Malicious traffic hypothesis detection method and device based on attention mechanism and data enhancement

Abstract

The invention discloses a malicious traffic hypothesis detection method and device based on an attention mechanism and data enhancement, and the method comprises the steps: carrying out the training of an encoder through employing an existing disclosed normal traffic and malicious traffic data set on a network, carrying out the enhancement of training data through a starGAN, and continuing the fine adjustment training of a Transformer. After training is completed, feature information in the traffic is extracted, then KS testing is conducted on the traffic, in the actual traffic detection process, traffic data are preprocessed and then encoded through an encoder to obtain features of the traffic data, then KS hypothesis testing is conducted on the traffic features, the confidence coefficient that the traffic is malicious traffic is given, and through the confidence coefficient hypothesis testing, the traffic is detected to be malicious traffic. Therefore, whether the traffic is malicious traffic can be determined within a certain threshold range. According to the method, malicious countermeasure attacks aiming at traffic and some attacks of unknown methods at present can be effectively prevented, and the accuracy and robustness of detection are improved on the premise of low false alarm rate.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a malicious traffic hypothesis detection method and device based on attention mechanism and data enhancement. Background Art

[0002] With the rapid development and popularization of the Internet, the scale and complexity of network traffic are increasing. At the same time, the means and techniques of network attacks are becoming increasingly complex and diverse, especially the widespread use of encrypted traffic, which enables malware and attackers to carry out malicious activities without being detected. Traditional network traffic detection methods mainly rely on feature extraction and analysis of plaintext data, but the effectiveness of these methods is greatly reduced when facing encrypted traffic. Therefore, how to effectively detect encrypted malicious traffic without compromising data privacy has become an urgent problem to be solved.

[0003] Malicious network traffic attacks are a serious threat to network security, usually carried out through malware, viruses, worms, Trojan horses, phishing attacks, and distributed denial of service (DDoS). These attacks not only cause network systems to collapse, but can also lead to the leakage of a large amount of sensitive information, posing a huge security risk to personal privacy and corporate data. Malware is spread through various means, including email attachments, malicious websites, and infected downloads. Once a user runs malware, the attacker can remotely control the infected computer to steal sensitive information or perform other malicious operations. Computer viruses and worms are self-replicating malicious programs that can automatically spread through the network, not only causing damage to system files, but also causing large-scale network paralysis. Trojan horses are malicious programs disguised as legitimate software. Once installed on a user's computer, the attacker can remotely control the infected system to steal data and tamper with information. Phishing attacks are a type of network fraud that deceives users of sensitive information by pretending to be legitimate institutions or individuals. They usually use fake emails or websites to induce users to enter personal information, thereby committing identity theft and financial fraud. DDoS attacks use a large number of botnets to send a large number of requests to the target server, causing the server to be unable to process legitimate requests normally, and eventually paralyzing the target server.

[0004] In the process of dealing with these complex attack methods, methods based on machine learning and deep learning have shown great potential and advantages in network traffic detection. In practical applications, a single technology is difficult to cope with complex encrypted network traffic detection tasks. In order to improve the accuracy and robustness of detection, researchers have tried to combine methods based on machine learning and deep learning with other technologies to build a comprehensive detection system. However, these methods still face many challenges when dealing with new and ever-changing malicious traffic: feature extraction is difficult. The features of encrypted traffic data are difficult to extract, and traditional feature extraction methods are difficult to adapt to complex encrypted traffic patterns; label noise problem. Label noise is prevalent in network traffic data sets. Incorrect labels will seriously affect the training effect and detection performance of the model; distribution changes. The distribution characteristics of new malicious traffic may be significantly different from those of known malicious traffic, resulting in insufficient generalization ability of the detection model, and thus poor traffic detection results. Summary of the invention

[0005] This paper proposes a malicious traffic hypothesis detection method based on attention mechanism and data enhancement to solve the problems of feature extraction difficulties, label noise and insufficient generalization ability of detection models caused by distribution changes in the existing technology when processing encrypted traffic.

[0006] The technical solution adopted by the present invention is as follows:

[0007] The first aspect provides a malicious traffic hypothesis detection method based on attention mechanism and data enhancement, including:

[0008] Obtain public normal traffic and malicious traffic data sets to construct original training data;

[0009] The DBSCAN clustering algorithm is used to estimate the data distribution of the original training data, and the data is re-labeled according to the clustering results of the DBSCAN clustering algorithm. The re-labeled samples are trained and predicted using the random forest classifier to obtain the corrected training data.

[0010] Use StarGAN to perform data enhancement on the corrected training data to obtain data enhanced training data;

[0011] The Transformer model is fine-tuned using the data-enhanced training data to obtain a traffic detection model.

[0012] The traffic detection model is used to extract characteristic information from the traffic to be detected, and the KS test is performed based on the extracted characteristic information.

