Stable access method of IMS switched network based on GAN

Abstract

The invention provides a stable access method of an IMS (IP Multimedia Subsystem) switching network based on a GAN (Generic Area Network). The stable access method comprises the following steps: step 1, carrying out architecture reconstruction design on an IMS; 2, combining a Pcap data server and a GAN (Generative Adversarial Network) model to carry out network abnormal event detection; and step 3, establishing an ABPcapGAN model, and carrying out anomaly detection based on the PcapGAN. According to the method, the detection capability of unknown abnormal events in a complex network environment can be enhanced, so that the overall stability and safety of the IMS network are effectively improved.

Description

Technical Field

[0001] The present invention relates to the fields of information and communication technology and deep learning, and in particular to a GAN-based IMS switching network stability access method. Background Art

[0002] In the current network environment, ensuring seamless evolution and service continuity of heterogeneous networks is crucial for wireless user devices to switch freely between various networks and access rich voice and data services. IP Multimedia Subsystem (IMS) plays a core role in high-quality voice and multimedia communication services with its architecture design based on IP protocol and open standard interface. However, as the scale of networks becomes larger and more complex, IMS switching networks face more and more security threats and anomaly detection challenges, such as video surveillance, network system security, and fraud detection.

[0003] Traditional intrusion detection systems (IDS) use supervised machine learning methods (such as decision trees, support vector machines, etc.) to detect anomalies, but these methods have limited performance when dealing with high-dimensional features and complex network data. In addition, it is difficult and expensive to obtain a large amount of labeled malicious traffic data. Therefore, how to use unsupervised deep learning methods to detect malicious attack traffic has become a hot research direction in the field of network security. By learning normal traffic features to automatically detect abnormal traffic, the need for a large amount of labeled data is avoided.

[0004] However, the ever-changing cyber threats make it very difficult to collect enough malicious samples to train deep learning classifiers for good generalization. The limitation of supervised learning methods is that their detection capabilities are limited to the known attack types during training, and it is difficult to capture unknown threats. To this end, the exploration of anomaly-based unsupervised intrusion detection systems has been widely studied, which avoids the expensive operation of obtaining malicious samples by utilizing large-scale normal data. Although such systems are able to detect novel or mutated attacks, they have a high false alarm rate.

[0005] To overcome the challenge of high false alarm rate, a semi-supervised method based on generative adversarial network (GAN) is proposed. This method achieves poor reconstruction of abnormal instances and good reconstruction of normal instances by combining normal and a small number of abnormal instances for training. Among them, the N-GAN model combines PcapGAN and GAN modules. The encoder encodes the Pcap datagram into the latent vector space, and the generator reconstructs it back to the feature space. High reconstruction error indicates anomaly, and the powerful generation ability of GAN is used to effectively model complex high-dimensional data distribution, improve the stability of anomaly detection, and further ensure the safe and stable operation of multimedia communication systems.

[0006] Based on the above background, in view of the stability challenges faced by the IMS switching network, it is necessary to propose an access method to improve the stability of the IMS switching network, so as to enhance the detection capability of unknown abnormal events in a complex network environment, thereby effectively improving the overall stability and security of the IMS network. Summary of the invention

[0007] Purpose of the invention: The multimedia communication system based on IP Multimedia Subsystem (IMS) provides a unified and efficient way to deliver a variety of communication services. However, any system error or abnormal event may lead to huge revenue loss and decreased productivity, so an effective anomaly detection method is needed to ensure the stable operation of the entire system. In order to solve the challenges of security and stability of multimedia communication systems based on IMS, the present invention proposes a stable access method for IMS switching network based on GAN. The method implements abnormal event detection on IMS based on Pcap data and semi-supervised ABpcapGAN model, which can effectively improve the security and stability of system operation and overcome existing deficiencies. Therefore, this method has practical significance for improving the stability of IMS network.

[0008] The present invention specifically provides a GAN-based stable access method for an IMS switching network. By collecting Pcap datagrams on the IMS and using the semi-supervised method ABPcapGAN to detect abnormal events, the detection capability of unknown abnormal events is improved to ensure stable operation of the system.

[0009] To achieve the above object, the present invention provides the following technical solutions:

[0010] Based on the stability access method of IMS switching network based on GAN, a semi-supervised abnormal network intrusion detection method using generative adversarial network (GAN) technology is proposed. This method is based on Pcap data and semi-supervised ABpcapGAN model, and detects network abnormal events by combining Pcap data server and GAN technology. It specifically includes the following steps:

[0011] Step 1: Redesign the architecture of IP multimedia subsystem IMS;

[0012] Step 2: Combine the Pcap data server and the Generative Adversarial Network (GAN) model to detect network anomalies.

