Fast adaptive model training method for novel attack detection

Abstract

The invention relates to the technical field of network communication detection and deep learning, and discloses a rapid adaptive model training method for novel attack detection. The method comprises the following steps: firstly, pre-training a detection model through a meta-learning method by utilizing existing attack sample data, so as to realize preliminary distinguishing of an attack sample and a normal sample, and reduce the demand of a detection model training process on a novel attack sample; expanding the novel attack sample, and increasing the scale of the novel attack sample; and finally, constructing a meta-fine tuning task by using the extended sample set, and further performing fine tuning on the detection model to adapt to novel attack detection requirements. According to the method, rapid self-adaptive adjustment of an attack detection model can be realized at a low sample cost, the similarity between a novel attack and an existing attack can be fully utilized through element pre-training, and meanwhile, the problem of task cross-domain between the novel attack and the existing attack is eliminated by means of element fine adjustment; therefore, the rapid adaptive training of the novel attack detection model is realized.

Description

Technical Field

[0001] The present invention relates to the field of network communication detection and deep learning technology, and in particular to a fast adaptive model training method for new attack detection. Background Art

[0002] Deep learning methods have end-to-end learning capabilities and can automatically mine the patterns contained in raw data. In recent years, they have been widely used in network attack detection research. It cannot be ignored that deep learning is a data-driven method, and rich high-quality sample data is the key to the success of deep learning. The current network attack and defense game is becoming increasingly fierce, and new network attack methods are emerging in an endless stream. Intelligent detection methods require a large number of labeled samples to drive training. In the face of new attack methods, the number of traffic samples that can be collected is small, making it difficult to drive deep learning model training.

[0003] From the attacker's perspective, using new attack methods, attack strategies, and attack paths to launch attacks is an effective means of evading detection. New network attacks are constantly emerging. Attackers use protocol or business vulnerabilities to achieve covert control of the target network and information feedback. For example, the Heartbleed attack uses the OpenSSL security vulnerability to steal sensitive data. The HTTP request smuggling attack uses the HTTP protocol vulnerability to complete the return of stolen information. At present, there are also attackers who use common services such as Email, Weibo, and Github to carry out espionage attacks on the target network. In order to evade detection, new attacks are more or less disguised as normal business and keep different from existing attack methods.

[0004] From a defense perspective, it is extremely difficult to collect and annotate a large number of new attack samples in the early stages of new attacks. If defenders wait for the completion of the collection and annotation process of attack samples, they will have missed the best time to respond to new attacks. Existing deep learning intelligent attack detection methods have obvious data-driven characteristics and require a large number of annotated samples to optimize model parameters. In the case of insufficient number of annotated samples, how to complete the training of attack detection models at a lower sample cost to quickly adapt to the requirements of new attack detection tasks is a key challenge facing current network attack intelligent detection models.

[0005] There are currently two mainstream methods for small sample attack detection tasks: transfer learning and meta-learning. Both methods assume that there is similarity between existing attack type traffic and new attack type traffic, and help complete the training of new attack detection models by transferring existing attack detection knowledge. These two methods focus on the transferability between tasks, but lack further exploration of the causes of small sample problems in new attack detection tasks. The methods are less targeted and it is difficult to achieve the migration goal when the tasks are cross-domain. In new attack detection tasks, the causes of small sample problems can be divided into the following two aspects:

[0006] (1) In the early stage of new attack discovery, the number of available samples is small, and there are differences between new attacks and existing attacks. In the early stage of new attacks, the defender can only capture and annotate a small number of attack samples, which makes it difficult to support the training of the detection model. At the same time, it should be noted that there are differences between new attacks and existing attacks, and it is difficult to directly apply existing attack detection knowledge to new attack detection tasks. At this time, there is a need to build a new attack detection model. For example, the known attack detection task is to distinguish between normal traffic and DoS attack traffic, and the new attack detection task is to distinguish between normal Github business traffic and Github secret theft traffic. At this time, there is a big difference between the definitions of the known attack detection task and the new attack detection task (the task is cross-domain).