[0013] In one implementation, the DBSCAN clustering algorithm is used to estimate the data distribution of the original training data, and the data is re-labeled according to the clustering results of the DBSCAN clustering algorithm. The re-labeled samples are trained and predicted using a random forest classifier to obtain corrected training data, including:

[0014] Use the DBSCAN clustering algorithm to cluster the original training data and estimate the distribution of the data;

[0015] According to the DBSCAN clustering results, the samples in the high-density area are re-marked as normal samples, and the samples in the low-density area are marked as malicious samples. The area above the density threshold is the high-density area, and the area below the density threshold is the low-density area.

[0016] The relabeled samples are trained and predicted using a random forest classifier, and the labels of the decision boundary samples are corrected to obtain the corrected training data, where the decision boundary samples are samples at the boundary between the high-density area and the low-density area when clustering is performed using the DBSCAN clustering algorithm.

[0017] In one embodiment, the original training data is clustered using the DBSCAN clustering algorithm to estimate the distribution of the data, including:

[0018] Set the minimum number of samples minPts and the distance threshold ∈, and calculate the regional density of the sample data point p according to the formula D(p) = {q∈D|dist(p,q)≤∈}, where p and q are two sample data points, D represents the data set consisting of the original training data, D(p) represents the cluster with p as the core, that is, the regional density of the sample data point p, and dist(p,q) represents the distance between two sample data points.

[0019] In one implementation, StarGAN is used to perform data enhancement on the corrected training data to obtain data-enhanced training data, including:

[0020] Define the target area for data enhancement based on the distribution of malicious data and normal data;

[0021] Use StarGAN to generate new data so that its distribution conforms to the distribution characteristics of the target area;

[0022] The generated new data is combined with the corrected training data to obtain data-enhanced training data.

[0023] In one implementation, the Transformer model is fine-tuned using the data-enhanced training data to obtain a traffic detection model, including:

[0024] Convert the augmented training data into embedding vectors;

[0025] The encoder of the Transformer model is used to process the embedding vector to capture the complex patterns in the sequence data and generate the encoded feature vector F;

[0026] Use the decoder of the Transformer model to restore the encoded feature vector and generate a restored vector R = Decoder (F), where Decoder represents the decoder;

[0027] A combination of self-supervised learning and supervised learning is used to fine-tune and train the model to obtain a traffic detection model.

[0028] In one embodiment, when fine-tuning and training the model using a combination of self-supervised learning and supervised learning, the calculated losses include the reconstruction loss of the encoder and decoder, and the spherical loss during encoder encoding, wherein the spherical loss during encoder encoding is used to restrict normal traffic samples within the sphere and exclude malicious traffic samples from outside the sphere.

[0029] In one implementation, the flow detection model is used to extract flow characteristic information in the flow to be detected, and a KS test is performed based on the extracted characteristic information, including:

[0030] Pre-process the traffic to be detected.

[0031] The pre-processed traffic to be detected is encoded through the traffic detection model to extract the corresponding traffic feature information;

[0032] The KS hypothesis test is used on the traffic characteristics to give the confidence that the traffic is malicious traffic, and a hypothesis test is performed to calculate the test value. If the test value is above the threshold, the traffic to be detected is determined to be malicious traffic, otherwise, the traffic to be detected is determined to be normal traffic.

[0033] Based on the same inventive concept, the second aspect of the present invention provides a malicious traffic hypothesis detection device based on attention mechanism and data enhancement, comprising:

[0034] The data acquisition module is used to obtain public normal traffic and malicious traffic data sets to construct original training data;

[0035] The label correction module is used to estimate the data distribution of the original training data using the DBSCAN clustering algorithm, re-label the data according to the clustering results of the DBSCAN clustering algorithm, and use the random forest classifier to train and predict the re-labeled samples to obtain the corrected training data;

[0036] A data enhancement module is used to enhance the corrected training data using StarGAN to obtain data-enhanced training data;

[0037] The fine-tuning training module is used to fine-tune the Transformer model using the data-enhanced training data to obtain a traffic detection model;

[0038] The flow detection module is used to extract characteristic information from the flow to be detected by using the flow detection model, and perform KS inspection based on the extracted characteristic information.

[0039] Based on the same inventive concept, the third aspect of the present invention provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the malicious traffic hypothesis detection method based on attention mechanism and data enhancement described in the first aspect is implemented.

[0040] Based on the same inventive concept, the fourth aspect of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the malicious traffic hypothesis detection method based on attention mechanism and data enhancement described in the first aspect is implemented.

