Single-stage multi-view large-scale network behavior analysis system based on potential subspace anchor point learning

Abstract

The invention relates to a single-stage multi-view large-scale network behavior analysis system based on potential subspace anchor point learning. The invention discloses a single-stage multi-view large-scale network behavior analysis system based on potential subspace anchor point learning (SAGL), and belongs to the field of network behavior analysis. The method comprises the following steps: firstly, dominantly mapping a collected network data sample to a high-dimensional kernel space through a plurality of different empirical kernel functions; secondly, learning an anchor point of a sample in a consensus potential subspace; secondly, introducing a projection matrix to establish a relation between an anchor point in the consensus potential subspace and an original sample, and constructing a multi-view consensus anchor point diagram in a multi-view scene based on the idea of an adaptive neighbor method; then, strictly constraining connected components of the constructed multi-view consensus anchor point diagram; and finally, optimizing each parameter by adopting a coordinate descent method until convergence, and finally obtaining a cluster where the network data sample is located according to the connected component of the anchor point diagram. According to the method, information loss caused by mutual separation of stages of a large-scale network behavior analysis system is reduced, and a high-quality network behavior analysis result can be obtained through a single-stage strategy.

Description

Technical Field

[0001] The present invention relates to the field of network access behavior analysis, and in particular to a single-stage multi-view large-scale network behavior analysis system based on potential subspace anchor point learning. Background Art

[0002] The popularity of the Internet and the explosive growth of data access terminals have generated massive amounts of network access data. How to aggregate massive amounts of data with similar access behaviors based on the characteristics of the network data itself without providing label information guidance is an important means of network behavior analysis, which can provide important technical support for subsequent network intrusion detection.

[0003] Graph-based clustering algorithms can handle complex data well by estimating the manifold space where samples are located. They are one of the hot research topics in the field of machine learning and data analysis in recent years. However, such algorithms usually need to calculate the similarity relationship between all samples, and the amount of calculation is usually the quadratic or even cubic power of the number of samples N. Such a high computational cost means that such algorithms can achieve good performance when processing small-scale data, but cannot be extended to the application scenario of massive network access data analysis, and have poor scalability.

[0004] On the other hand, a large number of studies based on multi-perspective learning have proven that the comprehensive use of multiple data sources can effectively improve the performance of model data analysis. At present, network access data usually comes from a single data source. How to expand it into multi-source data to fully utilize the advantages of multi-perspective learning is also an important factor to consider when designing a large-scale network behavior analysis system.

[0005] In order to improve the scalability of the graph-based multi-view clustering algorithm, researchers tried to use the anchor graph strategy to reduce the computational cost. The core of the anchor graph is to select M (M<<N) representative anchor samples and build the connection between the anchor and all samples to describe the distribution of the overall samples, which can reduce the original graph-based algorithm’s O(N) 2 ) or even O(N 3 ) is greatly reduced to O(MN).

[0006] Anchor graph-based algorithms usually follow the process of first selecting anchor samples, then building anchor graphs, and finally obtaining the final clustering results through spectral clustering algorithms or K-means algorithms. However, the steps in this process are separated from each other, so there is information loss and suboptimal clustering results.

[0007] Relevant researchers have tried to combine anchor graph learning and clustering process in a unified learning framework to reduce information loss. For example, the parameter-free scalable multi-view graph clustering algorithm SFMC selects anchor points and constructs adaptive neighbor graphs of multiple perspectives through a self-designed sampling algorithm, and then learns the optimal structural consensus graph of the multi-view adaptive neighbor graph in a unified framework to directly obtain the cluster indication of the sample; the fast multi-view prototype graph clustering algorithm FMVPG randomly selects anchor samples to construct a K-nearest neighbor anchor graph, and then uses the anchor graph as the basis to combine spectral embedding and spectral rotation in a unified learning framework to directly obtain the clustering results of the samples.

