Knowledge plane construction method and system based on ensemble learning and federal learning

Abstract

The invention provides a knowledge plane construction method and system based on ensemble learning and federal learning, and the method comprises the steps: obtaining historical flow log information, classifying the historical flow log information, marking the historical flow log information according to a classification result, and obtaining primary threat intelligence; preprocessing the primary threat intelligence to obtain a data set, and performing federated learning on a plurality of constructed initial DDOS traffic identification and classification models according to the data to obtain a plurality of final DDOS traffic identification and classification models according to a federated learning result; and carrying out ensemble learning on the obtained multiple final DDOS traffic identification and classification models by using a stack generalization algorithm so as to obtain a DDOS knowledge plane according to an ensemble learning result. According to the method and the device, the DDOS attack detection accuracy and the model robustness can be improved.

Description

Technical Field

[0001] The present invention relates to the field of computer network security technology, and in particular to a knowledge plane construction method and system based on ensemble learning and federated learning. Background Art

[0002] Federated learning is a machine learning technique that allows multiple participants to collaboratively train a shared model without directly exchanging their data. All participants jointly train a global model. After each participant updates the model, only the model's updates (usually gradient information) are sent to the central server. The server aggregates these updates to improve the model, and then sends the improved model back to the participants.

[0003] Ensemble learning is mainly to complete the learning task by building and combining multiple models to achieve better performance than a single model. In the process of integrating the trained model for detecting DDOS attacks, ensemble learning technology combines multiple detection models to improve the accuracy and robustness of detection. The ensemble model outputs the final prediction result, which is usually based on majority voting or average probability. In the process of integrating the DDOS detection model, a threshold is set to determine whether it is a DDOS attack.

[0004] Threat intelligence involves in-depth analysis of attackers' strategies, techniques, motivations, and action patterns, as well as predictions of future threats. The DDOS attack detection model obtained through ensemble learning can not only be used directly to defend against network attacks, but also serve as an advanced threat intelligence resource. By outputting these models as advanced threat intelligence that integrates knowledge, it can provide deeper insights into network security and enhance the understanding and defense capabilities of complex network threat environments.

[0005] However, at present, there are still few cases of using the fusion of federated learning and ensemble learning in the construction of DDOS knowledge plane. Summary of the invention

[0006] The purpose of the present invention is to provide a knowledge plane construction method and system based on ensemble learning and federated learning, aiming to use federated learning to train an initial DDOS traffic identification and classification model, and then use ensemble learning to combine multiple models to aggregate into a model with better performance to complete the DDOS traffic detection task. The aggregated model forms a DDOS-related threat intelligence knowledge plane, which is more helpful to improve the accuracy of detecting DDOS attacks and the robustness of the model.

[0007] In a first aspect, the present invention provides a method for constructing a knowledge plane based on ensemble learning and federated learning, the method comprising:

[0008] Acquire historical traffic log information, and classify the historical traffic log information, so as to mark the historical traffic log information according to the classification result, and obtain primary threat intelligence;

[0009] Preprocessing the primary threat intelligence to obtain a data set, and performing federated learning on multiple initial DDOS traffic identification and classification models constructed based on the data, so as to obtain multiple final DDOS traffic identification and classification models based on the federated learning results;

[0010] The obtained multiple final DDOS traffic identification and classification models are integrated and learned using a stacking generalization algorithm to obtain a DDOS knowledge plane according to the integrated learning results.

[0011] Furthermore, the step of obtaining historical traffic log information, classifying the historical traffic log information, and marking the historical traffic log information according to the classification result to obtain primary threat intelligence includes:

[0012] Classifying the historical traffic log information according to traffic types to obtain normal traffic and DDOS traffic, and marking the traffic types of the normal traffic and the DDOS traffic;

[0013] The historical traffic daily information includes multiple traffic data, each of which includes request time, IP address, requested page, and returned status code.

