Abnormal flow identification method, device, electronic device and storage medium

Abstract

The present invention provides an abnormal traffic identification method, device, electronic device and storage medium, which belongs to the field of abnormal traffic identification technology, including: obtaining multiple feature vectors of the traffic to be identified; inputting multiple feature vectors into a trained long short-term memory network to obtain a hidden state vector output by the trained long short-term memory network; inputting the hidden state vector into a trained autoencoder to obtain a reconstruction vector output by the trained autoencoder; when the reconstruction error value between the hidden state vector and the reconstruction vector is greater than an error threshold, marking the traffic to be identified as abnormal traffic. The abnormal traffic identification method provided by the present invention solves the technical problem that the abnormal traffic identification method in the related art cannot accurately identify abnormal traffic.

Description

Technical Field

[0001] The present invention relates to the technical field of abnormal traffic identification, and in particular to an abnormal traffic identification method, device, electronic equipment and storage medium. Background Art

[0002] Current abnormal traffic identification solutions can be mainly divided into the following categories: signature-based abnormal traffic detection, behavior-based abnormal traffic detection, statistics and machine learning-based abnormal traffic detection, deep learning-based abnormal traffic detection, and hybrid model-based abnormal traffic detection.

[0003] The signature detection method is the most traditional way to identify abnormal traffic. The signature-based abnormal traffic detection method can only match network traffic through predefined abnormal traffic patterns (i.e., "signatures"). The signature detection method is powerless against new, undefined attacks and needs to continuously update the signature library to cope with new attack methods, which consumes a lot of manpower and time costs. Therefore, the abnormal traffic identification method in the relevant technology, in the absence of external intelligence support, cannot effectively identify abnormal traffic in the face of complex and changeable network environments and changing defense bypass strategies.

[0004] It can be seen that the abnormal traffic identification method in the related art has the technical problem of being unable to accurately identify abnormal traffic. Summary of the invention

[0005] The present invention provides an abnormal traffic identification method, device, electronic device and storage medium, which are used to solve the technical problem that the abnormal traffic identification method in the related art cannot accurately identify the abnormal traffic.

[0006] The present invention provides an abnormal traffic identification method, comprising the following steps: obtaining multiple feature vectors of the traffic to be identified; inputting the multiple feature vectors into a trained long short-term memory network to obtain a hidden state vector output by the trained long short-term memory network; inputting the hidden state vector into a trained autoencoder to obtain a reconstruction vector output by the trained autoencoder; when a reconstruction error value between the hidden state vector and the reconstruction vector is greater than an error threshold, marking the traffic to be identified as abnormal traffic; wherein the error threshold is updated by the following steps: obtaining a current error average of reconstruction error values ​​of multiple normal traffic flows in a current time period; updating the error threshold according to the current error average to obtain an updated error threshold, wherein the updated error threshold is applied to the next time period of the current time period.

[0007] According to an abnormal traffic identification method provided by the present invention, the current error average value of the reconstruction error values ​​of multiple normal flows in the current time period is obtained, including: classifying the multiple identified flows in the current time period by a density-based spatial clustering algorithm with noise to obtain the multiple normal flows; calculating the average value of the reconstruction error values ​​of the multiple normal flows to obtain the current error average value.

[0008] According to an abnormal traffic identification method provided by the present invention, the error threshold is updated according to the current error average value to obtain an updated error threshold, including: the updated error threshold is determined by the following formula:

[0009] ;

[0010] in, is the updated error threshold, is the error threshold, The value range is The adjustment factor, is the current error average.

[0011] According to an abnormal flow identification method provided by the present invention, the trained long short-term memory network is obtained by training through the following steps: obtaining a first sample flow data set; iteratively executing the following steps until the characteristic value error reaches a preset value to obtain the trained long short-term memory network: inputting the first sample flow data set into the long short-term memory network to obtain a plurality of predicted characteristic values ​​output by the long short-term memory network; calculating the characteristic value error between the real characteristic value and the predicted characteristic value of the sample flow through a first loss function; determining the gradient of the long short-term memory network based on the characteristic value error; updating the parameters of the long short-term memory network through a preset gradient descent algorithm to obtain an updated long short-term memory network; wherein the first loss function is: , is the number of sample flows in the first sample flow data set, is the number of features in the sample flow, For the The sample The true eigenvalue of the feature, Output the first The sample The predicted feature value of features, For the The weight of a feature.

