of each of the time windows, wherein the second feature information includes a plurality of average flow rates, fluctuation degrees, maximum values, and minimum values;

[0133] S64, aggregating multiple average flows, fluctuation degrees, maximum values, and minimum values ​​of multiple time windows to obtain multiple local spatial features;

[0134] S65, dividing the multiple time series features, local spatial features and key local features into a training set and a validation set according to a preset ratio;

[0135] S66: construct a preset detection classification model according to the time series features, local spatial features and key local features, wherein the preset detection classification model is:

[0136] ;

[0137] Among them, P(G) represents the evaluation value, α represents the first model parameter, a represents the time series weight, S(T) represents the time series feature, b represents the local spatial weight, J(T) represents the local spatial feature, c represents the key local weight, and G(T) represents the key local feature;

[0138] S67, sequentially inputting multiple time series features, local spatial features, and key local features in the training set into a preset detection classification model for training, and performing verification based on multiple time series features, local spatial features, and key local features in the verification set to obtain multiple prediction training results;

[0139] S68, adjusting the model parameters of the preset detection classification model according to the plurality of prediction training results to obtain a detection classification model, wherein the detection classification model is:

[0140] ;

[0141] Among them, Z(P) represents the confidence detection score, β represents the second model parameter, a represents the time series weight, S(T) represents the time series feature, b represents the local spatial weight, J(T) represents the local spatial feature, c represents the key local weight, and G(T) represents the key local feature.

[0142] As described in the above steps S61-S68, the present invention obtains first feature information of training data, wherein the first feature information includes process noise, observation noise, multiple state vectors, multiple observation values ​​and multiple time series data, and then obtains multiple time series features based on the process noise, observation noise, multiple state vectors, multiple observation values ​​and multiple time series data. In this way, multiple information such as process noise and observation noise are considered at the same time, providing a more comprehensive feature representation, so that the model can better distinguish normal traffic from malicious traffic. By considering the noise factor, the model is more robust in the face of uncertainty, and the adaptability to complex traffic in the real environment is improved. Extracting time series features can help identify traffic patterns and trends, and help detect long-term latent Attack behavior, diversified feature extraction methods can improve the learning effect of a few types of malicious traffic and alleviate the problem of data imbalance. Through the combination of multiple state vectors and observations, the model can more accurately capture traffic characteristics and improve the detection accuracy of malicious traffic. The training data is divided into multiple time windows according to a preset time length, and the second feature information of each time window is extracted, where the time window refers to a fixed time period selected for analysis or feature extraction when processing time series data. The second feature information includes multiple average flows, fluctuations, maximum values ​​and minimum values. Multiple average flows, fluctuations, maximum values ​​and minimum values ​​of multiple time windows are aggregated to obtain multiple local spatial features. By dividing the data into time windows The model can capture the temporal dynamic characteristics of traffic, identify traffic change trends and abnormal behaviors, and extract information such as average traffic, fluctuation degree, maximum and minimum values, etc., which provide multi-dimensional features to help the model analyze traffic from multiple angles. By aggregating the features of different time windows, the recognition ability of malicious traffic can be enhanced, especially in the case of data imbalance, which can improve the detection effect of minority samples. The introduction of fluctuation degree helps to identify potential attack patterns and abnormal traffic, and enhance the robustness of the model in the face of noise and disguised attacks. By aggregating multiple time windows, the model can capture local traffic characteristics and identify complex attack behaviors that may not be detected by a single feature. The division of time windows is suitable for real-time traffic monitoring and can be timely. Update features and feed them back to the model to ensure the timeliness and accuracy of detection. Divide multiple time series features, local space features and key local features into training sets and validation sets according to preset proportions. Construct a preset detection and classification model based on time series features, local space features and key local features. Input multiple time series features, local space features and key local features in the training set into the preset detection and classification model for training in turn. Verify based on multiple time series features, local space features and key local features in the validation set to obtain multiple prediction training results. Adjust model parameters of the preset detection and classification model based on multiple prediction training results to obtain a detection and classification model. By considering time series, local space and key features at the same time,It can capture the complexity of traffic more comprehensively, improve the model's ability to understand and identify diverse traffic patterns, and multi-dimensional features can more effectively distinguish normal traffic from malicious traffic, reducing false positive and false negative rates in complex environments. Especially when facing encrypted traffic, through the feedback of the verification set results, it can timely adjust the model parameters, optimize the model performance, ensure adaptability and stability under different conditions, and make it more effective and reliable when facing complex and changing network environments.

