A method and system for detecting malicious incremental traffic based on diversion strategy

Abstract

A method and system for detecting malicious traffic in incremental traffic based on a diversion strategy, comprising: S1: collecting and preprocessing network traffic; S2: constructing a basic multi-classifier to accurately identify malicious behavior observed in the current phase; S3: extracting a small number of samples through a random sampling strategy as the basis for implementing the diversion strategy; S4: training a stacked model meta-classifier; S5: training a binary classifier for new and old data; and S6: using the diversion strategy model to detect malicious traffic in network traffic. The present invention converts network traffic into a streamlined data representation, uses a multi-head attention mechanism to capture the rich spatiotemporal characteristics between packets in session traffic, trains a high-precision basic multi-classification model at each incremental step, and constructs an incremental learning model for malicious traffic detection based on the diversion strategy based on this model.

Description

Technical Field

[0001] The present invention relates to the field of network information security, and in particular to a method and system for detecting malicious incremental traffic based on a diversion strategy. Background Art

[0002] The rapid development of network technology and the continuous updating of diverse traffic types in network services have placed higher demands on network security. In particular, detecting malicious traffic behavior in traffic faces the constant emergence of unknown attack types, such as new malware variants, zero-day attacks, and unknown malicious traffic generated by attacks targeting emerging technologies like IoT that were not previously seen during training. This constant emergence of new types of traffic requires network intrusion detection systems (NIDS) to be able to quickly update and adapt to new types of network attacks, ensuring continuous and effective detection of malicious behavior and thus protecting the security and stability of the network environment. Therefore, the network security field urgently needs a dynamic detection method that can promptly adapt to new threats.

[0003] Traditional machine learning methods, when dealing with data with constantly changing distributions, suffer from catastrophic forgetting, where knowledge about old categories is forgotten when learning new ones. Maintaining a large dataset containing all old categories' data, as previously used, not only poses the risk of data poisoning or tampering, but also requires retraining the model each time a new class of traffic is learned, resulting in increased time, maintenance, and storage overhead, making it difficult to meet real-time requirements.

[0004] As an efficient learning strategy, incremental learning provides an ideal solution for addressing the continuous evolution of malware and malicious behavior. Its core advantage lies in its ability to continuously learn and adapt to emerging attack types based on existing models without having to retrain the entire model. This significantly reduces the computing resources and storage space required for model updates, significantly lowering the operational costs of network traffic malicious behavior detection systems.

[0005] In practice, data replay has proven to be an effective technical approach. By retaining a small number of representative old data samples, the model can review old knowledge while learning from new data, maintaining its ability to detect historical attack types. This not only helps address the stability-plasticity dilemma in model fine-tuning, but also provides an effective way to address the challenge of unknown categories in traffic classification. However, a key challenge facing this approach is the imbalance between new and old samples. This problem arises from the fact that the number of newly added samples far exceeds the number of retained old samples, which can cause the model to favor new samples and neglect the accurate identification of old samples. To overcome this difficulty, effective strategies are needed to ensure a balance between new and old samples, thereby maintaining the model's detection capabilities for all types of attacks.

[0006] After searching, CN202210106390.5 is an encrypted traffic classification method based on incremental learning, which trains the model by retaining samples with higher confidence under the current model and adding a category-balanced loss function to the loss function; CN202211618623.6 is a model training method and malicious traffic classification method and system based on contrastive incremental learning, which obtains latent space features through the encoding network of the variational autoencoder, uses knowledge distillation to transfer the trained model knowledge and combines incremental learning to classify and identify known and unknown malicious classes; CN202110380396.7 is an incremental learning traffic anomaly detection method based on deep learning, which extracts traffic data features through the LSTM model, and establishes a decision tree to improve the support vector machine model for classification.

[0007] The various existing methods mentioned above mostly only extract the features of the entire flow or session in general when extracting features from network traffic data, while ignoring the relationship between packet-level traffic. When performing incremental learning on the traffic classification model, they also fail to fully utilize the rich old category knowledge in the old data. In the present invention, the interdependence between packet-level features is captured by constructing the session-level network traffic as a 3D image and combining it with a multi-head attention mechanism module, and a model is constructed based on the new and old data diversion strategy to solve the model bias problem caused by the imbalance of new and old samples. Summary of the Invention

[0008] The present invention aims to overcome the above-mentioned shortcomings of the prior art and provides a method and system for detecting malicious incremental traffic based on a diversion strategy.

[0009] The present invention utilizes a session-level traffic processing method based on packet-level alignment technology to extract independent session-level traffic from network traffic data, and performs de-duplication, packet alignment, and anonymization operations on the data packets in the traffic to construct a 3D image traffic sample representation containing spatiotemporal features. Through a network traffic multi-classification model based on the spatiotemporal features of the data, the rich correlation features between the data packets in the session are captured from the 3D-CNN feature extraction model and the multi-head attention mechanism. Then, by retaining a small number of representation samples of the old categories, the stacked model meta-classifier and the new and old data binary classifier are trained to construct an incremental model for network traffic malicious traffic detection based on the diversion strategy for subsequent detection tasks.

[0010] Specifically, the present invention focuses on the analysis of network traffic data, extracts session-level traffic, and processes the data packets (deduplicate, align, and anonymize) to construct 3D image samples to represent the spatiotemporal features in the traffic. Utilizing 3D convolutional neural networks (3D-CNN) and multi-head attention mechanisms, we deeply explore the correlation features between data packets in the session and improve the efficiency and accuracy of feature extraction. Using an incremental learning method, combined with a diversion strategy based on a binary classifier of new and old data and a model stacking meta-classifier, we construct a malicious traffic detection model that can adapt to new and old traffic patterns. The model is trained by retaining a small number of old category samples, aiming to overcome catastrophic forgetting of the model and improve the accuracy and adaptability of the traffic anomaly detection model.