[0012] According to an abnormal traffic identification method provided by the present invention, the trained autoencoder includes a discriminator, and the trained autoencoder is trained by the following steps: obtaining a second sample traffic data set, wherein the samples in the second sample traffic data set are sample vectors of normal traffic; iteratively performing the following steps until the discriminator cannot distinguish between sample vectors and reconstructed sample vectors, thereby obtaining the trained autoencoder: inputting the second sample traffic data set into the autoencoder to obtain a plurality of reconstructed sample vectors output by the autoencoder; calculating a vector error between a sample vector and a reconstructed sample vector by a second loss function; determining a gradient of the autoencoder based on the vector error; updating the parameters of the autoencoder by a preset gradient descent algorithm to obtain an updated autoencoder; wherein the second loss function is:

[0013] ;

[0014] ;

[0015] ;

[0016] ;

[0017] To rebuild the losses, To combat losses, is the regularization term, and is the coefficient, the quantity is the number of samples of the second sample traffic data set, is the sample vector, To reconstruct the sample vector, is the discriminator, Reconstruct the flow for the discriminator pair The probability of output, is the number of parameters of the autoencoder, is the weight parameter of the autoencoder.

[0018] According to an abnormal traffic identification method provided by the present invention, before obtaining multiple feature vectors of the traffic to be identified, the method also includes: obtaining multiple initial feature vectors of the traffic to be identified to obtain a feature vector data set; calculating the mean and standard deviation of the feature vector data set; subtracting the mean from each of the multiple initial feature vectors and dividing the result by the standard deviation to obtain the multiple feature vectors.

[0019] The present invention also provides an abnormal traffic identification device, comprising the following modules: an acquisition module, used to acquire multiple feature vectors of the traffic to be identified; a first execution module, used to input the multiple feature vectors into a trained long short-term memory network to obtain a hidden state vector output by the trained long short-term memory network; a second execution module, used to input the hidden state vector into a trained autoencoder to obtain a reconstruction vector output by the trained autoencoder; a marking module, used to mark the traffic to be identified as abnormal traffic when the reconstruction error value between the hidden state vector and the reconstruction vector is greater than an error threshold; wherein the error threshold is updated by the following steps: obtaining a current error average of reconstruction error values ​​of multiple normal flows within a current time period; updating the error threshold according to the current error average to obtain an updated error threshold, wherein the updated error threshold is applied to the next time period of the current time period.

[0020] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, any of the above-mentioned abnormal traffic identification methods is implemented.

[0021] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the abnormal traffic identification method as described above is implemented.

[0022] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the abnormal traffic identification method described above is implemented.

[0023] The abnormal traffic identification method, device, electronic device and storage medium provided by the present invention mark the traffic to be identified as abnormal traffic when the reconstruction error value between the hidden state vector and the reconstruction vector is greater than the error threshold. Since abnormal traffic usually exhibits a pattern different from normal traffic, such as abnormal data packet size, abnormal connection duration, etc., it is difficult for the autoencoder to generate a reconstruction result similar to the original input for abnormal traffic, resulting in a large reconstruction error. At the same time, as the network environment and attack methods are updated, the fixed error threshold cannot be adapted to the new environment. In this solution, the error threshold is updated based on the current error average value, which increases the reliability of the solution, thereby solving the technical problem that the abnormal traffic identification method in the related art cannot accurately identify abnormal traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced one by one below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0025] Figure 1 It is a flow chart of the abnormal traffic identification method provided by the present invention.

[0026] Figure 2 It is a schematic diagram of the abnormal traffic identification method provided by the present invention.

[0027] Figure 3 It is a structural schematic diagram of the abnormal flow identification device provided by the present invention.

[0028] Figure 4 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0030] It should be noted that in the description of the present invention, the terms "include", "comprise" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "include one..." do not exclude the existence of other identical elements in the process, method, article or device including the elements. The orientation or position relationship indicated by the terms "upper", "lower" and the like is based on the orientation or position relationship shown in the drawings, which is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation of the present invention. Unless otherwise clearly specified and limited, the terms "installed", "connected" and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be an indirect connection through an intermediate medium, or it can be a connection between the two elements. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0031] The terms "first", "second", etc. in the present invention are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present invention can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally of the same type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" means at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0032] Anomalous traffic refers to any unusual traffic pattern compared to normal network traffic patterns, which can be due to malicious behavior (i.e., malicious code) or legitimate application updates, changes in user behavior, or other non-malicious reasons.