[0007] (2) Attackers can choose from a variety of attack methods, while the captured sample data is relatively simple. Attackers can choose a variety of different methods to conceal their attack intentions during the attack. At the same time, they can disguise the traffic through content segmentation, empty packet filling, content encoding, etc. to evade detection. Existing research usually only considers the existing sample traffic, ignoring the potential samples in the network that may not be captured. Summary of the invention

[0008] In view of the above problems, the purpose of the present invention is to provide a fast adaptive model training method for new attack detection, which can complete the training of attack detection model at a relatively low sample cost and improve the adaptability of detection model to new attacks; it can well solve the problem of fast adaptive adjustment of new attack detection model under small sample conditions and provide a reference for the rapid construction of new network attack intelligent detection model. The technical solution is as follows:

[0009] A fast adaptive model training method for new attack detection includes the following steps:

[0010] Step 1: Network traffic data processing

[0011] The data packets are grouped and aggregated according to the five-tuple to form a session flow, and the data packets in the session flow are sorted according to the order of their arrival time;

[0012] Step 2: Meta-pre-training

[0013] Use existing attack traffic samples to build meta-learning tasks, use meta-learning methods to pre-train attack detection models, and use back-propagation algorithms to optimize attack detection models to achieve preliminary distinctions between attack traffic and normal traffic.

[0014] Step 3: New attack sample expansion

[0015] Without changing the semantics of the transmitted content, the new attack traffic samples are expanded to increase the number of available new attack samples;

[0016] Step 4: Meta-fine-tuning

[0017] The meta-fine-tuning task is constructed using the expanded new attack samples to further fine-tune the attack detection model to adapt to the needs of new attack detection.

[0018] Furthermore, the step 1 also includes:

[0019] Set the minimum number of packets for each session flow to m, and the minimum number of bytes for each packet to n; perform empty packet padding for session flows with fewer than m packets; for packets with fewer than n bytes, fill the subsequent bytes with 0; for each packet, convert the entire packet into an integer in the range of [0,255] to obtain a data representation with consistent specifications;

[0020] The IP address and MAC address fields are randomized; each session flow is represented as:

[0021] Session=[p1,p2,...,p m ]

[0022] Among them, p i represents a data packet, i=1,…m; m is the number of data packets in the session flow;

[0023] Each data packet is represented as:

[0024] p i =[b1,b2,....,b n ]

[0025] Among them, b j Integer expression representing the corresponding byte in the data packet, j = 1, ... n; n is the length of the byte in the data packet;

[0026] Each data packet is represented as a one-dimensional byte array of length n, or as a two-dimensional byte matrix of n=k×k, and the corresponding network session flow is represented as a two-dimensional image or a three-dimensional cube.

[0027] Furthermore, the step 2 specifically includes:

[0028] Step 21: Constructing the meta-learning task

[0029] Based on the known attack type sample data, a learning task is constructed to form a sample set and query set for training. The sample set is defined as:

[0030] Sa=(x1,y1),(x2,y2),...,(x 2K ,y 2K )

[0031] in, y i ∈{O,A},x i represents the flow sample, y i Represents x i Corresponding labels, K represents the number of normal samples and malicious samples in each batch, and the number of normal samples and malicious samples is K; O and A represent category labels, where O represents normal traffic and A represents malicious traffic; d is the dimension of traffic samples, d = m × n;

[0032] Step 22: Calculate the similarity score

[0033] After feature extraction and similarity calculation for the query set, calculate its similarity with the samples in the sample set C = c, c2, ..., c 2K ;

[0034] Step 23: Calculate category scores

[0035] Take the flow sample x 2K+1 As the query sample, after feature extraction and similarity calculation, the output score vector is obtained, that is, the similarity C = c1, c2, ..., c 2K ;

[0036] The score of the query sample in category A is expressed as:

[0037]

[0038] The score represents the probability that the query sample is a malicious sample; similarly, the corresponding normal category score is calculated. O ;

[0039] Step 24: Calculate class labels

[0040] The final predicted label of the query sample is written as:

[0041]

[0042] Step 25: Optimize the prediction model

[0043] The prediction is optimized by minimizing the difference between the query sample prediction and the query sample label using the minimum mean square error loss; assuming that the number of query set samples is M, the corresponding optimization objective is expressed as:

[0044]

[0045] in, Represents the final predicted label of the i-th query set sample.

[0046] Furthermore, the sample expansion method in step 3 specifically includes:

[0047] (1) Content segmentation: segmenting the data transmitted in an existing data stream;

[0048] (2) Content encoding: further encoding the data transmitted in the existing data stream;

[0049] (3) Empty packet filling: Fill empty packets between consecutive data packets.

