Abnormal network flow detection method

Abstract

The invention relates to the technical field of information security, in particular to an abnormal network traffic detection method. Comprising the following steps: S1, obtaining to-be-detected network flow data, and performing preprocessing to form a to-be-detected data set; s2, constructing an abnormal network traffic detection model, specifically, S21, acquiring original abnormal network traffic data, and performing preprocessing to form an original data set; s22, constructing a teacher model, selecting a BiLSTM model as a basic structure of the teacher model, and training the BiLSTM model by using the original data set to obtain the teacher model; s23, constructing a student model, selecting a one-way LSTM model as the student model, and training the one-way LSTM model by adopting a knowledge distillation algorithm to obtain an abnormal network traffic detection model; s3, inputting a to-be-detected data set into the abnormal network traffic detection model, and outputting a detection result; and the detection speed and the operation efficiency are improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method for detecting abnormal network traffic. Background Art

[0002] With the continuous progress of the information society, the Internet has developed rapidly, which has also led to an explosive growth in network traffic. The sharp increase in network traffic has also brought corresponding security risks, which constantly threatens the information security of the network society. Traditional machine learning methods are no longer sufficient in dealing with abnormal network traffic detection. The commonly used solution is based on deep learning. However, the parameter scale of the abnormal network traffic detection model based on deep learning algorithms is increasing. For resource-constrained devices with limited processing power (embedded devices, network switches, edge devices, etc.), the operating efficiency of the model has become an issue that cannot be ignored.

[0003] BiLSTM is a special recurrent neural network structure that can consider both past and future context information when processing sequence data. BiLSTM increases the model's ability to understand time series data by stacking two LSTM layers together and processing forward and reverse sequence information respectively. Using BiLSTM can greatly improve the model's detection ability and accuracy.

[0004] Knowledge distillation is a model compression algorithm that aims to transfer the knowledge of a large deep learning model (usually called a teacher model) to a smaller and more efficient model (usually called a student model) while minimizing performance loss and constructing a model with similar performance but smaller size and computational complexity. This is very important for deploying models in resource-constrained environments.

[0005] However, in the prior art, there is no method for combining the BiLSTM model with the knowledge distillation algorithm to detect abnormal network traffic, and the parameters of the existing abnormal network traffic detection model are too large, resulting in slow detection speed and low operating efficiency in resource-constrained devices.

[0006] Therefore, there is an urgent need to provide an abnormal network traffic detection method that can improve the detection speed and operating efficiency compared to the existing technology. Summary of the invention

[0007] The present invention solves the technical problems existing in the prior art and provides a method for detecting abnormal network traffic.

[0008] To achieve the above purpose, the technical solution adopted by the present invention is as follows:

[0009] A method for detecting abnormal network traffic comprises the following steps:

[0010] S1. Obtain the network traffic data to be detected, pre-process the network traffic data to be detected, and form a data set to be detected;

[0011] S2. Construct an abnormal network traffic detection model, which specifically includes the following steps:

[0012] S21, obtaining original abnormal network traffic data, and preprocessing the original abnormal network traffic data to form an original data set;

[0013] S22, build a teacher model, select the BiLSTM model as the basic structure of the teacher model, and use the original data set obtained in step S2 to train the BiLSTM model to obtain the teacher model;

[0014] S23, construct a student model, select a unidirectional LSTM model as the student model, use the knowledge distillation algorithm to train the unidirectional LSTM model, and obtain an abnormal network traffic detection model;

[0015] S3: Input the data set to be detected after preprocessing in step S1 into the abnormal network traffic detection model, and output the detection result.

[0016] Furthermore, the structure of the BiLSTM model in step S22 includes a forward LSTM unit, a backward LSTM unit, a fully connected layer, a Softmax layer, and an output layer;

[0017] The forward LSTM unit and the backward LSTM unit are arranged in parallel, the fully connected layer is connected to the forward LSTM unit and the backward LSTM unit at the same time, the Softmax layer is connected to the fully connected layer, and the output layer is connected to the Softmax layer.

[0018] Furthermore, the forward LSTM unit, the backward LSTM unit, and the fully connected layer are all set to be a plurality of units, and a plurality of the forward LSTM units, a plurality of the backward LSTM units, and a plurality of the fully connected layers are set correspondingly.

