NetFlow lightweight feature representation method and device and electronic equipment
By sampling and aggregating NetFlow data, combining semantics and timing expansion, lightweight feature representation is obtained, which solves the problem of low accuracy in malicious traffic recognition in the existing technology, and achieves high accuracy of deep learning models in malicious traffic detection Rate.
Patent Information
- Application Number
- CN202411146061.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-20
- Publication Date
- 2024-12-13
AI Technical Summary
It is difficult for the prior art to obtain high accuracy in the identification of various types of malicious traffic, especially when using NetFlow data, it is difficult for deep learning models to accurately detect malicious traffic.
By sampling the NetFlow dataset, the data that satisfies the same traffic is aggregated according to five-tuple, the total number of packets and total bytes are determined, and the average packet length is expanded according to semantics and timing to obtain the NetFlow lightweight feature representation .
It improves the accuracy of malicious traffic detection and can effectively help the deep learning model accurately identify malicious traffic based on NetFlow data, achieving high-accurate malicious traffic detection.
Smart Images
Figure CN119135381A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer network security technology, and in particular to a NetFlow lightweight feature representation method, device and electronic device. Background Art
[0002] NetFlow is a network protocol used to collect IP network traffic data. It has become a widely adopted network traffic monitoring standard in the industry and is mainly used in network traffic analysis, bandwidth monitoring, network planning, network security and other fields. In the field of network security, compared with Deep Packet Inspection (DPI), using NetFlow is easier to collect and process data, less intrusive to user privacy, and has lower system overhead.
[0003] In the related art, machine learning or deep learning methods are usually used to detect malicious traffic based on NetFlow.
[0004] However, this method is difficult to achieve high accuracy in identifying various types of malicious traffic, and this problem needs to be solved urgently. Summary of the invention
[0005] The present application provides a NetFlow lightweight feature representation method, device and electronic device to solve the problem that the existing technology is difficult to achieve a high accuracy in identifying various types of malicious traffic, and effectively help deep learning models to accurately detect malicious traffic based on NetFlow.
[0006] To achieve the above objectives, the first embodiment of the present application proposes a NetFlow lightweight feature representation method, comprising the following steps:
[0007] Sample the target IP data packets according to the preset sampling period to obtain the NetFlow data set;
[0008] Aggregating the NetFlow data satisfying the same flow condition in the NetFlow data set according to a preset five-tuple, and obtaining an aggregation list of NetFlow element pairs according to the aggregation result;
[0009] The NetFlow element pair aggregation list is expanded by average packet length according to semantics and time sequence to obtain a NetFlow lightweight feature representation.
[0010] According to an embodiment of the present application, obtaining a NetFlow element pair aggregation list according to the aggregation result includes:
[0011] Based on the aggregation result, determine the total number of data packets and the total number of bytes corresponding to each flow;
[0012] A plurality of element pairs are formed according to the total number of data packets and the total number of bytes corresponding to each flow, and a NetFlow element pair aggregation list is obtained according to the plurality of element pairs.
[0013] According to an embodiment of the present application, obtaining a NetFlow element pair aggregation list according to the multiple element pairs includes:
[0014] The multiple element pairs are arranged according to a preset timestamp sorting strategy to obtain the NetFlow element pair aggregation list.
[0015] According to one embodiment of the present application, the preset quintuple includes a source IP address, a destination IP address, a source port number, a destination port number and a protocol number.
[0016] According to the NetFlow lightweight feature representation method proposed in the embodiment of the present application, a NetFlow data set can be obtained by sampling the target IP data packet according to a preset sampling period; the NetFlow data in the NetFlow data set that meets the same traffic condition is aggregated according to the preset five-tuple, and a NetFlow element pair aggregation list is obtained according to the aggregation result; the NetFlow element pair aggregation list is expanded according to the average packet length according to semantics and timing to obtain a NetFlow lightweight feature representation. Therefore, the data after the above processing can be used as a good representation of the NetFlow feature for malicious traffic detection, which solves the problem that the existing technology is difficult to achieve a high accuracy rate in identifying various types of malicious traffic, and effectively helps the deep learning model to accurately detect malicious traffic based on NetFlow.