[0011] The technical solutions adopted by the present invention to achieve the above-mentioned purpose are as follows:

[0012] A first aspect of the present invention relates to an incremental learning method for malicious traffic detection based on a diversion strategy, characterized in that it includes the following steps:

[0013] S1: Collect and preprocess the initial network traffic data. The collected data is split into five-tuples (source IP address, destination IP address, source port number, destination port number, and transport layer protocol number) and session-level traffic (bidirectional flow) formats. The packets in the session data are aligned and converted into sample representations in 3D image format.

[0014] S2: Design a network traffic multi-classification model based on the spatiotemporal characteristics of the data. Use the 3D-CNN model with a multi-head attention mechanism to build a basic multi-classifier. Use the network traffic collected in S1 to train the basic multi-classifier in the initial stage, and then randomly retain some samples for representation.

[0015] S3: In the new incremental phase, new category network traffic data is collected and processed using the method in step S1. The model designed in step S2 is then used to train a new basic multi-classifier. The multi-classifier trained in the previous phase is used as the old classifier, and the categories that can be classified by it are regarded as old categories.

[0016] S4: After the classifier training is completed in the current stage, a small number of samples are randomly selected from the network traffic data representation seen in the current stage and retained. A new and old data binary classifier that can distinguish between new and old category data is trained. Then, all old classifiers are strategically stacked to support the detection of all old anomaly categories in the early stage.

[0017] S5: Using the old category data obtained in S3, a meta-classifier is trained to stack the old classifiers trained before the incremental step. The meta-classifier is trained based on the feature vectors output by each old classifier. The meta-classifier is used to fit the stacked multiple old classifiers so that it has the ability to distinguish all old categories.

[0018] S6: Use the old category data obtained in S3 and the new category traffic data seen in the current stage to train a binary classifier that can distinguish between new and old data;

[0019] S7: Repeat steps S3-S6 to complete the incremental learning phase;

[0020] S8: Design an incremental traffic malicious detection method based on diversion strategy to identify malicious traffic in the network.

[0021] Preferably, in step S1:

[0022] S1.1: Segment the collected initial network traffic data into session-level traffic according to the five-tuple information of the data packet;

[0023] S1.2: Process each session and remove retransmitted packets due to network transmission errors.

[0024] S1.3: Extract the IP layer information of the first H packets from each session, and then extract the first m*m bytes of data from the IP layer information as the traffic sample representation of this session;

[0025] S1.4: Anonymize the source and destination IP addresses in the extracted IP layer information by replacing them with 0.0.0.0, and then normalize the remaining information to the range of 0-1;

[0026] S1.5: Align the data by padding with zeros to lengthen packets with less than m*m bytes of IP layer information to m*m bytes. Then, pad sessions with less than H packets to a length of H.

[0027] S1.6: Arrange the data packets processed by S1.5 in the order of arrival and process the session data into a 3D image, which can be represented as P∈R H*m*m .

[0028] Preferably, in step S2:

[0029] S2.1: The 3D image P of the training set is input into the 3D-CNN model to extract the temporal and content features of the traffic data. Its structure consists of two sequentially connected blocks. Each block contains multiple 3D convolution layers and maximum pooling layers. The image data undergoes a series of convolution and pooling steps, and finally the feature extractor output h is obtained. out1 ;

[0030] S2.2: Output h from the feature extractor out1Input the multi-head attention mechanism module, analyze the interaction and dependency between features through parallel attention heads, capture the global dependency between features, and obtain the output h out2 ;

[0031] The multi-head attention mechanism is implemented by splitting the attention mechanism "head" into multiple heads, each of which independently learns different relationships between inputs. The specific implementation is as follows:

[0032] First, a linear transformation is performed. For each head i, the input H out1 The query vector Q is calculated through different linear transformations i , key vector K i Sum value vector V i ,in:

[0033]

[0034] The second step is attention calculation. For each head, calculate the attention score A i and output O i ,in:

[0035]

[0036] Finally, merge the multi-head output: output all heads O i Splice and calculate the final output h through a linear transformation out2 , the formula is:

[0037] h out2 =Concat(O1,O2,…,O n )·W O (3)

[0038] Among them, "Concat" represents the concatenation operation, and n represents the output O i The number of

[0039] In short, in the multi-head attention mechanism, the input h out1 will be linearly transformed into multiple different spaces to calculate different attention scores, which will then be merged and transformed again to produce the output h out2 ;

[0040] S2.3: weighted feature h out2 Input the classifier, map the features to the category space through the fully connected layer, and output the final classification prediction h out3 ;

[0041] S2.4: Calculate predicted h out3The multi-classification cross entropy loss function between the actual label and the actual label is used, and the model parameters are updated through the back propagation algorithm to optimize the model classification performance. This step is repeated until the model performance reaches the expected goal and the training is completed. The multi-classification cross entropy loss function formula used is:

[0042]

[0043] Among them, N represents the number of samples, C represents the number of data categories seen in the current stage, and y i,c represents the true category of the i-th sample, Represents the predicted output of the multi-classification model for the i-th sample.

[0044] Preferably, in step S3:

[0045] S3.1: In the new incremental phase, collect new network traffic data of new categories that can be observed in the current phase;

[0046] S3.2: Use the data processing method of step S1 to process the new category data into a simplified sample representation;

[0047] S3.3: Use the model designed in step S2 to train a new multi-classifier that can accurately distinguish the new category data in the current stage;

[0048] S3.4: The multi-classifier trained in the previous stage is used as the old classifier, and the categories that can be classified by it are regarded as old categories. That is, the new multi-classifier in the current stage will be regarded as the old classifier starting from the next stage.