[0019] Furthermore, S22 specifically includes the following steps:

[0020] S221, taking the original data set as input, and inputting it into the forward LSTM unit and the backward LSTM unit respectively;

[0021] S222, the forward LSTM unit and the backward LSTM unit input their respective output results into the fully connected layer, where they are aggregated to form a multi-channel matrix;

[0022] S223, the fully connected layer processes the obtained multi-channel matrix through the ReLU activation function and inputs it into the Softmax layer for classification to obtain the abnormal network traffic detection result of the teacher model;

[0023] S224. Iterate steps S221-S223 to obtain the teacher model.

[0024] Furthermore, the knowledge distillation algorithm in step S23 specifically includes the following steps:

[0025] S231, input the data in the original data set preprocessed in step S21 into the unidirectional LSTM model, perform forward propagation, and obtain the prediction probability of each data by the unidirectional LSTM model;

[0026] S232, calculating the total loss according to the predicted probability obtained in S231;

[0027] S233, according to the total loss calculated in step S232, a back propagation algorithm is performed to update the weights of the parameters in the unidirectional LSTM model;

[0028] S234, iterate steps S231-S234 until the set number of iterations is reached to obtain an abnormal network traffic detection model.

[0029] Furthermore, the total loss in step S232 is calculated according to the loss function, and the loss function model is expressed as:

[0030] L=αL h +(1-α)L s ;

[0031] In the above formula, L represents the total loss; L h represents the loss of hard labels, which is the prediction loss between the prediction results of the student model and the corresponding data; L s represents the prediction loss of the student model for the soft labels generated by the teacher model; α represents the balance L h and L s The weight coefficient of .

[0032] Furthermore, a temperature value in the knowledge distillation algorithm is set, and based on the Softmax function and the set temperature value, a soft label generated by the teacher model on the original data set is obtained.

[0033] Furthermore, the set temperature value is used to keep the output probability of the teacher model within a set range.

[0034] Furthermore, S21 specifically includes the following steps:

[0035] S211, cutting the acquired original abnormal network traffic data into several sub-data packets of the same size;

[0036] S212, performing a zero-filling operation on the missing part of the field in each sub-data packet, and simultaneously performing a field-filling operation on the truncated data in the same sub-data packet;

[0037] S213, dividing all sub-data packets processed in step S212 into a training set and a test set.

[0038] Furthermore, in step S213, a k-fold cross validation method is used to divide the training set and the test set, and k=10 in the k-fold cross validation method.

[0039] Compared with the prior art, the present invention has the following beneficial effects:

[0040] The present invention uses the BiLSTM model as the teacher model and the unidirectional LSTM model as the student model, and adopts the knowledge distillation algorithm to obtain the abnormal network traffic detection model, performs abnormal detection on the network traffic to be detected, and realizes the compression of the parameters of the abnormal network traffic detection model. While improving the model recognition speed, it minimizes the performance loss and ensures the recognition accuracy of the model, and also has certain versatility. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 is a flow chart of the method of the present invention.

[0042] Figure 2 It is a structural diagram of the BiLSTM model of the present invention.

[0043] Figure 3 It is a flow chart of the knowledge distillation algorithm of the present invention. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0045] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] In the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be fixedly connected, detachably connected, or integrated; it can be directly connected, or indirectly connected through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0047] In addition, if "and / or" or "and / or" appears in the full text, its meaning includes three parallel solutions. Taking "A and / or B" as an example, it includes solution A, solution B, or solutions that satisfy both A and B. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such combination of technical solutions does not exist and is not within the protection scope required by the present invention.

[0048] like Figure 1 As shown, the present invention provides a method for detecting abnormal network traffic, comprising the following steps:

[0049] S1. Obtain the network traffic data to be detected, and pre-process the network traffic data to be detected to form a data set to be detected.

[0050] S2. Construct an abnormal network traffic detection model, which specifically includes the following steps:

[0051] S21, obtaining the original abnormal network traffic data, and preprocessing the original abnormal network traffic data to form an original data set, the original data set includes multiple sub-data sets, the original data set is divided into a training set and a test set, the training set includes part of the sub-data sets, the test set includes the remaining part of the sub-data sets, the training set is used to train the abnormal network traffic detection model, and the test set is used to evaluate the abnormal network traffic detection model. Specifically, the following steps are included:

[0052] S211. The original abnormal network traffic data obtained is data in pcap format, and the original abnormal network traffic data is cut into a plurality of sub-data packets of the same size.