[0041] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows:

[0042] The present invention provides a malicious traffic hypothesis detection method based on attention mechanism and data enhancement. First, the public normal traffic and malicious traffic data sets are obtained to construct original training data, and label noise correction and data enhancement are performed using DBSCAN clustering and StarGAN. The training data after data enhancement is then used to fine-tune the Transformer model to obtain a traffic detection model. Finally, the traffic detection model is used to determine whether the traffic is malicious traffic through KS test, and the feature extractor (encoder of the Transformer model) is reused, avoiding the training cost of reintroducing a classifier in the traditional recognition method. The accuracy and robustness of detection are improved under the premise of low false alarm rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0044] Figure 1A training flow chart of an encoder of a Transformer model provided in an embodiment of the present invention;

[0045] Figure 2 This is a flow chart of using a trained detection model to perform actual malicious traffic detection in an embodiment of the present invention. DETAILED DESCRIPTION

[0046] In the process of dealing with complex attack methods in existing technologies, methods based on machine learning and deep learning have shown great potential and advantages in network traffic detection. In particular, the Transformer model has become an ideal choice for processing network traffic data due to its powerful sequence modeling capabilities and parallel computing capabilities. The Transformer architecture can capture long-range dependencies and complex patterns in sequence data through the self-attention mechanism, which is very suitable for processing network traffic data. Its encoder and decoder structure has significant advantages in feature extraction and data restoration. The encoder converts the input data into an embedding vector and processes it through multiple layers of self-attention and feedforward neural networks to capture complex sequence patterns. The decoder attempts to restore the feature vector generated by the encoder to the original data, thereby improving the accuracy of feature extraction through self-supervised learning. The self-attention mechanism captures global dependencies and improves the quality of feature representation by calculating the association weights of each position with other positions in the input sequence.

[0047] DBSCAN is a density-based clustering algorithm that can effectively discover clusters of arbitrary shapes and identify noise points. DBSCAN determines whether data points belong to the same cluster by setting a distance threshold and a minimum number of samples. The algorithm performs well in clustering analysis and label noise correction of network traffic data. Density estimation determines whether a data point is a core point, a boundary point, or a noise point by calculating the neighborhood density of the data point; cluster formation clusters adjacent core points and boundary points into clusters based on the density connectivity of the core points and boundary points; label correction relabels normal samples and malicious samples through clustering results to improve data quality.

[0048] Random forest is an ensemble learning method that improves the accuracy and robustness of classification and regression by building multiple decision trees and combining their output results. Random forest has significant advantages in processing high-dimensional data and dealing with label noise, and is widely used in network traffic classification tasks. Decision tree construction constructs multiple decision trees by randomly selecting samples and features to reduce the overfitting of the model. The voting mechanism combines the classification results of all decision trees and determines the final classification result through the voting mechanism to improve the stability and accuracy of the model. Noise processing reduces the sensitivity of a single decision tree to noise data through the integration of multiple trees, and improves the robustness of the overall model.

[0049] In order to improve the accuracy and robustness of detection, the present invention combines the above technologies to construct a comprehensive detection system. The Transformer model can be used for feature extraction to generate high-quality feature vectors by capturing complex traffic patterns; the DBSCAN clustering algorithm can identify and correct label noise to improve data quality; the random forest classifier can further improve the accuracy and robustness of detection.

[0050] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] Embodiment 1

[0052] The present invention discloses a malicious traffic hypothesis detection method based on attention mechanism and data enhancement, comprising:

[0053] S1: Obtain public normal traffic and malicious traffic datasets to construct original training data;

[0054] S2: Use the DBSCAN clustering algorithm to estimate the data distribution of the original training data, re-label it according to the clustering results of the DBSCAN clustering algorithm, and use the random forest classifier to train and predict the re-labeled samples to obtain the corrected training data;

[0055] S3: Use StarGAN to perform data enhancement on the corrected training data to obtain data enhanced training data;

[0056] S4: Use the data-enhanced training data to fine-tune the Transformer model to obtain a traffic detection model;

[0057] S5: extract characteristic information from the traffic to be detected using the traffic detection model, and perform a KS test based on the extracted characteristic information.

[0058] Specifically, S1 constructs original training data by collecting normal traffic and malicious traffic datasets publicly available on the Internet.

[0059] In S2, the DBSCAN clustering algorithm calculates the regional density of each data point by setting the distance threshold ∈ and the minimum number of samples minPts, and then distinguishes high-density and low-density areas through the density threshold, relabels the samples in each area, and further uses the random forest classifier to correct the labels of the decision boundary samples.

[0060] S3 uses StarGAN to generate new data to enhance the original training data. The generator network of StarGAN generates new malicious traffic data and normal traffic data according to different target areas, and combines these new data with the original training data to obtain data-enhanced training data.

[0061] S4 uses the data-augmented training data obtained in S3 to perform fine-tuning training on the model.

[0062] S5 is a specific application of the detection model, which uses the encoder of the flow detection model to extract the characteristic information in the flow to be detected, and then performs the KS test.