[0049] Preferably, in step S4:

[0050] S4.1: Observe the number of samples of each category visible at the current stage. Based on the frequency and diversity of samples of each category in real situations, determine the number of samples to extract from the traffic data. To save storage resources, the number of samples is limited to 5% of the total number.

[0051] S4.2: Randomly select a predefined number of samples from the network traffic data of the current stage and save them to be used as the training set for subsequent training of the new and old data binary classifiers and the old classifier stacking model.

[0052] Preferably, in step S5:

[0053] S5.1: After each incremental training step, retain the trained multiple classifiers that have been trained and optimized on the previous data to recognize and classify the data categories during their training period;

[0054] S5.2: Input the old data retained in S4 into all old classifiers and merge the results into a feature vector. This feature vector contains the knowledge from different classifiers and their understanding of the sample. This feature vector is used as input information for the meta-classifier, which will provide the meta-classifier with information with sufficient discrimination.

[0055] S5.3: Use the feature vector constructed in S5.2 and the original sample labels as the training set to train the meta-classifier. Its training loss function adopts the multi-classification cross entropy loss function in formula (4), where the predicted value of the meta-classifier is The calculation formula is:

[0056]

[0057] in, represents the output of the meta-classifier, meta represents the prediction function of the meta-classifier, f1(x),f2(x),…,f n (x) represents the feature vector output of the basic multi-classifier corresponding to the input data x;

[0058] S5.4: Concatenate all old classifiers and the meta-classifier and use them as old classification models in the incremental classification model.

[0059] Preferably, in step S6:

[0060] S6.1: Use the old data retained before the current incremental stage as the old data category and the data seen in the current stage as the new category to construct the training set for the new and old binary classifiers of the current stage.

[0061] S6.2: Use the training data from the current incremental phase to train a binary classifier for new and old data. The loss function uses binary cross entropy, which is:

[0062]

[0063] Similar to formula (4), N represents the number of samples, y i represents the label of the i-th sample (its value is 0 or 1), Represents the prediction result of the binary classification model for the i-th sample;

[0064] Preferably, in step S7:

[0065] S7.1: Repeat steps S3-S6 in each incremental learning stage to train the new and old binary classifiers and meta-classifiers in each stage;

[0066] S7.2: Based on the trained new and old binary classifiers and meta-classifiers and the basic multi-classifiers in each incremental stage, construct an incremental malicious traffic detection model based on the diversion strategy;

[0067] Preferably, in step S8:

[0068] S8.1: Use an incremental malicious traffic detection model based on a diversion strategy for detection. Input data is first determined by a binary classifier to determine whether the input data belongs to the old or new category, and then the input data is diverted and classified.

[0069] S8.2: For samples classified as old categories, input them into the previously retained old multi-classifier for further classification. This old classifier’s expertise in old category data is used to ensure accurate recognition of the old category. For samples classified as new categories, input them into the new classifier trained in the current stage for further classification. The new classifier specializes in processing the newly added categories and has higher recognition ability for these categories.

[0070] S8.3: Based on the outputs of the binary classifier and the multi-classifier, integrate and output the final classification result.

[0071] A second aspect of the present invention relates to a system for implementing a method for detecting malicious incremental traffic based on a diversion strategy of the present invention, comprising: a network traffic preprocessing module, a basic model training module, a network traffic data sampling module, a model stacking module, and a binary classifier module;

[0072] The network traffic preprocessing module collects network traffic data in the network, preprocesses the collected data, and obtains a simplified traffic data representation;

[0073] The basic model training module uses the network traffic data seen in the current stage to train a basic classifier that can accurately classify the current category of traffic, which serves as the basis for the new classifier in the current stage and the old classifier in the subsequent stage;

[0074] The network traffic data sampling module randomly selects an appropriate amount of data representation from the network data seen in the current stage as the knowledge source for the subsequent binary classifier and stacked model meta-classifier;

[0075] The model stacking module uses the old data extracted by the network traffic data sampling module and all classifiers except the new basic classifier in the current stage to train a small meta-classifier, so that it can complete the classification task of all old categories based on the features extracted by the old classifier;

[0076] The binary classifier module uses the old data taken out by the network traffic data sampling module and the new data seen in the current stage to train the binary classifier, so as to accurately divert the test data and input it into the classifier that can accurately classify the test data.

[0077] The present invention converts network traffic into a streamlined data representation, uses a multi-head attention mechanism to capture the rich spatiotemporal characteristics between data packets in session traffic, trains a high-precision basic multi-classification model in each incremental step, and based on this, constructs an incremental learning model for malicious traffic detection based on a diversion strategy.

[0078] The present invention realizes the continuous maintenance and update of the network traffic malicious behavior detection model based on the new and old data diversion strategy. When the model is running, only a very small number of old samples and basic classification models need to be retained. It can achieve high-precision detection while expanding the applicable categories of the detection model. This greatly reduces the computing and storage consumption of retraining the detection model. When new attack methods appear, the model can be quickly adjusted to update the anomaly detection system.

[0079] Compared with the prior art, the present invention has the following beneficial effects:

[0080] (1) The present invention designs a session-level traffic processing method based on packet-level alignment technology. The method extracts session-level traffic from network traffic data, aligns the data packets in the session, removes duplicate packets, and anonymizes them. A grayscale image is constructed for each packet to construct the entire session into a 3D image. This ensures that the features of each data packet are comparable in the same dimension, while avoiding privacy leakage and model overfitting problems, reducing data redundancy, and improving data processing efficiency and model training efficiency.