[0033] The current abnormal traffic identification schemes can be mainly divided into the following categories: signature-based abnormal traffic detection, behavior-based abnormal traffic detection, statistics and machine learning-based abnormal traffic detection, deep learning-based abnormal traffic detection, and hybrid model-based abnormal traffic detection. Among them, the signature detection method is the most traditional abnormal traffic identification method, which matches the network traffic through predefined abnormal traffic patterns (i.e., "signatures"). When the traffic matches a known malicious signature, the system will identify the traffic as abnormal traffic; the behavior detection method identifies abnormal traffic by monitoring the behavioral characteristics of network traffic, and detects behaviors that deviate from the normal pattern based on the normal behavior model of the traffic, thereby identifying potential abnormal traffic; the statistics and machine learning methods analyze various characteristics of network traffic, build user behavior models or attack models, and thus identify abnormal traffic; abnormal traffic detection based on deep learning can automatically extract features from raw data and identify abnormal traffic through training models; abnormal traffic detection based on hybrid models can comprehensively play their respective advantages through the cooperation of different models to improve the ability to identify abnormal traffic.

[0034] Signature-based abnormal traffic detection methods can only match network traffic through predefined abnormal traffic patterns (i.e., "signatures"). Signature detection methods are powerless against new, undefined attacks, and require continuous updating of signature libraries to cope with new attack methods, which consumes a lot of manpower and time costs.

[0035] The behavior-based abnormal traffic detection method needs to identify abnormal traffic by monitoring the behavioral characteristics of network traffic. However, in a network environment, normal behavior patterns may change, leading to false alarms. In addition, in-depth modeling of normal traffic patterns is required, and it is difficult to cope with changing attack methods.

[0036] The effectiveness of abnormal traffic detection methods based on statistics and machine learning depends largely on the quality of training data and requires a large amount of labeled data for training. In the case of insufficient training data, the model is prone to a high false alarm rate.

[0037] Abnormal traffic detection methods based on deep learning usually require a lot of computing resources, especially when the amount of network data is large, the training process is complicated, and the time and computing power overhead are large. On the other hand, deep learning models are generally black box models, and it is difficult to explain the specific decision-making process.

[0038] The design and deployment of hybrid model-based abnormal traffic detection methods are usually complex and require in-depth design of the combination of different methods. Since multiple detection methods are involved, for complex and changing network environments, the detection methods may need to be regularly updated and adjusted, resulting in high maintenance costs.

[0039] The abnormal traffic identification method in the related art cannot effectively identify abnormal traffic in the face of complex and changing network environments and changing defense bypass strategies when there is a lack of external intelligence support. Therefore, it can be seen that the abnormal traffic identification method in the related art has the technical problem of being unable to accurately identify abnormal traffic.

[0040] In order to at least solve some of the above problems, the following Figure 1-Figure 4 The abnormal traffic identification method, device, electronic device and storage medium provided by the present invention are described.

[0041] The abnormal traffic identification method provided in this embodiment can be applied to the scenario of identifying the traffic to be identified and determining whether it is abnormal traffic. The abnormal traffic identification method in this embodiment can be executed by a server.

[0042] Figure 1 FIG. 1 is a flow chart of the abnormal traffic identification method provided by the present invention. Figure 1 As shown, including but not limited to the following steps:

[0043] Step 101: obtain multiple feature vectors of traffic to be identified.

[0044] In this embodiment, traffic generally refers to data transmission activities in a network, which includes all data packets and information transmitted through the network; traffic may include the following types:

[0045] Normal traffic: Traffic generated by normal user activities, such as web browsing, email sending, file downloading, etc.

[0046] Abnormal traffic: Traffic that is inconsistent with normal traffic patterns and may contain malicious behavior or system failures.

[0047] Malicious traffic: Malicious traffic is a type of abnormal traffic, also called malicious code. Malicious traffic is traffic generated by malicious behavior, such as network attacks, malware propagation, spam sending, etc.

[0048] The traffic to be identified in this embodiment is the traffic waiting to be identified. The traffic to be identified includes multiple features, including but not limited to: source IP (Internet Protocol), destination IP, port number, protocol, data packet size, connection duration, request type, and data packet interval time. Here, it is necessary to obtain multiple feature vectors corresponding to each of the multiple features of the traffic to be identified.

[0049] Step 102, input multiple feature vectors into the trained long short-term memory network to obtain the hidden state vector output by the trained long short-term memory network.

[0050] The Long Short-Term Memory Network (LSTM) is a special recurrent neural network. In this embodiment, the LSTM network is a trained network that can capture time series features in multiple feature vectors, thereby effectively identifying dynamic changes in normal traffic patterns.

