A malicious DoH tunnel traffic detection method based on incremental ensemble learning

Abstract

The present invention discloses a method for detecting malicious DoH tunnel traffic based on incremental ensemble learning, comprising the following steps: S1, obtaining labeled traffic data, dividing the training set and validation set of corresponding feature data; S2, creating multiple base learners, forming a classifier set, and completing the initialization construction of the classifier set; S3, obtaining the K nearest neighbor area of ​​the unknown sample in the validation set, selecting the best performing classifier as the expert classifier of the sample, and using the obtained prediction result as the pseudo label of the sample; S4, judging the drift state of the base classifier; S5, setting a warning threshold and a drift threshold; S6, updating if the relevant threshold is reached. The present invention can adapt to the characteristic distribution changes of malicious DoH tunnel traffic without the need for a large amount of labeled data, and continuously maintain excellent detection performance.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a malicious DoH tunnel traffic detection method based on incremental ensemble learning. Background Art

[0002] The Domain Name System (DNS) is one of the infrastructures of the Internet, which can convert easy-to-remember domain names into machine-readable IP addresses. However, the DNS query and response information in the DNS protocol is transmitted in plain text, which is vulnerable to man-in-the-middle attacks. In recent years, the security issues of the DNS protocol have gradually attracted attention, and a new generation of encrypted DNS protocols have emerged to enhance user privacy and data security. Among them, the DoH (DNS over HTTPS) protocol has attracted much attention. It was proposed by Mozilla Foundation engineers in 2018, that is, to encrypt and encapsulate DNS communication data with HTTPS. However, while the DoH protocol enhances data security, it also provides attackers with a hidden encrypted tunnel.

[0003] Due to its highly concealed and difficult to trace characteristics, DoH tunnels have been favored by multiple hacker groups and widely used in a variety of malware. Today, DoH-based tunnel attacks have become a very thorny issue in the field of network security: in 2019, the first malware Godlua that used DoH tunnels to steal data was disclosed; in 2020, the first APT organization (APT34) that used DoH tunnels for data outflow attacks was disclosed.

[0004] At present, although some existing detection systems based on static machine learning models can effectively identify the DoH tunnel communication behavior of some known tunnel tools, new tunnel tools continue to emerge over time. Compared with classic tunnel tools, these new tunnel tools have significant differences in implementation details such as the selection of transmission packet payload size and the setting of query response time interval, which leads to changes in the distribution of tunnel traffic characteristics generated by them, thereby causing the performance degradation of static learning models, and eventually being broken through by new variant tunnel tools.

[0005] Therefore, appropriate methods are needed to deal with it. Summary of the invention

[0006] The purpose of the present invention is to provide a malicious DoH tunnel traffic detection method based on incremental ensemble learning to solve the following problems existing in the prior art: Although the detection method based on the static learning model can effectively identify the DoH tunnel communication behavior of some known tunnel tools, new tunnel tools continue to emerge over time. Compared with classic tunnel tools, these new tunnel tools have significant differences in implementation details such as the selection of the transmission data packet payload size and the setting of the query response time interval, which leads to changes in the characteristic distribution of the tunnel traffic generated by them, thereby causing the performance degradation of the static learning model, and finally being broken through by the new variant tunnel tool.

[0007] To achieve the above object, the present invention provides a malicious DoH tunnel traffic detection method based on incremental ensemble learning, comprising the following steps:

[0008] S1. Obtain labeled traffic data, preprocess the data, and divide the data into a training set and a validation set corresponding to the feature data;

[0009] S2. Create multiple base learners to form a classifier set. Use the Bagging strategy to train each base classifier separately on the training set to complete the initialization construction of the classifier set.

[0010] S3. For unknown samples, a dynamic classifier selection strategy based on local accuracy is used to obtain the K nearest neighbor region of the unknown sample in the validation set, evaluate the performance of each classifier in this region, and then select the best performing classifier as the expert classifier of the sample. The obtained prediction result is used as the pseudo label of the sample.