[0050] Furthermore, the step 4 specifically includes:

[0051] Step 41: Build the extended support set

[0052] The support set is expanded based on the expanded new attack samples to form an extended support set; the given support set is:

[0053] Su=(x1, y1), (x2, y2),..., (x 2K ,y 2K )

[0054] The sample is expanded by using three methods: content encoding, empty packet filling and content segmentation, forming:

[0055] Content coding support set Su e :

[0056] Su e =(x1 e , y1), (x2 e , y2),...,(x 2K e ,y 2K )

[0057] Empty bag filling support set Su a :

[0058] Su a =(x1 a , y1), (x2 a , y2),...,(x2K a ,y 2K )

[0059] Content segmentation support set Su s :

[0060] Su s =(x1 s , y1), (x2 s , y2),...,(x 2K s ,y 2K )

[0061] Among them, x i e 、x i a and x i s These are the traffic samples after content encoding, empty packet filling, and content segmentation.

[0062] Here, the normal sample label is 0 and the malicious sample label is 1.

[0063] Step 42: Construct the out-of-order support set

[0064] The extended support set is randomly shuffled and a sample subset is randomly selected to form a shuffled support set Su r , used to further fine-tune the model weights;

[0065] Su r =(x1 r ,y1 r ), (x2 r , y2 r ),...,(x M r ,y M r )

[0066] Among them, x i r is the traffic sample after out-of-order processing, y i r Represents x i r The corresponding label;

[0067] Step 43: Fine-tune model weights

[0068] Using the extended support set as the sample set and the shuffled support set as the query set, construct a meta-fine-tuning task and fine-tune the model structure according to the method in step 25.

[0069] The beneficial effects of the present invention are:

[0070] The present invention is a multi-step meta-learning small sample attack detection method. Through the "one reduction and one increase" strategy (reducing the demand for new attack samples and actively expanding the scale of new attack samples), the attack detection model is trained at a relatively small sample cost, the detection model's adaptability to new attacks is improved, and the need for rapid construction of new attack detection models is met. Only a small amount of new attack sample data is used, supplemented by a larger amount of existing attack sample data, and rapid adaptive model training is achieved for new attack detection through meta-pre-training, active expansion of attack samples, meta-fine-tuning and other means. The method can well solve the problem of rapid adaptive adjustment of new attack detection models under small sample conditions, and provide a reference for the rapid construction of new network attack intelligent detection models. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 This is the overall flow chart of the model training in the present invention.

[0072] Figure 2 Schematic diagram of data partitioning in the meta-learning pre-training step of the present invention.

[0073] Figure 3 This is a schematic diagram of a new attack sample expansion method in the present invention.

[0074] Figure 4 Schematic diagram of data division in the meta-adjustment step of the present invention.

[0075] FIG5(a) is a schematic diagram of the detection model structure used in the present invention—the feature learning stage.

[0076] FIG5( b ) is a schematic diagram of the detection model structure used in the present invention—the comparison module learning stage. DETAILED DESCRIPTION

[0077] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0078] The process of the method of the present invention during specific implementation is as follows Figure 1 As shown in the figure, the meta-learning method is expanded into three stages: meta-pre-training, new attack sample expansion, and meta-fine-tuning. This can make good use of the information of existing attack samples, reduce the number of new attack samples required for model training, and adapt to new attack detection tasks through meta-fine-tuning. It mainly includes the following steps:

[0079] Step 1: Network traffic data processing and preliminary feature extraction.

[0080] The network data packets are grouped and aggregated according to the five-tuple, and the network data packets are sorted according to the arrival time, and finally a fixed-size network data flow representation is formed. The data flows with different packet sizes and different packet numbers are normalized to form a tensor representation of fixed-size flow data, which provides a basis for the training of network attack detection models.

[0081] Aggregate network data packets with the five-tuple <source IP, destination IP, source port, destination port, protocol> to form a session flow, and sort the packets in the session flow in the order of packet arrival time. To obtain consistent data representation, set the minimum number of packets per session flow to m, and the minimum number of bytes per packet to n. For session flows with fewer than m packets, fill with empty packets. For packets with fewer than n bytes, fill the subsequent bytes with 0. For each packet, convert the entire packet into an integer in the interval [0,255] by byte.

[0082] For each session flow, refer to the network flow standard defined by Cisco and truncate the session flow according to the following rules.

[0083] a. If the session lasts for more than 15 minutes, it needs to be actively terminated and detected in time.