[0051] Specifically, multiple feature vectors can be used as inputs of the LSTM network, and the LSTM neural network can be used to predict the features of the next time step. Considering that different features may have different effects on the prediction accuracy, different weights can be assigned to each feature.

[0052] In this embodiment, the hidden state vector contains the LSTM network's accumulated memory of the input feature vector, which can capture important information in the feature vector; the hidden state vector contains the context information of the current time step, which can be used to predict the output of the next time step.

[0053] Step 103, input the hidden state vector to the trained autoencoder to obtain a reconstructed vector output by the trained autoencoder.

[0054] In this embodiment, the autoencoder includes an encoder and a decoder. The encoder part gradually compresses the latent state vector into a low-dimensional representation through multiple hidden layers and extracts the main features of the latent state vector; the decoder gradually reconstructs the input data through another hidden layer and outputs a reconstruction result that is as similar as possible to the original input, that is, a reconstructed vector.

[0055] Step 104, when the reconstruction error value between the hidden state vector and the reconstruction vector is greater than the error threshold, marking the traffic to be identified as abnormal traffic;

[0056] The error threshold is updated by the following steps:

[0057] Obtain the current error average of the reconstruction error values ​​of multiple normal flows in the current period;

[0058] The error threshold is updated according to the current error average value to obtain an updated error threshold, wherein the updated error threshold is applied to the next period of the current period.

[0059] Since abnormal traffic usually exhibits patterns different from normal traffic, such as abnormal data packet size, abnormal connection duration, etc., it is difficult for the autoencoder to generate a reconstruction result similar to the original input for abnormal traffic, resulting in a large reconstruction error; therefore, in this embodiment, when the reconstruction error value between the hidden state vector and the reconstruction vector is greater than the error threshold, the traffic to be identified is marked as abnormal traffic.

[0060] At the same time, as the network environment and attack methods are updated, the fixed error threshold cannot adapt to the new environment. Therefore, the error threshold can be updated based on the current error average value.

[0061] Through the embodiments provided by the present application, multiple feature vectors of the traffic to be identified are obtained; the multiple feature vectors are input into a trained long short-term memory network to obtain a hidden state vector output by the trained long short-term memory network; the hidden state vector is input into a trained autoencoder to obtain a reconstruction vector output by the trained autoencoder; when the reconstruction error value between the hidden state vector and the reconstruction vector is greater than an error threshold, the traffic to be identified is marked as abnormal traffic; wherein the error threshold is updated by the following steps: obtaining a current error average of reconstruction error values ​​of multiple normal traffic in the current time period; updating the error threshold according to the current error average to obtain an updated error threshold, wherein the updated error threshold is applied to the next time period of the current time period; the abnormal traffic identification method in the related art is solved, and the technical problem that the abnormal traffic cannot be accurately identified is solved, thereby improving the accuracy of abnormal traffic identification.

[0062] As an optional solution, a current error average of reconstruction error values ​​of multiple normal flows in a current period is obtained, including:

[0063] S11, classifying multiple identified flows in the current time period by using a density-based spatial clustering algorithm with noise to obtain multiple normal flows;

[0064] S12, calculating an average value of reconstruction error values ​​of multiple normal flows to obtain a current error average value.

[0065] Density-Based Spatial Clustering of Applications with Noise (DBSCAN) is a representative density-based clustering algorithm that can define a cluster as the largest set of density-connected points, thereby dividing areas with sufficiently high density into clusters. It can also discover clusters of arbitrary shapes in a noisy spatial database and is highly robust to noise points.

[0066] In this embodiment, the DBSCAN algorithm is used to filter and separate abnormal points, that is, based on the DBSCAN algorithm, the abnormal flows in the multiple identified flows in the current time period are eliminated to obtain multiple normal flows in the current time period.

[0067] Furthermore, an average value of the reconstruction error values ​​of a plurality of normal flows is calculated to obtain a current error average value.

[0068] Through this embodiment, multiple normal flows in the current time period can be accurately determined, and then the current error average value can be determined, thereby improving the reliability and stability of the abnormal flow identification method of this embodiment.

[0069] As an optional solution, the error threshold is updated according to the current error average value to obtain an updated error threshold, including:

[0070] S21, the updated error threshold is determined by the following formula:

[0071] ;

[0072] in, is the updated error threshold, is the error threshold, The value range is The adjustment factor, is the current error average.

[0073] In this embodiment, The error threshold for the current period is used as a baseline to help evaluate whether the current error threshold needs to be adjusted; It is the error threshold of the next period of the current period, which is used for subsequent abnormal traffic detection and determines which traffic will be marked as abnormal traffic; It is the current error average value, reflecting the normal characteristics of the traffic in the current period. The error threshold is dynamically adjusted based on the reconstruction error of the actual traffic.