[0081] (2) This paper constructs a network traffic multi-classification model based on the spatiotemporal characteristics of data, effectively utilizing the output characteristics of the 3D-CNN model and the multi-head attention mechanism. While effectively capturing the spatiotemporal characteristics of the packet sequence, it also captures the rich interrelationships between each packet, thus enhancing the model's ability to understand the complex interactions between packets.

[0082] (3) The present invention designs and implements a new and old data diversion strategy based on binary classification. By saving a very small amount of old data representation samples as a knowledge source, a binary classifier is constructed according to the data characteristics of each incremental step and the previous basic model is integrated as the old category classifier. The detection data is input into the appropriate classifier to solve the model bias problem caused by the imbalance of new and old samples, and the maintenance and update of the network traffic malicious behavior detection model is efficiently realized. BRIEF DESCRIPTION OF THE DRAWINGS

[0083] In order to explain the content of the present invention more clearly, the present invention will be further described below based on specific embodiments of the present invention in conjunction with the accompanying drawings.

[0084] Figure 1 It is a structural flow chart of the present invention.

[0085] Figure 2This is the network traffic data processing process of the present invention.

[0086] Figure 3 The present invention processes network traffic samples to obtain a simplified sample representation of session-level traffic.

[0087] Figure 4 This is a framework diagram of the basic model used in the present invention.

[0088] Figure 5 This is a framework diagram of the incremental learning model for malicious traffic detection based on diversion strategy proposed in the present invention.

[0089] Figure 6 This is a system module connection diagram of the present invention. DETAILED DESCRIPTION

[0090] The technical solution of the present invention is further described below with reference to the accompanying drawings.

[0091] Example 1

[0092] The present invention extracts independent session-level traffic from network traffic data, and performs de-duplication, packet alignment and anonymization operations on the data packets in the traffic, constructs a 3D image traffic sample representation containing spatiotemporal features, and uses a 3D-CNN feature extraction model and a multi-head attention mechanism to capture the rich correlation features between data packets in the session. Then, by retaining a small number of representation samples of old categories, a stacked model meta-classifier and a new and old data binary classifier are trained to construct an incremental model for network traffic malicious traffic detection based on a diversion strategy for subsequent detection tasks.

[0093] Specifically, the present invention focuses on the analysis of network traffic data, extracts session-level traffic, and processes the data packets (deduplicate, align, and anonymize) to construct 3D image samples to represent the spatiotemporal features in the traffic. Utilizing 3D convolutional neural networks (3D-CNN) and multi-head attention mechanisms, we deeply explore the correlation features between data packets in the session and improve the efficiency and accuracy of feature extraction. Using an incremental learning method, combined with a diversion strategy based on a binary classifier of new and old data and a model stacking meta-classifier, we construct a malicious traffic detection model that can adapt to new and old traffic patterns. The model is trained by retaining a small number of old category samples, aiming to overcome catastrophic forgetting of the model and improve the accuracy and adaptability of the traffic anomaly detection model.

[0094] The technical solutions adopted by the present invention to achieve the above-mentioned purpose are as follows:

[0095] A method for detecting malicious incremental traffic based on a diversion strategy includes the following steps:

[0096] S1: Collect and preprocess the initial network traffic data. The collected data is split into five-tuples (source IP address, destination IP address, source port number, destination port number, and transport layer protocol number) and session-level traffic (bidirectional flow) formats. The packets in the session data are aligned and converted into sample representations in 3D image format.

[0097] S2: Design a network traffic multi-classification model based on the spatiotemporal characteristics of the data. Use the 3D-CNN model with a multi-head attention mechanism to build a basic multi-classifier. Use the network traffic collected in S1 to train the basic multi-classifier in the initial stage, and then randomly retain some samples for representation.

[0098] S3: In the new incremental phase, new category network traffic data is collected and processed using the method in step S1. The model designed in step S2 is then used to train a new basic multi-classifier. The multi-classifier trained in the previous phase is used as the old classifier, and the categories that can be classified by it are regarded as old categories.

[0099] S4: After the classifier training is completed in the current stage, a small number of samples are randomly selected from the network traffic data representation seen in the current stage and retained. A new and old data binary classifier that can distinguish between new and old category data is trained. Then, all old classifiers are strategically stacked to support the detection of all old anomaly categories in the early stage.

[0100] S5: Using the old category data obtained in S3, a meta-classifier is trained to stack the old classifiers trained before the incremental step. The meta-classifier is trained based on the feature vectors output by each old classifier. The meta-classifier is used to fit the stacked multiple old classifiers so that it has the ability to distinguish all old categories.

[0101] S6: Use the old category data obtained in S3 and the new category traffic data seen in the current stage to train a binary classifier that can distinguish between new and old data;

[0102] S7: Repeat steps S3-S6 to complete the incremental learning phase;

[0103] S8: Design an incremental traffic malicious detection method based on diversion strategy to identify malicious traffic in the network.

[0104] In the step S1:

[0105] S1.1: Segment the collected initial Packet Capture Data File Format (PCAP) network traffic data into session-level (bidirectional) traffic based on the packet's five-tuple information (source IP address, destination IP address, source port number, destination port number, and transport layer protocol number).

[0106] S1.2: Process each session and remove retransmitted packets due to network transmission errors.

[0107] S1.3: Extract the IP layer information of the first 20 packets from each session, and then extract the first 256 (16 * 16) bytes of data from the IP layer information as the traffic sample representation of this session;

[0108] S1.4: Anonymize the source and destination IP addresses in the extracted IP layer information by replacing them with 0.0.0.0, and then normalize the remaining information to the range of 0-1;

[0109] S1.5: Align the data by padding with zeros to lengthen packets with IP layer information less than 16*16 bytes to 16*16 bytes. Furthermore, sessions with less than 20 packets are padded to a length of 20.