[0084] b. If the idle waiting time in the session is greater than 30 seconds, it indicates that the session has terminated.

[0085] c. A FIN or RST packet is found in the session stream, which indicates the end of the TCP session.

[0086] In order to avoid the problem of model overfitting caused by IP addresses, MAC addresses, etc., fields such as IP addresses and MAC addresses are randomized during processing. Each session flow can be expressed as:

[0087] Session=[p1,p2,...,p m ]

[0088] Where p represents a data packet, and each data packet can be expressed as:

[0089] p=[b1,b2,....,b n ]

[0090] Among them, b represents the integer expression of the corresponding byte in the data packet. Each data packet can be represented as a one-dimensional byte array with a length of n, or as a two-dimensional byte matrix of n=k×k (if the value of n is a square number). The corresponding network session flow can be represented as a two-dimensional image or a three-dimensional cube. The method represents network traffic in the form of packet sequences and maintains the spatiotemporal characteristics of network traffic, providing a basis for further attack detection.

[0091] Step 2: Meta-pre-training. Use existing attack traffic samples to build meta-learning tasks, pre-train the attack detection model, and use the back-propagation algorithm to optimize the attack detection model to achieve preliminary distinction between attack traffic and normal traffic.

[0092] By using existing attack sample resources, the feature extraction module (i.e., the feature encoder shown in FIG5(a)) is initially trained to reduce the number of new attack samples required by the detection model. Although there are differences in samples and targets between new attacks and existing attack detection tasks, they are both traffic classification tasks, and there are certain similarities in the network traffic patterns. Using existing attack samples to pre-train the feature extraction module enables it to have certain traffic behavior characterization and differentiation capabilities, which helps to reduce the demand for new attack samples in model training. The present invention proposes for the first time to use a meta-learning method to pre-train the detection model.

[0093] The meta-learning idea is used in the pre-training process of the attack detection model. Based on the known attack type sample data, the learning task is constructed to form a sample set and query set that can be used for training. The minimum mean square error loss is used to minimize the difference between the query sample prediction and the query sample label.

[0094] The basic steps of meta-pre-training are:

[0095] Step 21: Construct a meta-learning task. Based on the known attack type sample data, construct a learning task to form a sample set and query set that can be used for training, such as Figure 2 As shown. The sample set is defined as:

[0096] Sa=(x1,y1),(x2,y2),...,(x 2K ,y 2K ),in y i ∈{O,A}

[0097] where x i represents the flow sample, y i represents the corresponding label, K represents the number of normal samples and malicious samples in each batch. O and A represent category labels, where O represents normal traffic and A represents malicious traffic.

[0098] Step 22: Calculate the similarity score. After feature extraction and similarity calculation for the query set samples, the similarity between them and the samples in the sample set can be calculated C = c1, c2, ..., c 2K .

[0099] Step 23: Calculate the category score. Take sample x 2K+1 As a query sample. After feature extraction and similarity calculation, the output score vector C = c1, c2, ..., c2K . Then the score of the query sample in category A can be expressed as:

[0100]

[0101] This score can represent the probability that the query sample is a malicious sample. Similarly, the corresponding normal category score can be calculated. O .

[0102] Step 24: Calculate the category label. Based on step 23, the final predicted label for the query sample can be written as:

[0103]

[0104] Step 25: Optimize the prediction model. To optimize the prediction, the minimum mean square error loss can be used to minimize the difference between the query sample prediction and the query sample label. Assuming that the number of query set samples is M, the corresponding optimization objective can be expressed as:

[0105]

[0106] In different training phases (episodes), different attack categories need to be randomly selected as target categories. By cyclically optimizing between different attack categories, the meta-learning method can learn feature representations with strong generalization capabilities and have the initial ability to distinguish between attack traffic and normal traffic.

[0107] Step 3: New attack sample expansion: Actively expand new attack traffic samples to increase the number of available new attack samples and provide a basis for new attack detection model training.

[0108] Different from the existing methods that expand samples in the feature space, the present invention expands the traffic data in the sample space to keep the original characteristics of the attack traffic as much as possible.

[0109] In order to expand the coverage of new attack traffic samples, this paper attempts to expand new attack traffic samples through content segmentation, content encoding, and empty packet filling without changing the semantics of the transmitted content. Various traffic expansion operations are defined as follows:

[0110] (1) Content segmentation. The data transmitted in the existing data stream is segmented. Since the TCP protocol has a reassembly mechanism, segmenting the data packets during transmission does not affect the content transmitted in the data stream. However, there are differences in the content representation of the deep learning model. Here, more similar network attack traffic can be obtained through content segmentation.