[0074] Understandably, by and Compare and adjust the coefficient , to achieve dynamic adjustment of the error threshold; when Greater than When , it indicates that the detected traffic shows more abnormal characteristics, will increase; when Less than When , it indicates that the current traffic is tending to normal characteristics. Will decrease.

[0075] Through this embodiment, by flexibly and dynamically adjusting the error threshold, the abnormal traffic identification method of this embodiment can adapt itself according to the changes in real-time traffic, thereby improving the reliability and stability of the abnormal traffic identification method.

[0076] As an optional solution, the trained long short-term memory network is trained by the following steps:

[0077] S31, obtaining a first sample traffic data set;

[0078] S32, iteratively perform the following steps until the eigenvalue error reaches a preset value, and obtain the trained long short-term memory network:

[0079] Inputting the first sample traffic data set into the long short-term memory network to obtain a plurality of predicted feature values ​​output by the long short-term memory network;

[0080] Calculate the eigenvalue error between the actual eigenvalue and the predicted eigenvalue of the sample flow through a first loss function;

[0081] Determine the gradient of the long short-term memory network based on the eigenvalue error;

[0082] The parameters of the long short-term memory network are updated by a preset gradient descent algorithm to obtain an updated long short-term memory network;

[0083] Among them, the first loss function is: , is the number of sample flows in the first sample flow data set, is the number of features in the sample flow, For the The sample The true eigenvalue of the feature, Output the first The sample The predicted feature value of features, For the The weight of a feature.

[0084] In this embodiment, the main purpose of using the LSTM neural network is to capture the time series characteristics in the network traffic, so as to effectively identify the dynamic changes of the normal traffic pattern; the standardized network traffic feature data is used as the input of the neural network, and the LSTM neural network is used to predict the characteristics of the time step at the next moment; considering that different characteristics of network traffic may have different effects on the prediction accuracy, different weights are assigned to each feature. In the loss function, important features will obtain greater weights, so that they will receive more attention in the optimization process.

[0085] Through this embodiment, the trained long short-term memory network can be accurately determined, thereby improving the reliability and stability of the abnormal traffic identification method of this embodiment.

[0086] As an optional solution, the trained autoencoder includes a discriminator, and the trained autoencoder is trained by the following steps:

[0087] S41, obtaining a second sample traffic data set, wherein the samples in the second sample traffic data set are sample vectors of normal traffic;

[0088] S42, iteratively perform the following steps until the discriminator cannot distinguish between the sample vector and the reconstructed sample vector, and obtain the trained autoencoder:

[0089] Inputting the second sample traffic data set into the autoencoder to obtain a plurality of reconstructed sample vectors output by the autoencoder;

[0090] Calculate the vector error between the sample vector and the reconstructed sample vector by a second loss function;

[0091] Based on the vector error, determine the gradient of the autoencoder;

[0092] The parameters of the autoencoder are updated by a preset gradient descent algorithm to obtain an updated autoencoder;

[0093] Among them, the second loss function is:

[0094] ;

[0095] ;

[0096] ;

[0097] ;

[0098] To rebuild the losses, To combat losses, is the regularization term, and is the coefficient, the quantity is the number of samples of the second sample traffic data set, is the sample vector, To reconstruct the sample vector, is the discriminator, Reconstruct the flow for the discriminator pair The probability of output, is the number of parameters of the autoencoder, is the weight parameter of the autoencoder.

[0099] It should be noted that the samples in the second sample traffic data set in this embodiment are sample vectors of normal traffic, that is, the autoencoder is trained on normal traffic samples.

[0100] In this embodiment, in order to improve the robustness of the model, an adversarial sample generation and identification mechanism can be adopted, and an adversarial training method can be used to generate adversarial samples and train the autoencoder. The overall process of model training is: after the sample vector is reduced in dimension by the encoder of the autoencoder, the decoder uses the reduced feature vector to generate a reconstructed sample vector with the same dimension as the original network traffic feature vector. The training goal is to make the error between the reconstructed sample vector generated by the decoder and the sample vector as small as possible and to deceive the judgment of the discriminator.

[0101] It should be noted that the second loss function consists of three parts, namely reconstruction loss, adversarial loss and regularization term; reconstruction loss is used to measure the ability of the autoencoder to reconstruct the input data, adversarial loss is used to improve the robustness of the model, and regularization term is used to control the complexity of the model and prevent overfitting.