[0017] To achieve the above-mentioned purpose, the second embodiment of the present application proposes a NetFlow lightweight feature representation device, including:
[0018] The sampling module is used to sample the target IP data packets according to the preset sampling period to obtain the NetFlow data set;
[0019] A processing module, configured to aggregate the NetFlow data satisfying the same flow condition in the NetFlow data set according to a preset five-tuple, and obtain an aggregation list of NetFlow element pairs according to the aggregation result;
[0020] The expansion module is used to expand the average packet length of the NetFlow element pair aggregation list according to semantics and timing to obtain a NetFlow lightweight feature representation.
[0021] According to one embodiment of the present application, the processing module includes:
[0022] A first obtaining unit, configured to determine the total number of data packets and the total number of bytes corresponding to each flow based on the aggregation result;
[0023] The second obtaining unit is used to form a plurality of element pairs according to the total number of data packets and the total number of bytes corresponding to each flow, and obtain a NetFlow element pair aggregation list according to the plurality of element pairs.
[0024] According to one embodiment of the present application, the second obtaining unit is specifically configured to:
[0025] The multiple element pairs are arranged according to a preset timestamp sorting strategy to obtain the NetFlow element pair aggregation list.
[0026] According to one embodiment of the present application, the preset quintuple includes a source IP address, a destination IP address, a source port number, a destination port number and a protocol number.
[0027] According to the NetFlow lightweight feature representation device proposed in the embodiment of the present application, a NetFlow data set can be obtained by sampling the target IP data packet according to a preset sampling period; the NetFlow data in the NetFlow data set that meets the same traffic condition is aggregated according to the preset five-tuple, and a NetFlow element pair aggregation list is obtained according to the aggregation result; the NetFlow element pair aggregation list is expanded according to the average packet length according to the semantics and timing to obtain a NetFlow lightweight feature representation. Therefore, the data after the above processing can be used as a good representation of the NetFlow feature for malicious traffic detection, which solves the problem that the existing technology is difficult to achieve a high accuracy rate in identifying various types of malicious traffic, and effectively helps the deep learning model to accurately detect malicious traffic based on NetFlow.
[0028] To achieve the above objectives, the third aspect of the present application proposes an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the NetFlow lightweight feature representation method as described in the above embodiments.
[0029] To achieve the above objectives, the fourth aspect of the present application proposes a computer-readable storage medium on which a computer program is stored, and the program is executed by a processor to implement the NetFlow lightweight feature representation method as described in the above embodiments.
[0030] To achieve the above objectives, a fifth aspect of the present invention provides a computer program product, including a computer program, which, when executed by a processor, is used to implement the NetFlow lightweight feature representation method as described in the above embodiments.
[0031] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS
[0032] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:
[0033] Figure 1 A flowchart of a NetFlow lightweight feature representation method provided according to an embodiment of the present application;
[0034] Figure 2 A flowchart of another NetFlow lightweight feature representation method provided according to an embodiment of the present application;
[0035] Figure 3 A schematic diagram of test results obtained by using the NetFlow representation proposed in this solution and training a deep learning model directly based on the original NetFlow data on the CIRA-CIC-DoHBrw-2020 dataset according to an embodiment of the present application;
[0036] Figure 4 A schematic diagram of test results obtained by using the NetFlow representation proposed in this solution and training a deep learning model directly based on original NetFlow data on a Hyper Vision dataset according to an embodiment of the present application;
[0037] Figure 5 A schematic block diagram of a NetFlow lightweight feature representation device provided according to an embodiment of the present application;
[0038] Figure 6 It is a schematic diagram of the structure of an electronic device provided according to an embodiment of the present application. DETAILED DESCRIPTION
[0039] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.
[0040] The following describes the NetFlow lightweight feature representation method, device and electronic device proposed according to the embodiments of the present application with reference to the accompanying drawings.
[0041] Figure 1 This is a flowchart of a NetFlow lightweight feature representation method according to an embodiment of the present application.