[0111] (2) Content encoding. Further encode the data transmitted in the existing data stream. For example, in TrojanC2, Base64 is used to encode the sent content. A similar method can be used to encode the content. Only the client needs to add the corresponding decoding logic, which will not affect the effectiveness of the attack.

[0112] (3) Empty packet filling: Empty packets are filled between consecutive data packets. These empty packets will be reflected in the deep learning model representation process, but will not affect the original transmitted content when the network content is reorganized, and therefore will not affect the attack traffic semantics.

[0113] Step 4: Meta-fine-tuning. Use the expanded new attack samples to construct a meta-fine-tuning task and further fine-tune the attack detection model to adapt to the new attack detection requirements.

[0114] This paper proposes for the first time a meta-fine-tuning model training method, which aims to use a small number of target category support samples to complete the fine-tuning of the comparison module so that it can better adapt to new attack detection tasks.

[0115] Considering the differences between new attack detection and existing attack detection tasks, only using known attack traffic samples for model training cannot meet the needs of new attack detection. The meta-fine-tuning stage aims to use a small number of target category support samples to complete the fine-tuning of the comparison module so that it can better adapt to new attack detection tasks. It should be noted that in order to avoid the data perspective problem, the present invention requires that the test set data cannot be accessed during fine-tuning, and only a small number of support set samples are available for fine-tuning. In order to make full use of a small number of support set samples, the present invention proposes a method for constructing a meta-fine-tuning task using support set samples. It should be noted that in step 2, the overall weight of the detection model needs to be learned, while in step 4, only the weight of the comparison module is further fine-tuned, which does not affect the weights of other parts of the model, as shown in Figure 5(a) and Figure 5(b).

[0116] The basic steps of meta-tuning are:

[0117] Step 41: Construct the extended support set.

[0118] In order to expand the scale of fine-tuning samples and provide samples for model element fine-tuning, the present invention expands the support set based on step 3 to form an extended support set. Given a support set:

[0119] Su=(x1, y1), (x2, y2),..., (x 2K ,y 2K )

[0120] like Figure 3 As shown, the present invention adopts three methods of content coding, empty packet filling and content segmentation to perform sample expansion, forming coding support sets respectively:

[0121] Su e =(x1 e , y1), (x2 e , y2),...,(x 2K e ,y 2K )

[0122] Empty bag filling support set:

[0123] Su a =(x1 a , y1), (x2 a , y2),...,(x 2K a ,y 2K )

[0124] Content segmentation support set:

[0125] Su s =(x1 s , y1), (x2 s , y2),...,(x 2K s ,y 2K )

[0126] Step 42: Construct a random support set.

[0127] The present invention proposes to randomly shuffle the support set and randomly select a sample subset to form a "shuffled support set", such as Figure 4 Its function is the same as the query sample in step 2, which is used to further fine-tune the model weights.

[0128] Su r =(x1 r ,y1 r ), (x2 r , y2 r ),...,(x M r ,y M r )

[0129] Step 43: Fine-tune the model weights. Use the extended support set as the sample set and the shuffled support set as the query set to construct a meta-fine-tuning task and fine-tune the model structure according to the method in step 25.

[0130] The present invention can realize rapid adaptive adjustment of attack detection models at a low sample cost, can make full use of the similarities between new attacks and existing attacks through meta-pre-training, and eliminate the problem of cross-domain tasks between new attacks and existing attacks with the help of meta-fine-tuning, thereby realizing rapid adaptive training of new attack detection models.

Claims

1. A fast adaptive model training method for new attack detection, characterized in that: The following steps are involved: Step 1: Network traffic data processing The data packets are grouped and aggregated according to the five-tuple to form a session flow, and the data packets in the session flow are sorted according to the order of their arrival time; Step 2: Meta-pre-training Use existing attack traffic samples to build meta-learning tasks, use meta-learning methods to pre-train attack detection models, and use back-propagation algorithms to optimize attack detection models to achieve preliminary distinctions between attack traffic and normal traffic. Step 3: New attack sample expansion Without changing the semantics of the transmitted content, the new attack traffic samples are expanded to increase the number of available new attack samples; Step 4: Meta-fine-tuning The meta-fine-tuning task is constructed using the expanded new attack samples to further fine-tune the attack detection model to adapt to the needs of new attack detection.