[0143] In one embodiment, the step S62 of acquiring multiple time series features according to the process noise, the observation noise, the multiple state vectors, the multiple observation values ​​and the multiple time series data includes:

[0144] S621, obtaining a state transfer matrix according to a plurality of the time series features;

[0145] S622, obtaining an observation matrix according to the mapping of each state vector to the corresponding observation value;

[0146] S623, calculating the corresponding prediction covariance according to the process noise, the state transfer matrix and each state vector, wherein the calculation formula is:

[0147] ;

[0148] Among them, Y(X) represents the prediction covariance, Z(J) represents the state transfer matrix, Z(X) represents the state covariance, and G(Z) represents the process noise;

[0149] S624, obtaining a corresponding Kalman gain according to the observation noise and each prediction covariance;

[0150] S625, obtaining a predicted state vector according to the state covariance and the state transfer matrix;

[0151] S626. Calculate the corresponding time series characteristics according to the predicted state vector, the observation matrix, each observation value and each Kalman gain, wherein the calculation formula is:

[0152] ;

[0153] Among them, S(T) represents the time series characteristics, Y(Z) represents the predicted state vector, K(Z) represents the Kalman gain, G(Z) represents the observation matrix, and G(C) represents the observation value.

[0154] As described in the above steps S621-S626, the present invention obtains a state transfer matrix through multiple time series features, wherein the state transfer matrix is ​​a mathematical tool that describes the evolution of the system state over time. In Kalman filtering, it is used to convert the state vector of the previous time point into the state vector of the current time point. The observation matrix is ​​obtained according to the mapping of each state vector to the corresponding observation value, wherein the observation matrix is ​​also called the output matrix, which is used to map the state vector of the system to the observation value. In Kalman filtering, it indicates how to generate the observation value through the state vector. The corresponding prediction covariance is calculated according to the process noise, the state transfer matrix and each state vector. By establishing the state transfer matrix, the change of flow over time can be dynamically captured, and the evolution of flow pattern can be identified. Changes can help to detect potential abnormal behaviors in a timely manner. By mapping multiple time series features, a more comprehensive observation matrix can be obtained, which helps the model understand and analyze traffic data from different angles and improve the accuracy of detection. Introducing process noise into the model can help improve the adaptability to environmental changes and data uncertainty, thereby maintaining higher robustness in the face of complex attacks. By calculating the predicted covariance, the model's confidence in future states can be evaluated and the detection sensitivity of malicious traffic can be improved, especially when the traffic pattern changes greatly. This method can better adapt to a variety of encryption protocols and use the combination of state transitions and observation matrices to identify abnormal patterns in encrypted traffic. By clarifying the relationship between state vectors and observations, it can be more Better understand the decision-making process of the model, improve the interpretability of the model, obtain the corresponding Kalman gain according to the observation noise and each prediction covariance, obtain the predicted state vector according to the state covariance and the state transfer matrix, and dynamically calculate the Kalman gain through the observation noise and the prediction covariance. Among them, the Kalman gain is a dynamically calculated weight used to balance the weight between the predicted value and the observed value in the Kalman filter. The Kalman gain determines the degree of influence of the observed value on the final estimate when updating the state estimate. It can adaptively adjust the model's response to new observation data and enhance its adaptability to a changing environment. Using the state covariance and state transfer matrix, it can more accurately predict future states, which helps to improve the detection accuracy of malicious traffic, especially in the face of encrypted When the traffic is detected, since the observation noise is taken into account, the Kalman filter is used to reduce the impact of noise on the detection results and enhance the robustness of the model. By predicting the multi-dimensional state vector and combining the data with different characteristics, the characteristics of the traffic can be captured more comprehensively, and the recognition ability of complex attack patterns can be improved. The corresponding time series characteristics are calculated according to the predicted state vector, the observation matrix, each observation value and each Kalman gain. The present invention can extract rich time series characteristics from multiple sources (predicted state, observation matrix, etc.), so that the model can understand the traffic data more comprehensively and improve the accuracy of malicious traffic detection. By calculating the Kalman gain, the response of the model to the new observation data can be dynamically adjusted, so that the model can remain efficient and accurate in a changing network environment.This method effectively handles observation noise and can improve the robustness of the model, thereby maintaining a high detection effect in the face of complex and disguised attacks. By integrating multiple time series features, it can alleviate the problem of data imbalance, allowing the model to better capture the characteristics of minority classes during training and improve the ability to identify malicious traffic. By combining the predicted state vector and the actual observation value, the output of the model can be better calibrated, making the detection results more accurate and reliable. The combination of the predicted state vector, the observation matrix and the Kalman gain to calculate the time series features can not only improve the accuracy and robustness of encrypted malicious traffic detection, but also provide a more comprehensive and effective solution when facing complex and dynamic network environments. ,