[0110] S1.6: Arrange the data packets processed by S1.5 in the order in which they arrive, and process the session data into a 3D image, which can be represented as P∈R 20*16*16 .

[0111] In the step S2:

[0112] S2.1: The 3D image P of the training set is input into the 3D-CNN model to extract the temporal and content features of the traffic data. Its structure consists of two sequentially connected blocks. Each block contains multiple 3D convolution layers and maximum pooling layers. The image data undergoes a series of convolution and pooling steps, and finally the feature extractor output h is obtained. out1 ;

[0113] S2.2: Output h from the feature extractor out1 Input the multi-head attention mechanism module, analyze the interaction and dependency between features through parallel attention heads, capture the global dependency between features, and obtain the output h out2 ;

[0114] The multi-head attention mechanism is implemented by splitting the attention mechanism "head" into multiple heads, each of which independently learns different relationships between inputs. The specific implementation is as follows:

[0115] First, a linear transformation is performed. For each head i, the input H out1 The query vector Q is calculated through different linear transformations i , key vector K i Sum value vector V i ,in:

[0116]

[0117] The second step is attention calculation. For each head, calculate the attention score A i and output O i ,in:

[0118]

[0119] Finally, merge the multi-head output: output all heads O i Splice and calculate the final output h through a linear transformation out2 , the formula is:

[0120] h out2 =Concat(O1,O2,…,O n )·W O (3)

[0121] Among them, "Concat" represents the concatenation operation, and n represents the output O i The number of

[0122] In short, in the multi-head attention mechanism, the input h out1 will be linearly transformed into multiple different spaces to calculate different attention scores, which will then be merged and transformed again to produce the output h out2 ;

[0123] S2.3: weighted feature h out2 Input the classifier, map the features to the category space through the fully connected layer, and output the final classification prediction h out3 ;

[0124] S2.4: Calculate predicted h out3 The multi-classification cross entropy loss function between the actual label and the actual label is used, and the model parameters are updated through the back propagation algorithm to optimize the model classification performance. This step is repeated until the model performance reaches the expected goal and the training is completed. The multi-classification cross entropy loss function formula used is:

[0125]

[0126] Among them, N represents the number of samples, C represents the number of data categories seen in the current stage, and y i,c represents the true category of the i-th sample, Represents the predicted output of the multi-classification model for the i-th sample.

[0127] In the step S3:

[0128] S3.1: In the new incremental phase, collect new network traffic data of new categories that can be observed in the current phase;

[0129] S3.2: Use the data processing method of step S1 to process the new category data into a simplified sample representation;

[0130] S3.3: Use the model designed in step S2 to train a new multi-classifier that can accurately distinguish the new category data in the current stage;

[0131] S3.4: The multi-classifier trained in the previous stage is used as the old classifier, and the categories that can be classified by it are regarded as old categories. That is, the new multi-classifier in the current stage will be regarded as the old classifier starting from the next stage.

[0132] In the step S4:

[0133] S4.1: Observe the number of samples of each category visible at the current stage. Based on the frequency and diversity of samples of each category in real situations, determine the number of samples to extract from the traffic data. To save storage resources, the number of samples is limited to 5% of the total number.

[0134] S4.2: Randomly select a predefined number of samples from the current phase of network traffic data and save them to be used as training sets for subsequent training of new and old data binary classifiers and old classifier stacking models

[0135] In the step S5:

[0136] S5.1: After each incremental training step, retain the trained multiple classifiers that have been trained and optimized on the previous data to recognize and classify the data categories during their training period;

[0137] S5.2: Input the old data retained in S4 into all old classifiers and merge the results into a feature vector. This feature vector contains the knowledge from different classifiers and their understanding of the sample. This feature vector is used as input information for the meta-classifier, which will provide the meta-classifier with information with sufficient discrimination.

[0138] S5.3: Use the feature vector constructed in S5.2 and the original sample labels as the training set to train the meta-classifier. Its training loss function adopts the multi-classification cross entropy loss function in formula (4), where the predicted value of the meta-classifier is The calculation formula is:

[0139]

[0140] in, Represents the output of the meta-classifier, f meta represents the prediction function of the meta-classifier, f1(x),f2(x),…,f n (x) represents the feature vector output of the basic multi-classifier corresponding to the input data x;

[0141] S5.4: Concatenate all old classifiers and the meta-classifier and use them as old classification models in the incremental classification model.

[0142] In the step S6:

[0143] S6.1: Use the old data retained before the current incremental stage as the old data category and the data seen in the current stage as the new category to construct the training set for the new and old binary classifiers of the current stage.

[0144] S6.2: Use the training data from the current incremental phase to train a binary classifier for new and old data. The loss function uses binary cross entropy, which is:

[0145]

[0146] Similar to formula (4), N represents the number of samples, y i represents the label of the i-th sample (its value is 0 or 1), Represents the prediction result of the binary classification model for the i-th sample;

[0147] In step S7:

[0148] S7.1: Repeat steps S3-S6 in each incremental learning stage to train the new and old binary classifiers and meta-classifiers in each stage;

[0149] S7.2: Based on the trained new and old binary classifiers and meta-classifiers and the basic multi-classifiers in each incremental stage, construct an incremental malicious traffic detection model based on the diversion strategy;

[0150] In the step S8:

[0151] S8.1: Use an incremental malicious traffic detection model based on a diversion strategy for detection. Input data is first determined by a binary classifier to determine whether the input data belongs to the old or new category, and then the input data is diverted and classified.