[0014] Furthermore, the step of performing federated learning on the multiple initial DDOS traffic identification and classification models constructed according to the data to obtain multiple final DDOS traffic identification and classification models according to the federated learning results includes:

[0015] Based on the data set used, a 1D convolutional neural network is constructed, and the input is a one-dimensional sequence data set. Let the input data flow be x∈R L , where L is the sequence number of the data set;

[0016] The first convolutional layer is denoted as h1, which uses 32 filters, each with a convolution kernel size of 3;

[0017] The first pooling layer uses average pooling, denoted as h2, with a pooling window of 2 and a step size of 2;

[0018] The second convolution layer uses Conv1d, uses 64 filters, and the convolution kernel size and padding are the same as the first convolution layer, keeping the data length unchanged; before connecting to the fully connected layer, the data is flattened from multi-dimensional to one-dimensional, denoted as h3;

[0019] The second pooling layer is denoted as h4;

[0020] Design two fully connected layers. The first fully connected layer connects the flattened data to 128 neurons. The flattening operation is denoted as h5, the first fully connected layer is denoted as h6, and the second fully connected layer outputs the final classification result.

[0021] Furthermore, the first convolutional layer is obtained according to the following formula:

[0022] h1=RELU(Conv1d(x,W1,b1,padding=1))

[0023] The first pooling layer is obtained according to the following formula:

[0024] h2=AvgPool1d(h1,kernel_size=2,stride=2)

[0025] The second convolutional layer is obtained according to the following formula:

[0026] h3=RELU(Conv1d(h2,W2,b2,padding=1))

[0027] The second pooling layer is obtained according to the following formula:

[0028] h4=AvgPool1d(h3,kernel_size=2,stride=2)

[0029] The flattening operation is performed according to the following formula:

[0030] h5=flatten(h4)

[0031] The first fully connected layer is obtained according to the following formula:

[0032] h6=RELU(W3h5+b3)

[0033] The final classification result is obtained according to the following formula:

[0034] y=W4h6+b4

[0035] Among them, RELU(·) represents an activation function for increasing nonlinearity, Conv1d(·) represents a function for extracting local features, W1, W2, W3, and W4 represent weights of their respective layers, b1, b2, b3, and b4 represent bias items of their respective layers, padding represents a function for retaining edge information and controlling output size, AvgPool1d(·) represents an average pooling function, kernel_size represents a pooling window, stride represents a step size, flatten(·) represents a flattening function, and y represents the output of the final DDOS traffic identification and classification model.

[0036] Furthermore, the step of using a stacked generalization algorithm to perform ensemble learning on the obtained multiple final DDOS traffic identification and classification models to obtain a DDOS knowledge plane according to the ensemble learning results includes:

[0037] Assume that the designed K initial DDOS traffic identification and classification models are trained through federated learning to obtain K final DDOS traffic identification and classification models (f1, f2, ..., f K ), each learner is trained on a given training set D;

[0038] Each final DDOS traffic identification and classification model predicts the preprocessed traffic data set D and generates a prediction output y^ ik , where i represents the sample index and k represents the index of the final DDOS traffic identification and classification model;

[0039] For each flow data i, the vector composed of the predictions of all base models constitutes the meta-feature Z of the meta-model i , which is Z i =[y^ i1 ,y^ i2 ,…,y^ iK ];

[0040] Using the meta-feature Z as input, we train a meta-DDOS traffic detection model g(f k ) to make the final prediction. This training is done on the original training set D or on the new validation set D val Onwards;

[0041] Meta-DDOS traffic detection model g(f k ) uses the prediction outputs from all final DDOS traffic identification and classification models as input, stacks and returns the final prediction result y^=g(Z) and derives the integrated knowledge plane.

[0042] Furthermore, the final prediction result is obtained according to the following formula:

[0043]

[0044] Where L(·) represents the loss function of a single final DDOS traffic identification and classification model, y i is the true label of sample i, g(z i ) represents the predicted output, and N represents the number of samples.

[0045] In a second aspect, the present invention provides a knowledge plane construction system based on ensemble learning and federated learning, the system comprising:

[0046] A data annotation module is used to obtain historical traffic log information and classify the historical traffic log information, so as to annotate the historical traffic log information according to the classification result to obtain primary threat intelligence;

[0047] A federated learning module, used to pre-process the primary threat intelligence to obtain a data set, and perform federated learning on multiple initial DDOS traffic identification and classification models constructed according to the data, so as to obtain multiple final DDOS traffic identification and classification models according to the federated learning results;

[0048] The integrated learning module is used to perform integrated learning on the obtained multiple final DDOS traffic identification and classification models using a stacking generalization algorithm, so as to obtain a DDOS knowledge plane according to the integrated learning results.

