Network traffic classification method and device, computer equipment and storage medium

Abstract

The invention relates to a network traffic classification method, and the method comprises the steps: obtaining a training set which comprises a new class sample and an old class example stored in a representative memory; inputting the training set into an incremental learning model for training; updating the representative memory; and inputting the network traffic to be classified to the trained incremental learning model to obtain a classification result. The problems that in the prior art, network flow classification through incremental learning is insufficient in performance and low in effective model updating capacity are solved. The technical effects of effectively identifying the novel threats in the dynamically changing network environment and keeping the high identification rate of the known threats are achieved, so that the network security protection capability is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a network traffic classification method, apparatus, computer equipment, storage medium and computer program product. Background Art

[0002] With the rapid development of information technology and the continuous evolution of network attack techniques, network traffic classification systems play an increasingly important role in network security protection. Traditional network traffic classification methods usually rely on static models that use fixed feature sets and category definitions for classification. However, with the emergence of new attack techniques and changes in network traffic patterns, traditional methods face significant limitations. These methods are difficult to effectively adapt to the ever-changing network environment, especially when faced with the emergence of new categories, their classification performance tends to decline.

[0003] To address these challenges, researchers have proposed a variety of advanced technologies to improve the adaptability and robustness of network traffic classification systems. Incremental learning is an important technology that can learn as new categories continue to increase and effectively avoid forgetting old knowledge. However, incremental learning still faces some challenges in practical applications, such as how to deal with the separability problem between categories, how to maintain model performance when new categories appear, and how to effectively update the model to maintain classification capabilities. Summary of the invention

[0004] Based on this, it is necessary to provide a network traffic classification method, apparatus, computer equipment, computer-readable storage medium and computer program product to address the above technical issues.

[0005] In a first aspect, the present application provides a network traffic classification method. The method comprises:

[0006] obtaining a training set comprising new category samples and old category examples stored in a representative memory;

[0007] Inputting the training set into an incremental learning model for training;

[0008] updating the representative memory;

[0009] Input the network traffic to be classified into the trained incremental learning model to obtain the classification result.

[0010] In one embodiment, inputting the training set into the incremental learning model for training includes:

[0011] Obtain feature vectors of all features in the training set;

[0012] Mapping the feature vector onto a spherical surface through L2 norm normalization and inputting it into a deep neural network (DNN) model to extract high-level features through a hidden layer;

[0013] Inputting new category samples in the training set into the loss function to calculate the loss;

[0014] Add a new classification layer for the new category samples and connect it to the feature extractor and the loss calculation component;

[0015] The trained model is used as the classification network of the incremental learning new classification model.

[0016] In one embodiment, the trained incremental learning model is a classification network of the incremental learning new classification model.

[0017] In one embodiment, for a vector x=[x1, x2, ..., x n ], the calculation formula for each component of the L2 norm normalized vector x′ is:

[0018]

[0019] In one embodiment, the loss function includes: a cross entropy loss function, a distillation loss function, and a Dandelion angle separation mechanism DASM separation loss function;

[0020] The loss function is:

[0021] In one embodiment, updating the representative memory includes:

[0022] Use Euclidean distance to select new samples;

[0023] Calculate category means and Euclidean distances;

[0024] Remove old samples and get new representative memory.

[0025] In a second aspect, the present application also provides a network traffic classification device. The device comprises:

[0026] A training set acquisition module, used for acquiring a training set, wherein the training set includes new category samples and old category examples stored in a representative memory;

[0027] A training module, used for inputting the training set into an incremental learning model for training;

[0028] an updating module, configured to update the representative memory;

[0029] The classification module is used to input the network traffic to be classified into the trained incremental learning model to obtain the classification result.

[0030] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0031] obtaining a training set comprising new category samples and old category examples stored in a representative memory;

[0032] Inputting the training set into an incremental learning model for training;

[0033] updating the representative memory;

[0034] Input the network traffic to be classified into the trained incremental learning model to obtain the classification result.

[0035] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0036] Obtaining a training set comprising new category samples and old category examples stored in a representative memory;

[0037] Inputting the training set into an incremental learning model for training;

[0038] updating the representative memory;

[0039] Input the network traffic to be classified into the trained incremental learning model to obtain the classification result.

[0040] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0041] obtaining a training set comprising new category samples and old category examples stored in a representative memory;

[0042] Inputting the training set into an incremental learning model for training;

[0043] updating the representative memory;

[0044] Input the network traffic to be classified into the trained incremental learning model to obtain the classification result.

