Intrusion traffic detection method and device, computer equipment and readable storage medium

Abstract

The invention relates to the technical field of network security, in particular to an intrusion traffic detection method and device, computer equipment and a readable storage medium. The method comprises the following steps: acquiring to-be-detected traffic, and extracting traffic characteristics of the to-be-detected traffic; inputting the traffic characteristics into a detection model to obtain an intrusion detection result output by the detection model; wherein the detection model is obtained based on training of a training data set; wherein the training data set comprises training flow samples, screened from the original data set, under each flow label, and a flow sample difference value between different training flow samples under each flow label is greater than a difference threshold value.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an intrusion traffic detection method, device, computer equipment and readable storage medium. Background Art

[0002] Intrusion Detection System (IDS) is a network security device or software specifically designed to detect, identify and respond to unauthorized network access, malicious activities and other behaviors that may pose a threat to system and network security. With the rapid development of the core network of the fifth generation mobile communication technology (5G), the complexity of the network environment and the sharp increase in traffic have brought unprecedented challenges to IDS.

[0003] Traditional IDS usually uses pattern matching algorithms to detect network attacks. However, with the increase of network traffic and the diversification of attack types, the computational complexity of pattern matching algorithms has also increased, resulting in a decrease in detection speed, so it is urgently needed to be improved. Summary of the invention

[0004] Based on this, it is necessary to provide an intrusion traffic detection method, apparatus, computer equipment and readable storage medium that can improve the speed of the intrusion traffic detection method in response to the above technical problems.

[0005] In a first aspect, the present application provides an intrusion traffic detection method, the method comprising:

[0006] Obtain the traffic to be detected and extract the traffic characteristics of the traffic to be detected;

[0007] Input the traffic characteristics into the detection model to obtain the intrusion detection results output by the detection model;

[0008] The detection model is trained based on a training data set; the training data set includes training traffic samples under each traffic label screened from an original data set, and the traffic sample difference value between different training traffic samples under each traffic label is greater than a difference threshold.

[0009] In one embodiment, the training data set is obtained in the following manner:

[0010] Determine the flow sample difference value between the original flow samples according to the flow characteristics of each original flow sample in the original data set;

[0011] According to the traffic sample difference value between each original traffic sample and the traffic label of each original traffic sample, the original data set is screened to obtain a training data set.

[0012] In one embodiment, the original data set is screened according to the traffic sample difference value between each original traffic sample and the traffic label of each original traffic sample to obtain a training data set, including:

[0013] A target traffic sample is selected from the unlabeled original traffic samples in the original data set, and all original traffic samples except the target traffic sample in the unlabeled original traffic are used as other traffic samples;

[0014] According to the traffic sample difference value between the target traffic sample and each other traffic sample, determine the adjacent traffic sample of the target traffic sample from each other traffic sample; wherein the traffic sample difference value between the target traffic sample and the adjacent traffic sample corresponding to the target traffic sample is less than or equal to the difference threshold;

[0015] According to the traffic label of the target traffic sample and the traffic label of the adjacent traffic sample, select the sample to be marked and the sample to be removed from the target traffic sample and the adjacent traffic sample;

[0016] Update the original data set according to the samples to be marked and the samples to be removed;

[0017] If the updated original data set only contains labeled traffic samples or there is an unlabeled original traffic sample, the updated original data set is used as the training data set.

[0018] In one embodiment, selecting a sample to be marked and a sample to be removed from the target traffic sample and the adjacent traffic samples according to the traffic label of the target traffic sample and the traffic label of the adjacent traffic sample includes:

[0019] If the traffic label of the target traffic sample in the original data set is consistent with the traffic label of the adjacent traffic sample, the target traffic sample is taken as the sample to be labeled, and the adjacent traffic sample is taken as the sample to be removed;

[0020] If the traffic label of the target traffic sample in the original data set is inconsistent with the traffic labels of the adjacent traffic samples, the target traffic sample is taken as a sample to be labeled.