[0049] In a third aspect, the present invention provides a readable storage medium, which stores one or more programs, which, when executed by a processor, implement the above-mentioned knowledge plane construction method based on integrated learning and federated learning.

[0050] In a fourth aspect, the present invention provides a computer device, the computer device comprising a memory and a processor, wherein:

[0051] The memory is used to store computer programs;

[0052] When the processor is used to execute the computer program stored in the memory, the above-mentioned knowledge plane construction method based on integrated learning and federated learning is implemented.

[0053] Compared with the prior art, the present invention has the following advantages:

[0054] 1. The present invention performs federated learning on multiple initial DDOS traffic identification and classification models, so that the final DDOS traffic identification and classification model obtained can identify more complex and subtle threat behaviors, which may be difficult to detect in a single data set, thereby improving the accuracy of identification and classification. The final DDOS traffic identification and classification model obtained is regarded as advanced threat intelligence, which is very important for improving the detection of DDOS attacks. It can integrate multi-source data and improve threat detection capabilities while ensuring data privacy. It can not only more effectively identify and respond to complex network attacks, but also promote the innovation and improvement of the security threat intelligence library.

[0055] 2. The DDOS knowledge plane constructed by the present invention integrates the robustness of multiple base models (the final DDOS traffic identification and classification model). When the predictions of multiple models are used to integrate the learning model, the aggregated knowledge plane can learn from each base model how to most effectively utilize their respective strengths. This approach can enhance the model's adaptability and robustness to new, unknown or changing data.

[0056] 3. The DDOS knowledge plane constructed by the present invention covers a wider data feature space. Specifically, each base model may have different sensitivities and interpretation capabilities for different features of the data. For example, a neural network may be able to capture complex nonlinear relationships, while a decision tree may be better at interpreting and utilizing clear rules. By integrating these models, the information in the data can be more fully utilized, thereby improving the overall prediction performance. The knowledge plane enables the ability to detect and identify DDOS attacks to be improved.

[0057] 4. The DDOS knowledge plane constructed by the present invention enhances the generalization ability of the model. By stacking different models and using their predictions as input to integrate learning and train a model, the knowledge plane formed by convergence can help the model learn how to find the best information combination in the base model prediction. This method is usually more generalizable to new data than the results obtained by directly training any single model using the original input data.

[0058] 5. The DDOS knowledge plane constructed by the present invention can reduce the risk of overfitting. After the integrated learning of the stacked generalization algorithm, the output of the base model is used as the input of the meta-model. Such a hierarchical structure helps to reduce the risk of overfitting of each single model on its own data set. By synthesizing the outputs of these base models, the meta-model can more objectively evaluate the effectiveness of each model and adjust its accuracy for the final prediction. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 A flowchart of a method for constructing a knowledge plane based on ensemble learning and federated learning proposed in one embodiment of the present invention;

[0060] Figure 2 This is a schematic diagram of the structure of a knowledge plane construction system based on integrated learning and federated learning proposed in one embodiment of the present invention.

[0061] The following specific implementation manner will further illustrate the present invention in conjunction with the above-mentioned drawings. DETAILED DESCRIPTION

[0062] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0063] See also Figure 1 , which is a flow chart of a method for constructing a knowledge plane based on ensemble learning and federated learning provided by an embodiment of the present invention, the method comprises steps S101 to S103, wherein:

[0064] Step S101: Obtain historical traffic log information, and classify the historical traffic log information, so as to mark the historical traffic log information according to the classification result, and obtain primary threat intelligence;

[0065] It should be noted that the historical traffic log information includes various types of traffic data. First, the historical traffic log information needs to be classified according to the traffic type to obtain normal traffic and DDOS traffic, and the traffic types of the normal traffic and the DDOS traffic are marked. The marked normal traffic and the DDOS traffic contain specific traffic information details, such as request time, IP address, requested page, returned status code, etc.