[0013] Step 3, build the ABPcapGAN (Encoder-Generator-Decoder) model, and perform anomaly detection based on PcapGAN. PcapGAN is a technology based on Generative Adversarial Network (GAN) to generate and enhance packet capture (Pcap) files. Pcap here refers to Packet Capture, i.e. network packet capture.

[0014] Step 1 includes: reconstructing the network architecture of the designed IP multimedia subsystem IMS including a data forwarding plane, a core control plane, a service logic plane and a data storage plane;

[0015] Wherein, the data forwarding plane is used for actual service data packet routing and transmission;

[0016] The core control plane is responsible for the core control and management functions of the IP Multimedia Subsystem IMS, which is used for session routing and service invocation, and implements user authentication and authorization, session management, and service invocation;

[0017] The business logic plane is responsible for implementing and managing specific business logic functions;

[0018] The data storage plane is responsible for storing and managing the data generated in the network; the data storage plane includes a data mirror server and a datagram storage device for performing data filtering services; the datagram Pcap storage device in the IP multimedia subsystem IMS records the relevant information of the data in the Pcap format, which can be read by a network data packet analyzer.

[0019] In step 1, the data forwarding plane includes an access forwarding plane and a core forwarding plane. The access forwarding plane supports terminal access and data forwarding, and provides mobility management, bearer management, and forwarding QoS (Quality of Service) differentiated control functions; the core forwarding plane is responsible for data forwarding between data centers, and can use the Internet or the operator's self-built cross-border and cross-regional data centers and data bearer networks to provide data packet aggregation and forwarding routing for voice services;

[0020] In step 1, the data mirror server receives all UDP (User Datagram Protocol) messages, extracts the payload of the message, and writes the payload into the message in the format of a network packet analyzer; after capturing the message using the Pcap library, the data mirror server creates the following concurrent processes:

[0021] Capture process: reads messages from the network interface, uses two or more threads at the same time, and puts the messages into the original queue;

[0022] Combination process: Process the messages in the original queue, analyze the messages through the IP (Internet Protocol) layer parameters, classify the messages into UDP long messages and UDP short messages, and use the hash algorithm to generate a unique value for each message; then combine all the information into a message structure; the message structure of the UDP short message is pushed to the short message queue, and the message structure of the UDP long message is pushed to the long message queue;

[0023] Writing process: reads messages from the short message queue and the long message queue, uses hash values ​​to verify whether the messages are duplicates, and if the hash value does not exist in the process memory, records the hash value and writes the message to a temporary Pcap file; if the hash value exists in the memory, ignores the message; the message is written to the temporary Pcap file according to time priority. When the temporary Pcap file reaches the upper limit of the size (in the creation of the writing process, the upper limit of the size of the temporary Pcap file usually depends on multiple factors, such as the file system limitations of the operating system, disk space, and design requirements of the program. In the absence of specific conventions or standards, the size of the temporary Pcap file is generally set to 1GB or 4GB) or the writing time reaches the configured time, the process closes the temporary Pcap file, deletes the hash map, renames the Pcap file to the specified name, and reopens a new temporary Pcap file.

[0024] Step 2 includes:

[0025] Step 2-1, data collection and preprocessing: Use the Pcap data server to perform capture, combination and writing processes, so that the captured network traffic data is a Pcap file; parse the Pcap file, extract key features, and convert the extracted key features into a format suitable for processing by the Generative Adversarial Network (GAN) model; the key features include source IP address, destination IP address, protocol type and packet length;

[0026] Step 2-2, constructing and training a generative adversarial network (GAN) model: constructing a generative adversarial network (GAN) model, wherein the generative adversarial network (GAN) model includes a generator and a discriminator, wherein the generator is responsible for generating realistic traffic samples, and the discriminator is responsible for distinguishing between real traffic and generated traffic;

[0027] Use preprocessed real network traffic data to train the Generative Adversarial Network (GAN) model. The generator and discriminator are continuously optimized through adversarial training.

[0028] Step 2-3, Generate Adversarial Network (GAN) model inference phase: Use the trained generator to generate network traffic samples with similar statistical characteristics and distribution to real traffic;

[0029] Step 2-4, anomaly detection phase: compare and analyze the network traffic captured in real time with the network traffic samples generated in step 2-3, and use the discriminator to determine the authenticity score of the real-time traffic. Traffic samples with low scores are abnormal or potential attack behaviors. The discriminator scores the network traffic captured in real time to determine whether it is real traffic. At this stage, a low score means that the traffic sample may be abnormal or a potential attack behavior. The specific low score can be in the following aspects:

[0030] The traffic characteristics are significantly different from normal traffic (if the characteristics of real-time network traffic are significantly different from the network traffic samples generated in step 2-3, the discriminator will give a lower authenticity score);

[0031] The attack behavior features are obvious (for example, SQL injection, DDoS attack and other attack behaviors have significant features, and the discriminator can capture these features and give a low score);

[0032] The traffic contains malicious features (if the real-time network traffic contains known malicious features such as known malicious IP addresses, domain names, specific malicious load patterns, etc., the discriminator will give a low score based on these features);

[0034] Step 3 includes: using the encoder M in PcapGAN en Submodules and Generators M ge The submodule maps the input file (the input file usually refers to the network data file captured and stored by the Pcap data server from the actual network traffic, specifically the Pcap file) to a low-dimensional vector space and passes it through the decoder M de The submodule regenerates the Pcap file from the embedding vector z in the low-dimensional vector space.