[0152] S8.2: For samples classified as old categories, input them into the previously retained old multi-classifier for further classification. This old classifier’s expertise in old category data is used to ensure accurate recognition of the old category. For samples classified as new categories, input them into the new classifier trained in the current stage for further classification. The new classifier specializes in processing the newly added categories and has higher recognition ability for these categories.

[0153] S8.3: Based on the outputs of the binary classifier and the multi-classifier, integrate and output the final classification result.

[0154] In order to verify the performance of the incremental learning method proposed in this paper, we use the CIC-IDS-2018, CIC-DDoS-2019, TON-IOT and CTU-13 network traffic datasets to merge into an experimental dataset containing 25 categories of traffic (1 category of normal traffic and 24 categories of abnormal traffic) to evaluate the effect of the proposed method. The specific experiments are as follows:

[0155] First, in terms of the number of data sets, the 1 type of normal traffic includes TCP and UDP traffic, and the 24 types of abnormal traffic include Bot, DDoS, Dos_Hulk, UDP_DDos and MSSQL. The specific categories and corresponding sample numbers are shown in Table 1. This experiment initially selected 5 types of traffic (1 type of normal and 4 types of abnormal) as the basis for training the initial multi-classifier model. In each subsequent incremental stage, a model that can classify the new 5 types of abnormal traffic is trained as a multi-classification model that can accurately classify the data seen in that stage. After the multi-classifier training of each incremental stage is completed, 5% of the current data of each category is randomly selected (if 5% is greater than 200, only 200 samples are retained) as the basis for the new and old binary classifiers and the stacked model meta-classifier. The data seen in the current stage is used as the new data, and the data retained in the previous incremental stage is used as the basis for the new and old binary classifiers and the stacked model meta-classifier. The old data is used as the old data to train a binary classifier that can implement the new and old data diversion strategy; the multi-classifier of each previous stage is used as a feature extractor to input the previously retained old data to obtain a feature vector with high discrimination and used to train the stacked model meta-classifier, which is used as the old classifier of the model; in the test phase, the input data will first be input into the new and old data binary classifier to implement diversion and classification of the input data. For samples with the classification results of the old category, they are input into the previously retained old multi-classifier for further classification. For samples with the classification results of the new category, they are input into the new classifier trained in the current stage for classification. The output results of the two classifiers are combined to obtain an accurate classification of the input data; the evaluation indicator of the method performance is the accuracy of each incremental stage; the comparison method is the iCaRL (Incremental Classifier and Representation Learning) method proposed in CVPR-2017, and the comparison results are shown in Table 2.

[0156] Table 1 Data categories and corresponding sample sizes

[0157]

[0158]

[0159] Table 2 Results of four incremental experiments

[0160] method Initial Model Increment 1 time Increment 2 times Increment 3 times Increment 4 times The present invention 100 99.39 97.45 96.76 96.14 iCaRL 100 82.38 81.29 80.04 79.06

[0161] Example 2

[0162] This embodiment relates to a system for implementing a method for detecting malicious incremental traffic based on a diversion strategy according to embodiment 1, comprising: a network traffic preprocessing module, a basic model training module, a network traffic data sampling module, a model stacking module, and a binary classifier module;

[0163] The network traffic preprocessing module collects network traffic data in the network, preprocesses the collected data, and obtains a simplified traffic data representation;

[0164] S1.1: Segment the collected Packet Capture Data File Format (PCAP) network traffic data into session-level (bidirectional) traffic based on the packet's five-tuple information (source IP address, destination IP address, source port number, destination port number, and transport layer protocol number).

[0165] S1.2: Process each session and remove retransmitted packets due to network transmission errors.

[0166] S1.3: Extract the IP layer information of the first 20 packets from each session, and then extract the first 256 (16 * 16) bytes of data from the IP layer information as the traffic sample representation of this session;

[0167] S1.4: Anonymize the source and destination IP addresses in the extracted IP layer information by replacing them with 0.0.0.0, and then normalize the remaining information to the range of 0-1;

[0168] S1.5: Align the data by padding with zeros to lengthen packets with IP layer information less than 16*16 bytes to 16*16 bytes. Furthermore, sessions with less than 20 packets are padded to a length of 20.

[0169] S1.6: Arrange the data packets in the order they arrive and process the session data into a 3D image P∈R 20816816 express.

[0170] The basic model training module uses the network traffic data seen in the current stage to train a basic classifier that can accurately classify the current category of traffic, which serves as the basis for the new classifier in the current stage and the old classifier in the subsequent stage;

[0171] S2.1: Input the 3D image P of the training set into the 3D-CNN model to extract the temporal and content features of the traffic data and obtain the feature extractor output h out1 ;

[0172] S2.2: Output h from the feature extractorout1 Input the multi-head attention mechanism module, analyze the interaction and dependency between features through parallel attention heads, capture the global dependency between features, and obtain the output h out2 ;

[0173] S2.3: weighted feature h out2 Input the classifier, map the features to the category space through the fully connected layer, and output the final classification prediction h out3 ;

[0174] The network traffic data sampling module randomly selects an appropriate amount of data representation from the network data seen in the current stage as the knowledge source for the subsequent binary classifier and stacked model meta-classifier;

[0175] S3.1: Observe the number of samples of each category visible at the current stage. Based on the frequency and diversity of samples of each category in real situations, determine the number of samples to extract from the traffic data. To save storage resources, the number of samples is limited to 5% of the total number.

[0176] S3.2: Use a random sampling strategy to select a predefined number of samples from the network traffic data of the current stage and save them for use as training sets for subsequent training of the new and old data binary classifiers and the old classifier stacking model.

