Network intrusion sample efficient labeling method and system based on limited review budget, and storage medium

Abstract

The invention provides a network intrusion sample efficient labeling method and system based on limited review budget, and a storage medium. The network intrusion sample efficient labeling method comprises the following steps: a manual labeling step: selecting a set number of samples from new samples for manual review, labeling and category number statistics; and a label distribution step: clustering and labeling residual samples by using the labeled samples and the statistical category number. The method has the beneficial effects that 1, the efficient labeling method for the network intrusion sample does not limit a feature space, can be executed in an original feature space, and can also be executed in a feature representation space; and 2, the efficient labeling method for the network intrusion sample can improve the labeling accuracy and efficiency of the new sample on the premise of limited labeling budget.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, system and storage medium for efficiently labeling network intrusion samples based on a limited review budget. Background Art

[0002] With the continuous emergence of new vulnerabilities and new attack techniques, timely detection of these latest network attacks is the key to protecting network security. A lot of research has been carried out to meet this challenge. However, how to speed up the review and annotation of the latest attack samples discovered has rarely been paid attention to. These reviewed and annotated new samples can support multiple subsequent tasks, thereby enhancing the protection capabilities of network security. For example, anomaly detection, network intrusion detection with noise labels, and small sample network intrusion detection.

[0003] How to effectively and efficiently review and label new samples is a very challenging problem. On the one hand, new samples often lack prior knowledge, making it difficult to directly judge whether they are normal or potential threats, resulting in methods that rely on automation being insufficient to cope with the complex and ever-changing real network environment. On the other hand, manual labeling by network security experts is a key step to ensure the correctness of the labeling, but this is usually accompanied by high costs and time consumption, making it impossible to cope with a steady stream of new samples within a limited review budget. Previous work used the DBSCAN clustering algorithm to estimate the number of categories, and then used the k-means clustering algorithm to achieve clustering and labeling of new samples. However, an estimate of the number of categories with too large an error will cause it to lose its effectiveness. Summary of the invention

[0004] In order to solve the problems in the prior art, the present invention provides an efficient labeling method for network intrusion samples based on a limited review budget, comprising performing the following steps: Manual labeling step: select a set number of samples from the new samples for manual review, labeling and counting of categories; Label assignment step: Use the labeled samples and the statistical number of categories to cluster and label the remaining samples.

[0005] As a further improvement of the present invention, in the manual labeling step, k-means is used to cluster the new samples, and the number of cluster categories is the number n of budget review samples provided by the enterprise. After the clustering is completed, a new sample closest to the center of each cluster is extracted for manual review and labeling by a network security analyst. The labeling result is further used to count the number of categories k appearing in the new sample, where k≤n.

[0006] As a further improvement of the present invention, in the label assignment step, a clustering method with sample constraints is adopted to achieve clustering and label assignment of new samples by modifying the k-means algorithm.

[0007] As a further improvement of the present invention, the specific process of modifying the k-means algorithm is as follows: Step 1: Set and check the random seed; Step 2: Initialize the cluster centroid, select new samples with the same category from the selected new samples in turn, and calculate the average value of the new sample features as the initial centroid; Step 3: Calculate the distance between the remaining unlabeled new samples and the initial centroid, and assign them the label closest to the centroid; Step 4: Update the initial centroid point and always keep the labeled new samples of the same category in the same cluster; Step 5: Calculate the distance between the remaining unlabeled new samples and the initial centroid again, and assign them the label closest to the centroid; Step 6: Iterate steps 4 to 5 until the clustering result does not change.

[0008] As a further improvement of the present invention, in step 2, the centroid corresponds to the number of categories counted in the new sample.

[0009] The present invention also discloses a system for efficiently labeling network intrusion samples based on a limited review budget, comprising: a memory, a processor, and a computer program stored on the memory, wherein the computer program is configured to implement the steps of the method for efficiently labeling network intrusion samples of the present invention when called by the processor.

[0010] The present invention also discloses a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is configured to implement the steps of the network intrusion sample efficient labeling method of the present invention when called by a processor.

[0011] The beneficial effects of the present invention are: 1. The efficient labeling method for network intrusion samples of the present invention does not limit the feature space, and can be executed in the original feature space or in the feature representation space; 2. The efficient labeling method for network intrusion samples of the present invention can improve the labeling accuracy and efficiency of new samples under the premise of limited labeling budget. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 It is a flow chart of the efficient labeling method for network intrusion samples of the present invention. DETAILED DESCRIPTION

[0013] In order to improve the accuracy and efficiency of labeling new samples under the premise of limited labeling budget, this paper proposes an efficient labeling method for network intrusion samples based on limited review budget. This method selects a small number of representative samples from new samples for manual labeling and statistical category number according to the labeling budget, and then uses the proposed constrained clustering algorithm to realize clustering and labeling allocation of new samples. Figure 1 As shown, the present invention discloses an efficient labeling method for network intrusion samples based on a limited review budget, and the efficient labeling method for network intrusion samples can be performed in the original feature space and the representation feature space. Taking the original feature space as an example, the proposed efficient labeling method for network intrusion samples includes the following steps: manual labeling step: selecting a small number of samples from new samples for manual review, labeling and statistical category number; labeling allocation step: clustering and labeling the remaining samples using the labeled samples and the statistical category number. The above processing is performed in the original feature space. Generally speaking, compared with the original feature space, the feature representation space using the pre-trained model has better clustering performance. At this time, the proposed method needs to add an additional feature representation module, and the present invention does not limit the training method of the pre-trained model. The difference between the original space and the feature space is reflected in a comparative way. The input of the algorithm in the original feature space is the feature extracted from the network traffic session by the tool, such as the statistical feature of 1×81; the feature representation space, that is, using the feature representation module, the input of the algorithm is the feature vector after the original feature is processed, such as mapping the feature of the 1×81 statistical feature to a feature vector with 1×16. The advantage of using the feature representation module is that it can enhance the clustering effect, because samples of the same category in the original feature space are not clustered together; while using the feature representation module, we can use the labels in the data set to map samples of the same category to a compact feature space, while samples of different categories are far away from each other.