[0042] Before introducing the NetFlow lightweight feature representation method proposed in the embodiment of the present application, the relevant technical background is first introduced.
[0043] The mainstream versions of NetFlow are v1, v5, v7, v8, v9, etc. Among them, v5 is one of the most commonly used versions, supported by most mainstream routers. The main fields of NetFlow v5 records are as follows:
[0044] Source IP address|Destination IP address|…|Total number of packets|Total number of bytes|…|Source port number|Destination port number|….
[0045] NetFlow v5 data is obtained by sampling IP packets from network devices during the active time of data flows. There are two configurable collection parameters in this process, namely Active Timeout and Inactive Timeout. Among them, the device can periodically generate NetFlow records when each flow remains active according to the Active Timeout to continuously collect traffic data. For any flow, if the device does not match the data packet of the flow within the time of the Inactive Timeout, the flow will be considered to be over and the collection of related data will stop.
[0046] In the related art, machine learning or deep learning methods are usually used to detect malicious traffic based on NetFlow.
[0047] However, this method has the following main problems: (1) NetFlow data is directly input into existing machine learning or deep learning methods without considering the specific attributes of network traffic and the data semantics of NetFlow, which is not conducive to the understanding of existing detection models and makes it difficult to achieve a high accuracy in identifying various types of malicious traffic; (2) Although some work has encoded NetFlow features, the process requires complex clustering algorithms to implement and cannot meet the requirements of lightweight.
[0048] Based on the above problems, the present application proposes a NetFlow lightweight feature representation method, combining Figure 2 As shown, the method can set the Active Timeout and Inactive Timeout of the router to collect NetFlow data, and aggregate the NetFlow records of the same flow according to the five-tuple, and only retain the total number of data packets and the total number of bytes to obtain the aggregation list of NetFlow elements. Finally, the list is expanded according to the average packet length according to semantics and timing to obtain the final NetFlow lightweight feature representation for malicious flow detection, which is used for accurate malicious traffic detection.
[0049] For example, Figure 1 As shown, the NetFlow lightweight feature representation method includes the following steps:
[0050] In step S101, the target IP data packet is sampled according to a preset sampling period to obtain a NetFlow data set.
[0051] The preset sampling period may be pre-set by a user, obtained through a limited number of experiments, or obtained through a limited number of computer simulations, which is not specifically limited here.
[0052] It is understandable that in a high-traffic network environment, directly processing each IP packet is more resource-intensive, so sampling technology can be used to reduce the amount of data that needs to be processed. First, a fixed sampling period is set on the network device (such as a router or switch), and the target IP packet is sampled under the fixed sampling period to obtain a NetFlow data set. For each NetFlow record of the flow, its five-tuple (source IP address, destination IP address, source port number, destination port number and protocol number), total number of packets and total number of bytes can be retained.
[0053] In step S102, the NetFlow data satisfying the same flow condition in the NetFlow data set are aggregated according to the preset five-tuple, and a NetFlow element pair aggregation list is obtained according to the aggregation result.
[0054] In some embodiments, the preset quintuple includes a source IP address, a destination IP address, a source port number, a destination port number and a protocol number.
[0055] That is to say, by traversing the NetFlow data set, the NetFlow data that meets the same flow condition (that is, the same quintuple) in the NetFlow data set can be aggregated according to the preset quintuple (source IP address, destination IP address, source port number, destination port number and protocol number), and the aggregation list of NetFlow element pairs for each flow can be obtained according to the aggregation result.
[0056] For ease of understanding, the following describes in detail how to obtain a NetFlow element pair aggregation list based on the aggregation result.
[0057] As a possible implementation method, in some embodiments, a NetFlow element pair aggregation list is obtained based on the aggregation results, including: determining the total number of data packets and the total number of bytes corresponding to each flow based on the aggregation results; forming multiple element pairs based on the total number of data packets and the total number of bytes corresponding to each flow, and obtaining the NetFlow element pair aggregation list based on the multiple element pairs.