[0011] S4, calculating the difference between the prediction result of each base classifier in the classifier set and the pseudo label as the pseudo error rate to determine the drift state of the classifier;

[0012] S5. setting a warning threshold and a drift threshold according to the historical false error rate of the base classifier;

[0013] S6. If the pseudo error rate reaches the warning threshold, create an alternative classifier for incremental update and collect current samples. If the pseudo error rate reaches the drift threshold, confirm that the classifier has concept drift, replace the global base classifier, and manually label the samples collected in the warning stage as a new verification set.

[0014] Furthermore, the step S1 specifically includes:

[0015] S1a. Obtain the original public dataset CIRA-CICDoHBrw-2020 and filter it according to two types of traffic: normal DoH traffic and malicious DoH traffic.

[0016] S1b, remove irrelevant features for detecting encrypted malicious traffic, including IP and port; standardize numerical features so that different features have the same dimension;

[0017] S1c. Divide the processed data set into training set and validation set.

[0018] Furthermore, the step S2 specifically includes:

[0019] S2a, create multiple Hoeffding trees as base classifiers to form a classifier set;

[0020] S2b, each classifier simulates the sampling learning with replacement of the training set through the Bagging strategy, and determines the sample according to the Poisson distribution x i The contribution degree of: that is, the number of times the sample is learned in each base classifier; for the sample x i and classifier C j , generating obedience parameters l =1 Poisson distributed random number w i,j , w i,j Representation classifier C j Study Sample x i times, so that different base classifiers can obtain different learning effects on the same training set, thereby improving the diversity of base classifiers in the set.

[0021] Furthermore, the step S3 specifically includes:

[0022] S3a, for unknown samples x , in the labeled validation set Medium Calculation x And the samples in the validation set x i The distance between

[0023]

[0024] in y i for x i The corresponding label, m is the characteristic dimension of the sample, x k and x i,k Respectively represent samples x and validation set samples x iIn the k The value of a feature;

[0025] S3b, after calculating the distance of all samples, sort these samples from small to large according to the distance, and select the first K neighbors that are most similar to the unknown sample to form a K nearest neighbor set N ( x )={ x 1 ,x 2 ,...,x K};

[0026] S3c, evaluate all classifiers C i The local accuracy on these neighbors, that is, using the classifier C j For K neighbor samples Make predictions based on the prediction labels Compute classifier C j The local accuracy

[0027]

[0028] in d ( x,y ) is an equality comparison function that returns a positive integer when its two input arguments are equal. d The value of is 1, otherwise it is 0;

[0029] S3d, select the classifier with the highest local accuracy

[0030]

[0031] As a sample x The expert classifier, whose prediction result As pseudo-label output, C j ∈C Representation classifier C j From the classifier collection C , Representation classifier k In the current sample x Neighborhood area N ( x ) on the local accuracy.

[0032] Furthermore, the step S4 specifically includes:

[0033] S4a, for each base classifier C j , false error rate It is defined as the inconsistency between the prediction results of the classifier on the unlabeled samples and the prediction results of the expert classifier; for N samples, if the classifier's prediction C j ( x i ) and pseudo labels If not, the false error rate is calculated.

[0034]

[0035] in N is the number of samples processed.

[0036] Furthermore, the step S5 specifically includes:

[0037] S5a, record the pseudo error rate of each base classifier p j and standard deviation s j , and the historical minimum pseudo error rate of the corresponding base classifier p min and standard deviation s min ;

[0038] S5b, the warning threshold of each classifier is set to the sum of the historical minimum false error rate of each base classifier and twice the standard deviation α = p min +2 s min , the drift threshold is set to the sum of the historical minimum pseudo error rate of each base classifier and three times the standard deviation

[0039] β = p min +3 s min .

[0040] Furthermore, the step S6 specifically includes:

[0041] S6a, when the classifier reaches the warning threshold, an alternative classifier will be created immediately, using the current samples and pseudo labels for incremental learning, and the current samples will be collected as subsequent validation sets;

[0042] S6b, when the classifier reaches the drift threshold, it immediately enters the drift adaptation phase, and the unknown samples collected in step S6a are manually annotated by experts and used as a new validation set;

[0043] S6c. After labeling is completed, the alternative classifier uses it for incremental learning, and uses the alternative classifier to globally replace each base classifier in the current set to maintain the adaptability of the base classifier to the new data distribution.