[0155] The present application also provides a detection system for encrypted malicious traffic, including:

[0156] An extraction module, used to obtain a random noise vector and a network data set, and extract a plurality of malicious traffic samples and normal traffic samples from the network data set;

[0157] A first input module, used for combining a plurality of the malicious traffic samples with a random noise vector to obtain a data training set, and inputting the data training set into a generator to obtain an input sequence;

[0158] A first acquisition module, configured to acquire a bidirectional output feature according to the input sequence, and acquire a forged sample according to the bidirectional output feature;

[0159] A second acquisition module, used to acquire adversarial samples according to the forged samples and the normal traffic samples, and to acquire training data according to the adversarial samples;

[0160] A third acquisition module is used to acquire global context information of the training data, and acquire a plurality of key local features according to the global context information;

[0161] A construction module, used to obtain multiple time series features and local spatial features of the training data, and to construct a detection classification model based on the multiple time series features, local spatial features and key local features;

[0162] A second input module is used to obtain real-time traffic and input the real-time traffic into the detection classification model to obtain a confidence detection score;

[0163] A judgment module, used to judge whether the confidence detection score is greater than a preset threshold;

[0164] If the confidence detection score is greater than a preset threshold, the real-time traffic is determined to be malicious traffic;

[0165] If the confidence detection score is not greater than a preset threshold, the real-time traffic is determined to be normal traffic.

[0166] In one embodiment, the first input module includes:

[0167] A conversion unit, used to obtain a plurality of malicious traffic samples and convert the plurality of malicious traffic samples into malicious traffic structured data;

[0168] A first acquisition unit, configured to acquire a plurality of malicious traffic key features of the malicious traffic structured data, wherein the malicious traffic key features include at least one of a protocol type, a traffic duration, a packet count, a source and a destination port, and a source and a destination IP address;

[0169] A combining unit, configured to perform standardization processing on a plurality of malicious traffic key features to obtain a plurality of malicious traffic numerical features, and combine the plurality of malicious traffic numerical features into a malicious traffic feature vector;

[0170] A second acquisition unit, used to acquire a dimension of a malicious traffic feature vector, and acquire a random noise vector according to the dimension;

[0171] A concatenation unit, used for concatenating the random noise vector and the malicious traffic feature vector to obtain a data training set;

[0172] A determination unit, used to obtain a generation speed and available memory of the generator, and determine an input sample batch according to the generation speed and available memory;

[0173] A separation unit, used for dividing the data training set into a plurality of loading input samples according to the input sample batches;

[0174] The input unit is used to input multiple loaded input samples into the generator in sequence to obtain an input sequence.

[0175] The present invention also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above-mentioned method for detecting encrypted malicious traffic when executing the computer program.

[0176] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned method for detecting encrypted malicious traffic are implemented.

[0177] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media provided in this application and used in the embodiments may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0178] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, device, article or method including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, device, article or method. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the presence of other identical elements in the process, device, article or method including the element.

[0179] The above description is only a preferred embodiment of the present invention, and does not limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made by using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for detecting encrypted malicious traffic, characterized in that: include: Obtaining a random noise vector and a network data set, and extracting a plurality of malicious traffic samples and normal traffic samples from the network data set; Combining a plurality of the malicious traffic samples with a random noise vector to obtain a data training set, and inputting the data training set into a generator to obtain an input sequence; Inputting the input sequence into a bidirectional long short-term memory network model; The forward part of the bidirectional long short-term memory network model gradually processes the input sequence from the starting time step to the ending time step of the input sequence to obtain the forward output feature; The reverse part of the bidirectional long short-term memory network model processes the input sequence step by step from the end time step to the start time step of the input sequence to obtain the reverse output features; Connecting the reverse output feature and the forward output feature to obtain a bidirectional output feature; Inputting the bidirectional output feature into a generator to obtain a forged sample; Obtaining adversarial samples according to the forged samples and the normal traffic samples, and obtaining training data according to the adversarial samples; Acquire global context information of the training data, and acquire a plurality of key local features according to the global context information; Acquire multiple time series features and local spatial features of the training data, and construct a detection classification model based on the multiple time series features, local spatial features and key local features; Acquire real-time traffic, and input the real-time traffic into a detection classification model to obtain a confidence detection score; Determining whether the confidence detection score is greater than a preset threshold; If the confidence detection score is greater than a preset threshold, the real-time traffic is determined to be malicious traffic; If the confidence detection score is not greater than a preset threshold, the real-time traffic is determined to be normal traffic.