[0063] In one implementation, the DBSCAN clustering method is used to correct label noise on the original training data to obtain corrected training data, including:

[0064] Use the DBSCAN clustering algorithm to cluster the original training data and estimate the distribution of the data;

[0065] According to the DBSCAN clustering results, the samples in the high-density area are re-marked as normal samples, and the samples in the low-density area are marked as malicious samples. The area above the density threshold is the high-density area, and the area below the density threshold is the low-density area.

[0066] The relabeled samples are trained and predicted using a random forest classifier, and the labels of the decision boundary samples are corrected to obtain the corrected training data, where the decision boundary samples are samples at the boundary between the high-density area and the low-density area when clustering is performed using the DBSCAN clustering algorithm.

[0067] In the specific implementation process, the DBSCAN clustering algorithm identifies high-density areas and low-density areas by setting the distance threshold ∈ and the minimum number of samples minPts.

[0068] When re-marking, the density threshold ρ is first set, and the area above the density threshold is regarded as a high-density area, and the area below the density threshold is regarded as a low-density area.

[0069] The specific implementation process of using the random forest classifier to train and predict the re-labeled samples and correct the labels of the decision boundary samples includes:

[0070] Construct a random forest classifier RF;

[0071] The encoded feature vector F obtained by the Transformer model encoder is used to train the classifier RF.

[0072] Use the trained classifier RF to perform label correction on the remaining samples (decision boundary samples) to obtain the corrected label set

[0073] In one embodiment, the original training data is clustered using the DBSCAN clustering algorithm to estimate the distribution of the data, including:

[0074] Set the minimum number of samples minPts and the distance threshold ∈, and calculate the regional density of the sample data point p according to the formula D(p) = {q∈D|dist(p,q)≤∈}, where p and q are two sample data points, D represents the data set consisting of the original training data, D(p) represents the cluster with p as the core, that is, the regional density of the sample data point p, and dist(p,q) represents the distance between two sample data points.

[0075] Among them, dist(p,q) is calculated as follows:

[0076]

[0077] Where p(x i ) represents the probability distribution of the sample data point p on the i-th feature. i ) indicates that the sample data point q is in the

[0078] Probability distribution on i features, n is the feature length, i∈[1,n].

[0079] In one implementation, StarGAN is used to perform data enhancement on the corrected training data to obtain data-enhanced training data, including:

[0080] Define the target area for data enhancement based on the distribution of malicious data and normal data;

[0081] Use StarGAN to generate new data so that its distribution conforms to the distribution characteristics of the target area;

[0082] The generated new data is combined with the corrected training data to obtain data-enhanced training data.

[0083] Specifically, the generated new data (new samples) meet the following conditions:

[0084] New samples are generated in the normal data boundary area, and the generation area is set to Ω NB , the corresponding probability density function is p N (x), the new sample should meet the following requirements:

[0085] x∈Ω NB And ρ≤p N (x)

[0086] Where ρ is the density threshold and x is the new sample.

[0087] New samples are generated in the malicious data boundary area, and the generation area is set to Ω MB , the corresponding probability density function is p M (x), the new sample should meet the following requirements:

[0088] x∈Ω MB And ∈≤p M (x)≤ρ

[0089] Where ∈ is the distance threshold mentioned above.

[0090] New samples are generated in an area far away from all data, and the generation area is set to Ω MO , the corresponding probability density function is p O (x), the new sample should meet the following requirements:

[0091] x∈Ω MO And p O (x)<∈

[0092] Among the newly generated samples, samples generated in the normal data boundary area are marked as normal samples, and the other two types of samples (generated in the malicious data boundary area and generated in the area far away from all data) are marked as malicious samples. The newly generated samples and the corrected training data constitute enhanced training data for subsequent model fine-tuning training.

[0093] In one implementation, the Transformer model is fine-tuned using the data-enhanced training data to obtain a traffic detection model, including:

[0094] Convert the augmented training data into embedding vectors;

[0095] The encoder of the Transformer model is used to process the embedding vector to capture the complex patterns in the sequence data and generate the encoded feature vector F;

[0096] Use the decoder of the Transformer model to restore the encoded feature vector and generate a restored vector R = Decoder (F), where Decoder represents the decoder;

[0097] A combination of self-supervised learning and supervised learning is used to fine-tune and train the model to obtain a traffic detection model.

[0098] Specifically, the traffic detection model uses the Transformer architecture for feature extraction, and combines self-supervised learning with supervised learning to encode and restore network traffic data, converting the traffic data into feature vectors.

[0099] In the specific implementation process, the training data after data enhancement X={x1,x2,…,x n} is converted to an embedding vector E = {e1, e2, …, e n}, where x i is the flow data, e i is the embedding vector. Where n is the length of the vector, i∈[1,n].