[0035] Step 3 also includes: The ABPcapGAN model uses the encoder submodule and the generator submodule to map the generated Pcap file to the latent representation Finally, both the real Pcap file and the generated Pcap file are input to the discriminator M diSubmodule to determine whether the input is a generated file; during the training process, by minimizing the distance between the normal Pcap file and the latent vector, the ABPcapGAN model learns the data distribution of normal samples; the ABPcapGAN model is a semi-supervised anomaly detection technology based on PcapGAN, and its Chinese meaning can be understood as balanced packet capture file anomaly detection technology based on generative adversarial network (Anomaly Balanced Packet Capture Generative Adversarial Network). In order to meet the challenge of detecting unknown anomalies in IMS switching networks, the present invention proposes a semi-supervised anomaly detection technology ABPcapGAN combined with PcapGAN. ABPcapGAN uses semi-supervised technology, and even when there are insufficient abnormal samples, the model can still effectively learn the characteristics of normal samples, thereby improving the detection ability of unknown anomalies.

[0036] Step 3 also includes: the ABPcapGAN model also includes a decoder submodule and a discriminator submodule; wherein the decoder submodule combines the information generated by the generator to reconstruct a valid Pcap file, which is convenient for subsequent complex tasks such as network flow graph analysis and timestamp analysis; both the real data and the Pcap file are input into the discriminator submodule to determine whether the input is a generated file;

[0037] The goal of the ABPcapGAN model is to train an unsupervised network to detect anomalies using a dataset that is highly biased towards a specific class.

[0038] Suppose there is a training data set D, which contains K normal Pcap files, D = {X1, X2, ..., X K}, and each sample follows the probability distribution P x ;X K Represents the Kth normal Pcap file in the training data set;

[0039] Test Dataset Contains N normal Pcap files and N abnormal Pcap files. where y i ∈[0,1] represents normal or abnormal labels; Represents the test data set The Nth normal Pcap file sample in y, the ∧ mark is to separate the test data set from the training data set; i The i in is a count from 1 to N, indicating that each data sample in the test data set has its own label data, and the normal and abnormal labels are represented by 0 and 1 respectively;

[0040] In the actual setting, the training set is significantly larger than the test set, so that K>>N; at the same time, it is assumed that when the abnormal file is forwarded to the generator M ge Submodule, even if the generator M ge The submodule manages to map the input X to a low-dimensional feature vector z, the discriminator M di The submodule is also unable to reconstruct the abnormal Pcap file, and the output of the abnormal features is missing May lead to the generator M ge The submodule will output Mapped to the feature vector representing the same missing anomaly feature This results in z and When the input file has the dissimilarity in the latent vector space, the ABPcapGAN model classifies the input file as an abnormal event or file;

[0041] In the ABPcapGAN model training, the objective function is formulated by combining three loss functions, and the encoder submodule, generator submodule, decoder submodule and discriminator submodule are optimized. The feature matching method is used to calculate the feature difference between the original file and the generated file of the input data distribution to guide the generator update, including:

[0042] First, we use the two-norm to define the adversarial loss:

[0043]

[0044] The h(·) function represents the output of the discriminator in its intermediate layer after receiving the input data; represents adversarial loss (the loss function of the generator); It means that when the input data x satisfies p x When h(M ge (x)) expectation; M ge (x) represents the output of sample data x after passing through the generator submodule;

[0045] Second, the distance between the input data and the generated file is used to learn the contextual information of the input data:

[0046]

[0047] in Indicates context information loss;

[0048] At the same time, the difference between the feature vectors of the input file and the generated file is used to guide the optimization of the encoder network:

[0049]

[0050] in represents the encoder loss; M en (x) represents the output after the sample data x passes through the encoder submodule;

[0051] Finally, the overall objective function It is expressed as:

[0052]

[0053] Among them, parameters λ1, λ2, λ3 are weight coefficients, which are used to adjust the impact of each loss item on the overall loss;