[0058] Specifically, based on the aggregation results, only the total number of packets and total bytes corresponding to each flow are retained, and then multiple element pairs are formed according to the total number of packets and total bytes corresponding to each flow. Based on the retained multiple element pairs, a NetFlow element pair aggregation list can be constructed for each flow, which is expressed as follows:
[0059] [(pkt_num 1 ,tot_bytes 1 ),…,(pkt_num n ,tot_bytes n )]
[0060] Where n is the number of element pairs of NetFlow records obtained on the network device, (pkt_num n ,tot_bytes n ) is an element pair, pkt_num n is the total number of packets, tot_bytes n The total number of bytes.
[0061] Furthermore, in some embodiments, obtaining a NetFlow element pair aggregation list based on a plurality of element pairs includes: arranging the plurality of element pairs according to a preset timestamp sorting strategy to obtain a NetFlow element pair aggregation list.
[0062] That is to say, based on the retained multiple element pairs, according to the preset timestamp sorting strategy (such as sorting in ascending order of timestamp, which helps to understand the occurrence order and change trend of traffic), use appropriate sorting algorithms (such as quick sort, merge sort, etc.) to arrange multiple element pairs, and then you can get the NetFlow element pair aggregation list.
[0063] It should be noted that when arranging multiple element pairs according to a preset timestamp sorting strategy, the preset timestamp sorting strategy is set to descending order, although it is not common, but it can be used in some cases, such as finding the most recent traffic activity.
[0064] Through the above operations, an ordered aggregation list of NetFlow element pairs can be obtained. Each element in the list is an aggregation item (total number of packets and total number of bytes), representing a group of flow records with the same five-tuple characteristics.
[0065] In step S103, the NetFlow element pair aggregation list is expanded according to the average packet length according to semantics and time sequence to obtain a NetFlow lightweight feature representation.
[0066] Specifically, after obtaining the NetFlow element pair aggregation list, the average packet length of the NetFlow element pair aggregation list can be expanded according to the NetFlow semantics and timing. The average packet length is obtained by dividing the total number of bytes by the total number of data packets. This calculation process provides an estimate of the average value of the data packet size in the traffic, which is a useful indicator for identifying traffic types (such as file transfer, real-time communication, etc.).
[0067] That is, the i-th group of element pairs (pkt_num i ,tot_bytes i ) is converted into the following expression according to NetFlow semantics and timing:
[0068] (avg_pkt_size i1 ,avg_pkt_size i2 …avg_pkt_size ik )
[0069] Among them, avg_pkt_size i1 =…=avg_pkt_size ik =tot_bytes i / pkt_num i ,k=pkt_num i .
[0070] Therefore, for each flow, a feature vector in the following format can be obtained:
[0071] [avg_pkt_size 11 ,avg_pkt_size 12 …avg_pkt_size ij …avg_pkt_size nk ]
[0072] This feature representation can be used as the average packet length sequence feature of the traffic based on NetFlow data, which is the final NetFlow lightweight feature representation.
[0073] In order to facilitate those skilled in the art to further understand the effectiveness of the NetFlow lightweight feature representation method proposed in the embodiment of the present application, it is explained below through experimental verification.
[0074] During the experiment, the processed data can be used to supervisely train a malicious traffic detection model. The detection model used here is the Deep Fingerprinting Net (DFN). The datasets used include the CIRA-CIC-DoHBrw-2020 dataset (a dataset used for network security research, specifically for the detection and classification of encrypted DNS (DoH) traffic) and the Hyper Vision dataset (Hyper Vision is a malicious traffic detection system based on real-time unsupervised machine learning). Softflowd is used to generate NetFlow format data for the CIRA-CIC-DoHBrw-2020 dataset and the HyperVision dataset. Here, the Active Timeout value range is set to [1s, 5s, 10s, 15s, 20s, 25s, 30s], and the Inactive Timeout is set to 30s. The dataset is divided into training: testing: validation = 6:2:2. The detection model is supervised using the training dataset, and the detection model is tested using the test dataset. The test results are shown in Figure 2. Figure 3 and Figure 4 shown.
