A method for Internet traffic classification and identification based on weakly supervised learning

Abstract

The present invention discloses an Internet traffic classification and identification method based on weakly supervised learning. The method constructs a deterministic finite state machine containing multiple protocol application load characteristics, then matches the deterministic finite state machine with Internet traffic, regards Internet traffic that successfully matches the deterministic finite state machine as known traffic and adds corresponding application type labels, and regards Internet traffic that fails to successfully match the deterministic finite state machine as unknown traffic, thereby performing an Internet traffic automatic labeling method based on application load matching. The method of the present invention can quickly realize the identification and classification of Internet traffic types in an Internet environment with a large number of unknown traffic by constructing an efficient weakly supervised traffic classification model.

Description

Technical Field

[0001] The present invention relates to the field of cyberspace security technology, and in particular to an Internet traffic classification and identification method based on weakly supervised learning. Background Art

[0002] With the continuous popularization and development of computer networks, tens of millions of users access the Internet every moment and generate massive network data. Massive network data carries rich network status information and user behavior information, which is of great significance for monitoring network operation status, improving network operation and maintenance management, understanding user behavior, and mining user intentions. The real-time flow and interaction in the network link is binary code that is difficult for people to understand, so it is very important to collect it with high performance and parse it into more easily understandable structured data. At the same time, the collected network data has the characteristics of large quantity, complex types, and low value density. Only by rationally using relevant technologies in the field of big data to efficiently process and analyze it can the value behind it be mined. Network traffic monitoring used to be just the operation and maintenance work of the IT department, but now it has become a common concern of multiple departments such as operation and maintenance, security, and business audit. Whether it is network troubleshooting, cloud network alarms, or network diagnosis based on business perspectives, it is necessary to collect and analyze the entire network traffic. The demand for network traffic collection capabilities has also transformed and improved from the current traditional full-flow collection capabilities to the full-flow collection capabilities of ultra-large-scale network traffic.

[0003] In terms of traffic classification and identification, traditional supervised learning and unsupervised learning traffic classification and identification methods are difficult to apply to high-speed network traffic environments. Internet traffic classification and identification methods based on weakly supervised learning aim to train models using data sets with only flow-level annotations to achieve traffic classification. Currently, the mainstream two-stage weakly supervised target detection algorithms only select the category with the highest score in a single category as a pseudo-label for each flow in the training set to train the fully supervised network. Therefore, these methods will lose a lot of information in complex cross-border Internet traffic classification scenarios. In addition, these methods focus on how to make the classification accuracy of the first-stage output higher and assume that the pseudo-labels generated in the first stage are completely accurate. However, due to the inherent defects of weakly supervised classifiers, the classification results are generally inaccurate. Taking these classification results as true values ​​and training the fully supervised detector in the second stage will largely mislead the training of the fully supervised model, and a large number of pseudo-labels can only cover the most obvious attributes. Therefore, by optimizing and improving weakly supervised learning, the identification of unknown traffic in the Internet can be effectively achieved. Summary of the invention

[0004] In order to solve the problems existing in the prior art, the present invention proposes an Internet traffic classification and identification method based on weakly supervised learning.

[0005] The technical solution of the present invention is as follows:

[0006] A method for classifying and identifying Internet traffic based on weakly supervised learning, comprising:

[0007] Step 1) constructing a deterministic finite state machine containing multiple protocol application load characteristics, and then matching the deterministic finite state machine with Internet traffic, treating the Internet traffic that successfully matches the deterministic finite state machine as known traffic and adding corresponding application type tags, and treating the Internet traffic that fails to successfully match the deterministic finite state machine as unknown traffic;

[0008] Step 2) Extract typical features from known traffic and unknown traffic, and then calculate the cosine similarity value between the unknown traffic and the known traffic based on the extracted typical features. Based on the maximum cosine similarity value corresponding to the unknown traffic, obtain the application type label corresponding to the unknown traffic, and then compare the maximum cosine similarity value corresponding to the unknown traffic with the similarity threshold. If the maximum cosine similarity value exceeds the similarity threshold, add a strong label to the unknown traffic; otherwise, add a weak label.

[0009] Step 3) Substitute the weights of strong labels and weak labels into the residual neural network model, use the classified historical sample traffic to classify and calculate the overall loss, and use the softmax function to normalize the overall loss to obtain the optimal weights of strong labels and weak labels;

[0010] Step 4) Substitute the optimal weights of strong labels and weak labels into the residual neural network model, and use the residual neural network model to realize the classification and identification of Internet traffic.