[0066] Traffic information, as primary threat intelligence, has the characteristics of threat identification and usually involves collecting basic information about potential attackers, namely IP addresses, tools used, access time, etc. This information can help the model preliminarily identify whether there is a threat and preliminarily classify it.

[0067] Using website traffic information (historical traffic log information) as primary threat intelligence is a basic but critical threat discovery measure that helps to identify and respond to potential security threats at an early stage. By continuously collecting, updating and analyzing this type of information, potential network attacks can be more effectively prevented and mitigated.

[0068] Step S102: preprocessing the primary threat intelligence to obtain a data set, and performing federated learning on multiple initial DDOS traffic identification and classification models constructed according to the data, so as to obtain multiple final DDOS traffic identification and classification models according to the federated learning results;

[0069] It should be pointed out that the preprocessing process includes: data cleaning to ensure the quality of the data, identify missing values ​​and outliers in the data, and remove traffic data containing missing values ​​and outliers; data set normalization, which specifically includes normalization, scaling and other operations, constructing a data segmentation function, and then dividing the labeled data into training sets and test sets. Reasonable data division can help evaluate the performance of the model on unseen data, avoid overfitting and underfitting, and ensure the generalization ability of the model.

[0070] In addition, after federated learning, the final DDOS traffic identification and classification model is saved and exported to form advanced threat intelligence with integrated knowledge. Advanced threat intelligence is defined as a collection of information and knowledge used in the field of network security to identify, evaluate and respond to complex network threats. The "advanced" nature of this intelligence lies in the fact that it integrates multiple knowledge levels to provide more comprehensive and in-depth threat analysis. The following are several key aspects of advanced threat intelligence integrated knowledge:

[0071] 1. Advanced threat intelligence integrates data from multiple sources: The generated advanced threat intelligence integrates data from different sources

[0072] 2. Advanced threat intelligence is a combination of technology and technology: Advanced intelligence does not only focus on the details of a single attack technology, such as malware signatures, IP addresses, etc., but pays more attention to the tactics, techniques and procedures (TTPs) of the attack. This information helps understand the attacker's behavior patterns and attack chain structure.

[0073] 3. Advanced threat intelligence is a fusion of qualitative and quantitative analysis: Threat intelligence analysis includes both qualitative analysis, such as determining the label of traffic information, whether it is normal traffic or malicious traffic, through a final DDOS traffic identification and classification model; Advanced threat intelligence also includes quantitative analysis, such as the accuracy and credibility of the final DDOS traffic identification and classification model.

[0074] In addition, it should be pointed out that the final DDOS traffic identification and classification model here can be used as advanced threat intelligence because:

[0075] In the training process of federated learning, each participant contributes his own data but does not need to share data. This means that the model can use data from multiple participants to learn a wider range of threat patterns and attack strategies, and the generalization is verified in the experiment.

[0076] By training on multiple data points through federated learning, the model can identify more complex and subtle threat behaviors that may be difficult to detect in a single data set, and the accuracy of identification and classification is improved. This type of advanced threat intelligence is very important for improving the detection of DDOS attacks. It can integrate multi-source data and improve threat detection capabilities while ensuring data privacy. It can not only more effectively identify and respond to complex network attacks, but also promote the innovation and improvement of the security threat intelligence library.

[0077] Step S103: The obtained multiple final DDOS traffic identification and classification models are subjected to ensemble learning using a stacking generalization algorithm, so as to obtain a DDOS knowledge plane according to the ensemble learning result.

[0078] In this step, the process of using the stacked generalization algorithm to perform ensemble learning on multiple advanced threat intelligence is as follows:

[0079] (1) Training base model: After determining the characteristics and labels of traffic data, select a decision tree model suitable for distributed training and start training. Design a suitable neural network model architecture and use a logistic regression model to participate in the classification task. Add the model to federated learning for training. The server is responsible for aggregating the model updates (such as parameters or gradients) uploaded by each node, and then sends the updated model parameters back to each node; each node receives the updated model parameters and continues to perform further training on local data until convergence.