[0045] The above network traffic classification method, device, computer equipment, storage medium and computer program product obtain a training set, which includes new category samples and old category examples stored in representative memory; input the training set into the incremental learning model for training; update the representative memory; input the network traffic to be classified into the trained incremental learning model to obtain the classification result. It solves the problem of insufficient performance of network traffic classification through incremental learning in the prior art and low effective model update capability; achieves the technical effect of effectively identifying new threats in a dynamically changing network environment while maintaining a high recognition rate for known threats, thereby improving network security protection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 A schematic diagram of a flow chart of a network traffic classification method in one embodiment;

[0047] Figure 2 A schematic diagram of a flow chart of a network traffic classification method in another embodiment;

[0048] Figure 3 A model diagram of an incremental learning model involved in a network traffic classification method in an application example;

[0049] Figure 4 is a structural block diagram of a network traffic classification device in one embodiment;

[0050] Figure 5 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0052] In one embodiment, Figure 1 As shown, a network traffic classification method is provided, the method comprising the following steps:

[0053] S100, obtaining a training set.

[0054] In this embodiment, the training set includes new category samples and old category examples stored in representative memory. To handle the three loss functions of classification, distillation, and separation, two labels are required for each sample. For classification and separation tasks, the unique hot encoding of the category to which the traffic data belongs is used, and for distillation tasks, the logits generated by each classification layer are used as labels. In order to strengthen the old knowledge, samples of the new category are used for distillation.

[0055] S200, input the training set into the incremental learning model for training. Specifically, Figure 2 As shown, S200 also includes:

[0056] S210, obtaining feature vectors of all features in the training set.

[0057] S220, mapping the feature vector onto a spherical surface through L2 norm normalization, and inputting the feature vector into a deep neural network DNN model to extract high-level features through a hidden layer.

[0058] Specifically, for a vector x = [x1, x2, ..., x n ], the calculation formula for each component of the L2 norm normalized vector x′ is:

[0059]

[0060] S230, inputting the new category samples in the training set into the loss function to calculate the loss.

[0061] Specifically, the classification layer is the last fully connected layer of the model. The number of outputs is equal to the number of categories. The classification layer generates logits. In the training phase, the logits are input into the loss function to calculate the loss. In the testing phase, the logits are input into the softmax layer for classification.

[0062] In an embodiment of the present application, the loss functions include: a cross entropy loss function, a distillation loss function, and a Dandelion angle separation mechanism DASM separation loss function.

[0063] The loss function is:

[0064] Furthermore, the specific formula of the cross entropy loss function is:

[0065]

[0066] in By sampling The score obtained by applying the softmax function to the classification layer logits, It is a sample The real label. and Represents the number of samples and the number of categories respectively

[0067] The distillation loss function The specific formula is:

[0068]

[0069] Losses in distillation In the definition of and is the adjusted probability output. This adjustment is done by and Raised to To complete, is the distillation parameter.

[0070] The DASM separation loss function The specific formula is:

[0071]

[0072] in, Represents the cosine similarity between the i-th and j-th intrusions. By minimizing the sum of the upper triangular part of the matrix, the angular difference between categories can be enlarged.

[0073] DASM separation loss The definition is as follows:

[0074]

[0075] Among them, represents the cosine similarity between the i-th and j-th intrusions. By minimizing the sum of the upper triangular part of the matrix, the angular difference between categories can be enlarged.

[0076] S240, adding a new classification layer for the new category sample and connecting it to the feature extractor and the loss calculation component. The loss includes: cross entropy loss and distillation loss.

[0077] S250, using the trained model as the classification network for the incremental learning of the new classification model.

[0078] Specifically, after reaching the number of training steps, the model is fine-tuned in a balanced manner, using a smaller learning rate and a balanced sample subset. The new training subset contains the same number of samples per category, which are from new and old categories. To prevent the model from forgetting the knowledge acquired in the previous training steps, a temporary distillation loss is added to the classification layer of the new category.

[0079] S300, updating the representative memory.

[0080] Specifically, S300 includes the following steps:

[0081] (1) Use Euclidean distance to select new samples.

[0082] Specifically, we use the Euclidean distance to select new samples and generate a sample list sorted by the distance between the sample and the category mean. Given the sorted sample list, we select the first n samples in the list:

[0083] Calculate the category mean (centroid): For each category, calculate the mean vector (centroid) of all samples in that category. Samples Category mean The calculation formula is:

[0084]

[0085] (2) Calculate category mean and Euclidean distance

[0086] Specifically, for each sample in the data set, calculate the Euclidean distance between it and the mean (centroid) of the category to which it belongs. Belongs to category and the category mean The Euclidean distance The calculation formula is:

[0087]

[0088] in, It is a sample The characteristic vector of Yes Category The mean vector of .

[0089] (3) Remove old samples and obtain new representative memory.

[0090] Specifically, remove the last sample in the sorted sample list of each category.

[0091] S400, inputting the network traffic to be classified into the trained incremental learning model to obtain a classification result.