[0011] Furthermore, the specific method of step 1) includes:

[0012] Step 1-1) construct a deterministic finite state machine containing multiple protocol application load characteristics based on known Internet protocols, and then use the deterministic finite state machine to perform matching analysis on Internet traffic;

[0013] Step 1-2) If the application payload of a certain flow in the Internet traffic successfully matches the deterministic finite state machine, the flow is marked as the corresponding protocol and treated as known traffic; otherwise, the flow is treated as unknown traffic;

[0014] Steps 1-3) Internet traffic forms two data sets, the first of which is a labeled data set , the second data set is an unlabeled data set ,in M and N are the data volumes of labeled and unlabeled datasets, respectively. and They represent the i-th known flow in the labeled dataset and its corresponding application type label, represents the jth unclassified stream in the unlabeled dataset.

[0015] Furthermore, the specific method of step 2) includes:

[0016] Step 2-1) Extract the labeled data set and unlabeled datasets The features of each stream in construct feature vectors, thereby forming a set of labeled feature vectors and the set of unlabeled feature vectors ; In the formula, K is the number of features, Respectively represent the known flows in the labeled dataset The corresponding eigenvalues ​​are Respectively represent the unclassified flows in the unlabeled dataset The corresponding eigenvalues;

[0017] Step 2-2) Read the unclassified stream one by one from the unlabeled feature vector set , and calculate the cosine similarity value between it and each known flow in the labeled feature vector set. The calculation formula is as follows:

[0018] ;

[0019] In the formula, Indicates unclassified traffic With known flow The similarity between them has a maximum value of 1 and a minimum value of 0;

[0020] Step 2-3) Set the similarity threshold , from all the cosine similarity calculation results, select the label corresponding to the largest cosine similarity value , if the cosine similarity value Exceeding the similarity threshold , then the unclassified flow Add strong tags Otherwise, add a weak label , and form a strong label dataset and weakly labeled datasets , where P and Q are the data volumes of the strong label dataset and the weak label dataset respectively; is the i-th data stream in the strong label dataset; for The corresponding application type label; is the i-th data stream in the weakly labeled dataset; for The corresponding application type label.

[0021] Furthermore, the labeled dataset and unlabeled datasets The characteristics of each flow include duration, number of forward / reverse packets, total size of forward / reverse packets, maximum size of forward / reverse packets, minimum size of forward / reverse packets, average size of forward / reverse packets and standard deviation size of forward / reverse packets.

[0022] Furthermore, the specific method of step 3) includes:

[0023] Step 3-1) Use the distribution alignment method to align the weakly labeled dataset Perform exponential moving average calculation to convert weak labels into corresponding strong labels. After the above conversion, the similarity value of some elements in the weak label data set will exceed , and thus transferred to the strong label data set; the calculation formula for the exponential moving average calculation is as follows:

[0024] ;

[0025] In the formula, A function that generates a strong label based on the maximum value of the predicted probability value;

[0026] Step 3-2) Set the weights of strong labels and weak labels to and , using the residual neural network model, the traffic samples are classified and the overall loss is calculated. The specific calculation formula is as follows: ;

[0027] In the formula, and Represent the results of model classification in strong label and weak label datasets respectively, and Represent the actual results of the data in the strong label and weak label datasets, respectively. represents the standard cross entropy loss;

[0028] Step 3-3) Use the softmax function to normalize the overall loss to obtain the optimal weights of strong and weak labels.

[0029] Furthermore, the specific steps of step 4) include: The characteristic values ​​corresponding to the flows in are taken as input and then substituted into the residual neural network model to obtain the final Internet traffic classification and recognition results.

[0030] Compared with the prior art, the present invention has the following beneficial effects:

[0031] The present invention proposes an Internet traffic classification and identification method based on weakly supervised learning. The method of the present invention can quickly realize the identification and classification of Internet traffic types in an Internet environment with a large amount of unknown traffic by constructing an efficient weakly supervised traffic classification model. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 A flow chart of an Internet traffic classification and identification method based on weakly supervised learning provided by the present invention. DETAILED DESCRIPTION

[0033] The present invention is further explained below in conjunction with the accompanying drawings and specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and are not used to limit the scope of the present invention. After reading the present invention, various equivalent modifications of the present invention by those skilled in the art all fall within the scope defined by the claims attached to this application.