[0080] (2) Converged knowledge plane: The prediction results of each model on the validation set are used as new features. These features will be used to train the integrated model. The training goal is to optimize the performance of the meta-model in how to integrate different predictions. Stacked generalization combines the advantages of multiple models to form a DDOS knowledge plane, which can effectively improve the accuracy and robustness of DDOS traffic detection.

[0081] In summary, according to the above-mentioned knowledge plane construction method based on ensemble learning and federated learning, by defining primary threat intelligence and advanced threat intelligence, and proposing the use of federated learning to achieve the transformation from primary threat intelligence to advanced threat intelligence, this process can improve the available value of primary threat intelligence, and realize the transformation from primary threat intelligence that has not been processed or is only simply labeled to available advanced threat intelligence with integrated knowledge; then the advanced threat intelligence with integrated knowledge is aggregated through ensemble learning to form a knowledge plane; using the aggregated knowledge plane, the accuracy of advanced threat intelligence in identifying new DDOS traffic data can be improved, which can enhance the system's identification of denial of service attack traffic.

[0082] In some embodiments, primary threat intelligence is used as a training data set, multiple clients and servers are set up, and an initial DDOS traffic identification and classification model is designed to determine how data is synchronized and updated among participants, start federated learning training, and start a training process in which the model is locally updated on each node and then the updated model is aggregated.

[0083] Specifically, the process of designing multiple initial DDOS traffic identification and classification models to train and form multiple advanced threat intelligence is as follows:

[0084] (1) Training and generating decision tree models: Each participating node (client) uses local data to train a part of the decision tree model, such as a decision node or a leaf node. Each node trains a decision tree and summarizes the updated tree structure to the central server. The server aggregates these decision trees to form a powerful integrated model.

[0085] (2) Training and generating neural network models: Each node uses its data to train a local neural network. Through the FedAvg algorithm, each node trains and sends updates to weights and biases to the server. The server averages these updates and distributes them back. This process is iterated to optimize the global model.

[0086] (3) Train and generate regression models: Use the data from each node to train a local linear regression or logistic regression model, and gradually build a global model by iteratively updating and averaging model parameters.

[0087] Through the above training process, it is possible to generate multiple final DDOS traffic identification and classification model models for DDOS attack detection. In addition, the final DDOS traffic identification and classification model models are exported and converted into advanced threat intelligence to enhance the overall network security defense capabilities.

[0088] In some embodiments, different designed DDOS identification and classification models are briefly introduced. Among them, the advantage of the convolutional neural network model is that it is better at capturing complex nonlinear relationships. First, the input is a one-dimensional sequence of data. Suppose the input traffic data is x∈R L , where L is the sequence number of the data sample.

[0089] The first convolutional layer is denoted as h1, which uses 32 filters (or convolution kernels), each with a convolution kernel size of 3;

[0090] h1=RELU(Conv1d(x,W1,b1,padding=1))

[0091] Among them, W1 is the weight of the convolution kernel and b1 is the bias term.

[0092] The first pooling layer uses average pooling (AvgPool1d), denoted as h2, with a pooling window of 2 and a step size of 2. This operation halves the data length;

[0093] h2=AvgPool1d(h1,kernel_size=2,stride=2)

[0094] The second convolutional layer continues to use Conv1d, this time with 64 filters, the convolution kernel size and padding are the same as the first layer, keeping the data length unchanged; before connecting to the fully connected layer, the data needs to be flattened from multi-dimensional (here is three-dimensional) to one-dimensional for full connection operation, and this layer is recorded as h3;

[0095] h3=RELU(Conv1d(h2,W2,b2,padding=1))

[0096] Among them, W2 is the weight of the convolution kernel and b2 is the bias term.

[0097] The second pooling layer plays a very important role in the entire convolutional neural network. It not only optimizes the data processing process, but also improves the generalization ability of the model, denoted by h4.

[0098] h4=AvgPool1d(h3,kernel_size=2,stride=2)

[0099] Two fully connected layers are designed here. The first fully connected layer connects the flattened data to 128 neurons for further learning and integrating features, and the flattening operation is denoted as h5.

[0100] h5=flatten(h4)

[0101] The first fully connected layer is denoted as h6.