[0054] The goal of the ABPcapGAN model is to model the training dataset D to learn the data distribution of the training dataset D and detect the test dataset in the inference phase. The abnormal samples are taken as outliers; the discriminator submodule learns the data distribution of normal samples and outputs anomaly scores A high anomaly score indicates that there may be anomalies in the file. Combined with formula (3), the anomaly score Defined as:

[0055]

[0056] where E(·) denotes the expectation of ·; for example, express expectations; Represents sample data in the test dataset The output after the encoder submodule, Represents sample data in the test dataset Output after passing through the generator submodule;

[0057] ABPcapGAN model calculation test dataset The anomaly score of a single test sample in the dataset is obtained, and the set of anomaly scores is obtained. And use the minimum and maximum scaling to scale the overall range of anomaly scores to between 0 and 1:

[0058]

[0059] Where min represents the minimum value function, and max represents the maximum value function; S i is the anomaly score set C s The i-th element in it represents the test data set The i-th sample in The anomaly score is Given by formula (5); the whole formula is the set C s Define the elements inside; S i′ is the anomaly score of the i-th sample after scaling. Formula (6) represents the conversion of the existing anomaly score set C s After normalization, we get C S ′ , C S ′ The anomaly score S after min-max scaling i ′ ;

[0060] At the same time, set the scoring threshold For the test instance if Then test instance Judged as abnormal.

[0061] The present invention also provides an electronic device, comprising a processor and a memory, wherein the memory stores program code, and when the program code is executed by the processor, the processor executes the steps of the described method.

[0062] The present invention also provides a storage medium storing a computer program or instruction. When the computer program or instruction is run on a computer, the steps of the method described are executed.

[0063] Beneficial effects: The method of the present invention can enhance the detection capability of unknown abnormal events in a complex network environment, thereby effectively improving the overall stability and security of the IMS network. The present invention performs abnormal event detection on the IMS based on Pcap data and the semi-supervised ABpcapGAN model. By combining the Pcap data packet generation technology, the present invention can generate more samples without collecting and annotating a large amount of training data, thereby achieving better generation effects and a higher abnormal event detection rate. The ABPcapGAN model uses semi-supervised technology, which can effectively learn the characteristics of normal samples even when there are insufficient abnormal samples, and distinguish abnormal samples from normal samples during the detection process, thereby improving the feature learning and detection capabilities of unknown abnormal events. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments, and the above and / or other advantages of the present invention will become more clear.

[0065] Figure 1 This is a diagram of the novel IMS network architecture of the present invention.

[0066] Figure 2 This is a flowchart of anomaly detection of the present invention.

[0067] Figure 3 Schematic diagram of the ABPcapGAN method of the present invention.

[0068] Figure 4 It is a histogram of the anomaly score of ABPcapGAN of the present invention. DETAILED DESCRIPTION

[0069] The present invention provides a GAN-based IMS switching network stability access method, and proposes an abnormal event detection method based on Pcap data and a semi-supervised ABpcapGAN model, including an IMS system architecture reconstruction design, combining a Pcap data server and GAN technology to perform network abnormal event detection, and an abnormality detection technology based on PcapGAN ABPcapGAN, specifically including:

[0070] 1. IMS system architecture reconstruction design

[0071] In order to make up for the shortcomings of the multimedia real-time communication system architecture of the existing IMS network and meet the diversified needs of vertical industries for real-time audio and video services in a fast and low-cost manner, it is necessary to enhance and upgrade the multimedia real-time communication system. The architectural reconstruction of the IMS system will continue to follow the design principle of decoupling session control and bearer, build an overlay architecture based on the data bearer plane, and further decouple session control, business logic and data storage. This reconstruction can effectively separate different network function modules, realize functional decoupling and independent expansion, thereby improving the flexibility, maintainability and performance of the IMS network.

[0072] Reference Figure 1 The novel IMS network architecture of the present invention includes four levels: data forwarding plane, core control plane, service logic plane and data storage plane.

[0073] Data forwarding plane: responsible for the actual routing and transmission of service data packets, ensuring that data between nodes in the ISM network can be transmitted efficiently and securely. The data forwarding plane consists of two parts: the access forwarding plane and the core forwarding plane. The access forwarding plane supports the access and data forwarding of various types of terminals, and provides functions such as mobility management, bearer management, and forwarding QoS differentiated control; the core forwarding plane is responsible for data forwarding between data centers, and can use the Internet or the operator's self-built cross-border and cross-regional data centers and data bearer networks to provide data packet aggregation and forwarding routing for voice services.

[0074] Core control plane: responsible for the core control and management functions of the IMS network, used for session routing and service calls, and implements user authentication and authorization, session management, and service calls.

[0075] Business logic: responsible for implementing and managing specific business logic functions. Based on the service-oriented architecture, it provides service registration, service discovery, dynamic service orchestration and capability exposure related to multimedia real-time communication services, so that service value-added capabilities and new business expansion capabilities can be realized more quickly.