[0075] The results show that the accuracy of the model trained using the average packet length sequence as the traffic feature in the two data sets is generally higher than that of the model trained using the original NetFlow data. Therefore, it can be shown that the solution proposed in this application can take into account both simplicity and high accuracy. Although the Active Timeout continues to increase, the embodiment of this application can still help the deep learning model to achieve accurate malicious traffic detection, that is, the malicious traffic recognition rate can be higher than 85%.
[0076] According to the NetFlow lightweight feature representation method proposed in the embodiment of the present application, a NetFlow data set can be obtained by sampling the target IP data packet according to a preset sampling period; the NetFlow data in the NetFlow data set that meets the same traffic condition is aggregated according to the preset five-tuple, and a NetFlow element pair aggregation list is obtained according to the aggregation result; the NetFlow element pair aggregation list is expanded according to the average packet length according to semantics and timing to obtain a NetFlow lightweight feature representation. Therefore, the data after the above processing can be used as a good representation of the NetFlow feature for malicious traffic detection, which solves the problem that the existing technology is difficult to achieve a high accuracy rate in identifying various types of malicious traffic, and effectively helps the deep learning model to accurately detect malicious traffic based on NetFlow.
[0077] Next, the NetFlow lightweight feature representation device proposed according to the embodiment of the present application is described with reference to the accompanying drawings.
[0078] Figure 5 It is a block diagram of a NetFlow lightweight feature representation device according to an embodiment of the present application.
[0079] like Figure 5 As shown, the NetFlow lightweight feature representation device 10 includes: a sampling module 100, a processing module 200 and an expansion module 300.
[0080] The sampling module 100 is used to sample the target IP data packet according to a preset sampling period to obtain a NetFlow data set;
[0081] The processing module 200 is used to aggregate the NetFlow data satisfying the same flow condition in the NetFlow data set according to the preset five-tuple, and obtain an aggregation list of NetFlow element pairs according to the aggregation result;
[0082] The expansion module 300 is used to expand the average packet length of the NetFlow element pair aggregation list according to semantics and time sequence to obtain a NetFlow lightweight feature representation.
[0083] Furthermore, in some embodiments, the processing module 200 includes:
[0084] A first obtaining unit, configured to determine the total number of data packets and the total number of bytes corresponding to each flow based on the aggregation result;
[0085] The second obtaining unit is used to form a plurality of element pairs according to the total number of data packets and the total number of bytes corresponding to each flow, and obtain a NetFlow element pair aggregation list according to the plurality of element pairs.
[0086] Further, in some embodiments, the second obtaining unit is specifically configured to:
[0087] Arrange multiple element pairs according to the preset timestamp sorting strategy to obtain a NetFlow element pair aggregation list.
[0088] Further, in some embodiments, the preset quintuple includes a source IP address, a destination IP address, a source port number, a destination port number, and a protocol number.
[0089] It should be noted that the aforementioned explanation of the embodiment of the NetFlow lightweight feature representation method is also applicable to the NetFlow lightweight feature representation device of this embodiment, and will not be repeated here.
[0090] According to the NetFlow lightweight feature representation device proposed in the embodiment of the present application, a NetFlow data set can be obtained by sampling the target IP data packet according to a preset sampling period; the NetFlow data in the NetFlow data set that meets the same traffic condition is aggregated according to the preset five-tuple, and a NetFlow element pair aggregation list is obtained according to the aggregation result; the NetFlow element pair aggregation list is expanded according to the average packet length according to the semantics and timing to obtain a NetFlow lightweight feature representation. Therefore, the data after the above processing can be used as a good representation of the NetFlow feature for malicious traffic detection, which solves the problem that the existing technology is difficult to achieve a high accuracy rate in identifying various types of malicious traffic, and effectively helps the deep learning model to accurately detect malicious traffic based on NetFlow.
[0091] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device may include:
[0092] A memory 601 , a processor 602 , and a computer program stored in the memory 601 and executable on the processor 602 .