[0102] h3=RELU(W3h5+b3)

[0103] Among them, W3 is the weight of the fully connected layer, and b3 is the bias term of the fully connected layer.

[0104] The last fully connected layer outputs the final classification result.

[0105] y=W4h6+b4

[0106] Among them, W4 is the weight of the convolution kernel and b4 is the bias term.

[0107] In addition, the model output y is a vector containing the scores for each data category. These scores are usually further processed by the softmax function to convert them into probabilities, thereby realizing the identification and classification of DDOS traffic.

[0108] In some embodiments, the specific process of stacking

[0109] (1) Assume that the designed K initial DDOS traffic identification and classification models are trained through federated learning to obtain K final DDOS traffic identification and classification models (f1, f2, …, f K ), each learner is trained on a given training set D.

[0110] (2) Each final DDOS traffic identification and classification model predicts the preprocessed traffic data set D and generates a prediction output y^ ik , where i represents the sample index and k represents the index of the final DDOS traffic identification and classification model.

[0111] (3) For each flow data i, the vector composed of the predictions of all base models constitutes the meta-feature Z of the meta-model i , which is Z i =[y^ i1 ,y^ i2 ,…,y^ iK ].

[0112] (4) Using the meta-feature Z as input, train a meta-DDOS traffic detection model g(f k ) to make the final prediction. This training is done on the original training set D or on the new validation set D val On.

[0113] (5) Meta-DDOS traffic detection model g(f k ) uses the prediction outputs from all final DDOS traffic identification and classification models as input, stacks and returns the final prediction result y^=g(Z) and derives the integrated knowledge plane.

[0114] In addition, it should be pointed out that the overall process of stacking generalization can also be said to be an optimization problem for meta-model training. The specific optimization function is:

[0115]

[0116] Where L(·) represents the loss function of a single final DDOS traffic identification and classification model, y i is the true label of sample i, g(z i ) represents the predicted output, and N represents the number of samples.

[0117] In summary, compared with the prior art, the present invention has the following advantages:

[0118] 1. The present invention performs federated learning on multiple initial DDOS traffic identification and classification models, so that the final DDOS traffic identification and classification model obtained can identify more complex and subtle threat behaviors, which may be difficult to detect in a single data set, thereby improving the accuracy of identification and classification. The final DDOS traffic identification and classification model obtained is regarded as advanced threat intelligence, which is very important for improving the detection of DDOS attacks. It can integrate multi-source data and improve threat detection capabilities while ensuring data privacy. It can not only more effectively identify and respond to complex network attacks, but also promote the innovation and improvement of the security threat intelligence library.

[0119] 2. The DDOS knowledge plane constructed by the present invention integrates the robustness of multiple base models (the final DDOS traffic identification and classification model). When the predictions of multiple models are used to integrate the learning model, the aggregated knowledge plane can learn from each base model how to most effectively utilize their respective strengths. This approach can enhance the model's adaptability and robustness to new, unknown or changing data.

[0120] 3. The DDOS knowledge plane constructed by the present invention covers a wider data feature space. Specifically, each base model may have different sensitivities and interpretation capabilities for different features of the data. For example, a neural network may be able to capture complex nonlinear relationships, while a decision tree may be better at interpreting and utilizing clear rules. By integrating these models, the information in the data can be more fully utilized, thereby improving the overall prediction performance. The knowledge plane enables the ability to detect and identify DDOS attacks to be improved.

[0121] 4. The DDOS knowledge plane constructed by the present invention enhances the generalization ability of the model. By stacking different models and using their predictions as input to integrate learning and train a model, the knowledge plane formed by convergence can help the model learn how to find the best information combination in the base model prediction. This method is usually more generalizable to new data than the results obtained by directly training any single model using the original input data.

[0122] 5. The DDOS knowledge plane constructed by the present invention can reduce the risk of overfitting. After the integrated learning of the stacked generalization algorithm, the output of the base model is used as the input of the meta-model. Such a hierarchical structure helps to reduce the risk of overfitting of each single model on its own data set. By synthesizing the outputs of these base models, the meta-model can more objectively evaluate the effectiveness of each model and adjust its accuracy for the final prediction.