[0044] Compared with the prior art, the present invention has the following beneficial effects:

[0045] The present invention can effectively deal with the concept drift problem in malicious DoH tunnel traffic without the need for a large amount of labeled data. It has good adaptability and detection accuracy and is suitable for complex network environments.

[0046] The present invention designs a malicious DoH tunnel traffic detection method based on incremental ensemble learning. The model is dynamically updated through online learning, and semi-supervised drift detection is performed based on a dynamic classifier selection strategy to improve detection accuracy and enhance adaptability and robustness to variant malicious DoH tunnel tools.

[0047] The present invention is a malicious DoH tunnel traffic detection method based on incremental ensemble learning. It dynamically updates the model through online learning, and performs semi-supervised drift detection and adaptation based on a dynamic classifier selection strategy, thereby enhancing the robustness against variant malicious DoH tunnel tools, improving the defense perception capability to cope with complex network attacks, and avoiding the catastrophic forgetting and resource waste problems caused by retraining the model in traditional methods. The dynamic classifier selection strategy is used to adaptively select expert classifiers, avoiding the assumption of independence of base classifiers in the set, thereby improving the generalization ability of the model to unseen malicious traffic. At the same time, the pseudo-label mechanism introduced reduces the dependence on manual labels to a certain extent through self-learning of unlabeled data, thereby reducing the cost of data labeling.

[0048] In addition to the above-described objects, features and advantages, the present invention has other objects, features and advantages. The present invention is further described in detail below. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The drawings constituting a part of this application are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0050] Figure 1 is a flow chart of an embodiment of the present invention;

[0051] Figure 2 This is a flow chart of classifier set initialization based on Bagging strategy according to an embodiment of the present invention. DETAILED DESCRIPTION

[0052] The embodiments of the present invention are described in detail below. The specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0053] A malicious DoH tunnel traffic detection method based on incremental ensemble learning of the present invention comprises the following steps:

[0054] S1. Obtain labeled traffic data, preprocess the data, and divide the data into a training set and a validation set corresponding to the feature data.

[0055] The step S1 specifically includes:

[0056] S1a. Obtain the original public dataset CIRA-CICDoHBrw-2020 and filter it according to two types of traffic: normal DoH traffic and malicious DoH traffic. You can also select other original public datasets for preprocessing.

[0057] S1b. Remove irrelevant features for detecting encrypted malicious traffic, including IP and port. Standardize numerical features so that different features have the same dimension.

[0058] S1c. Divide the processed data set into training set and validation set.

[0059] S2. Create multiple base learners to form a classifier set. Use the Bagging strategy on the training set to train each base classifier separately to complete the initialization construction of the classifier set.

[0060] The step S2 specifically includes:

[0061] S2a, create multiple Hoeffding trees as base classifiers to form a classifier set;

[0062] S2b, each classifier simulates the sampling learning with replacement of the training set through the Bagging strategy, and determines the sample according to the Poisson distribution x i The contribution degree of: that is, the number of times the sample is learned in each base classifier; for the sample x i and classifier C j , generating obedience parameters l =1 Poisson distributed random number w i,j , w i,j Representation classifier C j Study Sample x i times, so that different base classifiers can obtain different learning effects on the same training set, thereby improving the diversity of base classifiers in the set.

[0063] S3. For unknown samples, a dynamic classifier selection strategy based on local accuracy is used to obtain the K nearest neighbor area of ​​the unknown sample in the validation set, evaluate the performance of each classifier in this area, and then select the best performing classifier as the expert classifier of the sample. The obtained prediction result is used as the pseudo label of the sample.

[0064] The step S3 specifically includes:

[0065] S3a, for the unknown samples to be classified x , in the labeled validation set Medium Calculation x And the samples in the validation set x i The distance between

[0066]

[0067] in y i for x i The corresponding label, m is the characteristic dimension of the sample, x k and x i,k Respectively represent samples x and validation set samples x i In the k The value of a feature.

[0068] S3b, after calculating the distance of all samples, sort these samples from small to large according to the distance, and select the first K neighbors that are most similar to the unknown sample to form a K nearest neighbor set N ( x )={ x 1 ,x 2 ,...,x K}.

[0069] S3c, evaluate all classifiers C i The local accuracy on these neighbors, that is, using the classifier C j For K neighbor samples Make predictions based on the prediction labels Compute classifier C j The local accuracy

[0070]

[0071] in d ( x,y) is an equality comparison function that returns a positive integer when its two input arguments are equal. d The value is 1 if yes, otherwise it is 0.