[0008] Some researchers have also tried to combine anchor selection and anchor graph in a unified learning framework. For example, the scalable joint anchor multi-view subspace clustering algorithm SMVSC jointly learns the potential subspace anchors and consensus anchor graph of samples based on the idea of ​​self-representation subspace, and finally clusters the samples through the K-means algorithm; the fast non-parametric multi-view subspace clustering algorithm FPMVS-CAG guided by consistent anchors has developed a non-parametric version based on the SMVSC algorithm. However, there is no relevant research that can unify the three processes of anchor selection, anchor graph construction and sample clustering to minimize the suboptimal results caused by information loss. Summary of the invention

[0009] The purpose of the present invention is to provide a single-stage multi-perspective large-scale network behavior analysis system based on latent subspace anchor point learning, which can reduce the information loss caused by the correlation separation of each stage in the construction process of the large-scale network behavior analysis system, thereby improving the system's analysis performance on network data.

[0010] To achieve the above object, the present invention provides a single-stage multi-view large-scale network behavior analysis system based on latent subspace anchor point learning, which comprises:

[0011] Preprocessing: Collect the network data samples Z∈R D×N Through V different empirical kernel functions Explicitly map to high-dimensional kernel space to obtain the feature representation of network data samples in multiple high-dimensional kernel spaces Different high-dimensional kernel spaces are regarded as different perspectives, D is the original feature space dimension of the network data sample, N is the total number of network data samples, d v is the feature representation dimension of the vth perspective after mapping;

[0012] Learning sample anchor point A∈R in consensus latent subspace d×M , where M is the number of anchor points in the consensus latent subspace and d is the dimension of the consensus latent subspace;

[0013] Introduce the projection matrix for the vth perspective In this way, the jth anchor point sample a in the consensus potential subspace is established j ∈R d×1 and the i-th sample in the v-th view Based on the idea of ​​adaptive nearest neighbor method, a multi-view consensus anchor graph S is constructed in a multi-view scenario.

[0014] By strictly constraining the connected components of the constructed multi-view consensus anchor graph S, the number of its connected components is consistent with the number of network behavior categories K, thus directly reflecting the cluster structure of network data samples;

[0015] The coordinate descent method is used to optimize each parameter in the system until convergence, and finally the cluster where the network data samples are located is obtained.

[0016] The empirical kernel function involved in the above-mentioned single-stage multi-view large-scale network behavior analysis system based on latent subspace anchor learning, which is used to explicitly map network data samples to high-dimensional kernel space, is defined as Φ v :Z→X v , where Λ v is a diagonal matrix consisting of r eigenvalues ​​greater than 0 of the vth kernel function matrix, Q is the eigenvector corresponding to the r eigenvalues, ker v is the vth kernel function.

[0017] The final objective function in the above-mentioned single-stage multi-view large-scale network behavior analysis system based on latent subspace anchor learning is Among them, the introduced projection matrix The orthogonal constraint should be maintained to ensure the ability of the projection matrix to extract discriminative features, that is, s i represents the i-th row of S, s iT 1=1 means that the sum of the probabilities that the current i-th sample and all anchor points are neighbors is 1. To prevent trivial solutions, only the sample closest to the current sample is assigned a similarity of 1, and the rest of the samples are assigned 0. v is the weight parameter of the vth perspective to reasonably evaluate the quality of the current perspective, γ is a non-negative positive parameter, rank(·) is the rank of the matrix, is a diagonal matrix with diagonal elements BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 The overall flow chart of the present invention is DETAILED DESCRIPTION

[0019] Data processing: Network data Z∈R D×NThrough the empirical kernel function Through V different empirical kernel functions Explicitly map to high-dimensional kernel space to obtain the feature representation of network data samples in multiple high-dimensional kernel spaces In the present invention, Gaussian kernel, polynomial kernel and linear kernel are respectively used to map network data into three different high-dimensional kernel spaces.

[0020] Parameter initialization: Randomly initialize the anchor point A and initialize the anchor point graph S to satisfy s iT 1=1, according to Initialize the view weights.