2. The method for detecting encrypted malicious traffic according to claim 1, characterized in that: The step of combining the plurality of malicious traffic samples with a random noise vector to obtain a data training set, and inputting the data training set into a generator to obtain an input sequence comprises: Acquire multiple malicious traffic samples, and convert the multiple malicious traffic samples into malicious traffic structured data; Acquire malicious traffic key features of a plurality of the malicious traffic structured data, wherein the malicious traffic key features include at least one of a protocol type, a traffic duration, a packet count, a source and a destination port, and a source and a destination IP address; Standardizing the plurality of malicious traffic key features to obtain a plurality of malicious traffic numerical features, and combining the plurality of malicious traffic numerical features into a malicious traffic feature vector; Obtaining a dimension of a malicious traffic feature vector, and obtaining a random noise vector according to the dimension; The random noise vector and the malicious traffic feature vector are concatenated to obtain a data training set; Obtaining a generation speed and available memory of the generator, and determining an input sample batch according to the generation speed and available memory; Dividing the data training set into a plurality of loading input samples according to the input sample batches; Input multiple loading input samples into the generator in sequence to obtain an input sequence.

3. The method for detecting encrypted malicious traffic according to claim 1, characterized in that: The step of obtaining adversarial samples according to the forged samples and the normal traffic samples, and obtaining training data according to the adversarial samples includes: Inputting the forged sample and the normal traffic sample into the discriminator to obtain a discriminant output value; Determining whether the discrimination output value reaches a preset output value; If the discriminant output value does not reach the preset output value, it is determined that the authenticity of the forged sample is low, and the binary cross entropy loss is used to obtain the generator loss; The back-propagation algorithm is used to update the weight of the generator according to the generator loss until the discriminant output value output by the discriminator reaches the preset output value, and the forged sample at this time is marked as an adversarial sample; If the discrimination output value reaches a preset output value, the authenticity of the forged sample is determined to be high, and the forged sample is marked as an adversarial sample; Obtaining public traffic data, and cleaning the public traffic data to obtain standard traffic data; The adversarial sample is appended and merged at the end of the standard traffic data to obtain training data.

4. The method for detecting encrypted malicious traffic according to claim 1, characterized in that: The step of obtaining a plurality of time series features and local spatial features of the training data, and constructing a detection classification model according to the plurality of time series features, local spatial features and key local features, comprises: Acquire first feature information of the training data, wherein the first feature information includes process noise, observation noise, multiple state vectors, multiple observation values, and multiple time series data; Acquire multiple time series features according to the process noise, observation noise, multiple state vectors, multiple observation values ​​and multiple time series data; Dividing the training data into a plurality of time windows according to a preset time length, and extracting second feature information of each of the time windows, wherein the second feature information includes a plurality of average flow rates, fluctuation degrees, maximum values, and minimum values; Aggregate multiple average flows, fluctuations, maximums and minimums of multiple time windows to obtain multiple local spatial features; Dividing the plurality of time series features, local spatial features and key local features into a training set and a validation set according to a preset ratio; A preset detection classification model is constructed according to the time series features, local spatial features and key local features, wherein the preset detection classification model is: ； Among them, P(G) represents the evaluation value, α represents the first model parameter, a represents the time series weight, S(T) represents the time series feature, b represents the local spatial weight, J(T) represents the local spatial feature, c represents the key local weight, and G(T) represents the key local feature; Multiple time series features, local spatial features, and key local features in the training set are sequentially input into a preset detection classification model for training, and are verified based on multiple time series features, local spatial features, and key local features in the verification set to obtain multiple prediction training results; The model parameters of the preset detection classification model are adjusted according to the multiple prediction training results to obtain the detection classification model, wherein the detection classification model is: ； Among them, Z(P) represents the confidence detection score, β represents the second model parameter, a represents the time series weight, S(T) represents the time series feature, b represents the local spatial weight, J(T) represents the local spatial feature, c represents the key local weight, and G(T) represents the key local feature.