[0123] See also Figure 2 , which shows a knowledge plane construction system based on integrated learning and federated learning in one embodiment of the present invention, and the system includes:

[0124] The data annotation module 10 is used to obtain historical traffic log information and classify the historical traffic log information, so as to annotate the historical traffic log information according to the classification result to obtain primary threat intelligence;

[0125] A federated learning module 20 is used to pre-process the primary threat intelligence to obtain a data set, and perform federated learning on multiple initial DDOS traffic identification and classification models constructed according to the data, so as to obtain multiple final DDOS traffic identification and classification models according to the federated learning results;

[0126] The integrated learning module 30 is used to perform integrated learning on the obtained multiple final DDOS traffic identification and classification models using a stacking generalization algorithm to obtain a DDOS knowledge plane according to the integrated learning results.

[0127] On the other hand, the present invention further proposes a readable storage medium on which one or more programs are stored, which, when executed by a processor, implement the above-mentioned knowledge plane construction method based on integrated learning and federated learning.

[0128] On the other hand, the present invention also proposes a computer device, including a memory and a processor, wherein the memory is used to store computer programs, and the processor is used to execute the computer programs stored in the memory, so as to implement the above-mentioned knowledge plane construction method based on integrated learning and federated learning.

[0129] Those skilled in the art will appreciate that the logic and / or steps represented in the flowchart or otherwise described herein, for example, may be considered as an ordered list of executable instructions for implementing logical functions, and may be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For purposes of this specification, "computer-readable medium" may be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0130] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0131] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or a combination thereof: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0132] Although the embodiments of the present invention are described in detail above, it is obvious to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as described in the claims. Moreover, the present invention described herein may have other embodiments and may be implemented or realized in a variety of ways.

Claims

1. A knowledge plane construction method based on ensemble learning and federated learning, It is characterized in that The method comprises: Acquire historical traffic log information, and classify the historical traffic log information, so as to mark the historical traffic log information according to the classification result, and obtain primary threat intelligence; Preprocessing the primary threat intelligence to obtain a data set, and performing federated learning on multiple initial DDOS traffic identification and classification models constructed based on the data, so as to obtain multiple final DDOS traffic identification and classification models based on the federated learning results; The obtained multiple final DDOS traffic identification and classification models are integrated and learned using a stacking generalization algorithm to obtain a DDOS knowledge plane according to the integrated learning results.

2. The method for constructing a knowledge plane based on ensemble learning and federated learning according to claim 1, It is characterized in that The step of obtaining historical traffic log information, classifying the historical traffic log information, and marking the historical traffic log information according to the classification result to obtain primary threat intelligence includes: Classifying the historical traffic log information according to traffic types to obtain normal traffic and DDOS traffic, and marking the traffic types of the normal traffic and the DDOS traffic; The historical traffic daily information includes multiple traffic data, each of which includes request time, IP address, requested page, and returned status code.

3. The knowledge plane construction method based on ensemble learning and federated learning according to claim 1, It is characterized in that The step of performing federated learning on the multiple initial DDOS traffic identification and classification models constructed according to the data to obtain multiple final DDOS traffic identification and classification models according to the federated learning results includes: Based on the data set used, a 1D convolutional neural network is constructed, and the input is a one-dimensional sequence data set. Let the input data flow be x∈R L , where L is the sequence number of the data set; The first convolutional layer is denoted as h 1 , using 32 filters, each with a convolution kernel size of 3; The first pooling layer uses average pooling, denoted by h 2 , the pooling window is 2 and the step size is also 2; The second convolution layer uses Conv1d, uses 64 filters, and the convolution kernel size and padding are the same as the first convolution layer, keeping the data length unchanged; before connecting to the fully connected layer, the data is flattened from multi-dimensional to one-dimensional, denoted as h 3 ; The second pooling layer is denoted as h 4 ; Design two fully connected layers. The first fully connected layer connects the flattened data to 128 neurons, where the flattening operation is denoted as h 5 , the first fully connected layer is denoted as h 6 , the second fully connected layer outputs the final classification result.