[0072] S3d, select the classifier with the highest local accuracy

[0073]

[0074] As a sample x The expert classifier, whose prediction result As pseudo-label output, C j ∈C Representation classifier C j From the classifier collection C , Representation classifier k In the current sample x Neighborhood area N ( x ). The expert classifier is used to determine whether the unknown sample belongs to malicious DoH tunnel traffic.

[0075] S4. The difference between the prediction result of each base classifier in the classifier set and the pseudo label is counted as the pseudo error rate to determine the drift state of the classifier. Whether concept drift occurs is determined based on the DDM drift detection algorithm.

[0076] The step S4 specifically includes:

[0077] S4a, for each base classifier C j , false error rate It is defined as the inconsistency between the prediction results of the classifier on the unlabeled samples and the prediction results of the expert classifier; for N samples, if the classifier's prediction C j ( x i ) and pseudo labels If not, the false error rate is calculated.

[0078]

[0079] in N is the number of samples processed.

[0080] S5. The DDM drift detection algorithm sets two thresholds to judge the classifier status. The warning threshold and drift threshold are set according to the historical false error rate of the base classifier.

[0081] The step S5 specifically includes:

[0082] S5a, record the pseudo error rate of each base classifier p j and standard deviation s j , and the historical minimum pseudo error rate of the corresponding base classifier p min and standard deviation s min ;

[0083] S5b, the warning threshold of each classifier is set to the sum of the historical minimum false error rate of each base classifier and twice the standard deviation α = p min +2 s min , the drift threshold is set to the sum of the historical minimum pseudo error rate of each base classifier and three times the standard deviation

[0084] β = p min +3 s min .

[0085] S6. If the pseudo error rate reaches the warning threshold, create an alternative classifier for incremental update and collect current samples. If the pseudo error rate reaches the drift threshold, confirm that the classifier has concept drift, replace the global base classifier, and manually label the samples collected in the warning stage as a new verification set.

[0086] The step S6 specifically includes:

[0087] S6a. When the classifier reaches the warning threshold, an alternative classifier will be created immediately, using the current samples and pseudo labels for incremental learning, and the current samples will be collected as subsequent validation sets.

[0088] S6b, when the classifier reaches the drift threshold, it immediately enters the drift adaptation phase, and the unknown samples collected in step S6a are manually annotated by experts and used as a new validation set. Manual annotation by experts ensures accuracy.

[0089] S6c. After labeling is completed, the alternative classifier uses it for incremental learning, and uses the alternative classifier to globally replace each base classifier in the current set to maintain the adaptability of the base classifier to the new data distribution.

[0090] Example 1

[0091] The present invention discloses a malicious DoH tunnel traffic detection method based on incremental ensemble learning, the working process is as follows: Figure 1As shown. By obtaining benign and malicious DoH traffic samples from public data sets as training data; creating multiple Hoffeding Tree classifiers to form a classifier set; training the base classifiers in the classifier set based on the Bagging strategy to complete the initialization of the classifier set; in the test phase, through the dynamic classifier selection strategy based on local accuracy, the classifier with the best performance in the corresponding neighboring area is selected as the expert classifier for unknown samples, and the prediction result obtained by the expert classifier for the unknown sample is used as the final classification result and used as the pseudo label of the sample; recording the pseudo error rate of each base classifier in the test phase, judging the drift state of the base classifier, and performing the corresponding model update operation.

[0092] 1. Collect DoH traffic detection training data:

[0093] Obtain DoH traffic samples from public datasets. These samples should include both benign DoH traffic and malicious DoH traffic to ensure coverage of different usage scenarios and feature distributions. To improve the effectiveness and generalization of model training, priority is given to datasets with a high proportion of real traffic and accurate annotations, including DoH traffic logs from actual network environments, or experimental DoH traffic samples provided by trusted data sources. For example, obtain samples from the original public dataset CIRA-CICDoHBrw-2020. During data collection, special attention is paid to the diversity of the dataset to cover a variety of DoH tunnel traffic (such as tunnel tools such as dns2tcp, dnscat2, iodine, etc.) to build a comprehensive and representative training dataset.