[0021] In one embodiment, the original data set is updated according to the samples to be marked and the samples to be removed, including:

[0022] In the original data set, the samples to be marked are marked, and the samples to be removed are removed to obtain an updated original data set.

[0023] In one embodiment, the method further comprises:

[0024] If there are at least two unlabeled original traffic samples in the updated original data set, then based on the updated original data set, return to execute the step of selecting a target traffic sample from the unlabeled original traffic samples in the original data set.

[0025] In one of the embodiments, the traffic characteristics of the original traffic sample include at least the average packet length of the traffic packets, the variance of the packet length, the average packet arrival time, the standard deviation of the packet arrival time, the number of packets arriving per second and the duration of the flow.

[0026] In a second aspect, the present application also provides an intrusion traffic detection method and device, the device comprising:

[0027] An acquisition module is used to acquire the traffic to be detected and extract the traffic characteristics of the traffic to be detected;

[0028] The detection module is used to input the traffic characteristics into the detection model to obtain the intrusion detection results output by the detection model;

[0029] The detection model is trained based on a training data set; the training data set includes training traffic samples under each traffic label screened from an original data set, and the traffic sample difference value between different training traffic samples under each traffic label is greater than a difference threshold.

[0030] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0031] Obtain the traffic to be detected and extract the traffic characteristics of the traffic to be detected;

[0032] Input the traffic characteristics into the detection model to obtain the intrusion detection results output by the detection model;

[0033] The detection model is trained based on a training data set; the training data set includes training traffic samples under each traffic label screened from an original data set, and the traffic sample difference value between different training traffic samples under each traffic label is greater than a difference threshold.

[0034] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the following steps are implemented:

[0035] Obtain the traffic to be detected and extract the traffic characteristics of the traffic to be detected;

[0036] Input the traffic characteristics into the detection model to obtain the intrusion detection results output by the detection model;

[0037] The detection model is trained based on a training data set; the training data set includes training traffic samples under each traffic label screened from an original data set, and the traffic sample difference value between different training traffic samples under each traffic label is greater than a difference threshold.

[0038] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0039] Obtain the traffic to be detected and extract the traffic characteristics of the traffic to be detected;

[0040] Input the traffic characteristics into the detection model to obtain the intrusion detection results output by the detection model;

[0041] The detection model is trained based on a training data set; the training data set includes training traffic samples under each traffic label screened from an original data set, and the traffic sample difference value between different training traffic samples under each traffic label is greater than a difference threshold.

[0042] The above-mentioned intrusion traffic detection method, device, computer equipment and readable storage medium, when constructing a training data set, screen out training traffic samples under each traffic label from the original data set, and ensure that the difference value between each sample is greater than the preset difference threshold. In this way, the number of samples with high similarity can be reduced to avoid the model being interfered by redundant information during the training process. Ensure that the training data set contains diverse samples, covering various situations under different traffic labels. Increasing the difference between samples of different categories helps the model better learn and distinguish different traffic types, especially the difference between intrusion traffic and normal traffic. Based on this, the detection model is trained based on the optimized training data set, and through autonomous learning ability, the model can learn the characteristics of different traffic types.

[0043] During the training process, the model continuously adjusts its parameters to minimize prediction errors and improve the accuracy of identifying intrusion traffic. Since the detection model has been fully trained with the optimized training data set, in actual applications, only the characteristics of the traffic to be detected need to be input into the model to quickly obtain intrusion detection results. This method simplifies the detection process of intrusion traffic, reduces the need for manual analysis and intervention, and improves detection efficiency. The detection model fully learns the characteristics of different traffic types during the training process, so it can more accurately identify intrusion traffic in actual applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0045] Figure 1 A schematic diagram of a flow chart of an intrusion traffic detection method in an embodiment;

[0046] Figure 2 A schematic diagram of a flow chart of steps for screening an original data set to obtain a training data set in one embodiment;