[0021] Optimize the projection matrix W v :Objective function (1) about W v The sub-problems are:

[0022] Formula (2) can be transformed into a form that is easy to solve by the following mathematical transformation: Then formula (2) can be changed to:

[0023] The optimal solution of formula (4) is W v =PQ T , where P and Q can be expressed by v X v SA T Perform the singular value decomposition operation to obtain, that is: α v X v SA T =PΛQ T .

[0024] Update anchor point A: Since the columns a of anchor point A j They are independent of each other during optimization, so they can be solved by column-by-column optimization. j The derivative of is set to 0, and we get:

[0025] Update the anchor graph S: Due to the non-convex nature of the rank constraint, it is difficult to directly optimize S using the objective function (1), so a related transformation is required. Defined as The i-th smallest eigenvalue can easily satisfy the semi-positive definite property of the Laplace matrix Under this condition, it can be used Replacing the original rank constraint, the objective function (1) becomes: According to Ky Fan's theorem, formula (6) becomes in Furthermore, in formula (7) Can be expanded to: According to the specific composition of F, D and P, formula (8) can be transformed into By replacing the relevant terms in formula (7) with formula (9) and combining it with the definition of F norm, we can get in: Formula (11) contains N independent sub-problems, each of which is Furthermore, according to the definition of l2 norm, formula (12) is rewritten as: Then the optimal solution of formula (13) is where φ is the Lagrange multiplier.

[0026] Update the indicator matrix F: According to the definition of L and the orthogonal property of F, the subproblem of formula (7) about F can be rewritten as: Then formula (15) is obtained by and Solve the optimization, where P′ and Q′ are obtained by Perform the singular value decomposition operation to obtain:

[0027] Update the view weight α v : View weight α v pass Solve optimization.

[0028] After the optimization is completed, the analysis results of the network data are obtained according to the connected components of the anchor graph. Experimental design

[0029] Experimental data set: This example uses the NSL-KDD data set commonly used in the field of network data analysis to verify the performance of the system involved in the present invention. This data set collects 2256 network data of 5 different types. The feature dimension d after three empirical kernel mappings is v They are 464, 1144 and 104 respectively.

[0030] System parameter setting: In this system, the search range of the regularization parameter γ is set to [10 -3 ; 10 -2 ; 10 -1 ; 10 0 ; 10 1 ; 10 2 ; 10 3 ], set the regularization parameter λ to a heuristic update method, and set the search range of the number of anchor points M and the dimension of the latent subspace d to [K; 2K; 3K; 4K; 5K].

[0031] Experimental strategy: To avoid the interference of randomness in the experimental process on the final performance comparison, this system repeats all experiments 10 times independently and reports the mean and standard deviation. The best experimental results are bolded and the suboptimal results are passed. Underline The experiment was completed on an experimental platform equipped with Win 11 operating system, Intel Core i7-10700K CPU, 80GB memory and MATLAB 2019a (64-bit). The indicators used to evaluate network data analysis are NMI, ACC, Purity and FScore. The higher the indicator value, the better the performance. Experimental Results

[0032] Table 1 is a performance comparison result of this example and the current mainstream algorithm, wherein SAGL is the abbreviation of the present invention, and the standard deviation of the running results is in brackets.

[0033] The experimental results in Table 1 show that the performance of the present invention can achieve the best performance in all three indicators, and compared with the suboptimal results, the present invention improves the NMI, ACC, Purity and FScore by 11.11%, 8.71%, 1.06% and 12.89% respectively, reflecting a huge performance advantage.

[0034] Table 1:

[0035] The above is a specific implementation of the present invention, but the protection scope of the present invention is not limited to the above description, and any equivalent modifications and replacement means that can be easily thought of are within the protection scope of the present invention.