[0177] The model stacking module uses the old data extracted by the network traffic data sampling module and all classifiers except the new basic classifier in the current stage to train a small meta-classifier, so that it can complete the classification task of all old categories based on the features extracted by the old classifier;

[0178] S4.1: After each incremental training step, retain the trained multiple classifiers that have been trained and optimized on the previous data to recognize and classify the data categories during their training period;

[0179] S4.2: Input the old data retained in S3 into all old classifiers and merge the results into a feature vector. This feature vector contains the knowledge from different classifiers and their understanding of the sample. This feature vector is used as input information for the meta-classifier, which will provide the meta-classifier with information with sufficient discrimination.

[0180] S4.3: Use the feature vector constructed in S4.2 and the original sample labels as the training set to train the meta-classifier;

[0181] S4.4: Concatenate all old classifiers and the meta-classifier and use them as old classification models in the incremental classification model.

[0182] The binary classifier module uses the old data taken out by the network traffic data sampling module and the new data seen in the current stage to train the binary classifier, so as to accurately divert the test data and input it into the classifier that can accurately classify the test data.

[0183] S5.1: Use the data randomly sampled in step S3 as the old data of the binary classifier, and use the data seen in the current stage as the new data to train the binary classifier;

[0184] The embodiments described above are only for a more detailed description of the present invention and are not intended to limit the scope of the present invention. Without departing from the design spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by ordinary technicians in this field should fall within the scope of protection determined by the claims of the present invention.

Claims

1. A method for detecting malicious incremental traffic based on a diversion strategy, characterized in that: The steps include: S1: Collect and preprocess the initial network traffic data. The collected data is split into a five-tuple of source IP address, destination IP address, source port number, destination port number, and transport layer protocol number, in session-level traffic format. The packets in the session data are aligned and converted into sample representations in 3D image format. S2: Design a network traffic multi-classification model based on the spatiotemporal characteristics of the data. Use the 3D-CNN model with a multi-head attention mechanism to build a basic multi-classifier. Use the network traffic collected in step S1 to train the basic multi-classifier in the initial stage, and then randomly retain some sample representations. S3: In the new incremental phase, new category network traffic data is collected and processed using the method in step S1. The model designed in step S2 is then used to train a new basic multi-classifier. The multi-classifier trained in the previous phase is used as the old classifier, and the categories that can be classified by it are regarded as old categories. S4: After the classifier training is completed in the current stage, a small number of samples are randomly selected from the network traffic data representation seen in the current stage and retained. A new and old data binary classifier that can distinguish between new and old category data is trained. Then, all old classifiers are strategically stacked to support the detection of all old anomaly categories in the early stage. S5: Using the old category data obtained in S3, a meta-classifier is trained to stack the old classifiers trained before the incremental step. The meta-classifier is trained based on the feature vectors output by each old classifier. The meta-classifier is used to fit the stacked multiple old classifiers so that it has the ability to distinguish all old categories. S6: Use the old category data obtained in S3 and the new category traffic data seen in the current stage to train a binary classifier that can distinguish between new and old data; S7: Repeat steps S3-S6 to complete the incremental learning phase; S8: Design an incremental traffic malicious detection method based on diversion strategy to identify malicious traffic in the network.

2. The method for detecting malicious incremental traffic based on a diversion strategy according to claim 1, characterized in that: The step S1 specifically includes: S1.1: Segment the collected initial network traffic data into session-level traffic according to the five-tuple information of the data packet; S1.2: Process each session and remove retransmitted packets due to network transmission errors. S1.3: Extract the IP layer information of the first H packets from each session, and then extract the first m*m bytes of data from the IP layer information as the traffic sample representation of this session; S1.4: Anonymize the source and destination IP addresses in the extracted IP layer information by replacing them with 0.0.0.0, and then normalize the remaining information to the range of 0-1; S1.5: Align the data by padding with zeros to lengthen packets with less than m*m bytes of IP layer information to m*m bytes. Then, pad sessions with less than H packets to a length of H. S1.6: Arrange the data packets processed by S1.5 in the order of arrival and process the session data into a 3D image, represented as P∈R H*m*m .

3. The method for detecting malicious incremental traffic based on a diversion strategy according to claim 1, It is characterized in that The step S2 specifically includes: S2.1: The 3D image P of the training set is input into the 3D-CNN model to extract the temporal and content features of the traffic data. Its structure consists of two sequentially connected blocks. Each block contains multiple 3D convolution layers and maximum pooling layers. The image data undergoes a series of convolution and pooling steps, and finally the feature extractor output h is obtained. out1 ; S2.2: Output h from the feature extractor out1 Input the multi-head attention mechanism module, analyze the interaction and dependency between features through parallel attention heads, capture the global dependency between features, and obtain the output h out2 ; The multi-head attention mechanism is implemented by splitting the attention mechanism "head" into multiple heads, each of which independently learns different relationships between inputs. The specific implementation is as follows: First, a linear transformation is performed. For each head i, the input H out1 The query vector Q is calculated through different linear transformations i , key vector K i Sum value vector V i ,in: The second step is attention calculation. For each head, calculate the attention score A i and output O i ,in: Finally, merge the multi-head output: output all heads O i Splice and calculate the final output h through a linear transformation out2 , the formula is: h out2 =Concat(O1,O2,…,O n )·W O (3) Among them, "Concat" represents the concatenation operation, and n represents the output O i the number of In the multi-head attention mechanism, the input h out1 will be linearly transformed into multiple different spaces to calculate different attention scores, which will then be merged and transformed again to produce the output h out2 ; S2.3: weighted feature h out2 Input the classifier, map the features to the category space through the fully connected layer, and output the final classification prediction h out3 ; S2.4: Calculate predicted h out3 The multi-classification cross entropy loss function between the actual label and the actual label is used, and the model parameters are updated through the back propagation algorithm to optimize the model classification performance. The model parameters are updated repeatedly until the model performance reaches the expected goal and the training is completed. The multi-classification cross entropy loss function formula used is: Among them, N represents the number of samples, C represents the number of data categories seen in the current stage, and y i,c represents the true category of the i-th sample, Represents the predicted output of the multi-classification model for the i-th sample.