[0047] Figure 3 A schematic diagram of a flow chart of the steps of updating an original data set in one embodiment;

[0048] Figure 4 A flowchart of the steps of selecting samples to be marked and samples to be removed from target traffic samples and neighboring traffic samples in one embodiment;

[0049] Figure 5 A schematic diagram of a flow chart of an intrusion traffic detection method in another embodiment;

[0050] Figure 6 A structural block diagram of an intrusion traffic detection method and device in an embodiment;

[0051] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0053] In an exemplary embodiment, Figure 1 As shown, an intrusion traffic detection method is provided, and the method is applied to a computer device as an example for description, including the following S101 to S102. Among them:

[0054] S101, obtaining the flow to be detected, and extracting the flow characteristics of the flow to be detected.

[0055] The traffic to be detected refers to real-time or recent network traffic data collected from the network environment. These traffic data may contain normal network communications and potential intrusion behaviors.

[0056] Optionally, the collected traffic data is processed to extract key information that can represent its characteristics. These characteristics may include the source address, destination address, protocol used, packet size, transmission speed, connection duration, etc. The purpose of extracting features is to be able to input this information into the detection model for analysis later.

[0057] S102, inputting the traffic characteristics into the detection model to obtain the intrusion detection result output by the detection model.

[0058] Specifically, the traffic features extracted in S101 are used as input data and sent to a pre-trained detection model. The detection model will output a judgment result on whether there is an intrusion behavior based on the input traffic features. This result may be a binary classification (such as "intrusion" or "non-intrusion"), or it may be a multi-classification (such as specifically indicating which type of intrusion it is).

[0059] Among them, the detection model is trained based on the training data set.

[0060] Furthermore, the training data set includes training traffic samples under each traffic label obtained by screening from the original data set, and the traffic sample difference value between different training traffic samples under each traffic label is greater than the difference threshold.

[0061] Optionally, from the original data set, training traffic samples with different labels are filtered out according to traffic labels (i.e., types or classifications of traffic). These samples are used to train the detection model.

[0062] Under each traffic label, ensure that the difference between the selected training traffic samples is greater than a preset difference threshold. The purpose of this is to ensure the diversity and representativeness of the training samples, thereby improving the generalization ability of the detection model.

[0063] Specifically, when filtering the training traffic samples under each traffic label from the original data set, the following process can be used: (1) Data cleaning and preprocessing: remove noise, outliers, and incomplete records in the original data set. This helps to improve the quality of the training data set and reduce interference in the model training process. The cleaned data is standardized, such as scaling and normalization, to ensure the comparability between different features. In addition, feature selection can be performed to retain features that have an important impact on the classification task and remove redundant features. (2) Data sampling: stratify according to traffic labels to ensure that the number of samples under each label is relatively balanced. This helps to deal with the imbalance problem in the original data set and improve the generalization ability of the model.

[0064] In the above-mentioned intrusion traffic detection method, when constructing the training data set, the training traffic samples under each traffic label are screened out from the original data set, and it is ensured that the difference value between each sample is greater than the preset difference threshold. In this way, the number of samples with high similarity can be reduced to avoid the interference of redundant information on the model during the training process. Ensure that the training data set contains diverse samples, covering various situations under different traffic labels. Increasing the difference between samples of different categories helps the model better learn and distinguish different traffic types, especially the difference between intrusion traffic and normal traffic.

[0065] Based on this, the detection model is trained based on the optimized training data set. Through its autonomous learning ability, the model can learn the characteristics of different traffic types. During the training process, the model continuously adjusts its parameters to minimize prediction errors and improve the accuracy of identifying intrusion traffic. Since the detection model has been fully trained with the optimized training data set, in actual applications, only the characteristics of the traffic to be detected need to be input into the model to quickly obtain intrusion detection results. This method simplifies the detection process of intrusion traffic, reduces the need for manual analysis and intervention, and improves detection efficiency. The detection model fully learns the characteristics of different traffic types during the training process, so it can more accurately identify intrusion traffic in actual applications.