[0076] Data storage plane: responsible for storing and managing various data generated in the network. The introduction of data mirror server and datagram storage can effectively implement data filtering services through real-time backup, caching and management of data. , thereby improving the stability and security of the IMS system. . The datagram (Pcap) storage in the IMS system records the relevant information of the data in Pcap format for future debugging and comparison with other networks. This format can be read by a network packet analyzer.

[0077] The data mirror server receives all UDP messages, extracts the message's payload, and writes it to the message in a format that is suitable for network packet analyzers. After capturing the message using the Pcap library, the server creates the following processes that work simultaneously:

[0078] (1) Capture process: reads messages from the network interface, uses multiple threads simultaneously to improve performance, and puts the messages into the original queue.

[0079] (2) Combination process: Process the messages in the original queue, analyze the messages through the IP layer parameters, classify them into UDP long messages and UDP short messages, and use the hash algorithm to generate a unique value for each message. Then, all information (such as time, hash value, message length, and the message itself) is combined into a message structure. The UDP short message structure is pushed to the short message queue, and the UDP long message structure is pushed to the long message queue.

[0080] (3) Write process: Read messages from the short message queue and the long message queue, and use the hash value to verify whether the message is a duplicate. If the hash value does not exist in the process memory, the value is recorded and the message is written to the temporary Pcap file; if the hash value exists in the memory, the message is ignored. Messages are written to the temporary Pcap file according to time priority. When the temporary Pcap file reaches the upper limit of the size or the writing time reaches the configured time, the process closes the file, deletes the hash map, renames the Pcap file to the specified name, and reopens a new temporary Pcap file.

[0081] 2. Combine Pcap data server and GAN technology to detect network abnormal events

[0082] Reference Figure 2 The process of combining the Pcap data server and the GAN technology to detect network abnormal events provided by the present invention can be divided into the following main steps:

[0083] Data collection and preprocessing:

[0084] Use Pcap data server to capture network traffic data, including data packet capture, combination and storage, so that all network traffic data is saved as Pcap file;

[0085] Parse Pcap files and extract key features (source IP address, destination IP address, protocol type, packet length, etc.) to reflect the basic properties and behavior patterns of network traffic;

[0086] The extracted features are converted into a format suitable for GAN model processing (such as feature vectors) to ensure that the data can be effectively learned and generated by the GAN model.

[0087] Build and train the GAN model:

[0088] Build a GAN model, including a generator and a discriminator. The generator is responsible for generating realistic traffic samples, and the discriminator is responsible for distinguishing between real traffic and generated traffic;

[0089] The GAN model is trained using preprocessed real network traffic data. The generator and discriminator are continuously optimized through adversarial training. The generator generates more and more realistic traffic samples, and the discriminator improves its ability to distinguish between real and generated traffic.

[0090] GAN model inference stage:

[0091] Use the trained generator to generate a large number of network traffic samples with similar statistical characteristics and distribution to real traffic. These generated samples are used in the subsequent anomaly detection process;

[0092] The performance of the generator is evaluated to ensure that the generated samples have sufficient fidelity and diversity to effectively simulate normal traffic in a real ISM network environment.

[0093] Anomaly detection phase:

[0094] Capture and analyze network traffic data in real time, extract features and convert them into feature vectors;

[0095] Compare and analyze the real-time captured network traffic with the generated traffic samples. Use the discriminator to determine the "realism" score of the real-time traffic;

[0096] According to the score of the discriminator, abnormal traffic samples are identified and marked. Traffic samples with low scores usually indicate that their characteristics and behavior patterns are significantly different from normal traffic, which may indicate network attacks or other abnormal behaviors.

[0097] 3. Anomaly detection technology based on PcapGAN

[0098] To address the challenge of detecting unknown anomalies in IMS switching networks, the present invention proposes a semi-supervised anomaly detection technology ABPcapGAN combined with PcapGAN, which realizes the joint learning of Pcap file generation and latent space representation through PcapGAN.

[0099] like Figure 3 As shown, the ABPcapGAN technology uses the encoder M in PcapGAN en and generator M ge submodule, maps the input file into a low-dimensional vector space and passes it through the decoder M de The module regenerates the Pcap file from the embedding vector z in these low-dimensional spaces. Next, ABPcapGAN uses additional encoder and generator submodules to map the generated Pcap file to the latent representation Finally, both the real and generated Pcap files are fed into the discriminator M di Submodule to determine whether the input is a generated file. During the training process, by minimizing the distance between the normal Pcap file and its latent vector, the model learns the data distribution of normal samples. Therefore, during inference, samples with a large distance from the learned data distribution can be judged as abnormal samples. ABPcapGAN uses semi-supervised technology. Even if there are not enough abnormal samples, the model can still effectively learn the characteristics of normal samples, thereby improving the detection ability of unknown anomalies.