[0034] Example:

[0035] The present invention provides an Internet traffic classification and identification method based on weakly supervised learning, comprising:

[0036] Step 1) Using an automatic Internet traffic marking method based on application load matching to mark Internet traffic with a reference type label, specifically, constructing a deterministic finite state machine containing multiple protocol application load characteristics, and then matching the deterministic finite state machine with Internet traffic, treating Internet traffic that successfully matches the deterministic finite state machine as known traffic and adding a corresponding application type label, and treating other Internet traffic that fails to successfully match the deterministic finite state machine as unknown traffic, thereby achieving application type marking of known traffic;

[0037] The method for constructing the above-mentioned deterministic finite state machine includes: establishing a deterministic finite state machine by preprocessing the currently known Internet protocol payload characteristic character string.

[0038] Step 2) extract typical features from known traffic and unknown traffic, and then calculate the cosine similarity value between the unknown traffic and each known traffic one by one based on the extracted typical features, and obtain the application type label of the known traffic corresponding to the unknown traffic based on the maximum cosine similarity value corresponding to the unknown traffic (the application type label corresponding to the unknown traffic is the application type label of the known traffic corresponding to the unknown traffic), and then compare the maximum cosine similarity value corresponding to the unknown traffic with the similarity threshold. If the maximum cosine similarity value exceeds the similarity threshold, a strong label is added to the unknown traffic; otherwise, a weak label is added;

[0039] Step 3) Substitute the weights of strong labels and weak labels into the residual neural network model, use the classified historical sample traffic to classify and calculate the overall loss, and use the softmax function to normalize the overall loss to obtain the optimal weights of strong labels and weak labels;

[0040] Step 4) Substitute the optimal weights of strong labels and weak labels into the residual neural network model, and use the residual neural network model to realize the classification and identification of Internet traffic.

[0041] Furthermore, the specific method of step 1) includes:

[0042] Step 1-1) construct a deterministic finite state machine containing multiple protocol application load characteristics based on known Internet protocols, and then use the deterministic finite state machine to perform matching analysis on Internet traffic;

[0043] Step 1-2) If the application payload of a certain flow in the Internet traffic successfully matches the deterministic finite state machine, the flow is marked as the corresponding protocol and treated as known traffic; otherwise, the flow is treated as unknown traffic;

[0044] Steps 1-3) Through the above automatic labeling method, Internet traffic forms two data sets, of which the first data set is a labeled data set , the second data set is an unlabeled data set ,in M and N are the data volumes of labeled and unlabeled datasets, respectively. and They represent the i-th flow in the labeled dataset and its corresponding application type label, represents the jth stream in the unlabeled dataset.

[0045] Furthermore, the specific method of step 2) includes:

[0046] Step 2-1) Extract the labeled data set and unlabeled datasets The features of each stream in construct feature vectors, thereby forming a set of labeled feature vectors and the set of unlabeled feature vectors ; Where K is the number of features, Respectively represent the known flows in the labeled dataset The corresponding eigenvalues ​​are Respectively represent the unclassified flows in the unlabeled dataset The corresponding eigenvalues;

[0047] Step 2-2) Read the unclassified stream one by one from the unlabeled feature vector set , and calculate the cosine similarity value between it and each known flow in the labeled feature vector set. The calculation formula is as follows: ;

[0048] In the formula, Indicates unclassified traffic With known flow The similarity between them has a maximum value of 1 and a minimum value of 0;

[0049] Step 2-3) Set the similarity threshold , from all the cosine similarity calculation results, select the label corresponding to the largest cosine similarity value , if the cosine similarity value Exceeding the similarity threshold , then the unclassified flow Add strong tags Otherwise, add a weak label , and form a strong label dataset and weakly labeled datasets , where P and Q are the data volumes of the strong signature dataset and the weak label dataset respectively; is the i-th data stream in the strong label dataset; for The corresponding application type label; is the i-th data stream in the weakly labeled dataset; for The corresponding application type label. In this example, the similarity threshold The default setting is 0.8.

[0050] Furthermore, the labeled dataset and unlabeled datasets The characteristics of each flow include duration, number of forward / reverse packets, total size of forward / reverse packets, maximum size of forward / reverse packets, minimum size of forward / reverse packets, average size of forward / reverse packets and standard deviation size of forward / reverse packets.