[0102] Through this embodiment, the trained autoencoder can be accurately determined, thereby improving the reliability and stability of the abnormal traffic identification method of this embodiment.

[0103] As an optional solution, before obtaining multiple feature vectors of the traffic to be identified, the method further includes:

[0104] S51, obtaining a plurality of initial feature vectors of the traffic to be identified, and obtaining a feature vector data set;

[0105] S52, calculating the mean and standard deviation of the feature vector data set;

[0106] S53, subtracting the mean from each of the multiple initial eigenvectors and dividing the result by the standard deviation to obtain multiple eigenvectors.

[0107] In this embodiment, since the characteristic values ​​of the traffic to be identified vary greatly, the model may over-learn certain features and under-learn other features, thereby affecting the generalization ability of the model. Here, a standardization method is used to convert the characteristic values ​​to the same scale, and each characteristic value is subtracted from its mean and divided by its standard deviation to convert the data into a standard normal distribution, thereby eliminating the dimensional differences between different features and improving the performance of the model. Here, the model refers to models such as trained long short-term memory networks and trained autoencoders.

[0108] Through this embodiment, the dimensional differences between different features can be eliminated, thereby improving the reliability and stability of the abnormal traffic identification method of this embodiment.

[0109] Figure 2 is a schematic diagram of the abnormal traffic identification method provided by the present invention, see Figure 2 The abnormal traffic identification method of the embodiment of the present application is described below in conjunction with an optional example. In this optional example, the following steps may be included:

[0110] Get multiple feature vectors of the traffic to be identified; the traffic to be identified corresponds to Figure 2 The original network traffic in the network contains multiple features, such as source IP, destination IP, port number, protocol and other features; for multiple feature vectors corresponding to multiple features, the multiple feature vectors need to be standardized.

[0111] Multiple feature vectors are input into the trained LSTM network to extract network traffic time series features and obtain the hidden state vector output by the LSTM network.

[0112] The hidden state vector is input into the trained autoencoder, which includes a discriminator, an encoder and a decoder; the reconstructed vector output by the trained autoencoder is obtained; the encoder part gradually compresses the input data into a low-dimensional representation through multiple hidden layers and extracts the main features of the data; the decoder part gradually reconstructs the input data through another hidden layer and outputs a reconstruction result that is as similar as possible to the original input. In order to improve the robustness of the model, the generation and identification mechanism of adversarial samples can be adopted, and the adversarial training method can be used to generate adversarial samples and train the autoencoder. The overall process of model training is that the original network traffic feature vector is reduced in dimension by the encoder of the autoencoder, and the decoder uses the reduced feature vector to generate the same dimension as the original network traffic feature vector. The training goal is that the error between the feature vector generated by the decoder and the original network traffic feature vector is as small as possible and can deceive the judgment of the discriminator.

[0113] When the reconstruction error value between the hidden state vector and the reconstruction vector is greater than the error threshold, the traffic to be identified is marked as abnormal traffic.

[0114] Finally, the detected abnormal behaviors are clustered and classified through unsupervised learning (based on the DBSCAN algorithm), and the abnormal behavior model is continuously adjusted based on system feedback; the error threshold is dynamically updated based on historical detection conditions to increase the ability of self-adjustment to cope with uncertain attack patterns.

[0115] This embodiment provides an abnormal traffic identification method, and the system mainly includes three parts, namely, an adaptive learning normal behavior pattern recognition module, an abnormal deviation detection module, and a label-free learning and self-adjustment module:

[0116] Adaptive learning normal behavior pattern recognition module: Through the autoencoder, LSTM or generative adversarial network (GAN) model in deep learning, the system will learn the normal network behavior pattern over a period of time. The system can adapt to the normal traffic characteristics that change over time (such as high-frequency access patterns and periodic peaks within a certain period of time) and continuously update according to historical patterns.

[0117] Abnormal deviation detection module: In actual operation, the system compares real-time traffic with normal behavior patterns through automatic feature extraction and calculates the degree of deviation. When a traffic pattern deviates significantly from the learned normal behavior (such as frequent lateral traffic, large amounts of data upload, etc.), the system will automatically mark it as abnormal.

[0118] Unlabeled learning and self-adjustment: The module clusters and classifies detected abnormal behaviors through unsupervised learning, and continuously adjusts the abnormal behavior model based on system feedback. The scoring criteria are adjusted based on historical abnormal patterns, and the ability to self-adjust is increased to cope with uncertain attack patterns.