[0094] Perform feature extraction on the collected DoH traffic samples. Since DoH traffic is usually encrypted traffic encapsulated through the HTTPS protocol, the specific content of its internal DNS query cannot be directly obtained during transmission, so feature extraction is based on the statistical properties of the traffic. The first features extracted include flow duration, packet length information, and request / response time. These statistical features can reflect the behavior patterns of DoH traffic. Malicious DoH traffic often exhibits patterns that are significantly different from benign traffic in these statistical characteristics, such as frequent short-interval requests, abnormally large response packets, or sessions with irregular durations. By extracting these features, important data support can be provided for the model to distinguish between benign and malicious DoH traffic.

[0095] The data after feature extraction is preprocessed, including the following steps: First, data cleaning and formatting operations are performed. Data entries containing outliers or incomplete records are deleted, and the original data is converted into a unified structured format to ensure that each sample contains all necessary feature fields. Secondly, the data is deduplicated. A hash algorithm-based method is used to eliminate duplicate samples with exactly the same features, thereby avoiding deviations caused by duplicate data in the training data. In addition, the traffic features need to be standardized and normalized to reduce the dimensional differences between different features and ensure that the model can learn the contribution of each feature fairly.

[0096] 2. Train a set of DoH traffic classifiers:

[0097] In practical applications, a single classifier may not perform well in all cases, especially when faced with complex, noisy or changing data. Therefore, this method creates multiple base classifiers to form a classifier ensemble, and selects the Hoffeding Tree model as the base classifier. Based on the Bagging strategy, each classifier independently performs incremental learning on the training data. In this way, each classifier in the classifier ensemble will be trained differently based on the same data stream. This diversity design improves the generalization ability of the integrated model and has better robustness when facing a changing network environment and malicious traffic.

[0098] The mathematical expression of the Hoffeding Tree model is as follows. The training set used is ((x1,y1),(x2,y2),…(x i ,y i ),…,(x n ,y n )), where x i ∈R m is the feature vector, m is the vector dimension, n is the number of samples in the training set, , where 0 represents benign DoH traffic and 1 represents malicious DoH traffic. The feature vector x of each sample i It contains the statistical characteristics of the traffic, including flow duration, packet length information, and request / response time. The HoffedingTree model gradually optimizes its decision structure when processing traffic data through incremental learning to achieve efficient classification of traffic types.

[0099] The training process of Hoffeding Tree is based on incremental learning, and its main goal is to To build a decision tree to maximize the purity or information gain after splitting. At each node, the optimal splitting attribute is selected by calculating the splitting gain of each candidate attribute. The splitting criterion of the decision tree is controlled by Hoffeding Bound, which provides an error bound to ensure the splitting decision in the case of finite samples. The expression is

[0100]

[0101] in represents the upper limit of the error during splitting, is the confidence parameter, which usually takes a small value (such as 0.01). n is the number of samples on the current node. By calculating each candidate attribute Difference in split gain with other attributes and ensure that

[0102]

[0103] To select the optimal splitting attribute .

[0104] During each training, Hoffeding Tree will gradually update its decision tree based on the training samples, optimizing the selection of split attributes until all samples are classified into appropriate leaf nodes. For incremental data, Hoffeding Tree adopts an online learning strategy, that is, each time a new traffic sample is received, it can be quickly updated based on the current tree structure without retraining the entire model. This dynamic update method enables HoffedingTree to maintain good adaptability in an environment where traffic data changes rapidly.

[0105] In order to improve the robustness of the model, the training process adopts the Bagging strategy. Each classifier processes different subsets of training data independently to ensure that each classifier can learn from different traffic characteristics, thereby increasing the diversity between classifiers. In each training, the Poisson distribution is used for sample sampling, and the sampling weight of each sample is w i Generated from a Poisson distribution:

[0106]

[0107] In this way, the bagging strategy can ensure that each classifier can focus on different data subsets during training, thereby improving the generalization ability and accuracy of the classifier ensemble. The classifier ensemble initialization process based on the bagging strategy is as follows: Figure 2 shown.