[0066] In an exemplary embodiment, Figure 2 As shown, the training data set is obtained in the following way:

[0067] S201, determining a flow sample difference value between each original flow sample according to the flow characteristics of each original flow sample in the original data set.

[0068] The traffic characteristics of the original traffic sample include at least the average packet length of the traffic packet, the variance of the packet length, the average packet arrival time, the standard deviation of the packet arrival time, the number of packets arriving per second and the duration of the flow.

[0069] It can be understood that the average packet length of traffic packets refers to the average length of all data packets in a specific traffic sample or flow. Intrusion traffic may show a packet length distribution different from normal traffic, so the average packet length can be used as a useful feature.

[0070] Variance of packet length: Variance measures the dispersion of packet length from the mean. For some types of intrusions, such as DDoS attacks, packet length may show high variance because attackers may use packets of different sizes to simulate normal traffic.

[0071] Mean packet arrival time: This is the average time interval between the arrival of packets. Intrusion traffic may exhibit a different arrival time pattern than normal traffic, for example, arriving faster or at more irregular intervals.

[0072] Standard Deviation of Packet Arrival Times: The standard deviation is a measure of how scattered the packet arrival times are from the mean. A large standard deviation may indicate instability in the traffic pattern, which could be a sign of an intrusion.

[0073] Packets arriving per second: This is a basic measure of network traffic, the number of packets transmitted per second. Intrusion traffic can cause this number to increase significantly, especially in a flood or DDoS attack.

[0074] Flow duration: Flow duration refers to the time from the start to the end of a specific network connection or transmission session. Some types of intrusions may show different duration patterns than normal traffic. For example, short, frequent connections may be a sign of a scanning attack or attempted intrusion.

[0075] S202, screening the original data set according to the traffic sample difference value between each original traffic sample and the traffic label of each original traffic sample to obtain a training data set.

[0076] In one possible implementation, for each raw traffic sample under each traffic label, the traffic sample difference value between them is calculated. The difference value can be based on a variety of measurement methods, such as Euclidean distance, Manhattan distance, cosine similarity, etc. The specific method to be selected depends on the traffic characteristics and the requirements of the classification task. By setting a difference threshold, sample pairs with a difference value greater than the threshold can be screened out to ensure the diversity and representativeness of the training data set. The raw data set is screened according to the traffic sample difference value and traffic label.

[0077] Optionally, first, remove sample pairs with too small difference values ​​to reduce the number of samples with high similarity. Second, ensure that there are enough samples under each traffic label to support model training. In order to deal with possible data imbalance, stratified sampling can be used. That is, the original data set is stratified according to the traffic label, and then sampling is performed independently in each layer. This ensures that each traffic label is appropriately represented in the training data set.

[0078] In another possible implementation, Figure 3 As shown, according to the traffic sample difference value between each original traffic sample and the traffic label of each original traffic sample, the original data set is screened to obtain a training data set, including:

[0079] S301, selecting a target traffic sample from unlabeled original traffic samples in an original data set, and taking all original traffic samples except the target traffic sample in the unlabeled original traffic as other traffic samples.

[0080] Among them, the marked original traffic sample means that the original traffic sample does not need to participate in the subsequent screening process and is directly used as a training traffic sample; correspondingly, the unmarked original traffic sample means that the original traffic sample needs to participate in the subsequent screening process to verify whether it can be used as a training traffic sample.

[0081] S302: Determine, from other traffic samples, neighboring traffic samples of the target traffic sample according to the traffic sample difference value between the target traffic sample and other traffic samples.

[0082] Among them, the traffic sample difference value between the target traffic sample and the adjacent traffic sample corresponding to the target traffic sample is less than or equal to the difference threshold.