[0119] It can be understood that the abnormal traffic identification method provided by the present application, by introducing an adaptive abnormal behavior learning module, relies on internal traffic characteristics and behavior patterns to update and dynamically adjust the traffic identification model in real time, and capture malicious traffic behaviors in the network, and has the following advantages: no external data dependence: the system is completely based on internal traffic data and behavior patterns, and therefore does not require the support of external threat intelligence sources; new threat detection capabilities: the adaptive learning module has the ability of unsupervised learning and automatic adjustment, and can identify unknown threats without predefined attack patterns; reduce false alarm rate: the system will dynamically adjust the "normal" traffic standard based on the time series, thereby reducing the misjudgment of sudden normal traffic; strong adaptability: the system can be continuously optimized and can adapt to dynamic changes in the network environment.

[0120] Figure 3 is a schematic diagram of the structure of the abnormal flow identification device provided by the present invention, such as Figure 3 As shown, including but not limited to the following modules:

[0121] An acquisition module 301 is used to acquire multiple feature vectors of traffic to be identified;

[0122] A first execution module 302 is used to input a plurality of feature vectors into the trained long short-term memory network to obtain a hidden state vector output by the trained long short-term memory network;

[0123] The second execution module 303 is used to input the hidden state vector into the trained autoencoder to obtain a reconstructed vector output by the trained autoencoder;

[0124] A marking module 304 is used to mark the traffic to be identified as abnormal traffic when the reconstruction error value between the hidden state vector and the reconstruction vector is greater than an error threshold;

[0125] The error threshold is updated by the following steps:

[0126] Obtain the current error average of the reconstruction error values ​​of multiple normal flows in the current period;

[0127] The error threshold is updated according to the current error average value to obtain an updated error threshold, wherein the updated error threshold is applied to the next period of the current period.

[0128] Through the embodiments of the present application, multiple feature vectors of the traffic to be identified are obtained; the multiple feature vectors are input into the trained long short-term memory network to obtain the hidden state vector output by the trained long short-term memory network; the hidden state vector is input into the trained autoencoder to obtain the reconstruction vector output by the trained autoencoder; when the reconstruction error value between the hidden state vector and the reconstruction vector is greater than the error threshold, the traffic to be identified is marked as abnormal traffic; wherein the error threshold is updated by the following steps: obtaining the current error average of the reconstruction error values ​​of multiple normal traffic in the current time period; updating the error threshold according to the current error average to obtain the updated error threshold, wherein the updated error threshold is applied to the next time period of the current time period; the abnormal traffic identification method in the related art is solved, and the technical problem that the abnormal traffic cannot be accurately identified is solved, thereby improving the accuracy of abnormal traffic identification.

[0129] It should be noted that the abnormal traffic flow identification device provided by the present invention can execute the abnormal traffic flow identification method of any of the above embodiments during specific operation, which will not be elaborated in this embodiment.

[0130] Figure 4 is a schematic diagram of the structure of the electronic device provided by the present invention, such as Figure 4 As shown, the electronic device may include: a processor 410, a communication interface 420, a memory 430 and a communication bus 440, wherein the processor 410, the communication interface 420 and the memory 430 communicate with each other through the communication bus 440. The processor 410 may call the logic instructions in the memory 430 to execute the abnormal traffic identification method, which includes: obtaining multiple feature vectors of the traffic to be identified; inputting the multiple feature vectors into the trained long short-term memory network to obtain the hidden state vector output by the trained long short-term memory network; inputting the hidden state vector into the trained autoencoder to obtain the reconstruction vector output by the trained autoencoder; when the reconstruction error value between the hidden state vector and the reconstruction vector is greater than the error threshold, marking the traffic to be identified as abnormal traffic; wherein the error threshold is updated by the following steps: obtaining the current error average value of the reconstruction error values ​​of multiple normal traffic in the current period; updating the error threshold according to the current error average value to obtain the updated error threshold, wherein the updated error threshold is applied to the next period of the current period.

[0131] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0132] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the abnormal traffic identification method provided by the above-mentioned embodiments, and the method includes: obtaining multiple feature vectors of the traffic to be identified; inputting the multiple feature vectors into a trained long short-term memory network to obtain a hidden state vector output by the trained long short-term memory network; inputting the hidden state vector into a trained autoencoder to obtain a reconstruction vector output by the trained autoencoder; when the reconstruction error value between the hidden state vector and the reconstruction vector is greater than an error threshold, marking the traffic to be identified as abnormal traffic; wherein the error threshold is updated by the following steps: obtaining the current error average of the reconstruction error values ​​of multiple normal flows in the current time period; updating the error threshold according to the current error average to obtain an updated error threshold, wherein the updated error threshold is applied to the next time period of the current time period.