[0100] ABPcapGAN aims to train an unsupervised network to detect anomalies using a dataset that is highly biased towards a specific class.

[0101] Suppose there is a training data set D, which contains K normal Pcap files, D = {X1, X2, ..., X K}, and each sample follows the probability distribution P x . Test Dataset Relatively small, containing N normal and abnormal Pcap files, where y i ∈[0,1] represents a normal or abnormal label. In practical settings, the training set is significantly larger than the test set, so that K>>N. It is also assumed that when the abnormal file is forwarded to M ge Submodule, even if M ge The submodule tries to map the input X to a low-dimensional feature vector z,M di The submodule is also unable to reconstruct the abnormal Pcap file. This is because the overall network model only models normal samples during training, and its parameters and features are not suitable for the generation of abnormal samples. Therefore, the output of the missing abnormal features May cause M ge The submodule will Mapped to the feature vector representing the same missing anomaly feature This results in z and When an input file has this dissimilarity in the latent vector space, the model classifies this file as an abnormal event or file.

[0102] In the ABPcapGAN model training, the objective function is formulated by combining three loss functions, each of which optimizes a single sub-network. In order to enhance the stability of the GAN training process, the feature matching method is used to calculate the feature difference between the original file and the generated file of the input data distribution to guide the generator update.

[0103] First, we use the two-norm to define the adversarial loss:

[0104]

[0105] The h(·) function represents the output of the discriminator at its intermediate layer after receiving the input data. Secondly, the distance between the input data and the generated file is used to learn the contextual information of the input data:

[0106]

[0107] The above two loss functions can force the generator to generate realistic and contextual files. At the same time, the gap between the feature vectors of the input file and the generated file is used to guide the optimization of the encoder network:

[0108]

[0109] Finally, the overall objective function can be expressed as:

[0110]

[0111] Among them, the λ1, λ2, and λ3 parameters adjust the impact of each loss term on the overall loss.

[0112] The goal of ABPcapGAN is to model the dataset D to learn its data distribution and detect abnormal samples in D as outliers in the inference phase. The model f learns the data distribution of normal samples and outputs anomaly scores A high anomaly score indicates that there may be anomalies in the file. Combined with formula (3), the anomaly score is defined as:

[0113]

[0114] To evaluate the overall anomaly performance, ABPcapGAN computes the test set The anomaly score of a single test sample in the dataset is obtained, and the set of anomaly scores is obtained. And use min-max scaling to scale its overall range to between 0 and 1:

[0115]

[0116] At the same time, set the scoring threshold For the test instance if The instance is judged to be abnormal.

[0117] The present invention uses the CIC-IDS2017 network intrusion detection dataset to evaluate the performance of the ABPcapGAN method. This dataset reflects different types of network attacks and meets the standards of a reliable intrusion detection dataset to a certain extent. The dataset contains approximately 2,830,743 lines of features and original Pcap files, which are captured at different times of the week. There are 80 features in the dataset, and each line is marked as benign or 14 different attack types. After preprocessing, the present invention extracts approximately 2 million records, of which benign traffic accounts for approximately 1.5 million records, and attack traffic constitutes the remaining number. The present invention uses a dataset consisting of 50% benign traffic to train and optimize the encoder, generator, and decoder modules of ABPcapGAN.

[0118] The present invention uses the Tensorflow Keras framework to implement the ABPcapGA model. The hardware platform is a host equipped with an i5-12490F CPU and an RTX 3070Ti GPU to perform high-performance simulation experiments. Based on the design of PcapGAN, the present invention constructs encoder, generator, and decoder modules to generate higher quality and more standardized Pcap files. The discriminator network uses the quasi-discriminator network in DCGAN, and its goal is to classify the input and output as true or false Pcap files, respectively.

[0119] like Figure 4 As shown, it is a histogram of the abnormal scores of different events in the inference process of the ABPcapGAN model of the present invention, indicating that the red column represents a normal sample, the blue column represents an abnormal sample, and the black vertical line is the scoring threshold Most of the scores of abnormal events are significantly greater than those of normal events, which not only verifies that the ABPcapGAN method can only reconstruct normal samples and clearly separate normal and abnormal samples in low-dimensional space, but also provides a faster method for identifying abnormal events.