[0100] The embedded vector is then processed using a multi-layer Transformer encoder to capture the complex patterns in the sequence data and generate an encoded feature vector F = Encoder (E), where F = {f1, f2, …, f n}, where f i is the i-th flow feature;

[0101] Then use the decoder Decoder to try to restore the encoded feature vector and generate a restored vector R = Decoder (F).

[0102] In one embodiment, when fine-tuning and training the model using a combination of self-supervised learning and supervised learning, the calculated losses include the reconstruction loss of the encoder and decoder, and the spherical loss during encoder encoding, wherein the spherical loss during encoder encoding is used to restrict normal traffic samples within the sphere and exclude malicious traffic samples from outside the sphere.

[0103] Specifically, a training method combining self-supervised learning and supervised learning is adopted, including self-supervised learning loss and supervised learning loss. The self-supervised learning loss is the reconstruction loss of the encoder and decoder. The cross entropy loss function is used to penalize the original data and the restored data. The reconstruction loss function is defined as:

[0104]

[0105] Among them, x i represents the input sample, represents the i-th flow data of the input, n represents the number of flow data (the length of the vector composed of flow data), The restored data.

[0106] The supervised learning loss is the spherical loss when the encoder is encoding. The spherical loss is used to constrain the encoded feature vector. The feature vector F of the normal flow normal In the sphere, the characteristic vector F of malicious traffic malicious Placed outside the sphere. For a normal flow sample, the loss is defined as:

[0107]

[0108] For malicious traffic samples, the loss is defined as:

[0109]

[0110] Where c is the center of the sphere, R is the radius of the sphere, v is a hyperparameter that controls the relative strength of the two items, and x i is the input sample, and N is the number of samples in the data set.

[0111] Total loss function Defined as:

[0112]

[0113] Among them, λ1 and λ2 are weight coefficients.

[0114] In one implementation, the flow detection model is used to extract flow characteristic information in the flow to be detected, and a KS test is performed based on the extracted characteristic information, including:

[0115] Pre-process the traffic to be detected.

[0116] The pre-processed traffic to be detected is encoded through the traffic detection model to extract the corresponding traffic feature information;

[0117] The KS hypothesis test is used on the traffic characteristics to give the confidence that the traffic is malicious traffic, and a hypothesis test is performed to calculate the test value. If the test value is above the threshold, the traffic to be detected is determined to be malicious traffic, otherwise, the traffic to be detected is determined to be normal traffic.

[0118] In the specific implementation process, the input data X ts Use Transformer encoder to encode and get the feature vector F ts =Encoder(X ts ), and because the spherical loss is introduced during training, the distance between its feature and the center of the sphere is determined:

[0119]

[0120] It should be noted that the distance between the feature and the center of the sphere is used as an indicator for evaluating each sample in the subsequent hypothesis test, that is, the hypothesis test is performed on the data of the distance from the feature of the sample to the center of the sphere in the subsequent test.

[0121] Based on the distance between the above-calculated feature and the center of the sphere, a hypothesis test is performed. In this embodiment, there is a null hypothesis H0: the sample is normal traffic. An alternative hypothesis H1: the sample is malicious traffic. Given a significance level α, the null hypothesis is rejected if the following formula is satisfied:

[0122]

[0123] Where F(x) and G(x) represent the empirical distribution functions of malicious samples and clean samples respectively, and l and m are the sizes of the two samples. is the critical value of the KS distribution under the significance level α, where k is the index symbol of the sum, k∈[1,∞). One meaning of the significance level α is the probability of rejecting the null hypothesis incorrectly, that is, the false positive rate.

[0124] The present invention mainly uses the self-attention mechanism to realize feature extraction and hypothesis testing to realize the identification of malicious traffic, and introduces clustering methods and data enhancement to strengthen the feature identification and extraction of traffic, and realizes a malicious traffic identification system with low false positives and high accuracy. This method can achieve high robustness under low-quality training data sets.

[0125] In the specific implementation process, the method provided by the present invention should be implemented with the help of computer software technology. Figure 1 The embodiment takes training a Transformer feature extractor as an example to specifically illustrate the process of the present invention, as follows:

[0126] First, we build a neural network using Python programming and the PyTorch framework, where the Transformer model can be directly called from the torch library. Then we can connect the neural networks in series.

[0127] Then we need to define the loss of model training. The loss refers to the loss function described in the previous article. Three losses need to be defined respectively:

[0128] The first loss is the reconstruction loss of the Encoder and Decoder training. The Encoder trains the traffic input data E = {e1, e2, ..., e n} is encoded to extract its potential features F, and the Decoder attempts to restore the original traffic input data by restoring the features encoded by the Encoder. The difference between the original input data and the data decoded by the Decoder is calculated through the cross entropy loss to measure the level of Encoder encoding and Decoder decoding. The smaller the loss, the higher the level of Encoder encoding and Decoder decoding, that is, both have learned the potential features of the input data well. The prefix feature F encoded by the Encoder can well represent the input data in the latent space.