5. The method for detecting encrypted malicious traffic according to claim 4, characterized in that: The step of obtaining multiple time series features according to the process noise, observation noise, multiple state vectors, multiple observation values ​​and multiple time series data includes: Acquire a state transfer matrix according to the multiple time series features; Obtaining an observation matrix according to the mapping of each state vector to the corresponding observation value; The corresponding prediction covariance is calculated according to the process noise, the state transfer matrix and each state vector, wherein the calculation formula is: ； Among them, Y(X) represents the prediction covariance, Z(J) represents the state transfer matrix, Z(X) represents the state covariance, and G(Z) represents the process noise; Obtaining a corresponding Kalman gain according to the observation noise and each prediction covariance; Acquire a predicted state vector according to the state covariance and the state transfer matrix; The corresponding time series features are calculated according to the predicted state vector, the observation matrix, each observation value and each Kalman gain, wherein the calculation formula is: ； Among them, S(T) represents the time series characteristics, Y(Z) represents the predicted state vector, K(Z) represents the Kalman gain, G(Z) represents the observation matrix, and G(C) represents the observation value.

6. A system for detecting encrypted malicious traffic, characterized in that: include: An extraction module, used to obtain a random noise vector and a network data set, and extract a plurality of malicious traffic samples and normal traffic samples from the network data set; A first input module, used for combining a plurality of the malicious traffic samples with a random noise vector to obtain a data training set, and inputting the data training set into a generator to obtain an input sequence; The first acquisition module is used to obtain a bidirectional output feature according to the input sequence, and to obtain a forged sample according to the bidirectional output feature, specifically: input the input sequence into a bidirectional long short-term memory network model; process the input sequence step by step from the start time step to the end time step of the input sequence through the forward part of the bidirectional long short-term memory network model to obtain a forward output feature; process the input sequence step by step from the end time step to the start time step of the input sequence through the reverse part of the bidirectional long short-term memory network model to obtain a reverse output feature; connect the reverse output feature and the forward output feature to obtain a bidirectional output feature; input the bidirectional output feature into a generator to obtain a forged sample; A second acquisition module, used to acquire adversarial samples according to the forged samples and the normal traffic samples, and to acquire training data according to the adversarial samples; A third acquisition module is used to acquire global context information of the training data, and acquire a plurality of key local features according to the global context information; A construction module, used to obtain multiple time series features and local spatial features of the training data, and to construct a detection classification model based on the multiple time series features, local spatial features and key local features; A second input module is used to obtain real-time traffic and input the real-time traffic into the detection classification model to obtain a confidence detection score; A judgment module, used to judge whether the confidence detection score is greater than a preset threshold; If the confidence detection score is greater than a preset threshold, the real-time traffic is determined to be malicious traffic; If the confidence detection score is not greater than a preset threshold, the real-time traffic is determined to be normal traffic.

7. The system for detecting encrypted malicious traffic according to claim 6, characterized in that: The first input module comprises: A conversion unit, used to obtain a plurality of malicious traffic samples and convert the plurality of malicious traffic samples into malicious traffic structured data; A first acquisition unit, configured to acquire a plurality of malicious traffic key features of the malicious traffic structured data, wherein the malicious traffic key features include at least one of a protocol type, a traffic duration, a packet count, a source and a destination port, and a source and a destination IP address; A combining unit, configured to perform standardization processing on a plurality of malicious traffic key features to obtain a plurality of malicious traffic numerical features, and combine the plurality of malicious traffic numerical features into a malicious traffic feature vector; A second acquisition unit, used to acquire a dimension of a malicious traffic feature vector, and acquire a random noise vector according to the dimension; A concatenation unit, used for concatenating the random noise vector and the malicious traffic feature vector to obtain a data training set; A determination unit, used to obtain a generation speed and available memory of the generator, and determine an input sample batch according to the generation speed and available memory; A separation unit, used for dividing the data training set into a plurality of loading input samples according to the input sample batches; The input unit is used to input multiple loaded input samples into the generator in sequence to obtain an input sequence.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images