[0083] Among them, KNN (K-Nearest Neighbors) algorithm is a commonly used supervised learning algorithm, mainly used for classification and regression problems. In the classification problem, the KNN algorithm predicts the category of the target traffic sample by finding the K samples closest to the target traffic sample and based on the categories of these neighboring samples. The following are the steps for the KNN algorithm to determine the neighboring samples of the target traffic sample:

[0084] In the KNN algorithm, distance measurement is the key to determining the similarity or proximity between samples. Common distance measurement methods include: 1) Euclidean distance: measure the straight-line distance between two samples in multidimensional space. 2) Manhattan distance: measure the city block distance between two samples in multidimensional space. 3) Cosine similarity: measure the cosine value of the angle between two sample vectors, usually used in scenarios such as text classification. In this embodiment, the KNN algorithm is used to determine the neighboring traffic samples of the target traffic sample. Specifically, for a given target traffic sample, the distance between each other traffic sample needs to be calculated. According to the sorted distance, select the top K other traffic samples with the smallest distance as the neighboring samples of the target traffic sample. These neighboring samples will be used for subsequent category judgment or regression prediction.

[0085] S303, selecting samples to be marked and samples to be removed from the target traffic sample and the adjacent traffic samples according to the traffic label of the target traffic sample and the traffic labels of the adjacent traffic samples.

[0086] Among them, the samples to be marked refer to the samples that need to be marked, and the marked samples are directly used as training traffic samples; the samples to be removed refer to the samples that need to be removed and removed from the original data set.

[0087] S304: Update the original data set according to the samples to be marked and the samples to be eliminated.

[0088] Specifically, in the original data set, the samples to be marked are marked, and the samples to be removed are removed, so as to obtain an updated original data set.

[0089] S305, if there are at least two unlabeled original traffic samples in the updated original data set, then based on the updated original data set, return to the step of selecting a target traffic sample from the unlabeled original traffic samples in the original data set.

[0090] It can be understood that if there are at least two unlabeled original traffic samples in the updated original data set, it means that among the at least two unlabeled original traffic samples, there may be sample pairs that are adjacent traffic samples. In this case, it is necessary to further screen the at least two unlabeled original traffic samples, that is, return to the step of selecting a target traffic sample from the unlabeled original traffic samples in the original data set until the updated original data set contains only labeled traffic samples or there is one unlabeled original traffic sample.

[0091] Exemplarily, in this embodiment, three neighboring traffic samples may be selected for each target traffic sample. Accordingly, when the three nearest neighboring traffic samples of a target traffic sample A all have the same traffic label as A, the three nearest neighboring traffic samples may be deleted from the original data set, and the cycle continues until any sample in the original data set does not have three nearest neighboring traffic samples with the same traffic label as itself.

[0092] S306: If the updated original data set only contains labeled traffic samples or there is an unlabeled original traffic sample, the updated original data set is used as a training data set.

[0093] Correspondingly, if the updated original data set only contains labeled traffic samples, it means that there are no samples that need to be screened in the original data set. In this case, the original data set is directly used as the training data set, and the training data set is classified according to different traffic labels.

[0094] Furthermore, if there is only one unlabeled original traffic sample in the updated original data set, it means that the other original traffic samples in the updated original data set are all labeled original traffic samples. It can be understood that the labeled original traffic sample does not need to be screened again, and the unlabeled original traffic sample is a neighboring traffic sample of the target traffic sample in this round of screening, and the traffic label of the neighboring traffic sample is inconsistent with that of the target traffic sample. In this case, it means that although the difference between the neighboring traffic sample and the target traffic sample is large, they can be used as training traffic samples with their corresponding traffic labels respectively. In this case, the original data set with only one unlabeled original traffic sample is directly used as the training data set, and the training data set is classified according to different traffic labels.

[0095] In this embodiment, neighboring samples corresponding to each target traffic sample are screened from the sample feature dimension and the sample label dimension to update the original data set, so that the differences between samples in the updated original data set are greater.