[0120] Table 1 shows the performance comparison results of the model of the present invention and the baseline model in detecting specific categories of attacks. Under specific categories of attack methods, the performance of the ABpcapGAN model of the present invention compared with the baseline model is evaluated by two indicators: detection rate (DR) and area under the curve (AUC). The closer these two indicators are to 1, the more effectively the model can identify abnormal events and the better the classification performance. Compared with the baseline model, the performance of the ABpcapGAN model is significantly improved, especially in the SSH-Patator attack scenario, where DR and AUC are increased by 12.2% and 12.6% respectively. This is because the ABpcapGAN model makes full use of a small number of malicious samples during the training process, enhances the learning of unknown abnormal event features, and thus improves the detection capability of unknown abnormal events.

[0121] Table 1

[0122]

[0123] The present invention provides a stable access method for an IMS switching network based on GAN. There are many methods and ways to implement the technical solution. The above is only a preferred implementation of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the protection scope of the present invention. All components not specified in this embodiment can be implemented by existing technologies.

Claims

1. A stable access method for an IMS switching network based on GAN, characterized in that: The following steps are involved: Step 1: Redesign the architecture of IP multimedia subsystem IMS; Step 2: Combine the Pcap data server and the Generative Adversarial Network (GAN) model to detect network anomalies. Step 3, establish the ABPcapGAN model for anomaly detection based on PcapGAN.

2. The method according to claim 1, characterized in that Step 1 includes: reconstructing the network architecture of the designed IP multimedia subsystem IMS including a data forwarding plane, a core control plane, a service logic plane and a data storage plane; Wherein, the data forwarding plane is used for actual service data packet routing and transmission; The core control plane is responsible for the core control and management functions of the IP Multimedia Subsystem IMS, which is used for session routing and service invocation, and implements user authentication and authorization, session management, and service invocation; The business logic plane is responsible for implementing and managing specific business logic functions; The data storage plane is responsible for storing and managing the data generated in the network; the data storage plane includes a data mirror server and a datagram storage device for performing data filtering services; the datagram Pcap storage device in the IP multimedia subsystem IMS records the relevant information of the data in the Pcap format, which can be read by a network data packet analyzer.

3. The method according to claim 2, characterized in that In step 1, the data forwarding plane includes an access forwarding plane and a core forwarding plane. The access forwarding plane supports terminal access and data forwarding, and provides mobile management, bearer management, and forwarding QoS differentiated control functions; the core forwarding plane is responsible for data forwarding between data centers, and can use the Internet or the operator's self-built cross-border, cross-regional data centers and data bearer networks to provide data packet aggregation and forwarding routing for voice services.

4. The method according to claim 3, characterized in that In step 1, the data mirror server receives all UDP user datagram protocol messages, extracts the payload of the message, and writes the payload into the message in the format of the network packet analyzer; after the data mirror server captures the message using the Pcap library, it creates the following processes that work simultaneously: Capture process: reads messages from the network interface, uses two or more threads at the same time, and puts the messages into the original queue; Combination process: processes the messages in the original queue, analyzes the messages through IP layer parameters, classifies the messages into UDP long messages and UDP short messages, and uses the hash algorithm to generate a unique value for each message; Then all the information is combined into a message structure; the message structure of the UDP short message is pushed to the short message queue, and the message structure of the UDP long message is pushed to the long message queue; Write process: read messages from the short message queue and the long message queue, use the hash value to verify whether the message is repeated, if the hash value does not exist in the process memory, record the hash value and write the message to a temporary Pcap file; If the hash value exists in memory, the message is ignored; Messages are written to a temporary Pcap file based on time priority. When the temporary Pcap file reaches its size limit or the writing time reaches the configured time, the process closes the temporary Pcap file, deletes the hash map, renames the Pcap file to the specified name, and reopens a new temporary Pcap file.

5. The method according to claim 4, characterized in that Step 2 includes: Step 2-1, data collection and preprocessing: Use the Pcap data server to perform capture, combination and writing processes, so that the captured network traffic data is a Pcap file; parse the Pcap file, extract key features, and convert the extracted key features into a format suitable for processing by the Generative Adversarial Network (GAN) model; the key features include source IP address, destination IP address, protocol type and packet length; Step 2-2, constructing and training a generative adversarial network (GAN) model: constructing a generative adversarial network (GAN) model, wherein the generative adversarial network (GAN) model includes a generator and a discriminator, wherein the generator is responsible for generating realistic traffic samples, and the discriminator is responsible for distinguishing between real traffic and generated traffic; Use preprocessed real network traffic data to train the Generative Adversarial Network (GAN) model. The generator and discriminator are continuously optimized through adversarial training. Step 2-3, Generate Adversarial Network (GAN) model inference phase: Use the trained generator to generate network traffic samples with similar statistical characteristics and distribution to real traffic; Step 2-4, anomaly detection phase: compare and analyze the real-time captured network traffic with the network traffic samples generated in step 2-3, and use the discriminator to determine the authenticity score of the real-time traffic. Traffic samples with low scores are abnormal or potential attack behaviors.