4. The method for detecting malicious incremental traffic based on diversion strategy according to claim 1, characterized in that: The step S3 specifically includes: S3.1: In the new incremental phase, collect new network traffic data of new categories that can be observed in the current phase; S3.2: Use the data processing method of step S1 to process the new category data into a simplified sample representation; S3.3: Use the model designed in step S2 to train a new multi-classifier that can accurately distinguish the new category data in the current stage; S3.4: The multi-classifier trained in the previous stage is used as the old classifier, and the categories that can be classified by it are regarded as old categories. That is, the new multi-classifier in the current stage will be regarded as the old classifier starting from the next stage.

5. The method for detecting malicious incremental traffic based on diversion strategy according to claim 1, characterized in that: The step S4 specifically includes: S4.1: Observe the number of samples of each category visible at the current stage. Based on the frequency and diversity of samples of each category in real situations, determine the number of samples to extract from the traffic data. To save storage resources, the number of samples is limited to 5% of the total number. S4.2: Randomly select a predefined number of samples from the network traffic data of the current stage and save them to be used as the training set for subsequent training of the new and old data binary classifiers and the old classifier stacking model.

6. The method for detecting malicious incremental traffic based on diversion strategy according to claim 1, characterized in that: The step S5 specifically includes: S5.1: After each incremental training step, retain the trained multiple classifiers that have been trained and optimized on the previous data to recognize and classify the data categories during their training period; S5.2: Input the old data retained in S4 into all old classifiers and merge the results into a feature vector. This feature vector contains the knowledge from different classifiers and their understanding of the sample. This feature vector is used as input information for the meta-classifier, which will provide the meta-classifier with information with sufficient discrimination. S5.3: Use the feature vector constructed in S5.2 and the original sample labels as the training set to train the meta-classifier. Its training loss function adopts the multi-classification cross entropy loss function in formula (4), where the predicted value of the meta-classifier is The calculation formula is: in, Represents the output of the meta-classifier, f meta represents the prediction function of the meta-classifier, f1(x),f2(x),…,f n (x) represents the feature vector output of the basic multi-classifier corresponding to the input data x; S5.4: Concatenate all old classifiers and the meta-classifier and use them as old classification models in the incremental classification model.

7. The method for detecting malicious incremental traffic based on diversion strategy according to claim 1, characterized in that: The step S6 specifically includes: S6.1: Use the old data retained before the current incremental stage as the old data category and the data seen in the current stage as the new category to construct the training set for the new and old binary classifiers of the current stage. S6.2: Use the training data from the current incremental phase to train a binary classifier for new and old data. The loss function uses binary cross entropy, which is: Similar to formula (4), N represents the number of samples, y i represents the label of the i-th sample (its value is 0 or 1), Represents the prediction result of the binary classification model for the i-th sample.

8. The method for detecting malicious incremental traffic based on diversion strategy according to claim 1, characterized in that: The step S7 specifically includes: S7.1: Repeat steps S3-S6 in each incremental learning stage to train the new and old binary classifiers and meta-classifiers in each stage; S7.2: Based on the trained new and old binary classifiers and meta-classifiers and the basic multi-classifiers in each incremental stage, construct an incremental malicious traffic detection model based on the diversion strategy.

9. The method for detecting malicious incremental traffic based on diversion strategy according to claim 1, characterized in that: The step S8 specifically includes: S8.1: Use an incremental malicious traffic detection model based on a diversion strategy for detection. Input data is first determined by a binary classifier to determine whether the input data belongs to the old or new category, and then the input data is diverted and classified. S8.2: For samples classified as old categories, input them into the previously retained old multi-classifier for further classification. This old classifier’s expertise in old category data is used to ensure accurate recognition of the old category. For samples classified as new categories, input them into the new classifier trained in the current stage for further classification. The new classifier specializes in processing the newly added categories and has higher recognition ability for these categories. S8.3: Based on the outputs of the binary classifier and the multi-classifier, integrate and output the final classification result.

10. A system for implementing the method for detecting malicious incremental traffic based on a diversion strategy as claimed in claim 1, characterized in that: It includes network traffic preprocessing module, basic model training module, network traffic data extraction module, model stacking module and data diversion module; The network traffic preprocessing module collects network traffic data in the network, preprocesses the collected data, and obtains a simplified traffic data representation; The basic model training module uses the network traffic data seen in the current stage to train a basic classifier that can accurately classify the current category of traffic, which serves as the basis for the new classifier in the current stage and the old classifier in the subsequent stage; The network traffic data extraction module randomly selects an appropriate amount of data representation from the network data seen in the current stage as the knowledge source for the subsequent binary classifier and stacked model meta-classifier; The model stacking module uses the old data extracted by the network traffic data extraction module and all classifiers except the new basic classifier in the current stage to train a small meta-classifier, so that it can complete the classification task of all old categories based on the features extracted by the old classifier; The data diversion module uses the old data retrieved by the network traffic data extraction module and the new data seen in the current stage to train a binary classifier for accurately diverting the test data and inputting it into a classifier that can accurately classify the test data.

Images