4. The method for constructing a knowledge plane based on ensemble learning and federated learning according to claim 3, It is characterized in that The first convolutional layer is obtained according to the following formula: h 1 =RELU(Conv1d(x,W 1 ,b 1 ,padding=1)) The first pooling layer is obtained according to the following formula: h 2 =AvgPool1d(h 1 ,kernel_size=2,stride=2) The second convolutional layer is obtained according to the following formula: h 3 =RELU(Conv1d(h 2 ,W 2 ,b 2 ,padding=1)) The second pooling layer is obtained according to the following formula: h 4 =AvgPool1d(h 3 ,kernel_size=2,stride=2) The flattening operation is performed according to the following formula: h 5 =flatten(h 4 ) The first fully connected layer is obtained according to the following formula: h 6 =RELU(W 3 h 5 +b 3 ) The final classification result is obtained according to the following formula: y=W 4 h 6 +b 4 Among them, RELU(·) represents the activation function used to increase nonlinearity, Conv1d(·) represents the function used to extract local features, and W 1 , W 2 , W 3 , W 4 Both represent the weight of the layer, b 1 、b 2 、b 3 、b 4 All represent the bias items of the layer, padding represents the function used to retain edge information and control the output size, AvgPool1d(·) represents the average pooling function, kernel_size represents the pooling window, stride represents the step size, flatten(·) represents the flattening function, and y represents the output of the final DDOS traffic identification and classification model.

5. The method for constructing a knowledge plane based on ensemble learning and federated learning according to claim 1, It is characterized in that The step of using a stacked generalization algorithm to perform ensemble learning on the obtained multiple final DDOS traffic identification and classification models to obtain a DDOS knowledge plane according to the ensemble learning results includes: Assume that the designed K initial DDOS traffic identification and classification models are trained through federated learning to obtain K final DDOS traffic identification and classification models (f 1 ,f 2 ,…,f K ), each learner is trained on a given training set D; Each final DDOS traffic identification and classification model predicts the preprocessed traffic data set D and generates a prediction output y^ ik , where i represents the sample index and k represents the index of the final DDOS traffic identification and classification model; For each flow data i, the vector composed of the predictions of all base models constitutes the meta-feature Z of the meta-model i , which is Z i =[y^ i1 ,y^ i2 ,…,y^ iK ]; Using the meta-feature Z as input, we train a meta-DDOS traffic detection model g(f k ) to make the final prediction. This training is done on the original training set D or on the new validation set D val Onwards; Meta-DDOS traffic detection model g(f k ) uses the prediction outputs from all final DDOS traffic identification and classification models as input, stacks and returns the final prediction result y^=g(Z) and derives the integrated knowledge plane.

6. The method for constructing a knowledge plane based on ensemble learning and federated learning according to claim 5, It is characterized in that The final prediction result is obtained according to the following formula: Where L(·) represents the loss function of a single final DDOS traffic identification and classification model, y i is the true label of sample i, g(z i ) represents the predicted output, and N represents the number of samples.

7. A knowledge plane construction system based on ensemble learning and federated learning, It is characterized in that The system comprises: A data annotation module is used to obtain historical traffic log information and classify the historical traffic log information, so as to annotate the historical traffic log information according to the classification result to obtain primary threat intelligence; A federated learning module, used to pre-process the primary threat intelligence to obtain a data set, and perform federated learning on multiple initial DDOS traffic identification and classification models constructed according to the data, so as to obtain multiple final DDOS traffic identification and classification models according to the federated learning results; The integrated learning module is used to perform integrated learning on the obtained multiple final DDOS traffic identification and classification models using a stacking generalization algorithm, so as to obtain a DDOS knowledge plane according to the integrated learning results.

8. A readable storage medium, It is characterized in that The readable storage medium stores one or more programs, which, when executed by a processor, implement the knowledge plane construction method based on ensemble learning and federated learning as described in any one of claims 1 to 6.

9. A computer device comprising a memory and a processor, in: The memory is used to store computer programs; When the processor is used to execute the computer program stored in the memory, it implements the knowledge plane construction method based on ensemble learning and federated learning as described in any one of claims 1 to 6.

Images