[0053] S212, fill the missing parts of the source address, destination address, protocol number and other fields in each sub-data packet cut in step S211 with zeros, and at the same time fill the fields of the truncated data in the same sub-data packet.

[0054] S213 , using a k-fold cross validation method to divide all sub-data packets processed in step S212 into training sets and test sets, wherein k in the k-fold cross validation method is set to be 10.

[0055] S22. Construct a teacher model and train a deep learning model with more parameters and larger scale as the teacher model. In the embodiment of the present invention, the BiLSTM model is selected as the basic structure of the teacher model.

[0056] like Figure 2 As shown in the figure, the specific structure of the BiLSTM model includes several forward LSTM units, several backward LSTM units, several fully connected layers (FLN), Softmax layers and output layers. Several forward LSTM units, several backward LSTM units and several fully connected layers (FLN) are set one by one. The input end of each forward LSTM unit is connected to a sub-dataset, the output end of each forward LSTM unit is connected to the input end of a fully connected layer, the input end of each backward LSTM unit is connected to a sub-dataset of network traffic, the output end of each backward LSTM unit is connected to the input end of a fully connected layer, the output end of the fully connected layer is connected to the input end of the Softmax layer, the output end of the Softmax layer is connected to the output layer, and several prediction results are output in the output layer.

[0057] The specific construction method of the BiLSTM model is:

[0058] S221. Send the sub-training set in the training data set as input to the forward LSTM unit and the backward LSTM unit respectively, and the corresponding forward LSTM unit and backward LSTM unit input the same sub-training set.

[0059] S222, the forward LSTM unit and the backward LSTM unit input their respective output results into the corresponding fully connected layer, and converge in the fully connected layer to form a multi-channel matrix.

[0060] S223, the fully connected layer processes the obtained multi-channel matrix through the ReLU activation function and inputs it into the Softmax layer for classification to obtain the abnormal network traffic detection result, that is, the predicted probability of each sub-data set;

[0061] S224. Iterate steps S221-S223 to obtain the teacher model.

[0062] S23, construct a student model, train a deep learning model with fewer parameters and smaller scale as the student model, select a unidirectional LSTM model as the basic structure of the student model in the embodiment of the present invention, use the knowledge distillation algorithm to train the unidirectional LSTM model, and obtain an abnormal network data detection model; Figure 2 As shown in Figure 2, the specific steps of the knowledge distillation algorithm are:

[0063] S231. Input the data of the sub-dataset in the original data set preprocessed in step S21 into the student model, perform forward propagation, and obtain the prediction probability of each data by the student model.

[0064] S232. According to the predicted probability obtained in S231, the total loss is calculated. The total loss is calculated according to the loss function. The expression of the loss function model in the student model is set to:

[0065] L=αL h +(1-α)L s ;

[0066] In the above formula, L represents the total loss; L h represents the loss of hard labels, which is the prediction loss between the prediction results of the student model and the data in the corresponding sub-dataset; L s represents the prediction loss of the student model for the soft labels generated by the teacher model; α represents the balance L h and L s The weight coefficient of .

[0067] Among them, in the student model, the temperature value in the knowledge distillation algorithm is set to ensure that the output probability of the teacher model is within the set range. The output probability of the teacher model is within the set range, which means that the output probability of the teacher model is in a smooth range; based on the Softmax function and the temperature value set in step S231, the BiLSTM model constructed in step S22 generates a soft label on the training set, and the soft label is the continuous probability distribution information about the training set.

[0068] S233. According to the total loss calculated in step S232, a back propagation algorithm is performed to update the weights of the parameters in the student model.

[0069] S234, iterate steps S231-S234 until the set number of iterations is reached to obtain an abnormal network traffic detection model.

[0070] S3. Input the network traffic data set to be detected after preprocessing in step S1 into the abnormal network traffic detection model to perform anomaly detection and output the detection result.

[0071] The present invention provides an abnormal network traffic detection method, which uses a BiLSTM model as a teacher model and a unidirectional LSTM model as a student model, uses a knowledge distillation algorithm to obtain an abnormal network traffic detection model, detects the network traffic to be detected, and realizes the compression of parameters of the abnormal network traffic detection model. While improving the model recognition speed, it minimizes the performance loss and ensures the recognition accuracy of the model. The recognition accuracy is high and it also has certain versatility.