[0129] The second and third losses are spherical losses during encoder encoding, which aim to limit normal samples to the sphere and exclude malicious traffic samples from the sphere. The sphere center c needs to be initialized, usually using random initialization or all-0 initialization. In actual operation training, multiple attempts should be made to initialize and find the best location of the sphere center.

[0130] Superimposing the three losses requires manually setting the values ​​of the hyperparameters λ1 and λ2, and adjusting the values ​​of the hyperparameters multiple times during the training process to find the best relationship between the three so that the feature extractor can best learn how to extract features.

[0131] Since self-supervised learning is the main method and supervised learning is used as an aid, λ1 and λ2 should generally be set to be less than 1. That is, it is recommended to start from 0.1 or 0.001 and find the optimal weights through continuous adjustment.

[0132] The Transformer is trained using this loss for 500 epochs, and then the Encoder is used for subsequent feature extraction.

[0133] The trained Encoder will be used for feature extraction in actual traffic detection. Encoder is used to extract traffic features in the data set and then cluster them. Generally, since there are fewer malicious traffic samples, the minimum number of samples minPts should be set to 0, the distance threshold ∈ is set to 0.1, and then the density threshold ρ is set to 1. The above three parameters should also be trained multiple times in actual operation to find the best parameter values.

[0134] Then it needs to be used in the subsequent random forest classification process. Train a classifier to reverse the labels of samples that may have incorrect labels and obtain samples with correct labels.

[0135] Based on the obtained data set of correctly labeled samples (corrected training data), starGAN is trained. Since traffic has multiple characteristics, conventional GAN ​​is abandoned and starGAN is adopted in the hope that it can learn different characteristics and perform well in predicting unknown malicious traffic. StarGAN training requires training a Generator (generator network) and a Discriminator (discriminator network). The goal of Generator training is to generate three different types of data, namely: normal samples, malicious traffic samples, and samples on the decision boundary; the goal of Discriminator training is to identify whether the samples generated by the Generator have the same characteristics as the original data, that is, whether the data generated by it is as effective as the real data. The loss of Generator training is to reduce the discriminator's ability to discriminate the data generated by it, that is, to try to make the Discriminator unable to distinguish the difference between the data generated by it and the original data; the loss of Discriminator is to distinguish the data generated by the Generator from the original data, that is, to try to distinguish the original data from the data generated by the Generator. The training of the two is carried out separately. In each round of training, the Discriminator is trained first. Suppose it is trained for 100 epochs so that it can distinguish the original data from the data generated by the Generator. Then the Discriminator is fixed and the Generator is trained to generate data that cannot be distinguished by the Discriminator. It is also trained for 100 epochs. This cycle is repeated for a total of 500 epochs. StarGAN uses the Generator to generate new sample data for Transformer to fine-tune the training again by learning the feature information data obtained by the encoder. It is worth noting that the training process of GAN is highly random and often cannot produce good results. It takes multiple attempts to train to obtain better results.

[0136] Based on the obtained Generator, use it to generate new data, add it to the original training set, and use the new data set (training data after data enhancement) to fine-tune the Transformer. The fine-tuning process has been introduced in the previous article, so that the Transformer has good performance on the new data set. At this time, it means that the feature extractor training is completed.

[0137] Based on the above training process, the trained Encoder can be deployed to the system that needs to perform traffic detection. For the verification process, please refer to Figure 2 , including the following processes:

[0138] The intercepted traffic is encoded in latent space to obtain Embedding, which is then used as input to the Encoder to encode the latent feature F of the traffic. Then, the distance s from the center of the spherical loss is calculated, and then the significance level α is set according to the hypothesis test steps, which is the false alarm level required in actual use. It is generally set to 0.05. In this case, it is considered that 95% of the traffic data reported as malicious traffic is malicious traffic, and its accuracy level is relatively high. Then the traffic data is mixed with the clean sample, and N times of sampling without replacement and KS test are performed. The KS test directly calls the function ks_2samp in the SciPy library. This function is used for the distribution of two independent samples to determine whether they come from the same distribution. Through this function, it can be analyzed whether the sample and the clean sample belong to the same distribution, that is, under the condition of the significance level, it can be judged whether the sample is a normal traffic sample. The function returns the p value, which represents the probability of observing the current KS statistic or a more extreme statistic when the null hypothesis is true. The smaller the p value, the more reason there is to reject the null hypothesis. A KS statistic is also returned, which measures the maximum difference between the cumulative distribution functions of two samples. The larger the value, the greater the difference in the distribution of the two samples. By setting the threshold in advance, normal traffic samples and malicious traffic samples can be distinguished. In actual operation, the setting of the threshold needs to be determined through multiple experiments based on different data sets and different requirements for actual traffic interception.