[0092] For details, please refer to Figure 3 Model diagram of the incremental learning model after training for this application.

[0093] The above network traffic classification method, device, computer equipment, storage medium and computer program product obtain a training set, which includes new category samples and old category examples stored in representative memory; input the training set into the incremental learning model for training; update the representative memory; input the network traffic to be classified into the trained incremental learning model to obtain the classification result. It solves the problem of insufficient performance of network traffic classification through incremental learning in the prior art and low effective model update capability; achieves the technical effect of effectively identifying new threats in a dynamically changing network environment while maintaining a high recognition rate for known threats, thereby improving network security protection capabilities.

[0094] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0095] Based on the same inventive concept, the embodiment of the present application also provides a network traffic classification device for implementing the network traffic classification method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more network traffic classification device embodiments provided below can refer to the limitations of the network traffic classification method above, and will not be repeated here.

[0096] In one embodiment, Figure 4 As shown, a network traffic classification device is provided, comprising:

[0097] A training set acquisition module 100, used to acquire a training set, wherein the training set includes new category samples and old category examples stored in a representative memory;

[0098] A training module 200, used for inputting the training set into an incremental learning model for training;

[0099] An updating module 300, configured to update the representative memory;

[0100] The classification module 400 is used to input the network traffic to be classified into the trained incremental learning model to obtain the classification result.

[0101] The step of inputting the training set into the incremental learning model for training comprises:

[0102] Obtain feature vectors of all features in the training set;

[0103] Mapping the feature vector onto a spherical surface through L2 norm normalization and inputting it into a deep neural network (DNN) model to extract high-level features through a hidden layer;

[0104] Inputting new category samples in the training set into the loss function to calculate the loss;

[0105] Add a new classification layer for the new category samples and connect it to the feature extractor and the loss calculation component;

[0106] The trained model is used as the classification network of the incremental learning new classification model.

[0107] In one embodiment, the trained incremental learning model is a classification network of the incremental learning new classification model.

[0108] In one embodiment, for a vector x=[x1, x2, ..., x n ], the calculation formula for each component of the L2 norm normalized vector x′ is:

[0109]

[0110] In one embodiment, the loss function includes: a cross entropy loss function, a distillation loss function, and a Dandelion angle separation mechanism DASM separation loss function;

[0111] The loss function is:

[0112] In one embodiment, updating the representative memory includes:

[0113] Use Euclidean distance to select new samples;

[0114] Calculate category means and Euclidean distances;

[0115] Remove old samples and get new representative memory.

[0116] Each module in the above network traffic classification device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0117] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 5As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store preset data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a network traffic classification method is implemented.

[0118] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0119] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the above-mentioned network traffic classification method when executing the computer program.

[0120] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned network traffic classification method is implemented.

[0121] In one embodiment, a computer program product is provided, including a computer program, which implements the above-mentioned network traffic classification method when executed by a processor.

[0122] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the above-mentioned computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0123] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0124] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A network traffic classification method, characterized in that: The method comprises: obtaining a training set comprising new category samples and old category examples stored in a representative memory; Inputting the training set into an incremental learning model for training; updating the representative memory; Input the network traffic to be classified into the trained incremental learning model to obtain the classification result.

2. The network traffic classification method according to claim 1, characterized in that: The step of inputting the training set into the incremental learning model for training comprises: Obtain feature vectors of all features in the training set; Mapping the feature vector onto a spherical surface through L2 norm normalization and inputting it into a deep neural network (DNN) model to extract high-level features through a hidden layer; Inputting new category samples in the training set into the loss function to calculate the loss; Add a new classification layer for the new category samples and connect it to the feature extractor and the loss calculation component; The trained model is used as the classification network of the incremental learning new classification model.

3. The network traffic classification method according to claim 2, characterized in that: The trained incremental learning model is a classification network of the incremental learning new classification model.

4. The network traffic classification method according to claim 2, characterized in that: For a vector x = [x1, x2, ..., x n ], the calculation formula for each component of the L2 norm normalized vector x′ is:

5. The network traffic classification method according to claim 2, characterized in that: The loss functions include: cross entropy loss function, distillation loss function and Dandelion angle separation mechanism DASM separation loss function; The loss function is:

6. The network traffic classification method according to claim 1, characterized in that: The updating of the representative memory comprises: Use Euclidean distance to select new samples; Calculate category means and Euclidean distances; Remove old samples and get new representative memory.

7. A network traffic classification device, characterized in that: The device comprises: A training set acquisition module, used for acquiring a training set, wherein the training set includes new category samples and old category examples stored in a representative memory; A training module, used for inputting the training set into an incremental learning model for training; an updating module, configured to update the representative memory; The classification module is used to input the network traffic to be classified into the trained incremental learning model to obtain the classification result.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images