6. The method according to claim 5, characterized in that Step 3 includes: using the encoder M in PcapGAN en Submodules and Generators M ge submodule, maps the input file into a low-dimensional vector space and passes it through the decoder M de The submodule regenerates the Pcap file from the embedding vector z in the low-dimensional vector space.

7. The method according to claim 6, characterized in that Step 3 also includes: The ABPcapGAN model uses the encoder submodule and the generator submodule to map the generated Pcap file to the latent representation Finally, both the real Pcap file and the generated Pcap file are input to the discriminator M di submodule to determine whether the input is a generated file; during the training process, the ABPcapGAN model learns the data distribution of normal samples by minimizing the distance between the normal Pcap file and the latent vector.

8. The method according to claim 7, characterized in that Step 3 also includes: the ABPcapGAN model also includes a decoder submodule and a discriminator submodule; wherein the decoder submodule combines the information generated by the generator to reconstruct a valid Pcap file; both the real data and the Pcap file are input into the discriminator submodule to determine whether the input is a generated file; The goal of the ABPcapGAN model is to train an unsupervised network to detect anomalies using a dataset that is highly biased towards a specific class. Suppose there is a training data set D, which contains K normal Pcap files, D = {X1, X2, ..., X K }, and each sample follows the probability distribution P x ;X K Represents the Kth normal Pcap file in the training data set; Test Dataset Contains N normal Pcap files and N abnormal Pcap files. where y i ∈[0,1] represents normal or abnormal labels; Represents the test data set The Nth normal Pcap file sample in y, the ∧ mark is to separate the test data set from the training data set; i The i in is a count from 1 to N, indicating that each data sample in the test data set has its own label data, and the normal and abnormal labels are represented by 0 and 1 respectively; In the actual setting, the training set is significantly larger than the test set, so that K>>N; at the same time, it is assumed that when the abnormal file is forwarded to the generator M ge Submodule, even if the generator M ge The submodule manages to map the input X to a low-dimensional feature vector z, the discriminator M di The submodule is also unable to reconstruct the abnormal Pcap file, and the output of the abnormal features is missing May lead to the generator M ge The submodule will output Mapped to the feature vector representing the same missing anomaly feature This results in z and When the input file has the dissimilarity in the latent vector space, the ABPcapGAN model classifies the input file as an abnormal event or file; In the ABPcapGAN model training, the objective function is formulated by combining three loss functions, and the encoder submodule, generator submodule, decoder submodule and discriminator submodule are optimized. The feature matching method is used to calculate the feature difference between the original file and the generated file of the input data distribution to guide the generator update, including: First, we use the two-norm to define the adversarial loss: The h(·) function represents the output of the discriminator in its intermediate layer after receiving the input data; represents adversarial loss; It means that when the input data x satisfies p x When h(M ge (x)) expectation; M ge (x) represents the output of sample data x after passing through the generator submodule; Second, the distance between the input data and the generated file is used to learn the contextual information of the input data: in Indicates context information loss; At the same time, the difference between the feature vectors of the input file and the generated file is used to guide the optimization of the encoder network: in represents the encoder loss; M en (x) represents the output after the sample data x passes through the encoder submodule; Finally, the overall objective function It is expressed as: Among them, parameters λ1, λ2, λ3 are weight coefficients, which are used to adjust the impact of each loss item on the overall loss; The goal of the ABPcapGAN model is to model the training dataset D to learn the data distribution of the training dataset D and detect the test dataset in the inference phase. The abnormal samples are taken as outliers; the discriminator submodule learns the data distribution of normal samples and outputs anomaly scores A high anomaly score indicates that there may be anomalies in the file. Combined with formula (3), the anomaly score Defined as: where E(·) represents the expectation of ·; Represents sample data in the test dataset The output after the encoder submodule, Represents sample data in the test dataset Output after passing through the generator submodule; ABPcapGAN model calculation test dataset The anomaly score of a single test sample in the dataset is obtained, and the set of anomaly scores is obtained. And use the minimum and maximum scaling to scale the overall range of anomaly scores to between 0 and 1: Where min represents the minimum value function, and max represents the maximum value function; S i is the anomaly score set C s The i-th element in it represents the test data set The i-th sample in The anomaly score is Given by formula (5); the whole formula is the set C s Define the elements inside; S i ′ is the abnormal score of the i-th sample after scaling; At the same time, set the scoring threshold For the test instance if Test instance Judged as abnormal.

9. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores program codes, and when the program codes are executed by the processor, the processor executes the steps of the method according to any one of claims 1 to 8.

10. A storage medium, characterized in that: A computer program or instruction is stored, and when the computer program or instruction is run on a computer, the steps of the method according to any one of claims 1 to 8 are executed.

Images