[0051] Furthermore, the specific method of step 3) includes:

[0052] Step 3-1) Use the distribution alignment method to align the weakly labeled dataset Perform exponential moving average calculation to convert weak labels into corresponding strong labels. After the above conversion, the similarity value of some elements in the weak label data set will exceed , and thus transferred to the strong label data set; the calculation formula for the exponential moving average calculation is as follows: ;

[0053] In the formula, A function that generates a strong label based on the maximum value of the predicted probability value;

[0054] Step 3-2) Set the weights of strong labels and weak labels to and , using the residual neural network model, the traffic samples are classified and the overall loss is calculated. The specific calculation formula is as follows: ;

[0055] In the formula, and Represent the results of model classification in strong label and weak label datasets respectively, and Represent the actual results of the data in the strong label and weak label datasets, respectively. Represents the standard cross entropy loss; Step 3-3) uses the softmax function to standardize the overall loss, that is, , thus obtaining the optimal weights of strong and weak labels.

[0056] Furthermore, the specific steps of step 4) include: The characteristic values ​​corresponding to the flows in are taken as input and then substituted into the residual neural network model to obtain the final Internet traffic classification and recognition results.

[0057] This example simulates the implementation of the Internet traffic classification and identification method based on weakly supervised learning of the present invention on certain Internet traffic data. The operating environment of this example is a PC with an Intel-Windows architecture, a PC with a Core eight-core CPU with a hardware main frequency of 2.5GHz or above, a memory ≥8GB, a hard disk of 500GB, and runs the Windows 10 operating system.

[0058] like Figure 1 As shown, it starts from step S101, constructs a deterministic finite state machine including multiple protocol application load characteristics, and then goes to step S102;

[0059] In step S102, a deterministic finite state machine is used to perform matching analysis on Internet traffic to obtain a labeled data set and an unlabeled data set, and then the process goes to step S103;

[0060] In step S103, the feature vector of each stream in the labeled data set is extracted, and then the process goes to step S104;

[0061] In step S104, unclassified flows are read one by one from the unlabeled feature vector set, and the cosine similarity between the unclassified flows and the flows in the labeled feature vector set is calculated, and then the process goes to step S105;

[0062] In step S105, the label corresponding to the largest value is selected, and it is determined whether the similarity value exceeds the threshold. If so, the process goes to step S106, otherwise, the process goes to step S107;

[0063] In step S106, a strong label is added to the unclassified flow, and then the process goes to step S109;

[0064] In step S107, a weak label is added to the unclassified flow, and then the process goes to step S108;

[0065] In step S108, using the distribution alignment method, exponential moving average calculation is performed on the weak label data set to convert some weak labels into corresponding strong labels, and then go to step S109;

[0066] In step S109, the traffic samples are classified and the overall loss is calculated, and then the process goes to step S110;

[0067] In step S110, the overall loss is normalized using the softmax function to obtain the optimal weight values ​​of the strong labels and the weak labels, and then the process goes to step S111;

[0068] In step S111, the residual neural network model is trained using the above results to obtain a trained model, and then the process goes to step S112;

[0069] In step S112, the flow feature vector in the unlabeled feature vector set is used as input to obtain the final flow classification result, and then the process goes to step S113;

[0070] In step S113, the analysis is completed and the program is exited.

[0071] In summary, the Internet traffic classification and identification method based on weakly supervised learning can quickly realize the identification and classification of Internet traffic types in an Internet environment with a large amount of unknown traffic by building an efficient weakly supervised traffic classification model.

[0072] The implementation modes of the present invention are described in detail above in conjunction with the embodiments, but the present invention is not limited to the above-mentioned implementation modes. For ordinary technicians in this technical field, after knowing the contents recorded in the present invention, they can make several equivalent changes and substitutions thereto without departing from the principle of the present invention, and these equivalent changes and substitutions should also be regarded as belonging to the protection scope of the present invention.