[0014] Manual labeling step: Select a small number of new samples from the new samples for labeling and counting the number of new categories. When selecting new samples, two requirements need to be met: first, the number of selected samples should be small, and the number of budget review samples n is much smaller than the total number of new samples, to ensure that the network security company can bear the workload of manual detection; second, the selected samples should be diversified to ensure that all possible categories in the new samples can be fully covered, that is, the number of budget review samples n is greater than or equal to the number of real categories in the new samples. Specifically, the present invention uses k-means (clustering algorithm) to cluster new samples, and the number of cluster categories is the number of budget review samples n provided by the enterprise. After clustering is completed, a new sample closest to the center of each cluster is extracted for manual review and labeling by network security analysts, and the labeling results are further statistically used to estimate the number of categories k appearing in the new sample, where k≤n.

[0015] Label assignment module: cluster new samples under the constraints of a small number of labeled new samples. There are two advantages of using a small number of labeled new samples to guide the entire new sample. First, the spread of sample labels in the same cluster can avoid secondary review of new samples by network security experts. Second, and more importantly, the labeled new sample constraints show the correlation between samples, which helps to improve the clustering performance on the entire new sample. Therefore, combining these advantages, the present invention proposes a clustering method with sample constraints by modifying the k-means algorithm. The specific process is as follows: Step 1, set and check the random seed; Step 2: Initialize the cluster centroid (corresponding to the number of categories counted in the new sample), select new samples with the same category from the selected new samples in turn, and calculate the average value of the new sample features as the initial centroid; Step 3: Calculate the distance between the remaining unlabeled new samples and the initial centroid, and assign them the label closest to the centroid; Step 4: Update the initial centroid point and always keep the labeled new samples of the same category in the same cluster; Step 5: Calculate the distance between the remaining unlabeled new samples and the initial centroid again, and assign them the label closest to the centroid; The network intrusion sample efficient labeling method of the present invention provides a clustering method with sample constraints. The method uses existing labeled samples as constraints in the clustering process, and always keeps samples of the same category clustered into one cluster in the clustering process.

[0016] The present invention also discloses a system for efficient labeling of network intrusion samples based on a limited review budget, comprising: a memory, a processor, and a computer program stored on the memory, wherein the computer program is configured to implement the steps of the efficient labeling method of network intrusion samples of the present invention when called by the processor.

[0017] The present invention also discloses a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is configured to implement the steps of the network intrusion sample efficient labeling method of the present invention when called by a processor.

[0018] The beneficial effects of the present invention are: 1. The efficient labeling method for network intrusion samples of the present invention does not limit the feature space, and can be executed in the original feature space or in the feature representation space; 2. The efficient labeling method for network intrusion samples of the present invention can improve the labeling accuracy and efficiency of new samples under the premise of limited labeling budget.

[0019] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the protection scope of the present invention.

Claims

1. An efficient labeling method for network intrusion samples based on limited review budget, characterized in that: This involves performing the following steps: Manual labeling step: select a set number of samples from the new samples for manual review, labeling and counting of categories; Label assignment step: Use the labeled samples and the statistical number of categories to cluster and label the remaining samples.

2. The efficient network intrusion sample labeling method according to claim 1 is characterized in that: In the manual labeling step, k-means is used to cluster the new samples, and the number of cluster categories is the number n of budget review samples provided by the network security company; after the clustering is completed, a new sample closest to the center of each cluster is extracted for manual review and labeling by the network security analyst, and the labeling result is further used to count the number of categories k appearing in the new sample, where k≤n.

3. The efficient network intrusion sample labeling method according to claim 1 is characterized in that: In the label assignment step, a clustering method with sample constraints is adopted to achieve clustering and label assignment of new samples by modifying the k-means algorithm.

4. The efficient network intrusion sample labeling method according to claim 3 is characterized in that: The specific process of modifying the k-means algorithm is as follows: Step 1: Set and check the random seed; Step 2: Initialize the cluster centroid, select new samples with the same category from the selected new samples in turn, and calculate the average value of the new sample features as the initial centroid; Step 3: Calculate the distance between the remaining unlabeled new samples and the initial centroid, and assign them the label closest to the centroid; Step 4: Update the initial centroid point and always keep the labeled new samples of the same category in the same cluster; Step 5: Calculate the distance between the remaining unlabeled new samples and the initial centroid again, and assign them the label closest to the centroid; Step 6: Iterate steps 4 to 5 until the clustering result does not change.

5. The efficient network intrusion sample labeling method according to claim 3 is characterized in that: In step 2, the centroid corresponds to the number of categories counted from the labeled new samples.

6. A system for efficient labeling of network intrusion samples based on limited review budget, characterized in that: include: A memory, a processor, and a computer program stored in the memory, wherein the computer program is configured to implement the steps of the method for efficiently labeling network intrusion samples as described in any one of claims 1 to 5 when called by the processor.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is configured to implement the steps of the method for efficiently labeling network intrusion samples described in any one of claims 1 to 5 when called by a processor.

Images