Claims

1. A single-stage multi-view large-scale network behavior analysis system based on latent subspace anchor learning, characterized by: The specific steps are: 1) Preprocessing: Collect the network data samples Z∈R D×N Through V different empirical kernel functions Explicitly map to high-dimensional kernel space to obtain the feature representation of network data samples in multiple high-dimensional kernel spaces Different high-dimensional kernel spaces are regarded as different perspectives, D is the original feature space dimension of the network data sample, N is the total number of network data samples, d v is the feature representation dimension of the vth perspective after explicit mapping; 2) Learning the anchor point A∈R of the sample in the consensus latent subspace d×M , where M is the number of anchor points in the consensus latent subspace and d is the dimension of the consensus latent subspace; 3) Introduce the projection matrix for the vth perspective In this way, the jth anchor point sample a in the consensus potential subspace is established j ∈R d×1 and the i-th sample in the v-th view Based on the idea of ​​adaptive nearest neighbor method, a multi-view consensus anchor graph S is constructed in a multi-view scenario. 4) By strictly constraining the connected components of the constructed multi-view consensus anchor graph S, the number of its connected components is consistent with the number of network behavior categories K, thereby directly reflecting the cluster structure of the network data sample; 5) The above steps are jointly integrated in a unified learning framework, and the coordinate descent method is used to optimize each parameter until convergence, and finally the cluster where the network data sample is located is obtained according to the connected components of the anchor graph.

2. According to claim 1, a single-stage multi-view large-scale network behavior analysis system based on latent subspace anchor learning is characterized by: The empirical kernel function for explicitly mapping network data samples to a high-dimensional kernel space is defined as Φ v : where Λ v is a diagonal matrix consisting of r eigenvalues ​​greater than 0 of the vth kernel function matrix, Q is the eigenvector corresponding to the r eigenvalues, ker v is the vth kernel function.

3. The single-stage multi-view large-scale network behavior analysis system based on latent subspace anchor learning according to claim 1, characterized in that: The introduced projection matrix The orthogonal constraint should be maintained to ensure the ability of the projection matrix to extract discriminative features, that is, 4. The single-stage multi-view large-scale network behavior analysis system based on latent subspace anchor learning according to claim 1, characterized in that: The formula for constructing the multi-view consensus anchor graph S through the idea of ​​the adaptive nearest neighbor method is: Where: s i represents the i-th row of S, s iT 1=1 means that the sum of the probabilities that the current i-th sample and all anchor points are neighbors is 1. To prevent trivial solutions, only the sample closest to the current sample is assigned a similarity of 1, and the rest of the samples are assigned 0. v is the weight parameter of the vth perspective to reasonably evaluate the quality of the current perspective, and γ is a non-negative positive parameter.

5. The single-stage multi-view large-scale network behavior analysis system based on latent subspace anchor learning according to claim 1, characterized in that: The implementation method of strictly constraining the connected components of the constructed multi-view consensus anchor graph S is: The corresponding Laplace matrix impose a rank constraint, where is a diagonal matrix with diagonal elements The following objective function can be obtained: Where rank(·) is the rank of the matrix.

6. The single-stage multi-view large-scale network behavior analysis system based on latent subspace anchor learning according to claim 5, characterized in that: The objective function is By W v =PQ T Optimization, where P and Q can be obtained by v X v S T Perform the singular value decomposition operation to obtain, that is: α v X v S T =PΛQ T .

7. The single-stage multi-view large-scale network behavior analysis system based on latent subspace anchor learning according to claim 5, characterized in that: The objective function after applying the rank constraint can be changed to: in λ is a non-negative positive parameter, then a j The optimization method for solving is:

8. The single-stage multi-view large-scale network behavior analysis system based on latent subspace anchor learning according to claim 5, characterized in that: The objective function is for s i The optimization can be solved by calculating the following formula: in: F (N) The i-th row of F (M) The jth row of .

9. The single-stage multi-view large-scale network behavior analysis system based on latent subspace anchor learning according to claim 5, characterized in that: The objective function is for F (N) With F (M) Can be passed separately and Solve the optimization, where P′ and Q′ are obtained by Perform the singular value decomposition operation to obtain:

10. The single-stage multi-view large-scale network behavior analysis system based on latent subspace anchor learning according to claim 5, characterized in that: The objective function is for α v pass Solve optimization.

Images