[0108] 3. Expert classifier selection:

[0109] For new DoH traffic samples, this method adopts an expert classifier selection mechanism to dynamically select the classifier that best suits the current sample, thereby ensuring that each sample can be processed by the best classifier, rather than using the voting weighting of prediction results in traditional ensemble learning methods. This avoids the error accumulation that may be caused by the assumption of independence of each base classifier, and improves the accuracy and robustness of classification predictions.

[0110] Perform feature extraction on DoH traffic samples and construct feature vectors. Based on the K nearest neighbor algorithm, select the K samples most similar to the current sample from the validation set data of known categories, and evaluate the local accuracy of each base classifier on these samples. Select the classifier with the highest local accuracy as the expert classifier for the current sample, and use its prediction result as the final output.

[0111] Assume that the feature vector of the test sample is x test , select the most similar K neighbors from the validation set and get the neighbor set N k ={ x 1 ,x 2 ,...,x K}, where each neighbor x i The prediction result of the feature vector in the base classifier is For each base classifier C j , which is in the neighbor set N k The local accuracy on

[0112]

[0113] in d ( x,y ) is an equality comparison function that returns a positive integer when its two input arguments are equal. d The value is 1 if yes, otherwise it is 0.

[0114] Further, select the classifier with the highest local accuracy As a sample x The expert classifier, whose prediction result As the final classification result output, and as the sample x Pseudo labels of C j ∈C Representation classifier C j From the classifier collection C , Representation classifier k In the current sample x Neighborhood area N ( x ) on the local accuracy.

[0115] 4. Classifier drift state detection:

[0116] In order to ensure that each base classifier in the classifier set continues to maintain high performance in traffic data, the false error rate of each base classifier is continuously recorded to determine whether the classifier performance has declined, and then determine whether concept drift has occurred.

[0117] Specifically, for each base classifier C j , false error rate It is defined as the inconsistency between the prediction of the classifier on the unlabeled samples and the pseudo-labels predicted by the expert classifier. For N samples, if the classifier’s prediction C j ( x i ) and pseudo labels If not, the false error rate is calculated.

[0118]

[0119] in N is the number of samples processed.

[0120] Furthermore, after calculating the base classifier C j After the pseudo error rate of a base classifier is , this method uses the DDM drift detection algorithm and sets two thresholds according to the classifier's historical pseudo error rate and its standard deviation to judge the latest state of the classifier. d = p j + s j Exceeding warning threshold α = p min +2 s min , the base classifier enters the warning state, immediately creates an alternative classifier, uses the current sample and pseudo-label to perform incremental learning on it, and collects the current sample as the subsequent validation set to be labeled; if the current pseudo-error rate of a base classifier is d = p j + s j Exceeding drift threshold β = pmin +3 s min When the concept drift is confirmed, the drift adaptation phase is immediately entered to manually label the samples to be labeled collected in the warning state. After the manual labeling is completed, these samples will be used as a new validation set to replace part of the data in the original validation set, thereby providing the latest reference for dynamic classifier selection. Subsequently, a global replacement operation is performed on the base classifier set to ensure that the classifier set adapts to the changes in the new data distribution. This process ensures that the method can maintain its excellent accuracy and robustness when facing concept drift in traffic data.

[0121] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions and substitutions can be made without departing from the concept of the present invention, which should be regarded as belonging to the protection scope of the present invention.

Claims

1. A method for detecting malicious DoH tunnel traffic based on incremental ensemble learning, characterized in that: The steps include: S1. Obtain labeled traffic data, preprocess the data, and divide the data into a training set and a validation set corresponding to the feature data; S2. Create multiple base learners to form a classifier set. Use the Bagging strategy to train each base classifier separately on the training set to complete the initialization construction of the classifier set. S3. For unknown samples, a dynamic classifier selection strategy based on local accuracy is used to obtain the K nearest neighbor region of the unknown sample in the validation set, evaluate the performance of each classifier in this region, and then select the best performing classifier as the expert classifier of the sample. The obtained prediction result is used as the pseudo label of the sample. S4, calculating the difference between the prediction result of each base classifier in the classifier set and the pseudo label as the pseudo error rate to determine the drift state of the classifier; S5. setting a warning threshold and a drift threshold according to the historical false error rate of the base classifier; S6. If the pseudo error rate reaches the warning threshold, create an alternative classifier for incremental update and collect current samples. If the pseudo error rate reaches the drift threshold, confirm that the classifier has concept drift, replace the global base classifier, and manually label the samples collected in the warning stage as a new verification set.