[0139] Based on the above method, by training the feature extractor and deploying it to the system, and calculating the traffic features and then performing the KS test on it, it is possible to judge malicious traffic with high accuracy, which has strong practical significance. In general, in order to monitor some malicious traffic in network traffic and protect the server from being attacked by malicious traffic, the present invention discloses a method and system based on deep learning to extract features in traffic by using Transformer, and trying to find the interface between normal traffic and malicious traffic and divide them through spherical boundaries. Before the system is deployed, it is necessary to first train the encoder using the existing publicly available normal traffic and malicious traffic data sets on the network, and then enhance the training data through starGAN, and then continue to fine-tune the Transformer training. After the training is completed, the feature information in the traffic is extracted and then the KS test is performed on the device. Then, normal samples can be distinguished from malicious samples with high confidence, and then it can be deployed in the server traffic detection program. In the actual traffic detection process, the traffic data is first pre-processed and then encoded by the encoder to obtain its features. Then, the KS hypothesis test is used on the traffic features to give the confidence that the traffic is malicious traffic. Through the confidence hypothesis test, it can be determined within a certain threshold range whether the traffic is malicious traffic. Since the present invention adopts a method for finding the interface between normal samples and malicious samples to classify them, it can effectively prevent malicious confrontation attacks on traffic and some attacks by currently unknown methods to a certain extent.

[0140] Embodiment 2

[0141] Based on the same inventive concept, this embodiment discloses a malicious traffic hypothesis detection device based on attention mechanism and data enhancement, including:

[0142] The data acquisition module is used to obtain public normal traffic and malicious traffic data sets to construct original training data;

[0143] The label correction module is used to estimate the data distribution of the original training data using the DBSCAN clustering algorithm, re-label the data according to the clustering results of the DBSCAN clustering algorithm, and use the random forest classifier to train and predict the re-labeled samples to obtain the corrected training data;

[0144] A data enhancement module is used to enhance the corrected training data using StarGAN to obtain data-enhanced training data;

[0145] The fine-tuning training module is used to fine-tune the Transformer model using the data-enhanced training data to obtain a traffic detection model;

[0146] The flow detection module is used to extract characteristic information from the flow to be detected by using the flow detection model, and perform KS inspection based on the extracted characteristic information.

[0147] Since the device introduced in the second embodiment of the present invention is a device used to implement the malicious traffic hypothesis detection method based on the attention mechanism and data enhancement in the first embodiment of the present invention, based on the method introduced in the first embodiment of the present invention, the person skilled in the art can understand the specific structure and deformation of the device, so it is not repeated here. All devices used in the method in the first embodiment of the present invention belong to the scope of protection of the present invention.

[0148] Embodiment 3

[0149] Based on the same inventive concept, the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method described in the first embodiment is implemented.

[0150] Since the computer-readable storage medium introduced in the third embodiment of the present invention is a computer-readable storage medium used to implement the malicious traffic hypothesis detection method based on the attention mechanism and data enhancement in the first embodiment of the present invention, based on the method introduced in the first embodiment of the present invention, the person skilled in the art can understand the specific structure and deformation of the computer-readable storage medium, so it is not repeated here. All computer-readable storage media used in the method of the first embodiment of the present invention belong to the scope of protection of the present invention.

[0151] Embodiment 4

[0152] The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in Embodiment 1 when executing the program.

[0153] Since the computer device introduced in the fourth embodiment of the present invention is a computer device used to implement the malicious traffic hypothesis detection method based on the attention mechanism and data enhancement in the first embodiment of the present invention, based on the method introduced in the first embodiment of the present invention, the person skilled in the art can understand the specific structure and deformation of the computer device, so it is not repeated here. All computer devices used in the method of the first embodiment of the present invention belong to the scope of protection of the present invention.

[0154] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0155] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0156] Although preferred embodiments of the present invention have been described, additional changes and modifications may be made to these embodiments by those skilled in the art once the basic creative concepts are known. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention. Obviously, those skilled in the art may make various changes and modifications to the embodiments of the present invention without departing from the spirit and scope of the embodiments of the present invention. Thus, if these modifications and variations of the embodiments of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A malicious traffic hypothesis detection method based on attention mechanism and data enhancement, It is characterized in that include: Obtain public normal traffic and malicious traffic data sets to construct original training data; The DBSCAN clustering algorithm is used to estimate the data distribution of the original training data, and the data is re-labeled according to the clustering results of the DBSCAN clustering algorithm. The re-labeled samples are trained and predicted using the random forest classifier to obtain the corrected training data. Use StarGAN to perform data enhancement on the corrected training data to obtain data enhanced training data; The Transformer model is fine-tuned using the data-enhanced training data to obtain a traffic detection model. The traffic detection model is used to extract characteristic information from the traffic to be detected, and the KS test is performed based on the extracted characteristic information.