2. The fast adaptive model training method for new attack detection according to claim 1 is characterized in that: The step 1 also includes: Set the minimum number of packets for each session flow to m, and the minimum number of bytes for each packet to n; perform empty packet padding for session flows with fewer than m packets; for packets with fewer than n bytes, fill the subsequent bytes with 0; for each packet, convert the entire packet into an integer in the range of [0,255] to obtain a data representation with consistent specifications; The IP address and MAC address fields are randomized; each session flow is represented as: Session=[p1,p2,...,p m ] Among them, p i represents a data packet, i=1,…m; m is the number of data packets in the session flow; Each data packet is represented as: p i =[b1,b2,....,b n ] Among them, b j Integer expression representing the corresponding byte in the data packet, j = 1, ... n; n is the length of the byte in the data packet; Each data packet is represented as a one-dimensional byte array of length n, or as a two-dimensional byte matrix of n=k×k, and the corresponding network session flow is represented as a two-dimensional image or a three-dimensional cube.

3. The fast adaptive model training method for new attack detection according to claim 1 is characterized in that: The step 2 specifically includes: Step 21: Constructing the meta-learning task Based on the known attack type sample data, a learning task is constructed to form a sample set and query set for training. The sample set is defined as: In=(x1,y1),(x2,y2),...,(x 2K ,y 2K ) in, y i ∈{O,A},x i represents the flow sample, y i Represents x i Corresponding labels, K represents the number of normal samples and malicious samples in each batch, and the number of normal samples and malicious samples is K; O and A represent category labels, where O represents normal traffic and A represents malicious traffic; d is the dimension of the traffic sample, d = m × n; Step 22: Calculate the similarity score After feature extraction and similarity calculation for the query set, calculate its similarity with the samples in the sample set C = c1, c2, ..., c 2K ; Step 23: Calculate category scores Take the flow sample x 2K+1 As the query sample, after feature extraction and similarity calculation, the output score vector is obtained, that is, the similarity C = c1, c2, ..., c 2K ; The score of the query sample in category A is expressed as: The score represents the probability that the query sample is a malicious sample; similarly, the corresponding normal category score is calculated. O ; Step 24: Calculate the class labels The final predicted label of the query sample is written as: Step 25: Optimize the prediction model The prediction is optimized by minimizing the difference between the query sample prediction and the query sample label using the minimum mean square error loss; assuming that the number of query set samples is M, the corresponding optimization objective is expressed as: in, Represents the final predicted label of the i-th query set sample.

4. The fast adaptive model training method for new attack detection according to claim 3 is characterized in that: The method of sample expansion in step 3 specifically includes: (1) Content segmentation: segmenting the data transmitted in the existing data stream; (2) Content encoding: further encoding the data transmitted in the existing data stream; (3) Empty packet filling: Fill empty packets between consecutive data packets.

5. The fast adaptive model training method for new attack detection according to claim 4 is characterized in that: The step 4 specifically includes: Step 41: Build the extended support set The support set is expanded based on the expanded new attack samples to form an extended support set; the given support set is: Su=(x1,y1),(x2,y2),...,(x 2K ,and 2K ) The sample is expanded by using three methods: content encoding, empty packet filling and content segmentation, forming: Content coding support set Su e : His e (x1) e ,and1),(x2 e ,y2),...,(x 2K e ,and 2K ) Empty bag filling support set Su a : His a (x1) a ,and1),(x2 a ,y2),...,(x 2K a ,and 2K ) Content segmentation support set Su s : His s (x1) s ,and1),(x2 s ,y2),...,(x 2K s ,and 2K ) Among them, x i e 、x i a and x i s These are the traffic samples after content encoding, empty packet filling, and content segmentation. Step 42: Constructing the out-of-order support set The extended support set is randomly shuffled and a sample subset is randomly selected to form a shuffled support set Su r , used to further fine-tune the model weights; His r (x1) r ,y1 r ),(x2 r ,y2 r ),...,(x M r ,and M r ) Among them, x i r is the traffic sample after out-of-order processing, y i r Represents x i r The corresponding label; Step 43: Fine-tune model weights Using the extended support set as the sample set and the shuffled support set as the query set, construct a meta-fine-tuning task and fine-tune the model structure according to the method in step 25.

Images