[0096] In an exemplary embodiment, Figure 4 As shown, according to the traffic label of the target traffic sample and the traffic label of the adjacent traffic sample, samples to be marked and samples to be removed are selected from the target traffic sample and the adjacent traffic samples, including:

[0097] S401, if the traffic label of the target traffic sample and the traffic label of the adjacent traffic sample in the original data set are consistent, the target traffic sample is used as a sample to be marked, and the adjacent traffic sample is used as a sample to be removed.

[0098] It can be understood that if the traffic label of the target traffic sample in the original data set is consistent with the traffic label of the adjacent traffic sample, it means that the similarity between the target traffic sample and the adjacent traffic sample is high (the similarity is high in both the traffic feature dimension and the traffic label dimension). In this case, only one of the target traffic sample and the adjacent traffic sample needs to be selected. Optionally, the target traffic sample is retained and the adjacent traffic sample is eliminated as a sample to be eliminated.

[0099] S402: If the traffic label of the target traffic sample in the original data set is inconsistent with the traffic labels of the adjacent traffic samples, the target traffic sample is used as a sample to be labeled.

[0100] It can be understood that if the traffic label of the target traffic sample in the original data set is inconsistent with the traffic label of the adjacent traffic sample, it means that the target traffic sample and the adjacent traffic sample are similar only in the traffic feature dimension, but have a large difference in the traffic label dimension, and can be used as training traffic samples for their respective corresponding traffic labels.

[0101] In this embodiment, based on the traffic labels of the target traffic samples and the traffic labels of the neighboring traffic samples in the original data set, the similarities between the samples are measured from the traffic label dimension to achieve accurate screening of the target traffic samples and the neighboring traffic samples.

[0102] In an exemplary embodiment, Figure 5 As shown, this embodiment provides an intrusion traffic detection method, including:

[0103] S501, marking each collected original traffic sample to obtain an original data set.

[0104] The traffic characteristics of each original traffic sample include at least the average packet length of the traffic packet, the variance of the packet length, the average packet arrival time, the standard deviation of the packet arrival time, the number of packets arriving per second and the duration of the flow.

[0105] S502: Determine the traffic sample difference value between the original traffic samples according to the traffic characteristics of the original traffic samples in the original data set.

[0106] S503, selecting a target traffic sample from the unlabeled original traffic samples in the original data set, and taking all the original traffic samples in the unlabeled original traffic except the target traffic sample as other traffic samples.

[0107] S504: Determine, from other traffic samples, neighboring traffic samples of the target traffic sample according to the traffic sample difference value between the target traffic sample and other traffic samples.

[0108] S505, selecting samples to be marked and samples to be removed from the target traffic sample and the adjacent traffic samples according to the traffic label of the target traffic sample and the traffic labels of the adjacent traffic samples

[0109] S506: Update the original data set according to the samples to be marked and the samples to be eliminated.

[0110] S507, if there are at least two unlabeled original traffic samples in the updated original data set, then based on the updated original data set, return to the step of selecting a target traffic sample from the unlabeled original traffic samples in the original data set.

[0111] S508: If the updated original data set only contains labeled traffic samples or there is an unlabeled original traffic sample, the updated original data set is used as a training data set.

[0112] S509: Based on the training data set, the initial model is trained to obtain a detection model.

[0113] S510, obtaining the flow to be detected, and extracting the flow characteristics of the flow to be detected.

[0114] S511, input the traffic characteristics into the detection model to obtain the intrusion detection result output by the detection model.

[0115] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0116] Based on the same inventive concept, the embodiment of the present application also provides an intrusion flow detection device for implementing the above-mentioned intrusion flow detection. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above-mentioned method, so the specific limitations in one or more intrusion flow detection method device embodiments provided below can refer to the limitations of the intrusion flow detection method above, and will not be repeated here.