[0093] When the processor 602 executes the program, the NetFlow lightweight feature representation method provided in the above embodiment is implemented.
[0094] Furthermore, the electronic device further comprises:
[0095] The communication interface 603 is used for communication between the memory 601 and the processor 602 .
[0096] The memory 601 is used to store computer programs that can be executed on the processor 602 .
[0097] The memory 601 may include a high-speed RAM (Random Access Memory) memory, and may also include a non-volatile memory, such as at least one disk memory.
[0098] If the memory 601, the processor 602 and the communication interface 603 are implemented independently, the communication interface 603, the memory 601 and the processor 602 can be connected to each other through a bus and communicate with each other. The bus can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.
[0099] Optionally, in a specific implementation, if the memory 601, the processor 602 and the communication interface 603 are integrated on a chip, the memory 601, the processor 602 and the communication interface 603 can communicate with each other through an internal interface.
[0100] The processor 602 may be a CPU (Central Processing Unit), or an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiments of the present application.
[0101] An embodiment of the present application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-mentioned NetFlow lightweight feature representation method.
[0102] An embodiment of the present invention further provides a computer program product, including a computer program, which implements the above NetFlow lightweight feature representation method when executed by a processor.
[0103] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.
[0104] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms are not necessarily directed to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.
[0105] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.
Claims
1. A NetFlow lightweight feature representation method, characterized in that: The following steps are involved: Sample the target IP data packets according to the preset sampling period to obtain the NetFlow data set; Aggregating the NetFlow data satisfying the same flow condition in the NetFlow data set according to a preset five-tuple, and obtaining an aggregation list of NetFlow element pairs according to the aggregation result; The NetFlow element pair aggregation list is expanded by average packet length according to semantics and time sequence to obtain a NetFlow lightweight feature representation.
2. The method according to claim 1, characterized in that The NetFlow element pair aggregation list is obtained according to the aggregation result, including: Based on the aggregation result, determine the total number of data packets and the total number of bytes corresponding to each flow; A plurality of element pairs are formed according to the total number of data packets and the total number of bytes corresponding to each flow, and a NetFlow element pair aggregation list is obtained according to the plurality of element pairs.
3. The method according to claim 2, characterized in that The obtaining a NetFlow element pair aggregation list according to the multiple element pairs includes: The multiple element pairs are arranged according to a preset timestamp sorting strategy to obtain the NetFlow element pair aggregation list.
4. The method according to any one of claims 1 to 3, characterized in that The preset five-tuple includes a source IP address, a destination IP address, a source port number, a destination port number and a protocol number.
5. A NetFlow lightweight feature representation device, characterized in that: include: The sampling module is used to sample the target IP data packets according to the preset sampling period to obtain the NetFlow data set; A processing module, configured to aggregate the NetFlow data satisfying the same flow condition in the NetFlow data set according to a preset five-tuple, and obtain an aggregation list of NetFlow element pairs according to the aggregation result; The expansion module is used to expand the average packet length of the NetFlow element pair aggregation list according to semantics and timing to obtain a NetFlow lightweight feature representation.
6. The device according to claim 5, characterized in that The processing module comprises: A first obtaining unit, configured to determine the total number of data packets and the total number of bytes corresponding to each flow based on the aggregation result; The second obtaining unit is used to form a plurality of element pairs according to the total number of data packets and the total number of bytes corresponding to each flow, and obtain a NetFlow element pair aggregation list according to the plurality of element pairs.
7. The device according to claim 6, characterized in that The second obtaining unit is specifically used for: The multiple element pairs are arranged according to a preset timestamp sorting strategy to obtain the NetFlow element pair aggregation list.
8. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the NetFlow lightweight feature representation method according to any one of claims 1 to 4.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the NetFlow lightweight feature representation method as described in any one of claims 1 to 4.
10. A computer program product, characterized in that It includes a computer program, which, when executed by a processor, is used to implement the NetFlow lightweight feature representation method according to any one of claims 1 to 4.
Citation Information
Cited By
Malicious DoH tunnel traffic detection method and device, and storage medium
CN121125349A