[0072] Finally, it should be noted that the above content is only used to illustrate the technical solution of the present invention, rather than to limit the scope of protection of the present invention. Simple modifications or equivalent substitutions of the technical solution of the present invention by ordinary technicians in this field do not deviate from the essence and scope of the technical solution of the present invention.

Claims

1. A method for detecting abnormal network traffic, It is characterized in that The following steps are involved: S1. Obtain the network traffic data to be detected, pre-process the network traffic data to be detected, and form a data set to be detected; S2. Construct an abnormal network traffic detection model, which specifically includes the following steps: S21, obtaining original abnormal network traffic data, and preprocessing the original abnormal network traffic data to form an original data set; S22, build a teacher model, select the BiLSTM model as the basic structure of the teacher model, and use the original data set obtained in step S2 to train the BiLSTM model to obtain the teacher model; S23, construct a student model, select a unidirectional LSTM model as the student model, use the knowledge distillation algorithm to train the unidirectional LSTM model, and obtain an abnormal network traffic detection model; S3: Input the data set to be detected after preprocessing in step S1 into the abnormal network traffic detection model, and output the detection result.

2. The method for detecting abnormal network traffic according to claim 1, It is characterized in that The structure of the BiLSTM model in step S22 includes a forward LSTM unit, a backward LSTM unit, a fully connected layer, a Softmax layer, and an output layer; The forward LSTM unit and the backward LSTM unit are arranged in parallel, the fully connected layer is connected to the forward LSTM unit and the backward LSTM unit at the same time, the Softmax layer is connected to the fully connected layer, and the output layer is connected to the Softmax layer.

3. The abnormal network traffic detection method according to claim 2, It is characterized in that The forward LSTM unit, the backward LSTM unit, and the fully connected layer are all set to be a plurality of units, and the plurality of forward LSTM units, the plurality of backward LSTM units, and the plurality of fully connected layers are set correspondingly.

4. The abnormal network traffic detection method according to claim 2, It is characterized in that S22 specifically includes the following steps: S221, taking the original data set as input, and inputting it into the forward LSTM unit and the backward LSTM unit respectively; S222, the forward LSTM unit and the backward LSTM unit input their respective output results into the fully connected layer, where they are aggregated to form a multi-channel matrix; S223, the fully connected layer processes the obtained multi-channel matrix through the ReLU activation function and inputs it into the Softmax layer for classification to obtain the abnormal network traffic detection result of the teacher model; S224. Iterate steps S221-S223 to obtain the teacher model.

5. The abnormal network traffic detection method according to claim 1, It is characterized in that The knowledge distillation algorithm in step S23 specifically includes the following steps: S231, input the data in the original data set preprocessed in step S21 into the unidirectional LSTM model, perform forward propagation, and obtain the prediction probability of each data by the unidirectional LSTM model; S232, calculating the total loss according to the predicted probability obtained in S231; S233, according to the total loss calculated in step S232, a back propagation algorithm is performed to update the weights of the parameters in the unidirectional LSTM model; S234, iterate steps S231-S234 until the set number of iterations is reached to obtain an abnormal network traffic detection model.

6. The abnormal network traffic detection method according to claim 5, It is characterized in that The total loss in step S232 is calculated based on the loss function, and the loss function model is expressed as: L=αL h +(1-α)L s ; In the above formula, L represents the total loss; L h represents the loss of hard labels, which is the prediction loss between the prediction results of the student model and the corresponding data; L s represents the prediction loss of the student model for the soft labels generated by the teacher model; α represents the balance L h and L s The weight coefficient of .

7. The abnormal network traffic detection method according to claim 6, It is characterized in that in, Set the temperature value in the knowledge distillation algorithm, and obtain the soft labels generated by the teacher model on the original data set based on the Softmax function and the set temperature value.

8. The method for detecting abnormal network traffic according to claim 7, It is characterized in that The set temperature value is used to keep the output probability of the teacher model within the set range.

9. The abnormal network traffic detection method according to claim 1, It is characterized in that S21 specifically includes the following steps: S211, cutting the acquired original abnormal network traffic data into several sub-data packets of the same size; S212, performing a zero-filling operation on the missing part of the field in each sub-data packet, and simultaneously performing a field-filling operation on the truncated data in the same sub-data packet; S213, dividing all sub-data packets processed in step S212 into a training set and a test set.

10. The abnormal network traffic detection method according to claim 9, It is characterized in that In step S213, the k-fold cross validation method is used to divide the training set and the test set, and k in the k-fold cross validation method is set to 10.

Images