[0117] In an exemplary embodiment, Figure 6 As shown, an intrusion traffic detection method and device is provided, including: an acquisition module 11 and a detection module 12, wherein:

[0118] The acquisition module 11 is used to acquire the flow to be detected and extract the flow characteristics of the flow to be detected;

[0119] The detection module 12 is used to input the traffic characteristics into the detection model to obtain the intrusion detection result output by the detection model;

[0120] The detection model is trained based on a training data set; the training data set includes training traffic samples under each traffic label screened from an original data set, and the traffic sample difference value between different training traffic samples under each traffic label is greater than a difference threshold.

[0121] In one of the embodiments, the device further comprises a construction module, which is used to: determine the flow sample difference value between each original flow sample according to the flow characteristics of each original flow sample in the original data set;

[0122] According to the traffic sample difference value between each original traffic sample and the traffic label of each original traffic sample, the original data set is screened to obtain a training data set.

[0123] In one of the embodiments, a construction module is used to: select a target traffic sample from unlabeled original traffic samples in an original data set, and use all original traffic samples except the target traffic sample in the unlabeled original traffic as other traffic samples;

[0124] According to the traffic sample difference value between the target traffic sample and each other traffic sample, determine the adjacent traffic sample of the target traffic sample from each other traffic sample; wherein the traffic sample difference value between the target traffic sample and the adjacent traffic sample corresponding to the target traffic sample is less than or equal to the difference threshold;

[0125] According to the traffic label of the target traffic sample and the traffic label of the adjacent traffic sample, select the sample to be marked and the sample to be removed from the target traffic sample and the adjacent traffic sample;

[0126] Update the original data set according to the samples to be marked and the samples to be removed;

[0127] If the updated original data set only contains labeled traffic samples or there is an unlabeled original traffic sample, the updated original data set is used as the training data set.

[0128] In one of the embodiments, a construction module is used to: if the traffic label of the target traffic sample and the traffic label of the adjacent traffic sample in the original data set are consistent, then the target traffic sample is used as a sample to be labeled, and the adjacent traffic sample is used as a sample to be removed;

[0129] If the traffic label of the target traffic sample in the original data set is inconsistent with the traffic labels of the adjacent traffic samples, the target traffic sample is taken as a sample to be labeled.

[0130] In one embodiment, a construction module is used to: mark samples to be marked in an original data set, and remove samples to be removed, to obtain an updated original data set.

[0131] In one of the embodiments, the construction module is used to: if there are at least two unlabeled original traffic samples in the updated original data set, then based on the updated original data set, return to execute the step of selecting a target traffic sample from the unlabeled original traffic samples in the original data set.

[0132] In one of the embodiments, the traffic characteristics of the original traffic sample include at least the average packet length of the traffic packets, the variance of the packet length, the average packet arrival time, the standard deviation of the packet arrival time, the number of packets arriving per second and the duration of the flow.

[0133] Each module in the above-mentioned intrusion traffic detection method and device can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0134] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 7 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store XX data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an intrusion traffic detection method is implemented.

[0135] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0136] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0137] Obtain the traffic to be detected and extract the traffic characteristics of the traffic to be detected;

[0138] Input the traffic characteristics into the detection model to obtain the intrusion detection results output by the detection model;

[0139] The detection model is trained based on a training data set; the training data set includes training traffic samples under each traffic label screened from an original data set, and the traffic sample difference value between different training traffic samples under each traffic label is greater than a difference threshold.

[0140] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0141] Obtain the traffic to be detected and extract the traffic characteristics of the traffic to be detected;

[0142] Input the traffic characteristics into the detection model to obtain the intrusion detection results output by the detection model;

[0143] The detection model is trained based on a training data set; the training data set includes training traffic samples under each traffic label screened from an original data set, and the traffic sample difference value between different training traffic samples under each traffic label is greater than a difference threshold.