2. The method for detecting malicious DoH tunnel traffic based on incremental ensemble learning according to claim 1 is characterized in that: The step S1 specifically includes: S1a. Obtain the original public dataset CIRA-CICDoHBrw-2020 and filter it according to two types of traffic: normal DoH traffic and malicious DoH traffic. S1b, remove irrelevant features for detecting encrypted malicious traffic, including IP and port; standardize numerical features so that different features have the same dimension; S1c. Divide the processed data set into training set and validation set.

3. The method for detecting malicious DoH tunnel traffic based on incremental ensemble learning according to claim 1 is characterized in that: The step S2 specifically includes: S2a, create multiple Hoeffding trees as base classifiers to form a classifier set; S2b, each classifier simulates the sampling learning with replacement of the training set through the Bagging strategy, and determines the sample according to the Poisson distribution x i The contribution degree of: that is, the number of times the sample is learned in each base classifier; for the sample x i and classifier C j , generating obedience parameters λ =1 Poisson distributed random number w i,j , w i,j Representation classifier C j Study Sample x i times, so that different base classifiers can obtain different learning effects on the same training set, thereby improving the diversity of base classifiers in the set.

4. The method for detecting malicious DoH tunnel traffic based on incremental ensemble learning according to claim 1 is characterized in that: The step S3 specifically includes: S3a, for unknown samples x , in the labeled validation set Medium Calculation x And the samples in the validation set x i The distance between in y i for x i The corresponding label, m is the characteristic dimension of the sample, x k and x i,k Respectively represent samples x and validation set samples x i In the k The value of a feature; S3b, after calculating the distance of all samples, sort these samples from small to large according to the distance, and select the first K neighbors that are most similar to the unknown sample to form a K nearest neighbor set N ( x )={ x 1 ,x 2 ,...,x K }; S3c, evaluate all classifiers C i The local accuracy on these neighbors, that is, using the classifier C j For K neighbor samples Make predictions based on the prediction labels Compute classifier C j The local accuracy in δ ( x,y ) is an equality comparison function that returns a positive integer when its two input arguments are equal. δ The value of is 1, otherwise it is 0; S3d, select the classifier with the highest local accuracy As a sample x The expert classifier, whose prediction result As pseudo-label output, C j ∈C Representation classifier C j From the classifier collection C , Representation classifier k In the current sample x Neighborhood area N ( x ) on the local accuracy.

5. The method for detecting malicious DoH tunnel traffic based on incremental ensemble learning according to claim 1 is characterized in that: The step S4 specifically includes: S4a, for each base classifier C j , false error rate It is defined as the inconsistency between the prediction results of the classifier on the unlabeled samples and the prediction results of the expert classifier; for N samples, if the classifier's prediction C j ( x i ) and pseudo labels If not, the false error rate is calculated in N is the number of samples processed.

6. The method for detecting malicious DoH tunnel traffic based on incremental ensemble learning according to claim 1, characterized in that: The step S5 specifically includes: S5a, record the pseudo error rate of each base classifier p j and standard deviation s j , and the historical minimum pseudo error rate of the corresponding base classifier p min and standard deviation s min ; S5b, the warning threshold of each classifier is set to the sum of the historical minimum false error rate of each base classifier and twice the standard deviation α = p min +2 s min , the drift threshold is set to the sum of the historical minimum pseudo error rate of each base classifier and three times the standard deviation β = p min +3 s min 。 7. The method for detecting malicious DoH tunnel traffic based on incremental ensemble learning according to claim 1 is characterized in that: The step S6 specifically includes: S6a, when the classifier reaches the warning threshold, an alternative classifier will be created immediately, using the current samples and pseudo labels for incremental learning, and the current samples will be collected as subsequent validation sets; S6b, when the classifier reaches the drift threshold, it immediately enters the drift adaptation phase, and the unknown samples collected in step S6a are manually annotated by experts and used as a new validation set; S6c. After labeling is completed, the alternative classifier uses it for incremental learning, and uses the alternative classifier to globally replace each base classifier in the current set to maintain the adaptability of the base classifier to the new data distribution.

Images