2. The malicious traffic hypothesis detection method based on attention mechanism and data enhancement as claimed in claim 1, It is characterized in that The DBSCAN clustering algorithm is used to estimate the data distribution of the original training data, and the data is re-labeled according to the clustering results of the DBSCAN clustering algorithm. The re-labeled samples are trained and predicted using the random forest classifier to obtain the corrected training data, including: Use the DBSCAN clustering algorithm to cluster the original training data and estimate the distribution of the data; According to the DBSCAN clustering results, the samples in the high-density area are re-marked as normal samples, and the samples in the low-density area are marked as malicious samples. The area above the density threshold is the high-density area, and the area below the density threshold is the low-density area. The relabeled samples are trained and predicted using a random forest classifier, and the labels of the decision boundary samples are corrected to obtain the corrected training data, where the decision boundary samples are samples at the boundary between the high-density area and the low-density area when clustering is performed using the DBSCAN clustering algorithm.

3. The malicious traffic hypothesis detection method based on attention mechanism and data enhancement as claimed in claim 1, It is characterized in that Use the DBSCAN clustering algorithm to cluster the original training data and estimate the distribution of the data, including: Set the minimum number of samples minPts and the distance threshold ∈, and calculate the regional density of the sample data point p according to the formula D(p) = {q∈D|dist(p,q)≤∈}, where p and q are two sample data points, D represents the data set consisting of the original training data, D(p) represents the cluster with p as the core, that is, the regional density of the sample data point p, and dist(p,q) represents the distance between two sample data points.

4. The malicious traffic hypothesis detection method based on attention mechanism and data enhancement as claimed in claim 1, It is characterized in that StarGAN is used to perform data enhancement on the corrected training data to obtain data-enhanced training data, including: Define the target area for data enhancement based on the distribution of malicious data and normal data; Use StarGAN to generate new data so that its distribution conforms to the distribution characteristics of the target area; The generated new data is combined with the corrected training data to obtain data-enhanced training data.

5. The malicious traffic hypothesis detection method based on attention mechanism and data enhancement as claimed in claim 1, It is characterized in that The Transformer model is fine-tuned using the data-enhanced training data to obtain a traffic detection model, including: Convert the augmented training data into embedding vectors; The encoder of the Transformer model is used to process the embedding vector to capture the complex patterns in the sequence data and generate the encoded feature vector F; Use the decoder of the Transformer model to restore the encoded feature vector and generate a restored vector R = Decoder (F), where Decoder represents the decoder; A combination of self-supervised learning and supervised learning is used to fine-tune and train the model to obtain a traffic detection model.

6. The malicious traffic hypothesis detection method based on attention mechanism and data enhancement as claimed in claim 5, It is characterized in that When fine-tuning and training the model using a combination of self-supervised learning and supervised learning, the calculated losses include the reconstruction loss of the encoder and decoder, and the spherical loss during encoder encoding. The spherical loss during encoder encoding is used to restrict normal traffic samples within the sphere and exclude malicious traffic samples from the sphere.

7. The malicious traffic hypothesis detection method based on attention mechanism and data enhancement as claimed in claim 1, It is characterized in that The traffic detection model is used to extract traffic feature information from the traffic to be detected, and a KS test is performed based on the extracted feature information, including: Pre-process the traffic to be detected. The pre-processed traffic to be detected is encoded through the traffic detection model to extract the corresponding traffic feature information; The KS hypothesis test is used on the traffic characteristics to give the confidence that the traffic is malicious traffic, and a hypothesis test is performed to calculate the test value. If the test value is above the threshold, the traffic to be detected is determined to be malicious traffic, otherwise, the traffic to be detected is determined to be normal traffic.

8. A malicious traffic hypothesis detection device based on attention mechanism and data enhancement, It is characterized in that include: The data acquisition module is used to obtain public normal traffic and malicious traffic data sets to construct original training data; The label correction module is used to estimate the data distribution of the original training data using the DBSCAN clustering algorithm, re-label the data according to the clustering results of the DBSCAN clustering algorithm, and use the random forest classifier to train and predict the re-labeled samples to obtain the corrected training data; A data enhancement module is used to enhance the corrected training data using StarGAN to obtain data-enhanced training data; The fine-tuning training module is used to fine-tune the Transformer model using the data-enhanced training data to obtain a traffic detection model; The flow detection module is used to extract characteristic information from the flow to be detected by using the flow detection model, and perform KS inspection based on the extracted characteristic information.

9. A computer-readable storage medium having a computer program stored thereon, It is characterized in that When the program is executed by a processor, the malicious traffic hypothesis detection method based on attention mechanism and data enhancement as described in any one of claims 1 to 7 is implemented.

10. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, It is characterized in that When the processor executes the program, the malicious traffic hypothesis detection method based on attention mechanism and data enhancement is implemented as described in any one of claims 1 to 7.

Images