[0144] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0145] Obtain the traffic to be detected and extract the traffic characteristics of the traffic to be detected;

[0146] Input the traffic characteristics into the detection model to obtain the intrusion detection results output by the detection model;

[0147] The detection model is trained based on a training data set; the training data set includes training traffic samples under each traffic label screened from an original data set, and the traffic sample difference value between different training traffic samples under each traffic label is greater than a difference threshold.

[0148] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0149] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0150] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for detecting intrusion traffic, characterized in that: The method comprises: Acquire the flow to be detected, and extract the flow characteristics of the flow to be detected; Inputting the traffic characteristics into a detection model to obtain an intrusion detection result output by the detection model; Wherein, the detection model is trained based on a training data set; wherein, the training data set includes training traffic samples under each traffic label screened from the original data set, and the traffic sample difference value between different training traffic samples under each traffic label is greater than a difference threshold.

2. The method according to claim 1, characterized in that The training data set is obtained in the following way: Determine the flow sample difference value between the original flow samples according to the flow characteristics of each original flow sample in the original data set; The original data set is screened according to the traffic sample difference value between the original traffic samples and the traffic label of each original traffic sample to obtain the training data set.

3. The method according to claim 2, characterized in that The method of screening the original data set according to the traffic sample difference value between the original traffic samples and the traffic label of each original traffic sample to obtain the training data set includes: Selecting a target traffic sample from the unlabeled original traffic samples in the original data set, and taking all original traffic samples in the unlabeled original traffic except the target traffic sample as other traffic samples; According to the traffic sample difference value between the target traffic sample and each other traffic sample, determine the adjacent traffic sample of the target traffic sample from each other traffic sample; wherein the traffic sample difference value between the target traffic sample and the adjacent traffic sample corresponding to the target traffic sample is less than or equal to the difference threshold; Selecting a sample to be marked and a sample to be removed from the target traffic sample and the adjacent traffic sample according to the traffic label of the target traffic sample and the traffic label of the adjacent traffic sample; Updating the original data set according to the samples to be marked and the samples to be removed; If the updated original data set only contains labeled traffic samples or there is an unlabeled original traffic sample, the updated original data set is used as the training data set.

4. The method according to claim 3, characterized in that The selecting, from the target traffic sample and the adjacent traffic sample, samples to be marked and samples to be removed according to the traffic label of the target traffic sample and the traffic label of the adjacent traffic sample, comprises: If the traffic label of the target traffic sample in the original data set is consistent with the traffic label of the adjacent traffic sample, the target traffic sample is used as the sample to be marked, and the adjacent traffic sample is used as the sample to be removed; If the traffic label of the target traffic sample in the original data set is inconsistent with the traffic label of the adjacent traffic sample, the target traffic sample is used as the sample to be labeled.

5. The method according to claim 3, characterized in that: The updating of the original data set according to the samples to be marked and the samples to be removed includes: In the original data set, the samples to be marked are marked, and the samples to be removed are removed to obtain an updated original data set.

6. The method according to claim 3, characterized in that The method further comprises: If there are at least two unlabeled original traffic samples in the updated original data set, then based on the updated original data set, the step of selecting a target traffic sample from the unlabeled original traffic samples in the original data set is returned to be executed.

7. The method according to claim 2, characterized in that The traffic characteristics of the original traffic sample include at least the average packet length of the traffic packets, the variance of the packet length, the average packet arrival time, the standard deviation of the packet arrival time, the number of packets arriving per second and the duration of the flow.

8. A method and device for detecting intrusion traffic, characterized in that: The device comprises: An acquisition module, used for acquiring the flow to be detected and extracting the flow characteristics of the flow to be detected; A detection module, used for inputting the traffic characteristics into a detection model to obtain an intrusion detection result output by the detection model; Wherein, the detection model is trained based on a training data set; wherein, the training data set includes training traffic samples under each traffic label screened from the original data set, and the traffic sample difference value between different training traffic samples under each traffic label is greater than a difference threshold.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images