Claims

1. A method for classifying and identifying Internet traffic based on weakly supervised learning, characterized in that: include: Step 1) constructing a deterministic finite state machine containing multiple protocol application load characteristics, and then matching the deterministic finite state machine with Internet traffic, treating the Internet traffic that successfully matches the deterministic finite state machine as known traffic and adding corresponding application type tags, and treating the Internet traffic that fails to successfully match the deterministic finite state machine as unknown traffic; Step 2) extract typical features from known traffic and unknown traffic, and then calculate the cosine similarity value between the unknown traffic and the known traffic based on the extracted typical features, obtain the application type label corresponding to the unknown traffic based on the maximum cosine similarity value corresponding to the unknown traffic, and then compare the maximum cosine similarity value corresponding to the unknown traffic with the similarity threshold. If the maximum cosine similarity value exceeds the similarity threshold, add a strong label to the unknown traffic; Otherwise, add a weak label; the specific method of step 2) includes: Step 2-1) Extract the labeled data set and unlabeled datasets The features of each stream in construct feature vectors, thereby forming a set of labeled feature vectors and the set of unlabeled feature vectors ; In the formula, is the number of features, They represent the number of i Known Flow The corresponding eigenvalues ​​are They represent the j Unclassified streams The corresponding eigenvalues; and The data volumes of labeled and unlabeled datasets respectively; Step 2-2) Read the unclassified stream one by one from the unlabeled feature vector set , and calculate the cosine similarity value between it and each known flow in the labeled feature vector set. The calculation formula is as follows: ； In the formula, Indicates unclassified traffic With known flow The cosine similarity between them has a maximum value of 1 and a minimum value of 0; Step 2-3) Set the similarity threshold , if the cosine similarity value Exceeding the similarity threshold , then the unclassified flow Add strong tags Otherwise, add a weak label , and form a strong label dataset and weakly labeled datasets , where and are the data volumes of the strong label dataset and the weak label dataset respectively; is the first i data stream; for The corresponding application type label; is the first i data stream; for The corresponding application type label; Step 3) Substitute the weights of strong labels and weak labels into the residual neural network model, use the classified historical sample traffic to classify and calculate the overall loss, and use the softmax function to normalize the overall loss to obtain the optimal weights of strong labels and weak labels; the specific method of step 3) includes: Step 3-1) Use the distribution alignment method to align the weakly labeled dataset Perform exponential moving average calculation to convert weak labels into corresponding strong labels. After the above conversion, the similarity value of some elements in the weak label data set will exceed , and thus transferred to the strong label data set; the calculation formula for the exponential moving average calculation is as follows: ； In the formula, A function that generates a strong label based on the maximum value of the predicted probability value; Step 3-2) Set the weights of strong labels and weak labels to and , using the residual neural network model, the traffic samples are classified and the overall loss is calculated. The specific calculation formula is as follows: ； In the formula, and Represent the results of model classification in strong label and weak label datasets respectively, represents the standard cross entropy loss; Step 3-3) Use the softmax function to normalize the overall loss to obtain the optimal weights of strong and weak labels; Step 4) Substitute the optimal weights of strong labels and weak labels into the residual neural network model, and use the residual neural network model to realize the classification and identification of Internet traffic.

2. The Internet traffic classification and identification method based on weakly supervised learning according to claim 1 is characterized in that: The specific methods of step 1) include: Step 1-1) construct a deterministic finite state machine containing multiple protocol application load characteristics based on known Internet protocols, and then use the deterministic finite state machine to perform matching analysis on Internet traffic; Step 1-2) If the application payload of a flow in the Internet traffic successfully matches the deterministic finite state machine, the flow is marked as the corresponding protocol and treated as known traffic; otherwise, the flow is treated as unknown traffic; Step 1-3) Internet traffic forms two data sets, of which the first data set is a labeled data set , the second data set is an unlabeled data set ,in, and are the data volumes of labeled and unlabeled datasets, respectively. and They represent the number of Known flows and their corresponding application type labels, Represents the first Unclassified stream.

3. The Internet traffic classification and identification method based on weakly supervised learning according to claim 2 is characterized in that: The labeled dataset and unlabeled datasets The characteristics of each flow include duration, number of forward / reverse packets, total size of forward / reverse packets, maximum size of forward / reverse packets, minimum size of forward / reverse packets, average size of forward / reverse packets and standard deviation size of forward / reverse packets.

4. The Internet traffic classification and identification method based on weakly supervised learning according to claim 3 is characterized in that: The specific steps of step 4) include: The characteristic values ​​corresponding to the flows in are taken as input and then substituted into the residual neural network model to obtain the final Internet traffic classification and recognition results.

Images