[0133] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the abnormal traffic identification method provided by the above-mentioned embodiments, the method comprising: obtaining multiple feature vectors of the traffic to be identified; inputting the multiple feature vectors into a trained long short-term memory network to obtain a hidden state vector output by the trained long short-term memory network; inputting the hidden state vector into a trained autoencoder to obtain a reconstruction vector output by the trained autoencoder; when the reconstruction error value between the hidden state vector and the reconstruction vector is greater than an error threshold, marking the traffic to be identified as abnormal traffic; wherein the error threshold is updated by the following steps: obtaining a current error average of reconstruction error values ​​of multiple normal traffic within the current time period; updating the error threshold according to the current error average to obtain an updated error threshold, wherein the updated error threshold is applied to the next time period of the current time period.

[0134] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0135] Through the description of the above implementation modes, those skilled in the art can clearly understand that each implementation mode can be implemented by means of software plus a necessary general hardware platform, or of course by hardware. Based on such an understanding, the above technical solution can essentially or in other words be embodied in the form of a software product that contributes to the prior art. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0136] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for identifying abnormal traffic, characterized in that: include: Obtain multiple feature vectors of traffic to be identified; Inputting the plurality of feature vectors into a trained long short-term memory network to obtain a hidden state vector output by the trained long short-term memory network; Inputting the hidden state vector into the trained autoencoder to obtain a reconstructed vector output by the trained autoencoder; When a reconstruction error value between the hidden state vector and the reconstruction vector is greater than an error threshold, marking the traffic to be identified as abnormal traffic; The error threshold is updated by the following steps: Obtain the current error average of the reconstruction error values ​​of multiple normal flows in the current period; updating the error threshold according to the current error average value to obtain an updated error threshold, wherein the updated error threshold is applied to a time period next to the current time period; The step of obtaining a current error average value of reconstruction error values ​​of a plurality of normal flows in a current period includes: Classifying the multiple identified flows in the current time period by a density-based spatial clustering algorithm with noise to obtain the multiple normal flows; Calculating an average of the reconstruction error values ​​of the plurality of normal flows to obtain the current error average value; The updating the error threshold according to the current error average value to obtain an updated error threshold includes: The updated error threshold is determined by the following formula: ； in, is the updated error threshold, is the error threshold, The value range is The adjustment factor, is the current error average.

2. The abnormal traffic identification method according to claim 1, characterized in that: The trained long short-term memory network is obtained by training in the following steps: Obtaining a first sample traffic data set; The following steps are iteratively performed until the eigenvalue error reaches a preset value, thereby obtaining the trained long short-term memory network: Inputting the first sample traffic data set into a long short-term memory network to obtain a plurality of predicted feature values ​​output by the long short-term memory network; Calculate the eigenvalue error between the actual eigenvalue and the predicted eigenvalue of the sample flow through a first loss function; Determining a gradient of the long short-term memory network based on the eigenvalue error; Updating the parameters of the long short-term memory network by a preset gradient descent algorithm to obtain an updated long short-term memory network; Among them, the first loss function is: , is the number of sample flows in the first sample flow data set, is the number of features in the sample flow, For the The sample The true eigenvalue of the feature, Output the first The sample The predicted feature value of features, For the The weight of a feature.

3. The abnormal traffic identification method according to claim 1, characterized in that: The trained autoencoder includes a discriminator, and the trained autoencoder is trained by the following steps: Acquire a second sample traffic data set, wherein the samples in the second sample traffic data set are sample vectors of normal traffic; The following steps are iteratively performed until the discriminator cannot distinguish between the sample vector and the reconstructed sample vector, thereby obtaining the trained autoencoder: Inputting the second sample traffic data set into an autoencoder to obtain a plurality of reconstructed sample vectors output by the autoencoder; Calculate the vector error between the sample vector and the reconstructed sample vector by a second loss function; Determining a gradient of the autoencoder based on the vector error; Updating the parameters of the autoencoder by a preset gradient descent algorithm to obtain an updated autoencoder; Among them, the second loss function is: ； ； ； ； To rebuild the losses, To combat losses, is the regularization term, and is the coefficient, the quantity is the number of samples of the second sample traffic data set, is the sample vector, To reconstruct the sample vector, is the discriminator, Reconstruct the flow for the discriminator pair The probability of output, is the number of parameters of the autoencoder, is the weight parameter of the autoencoder.

4. The abnormal traffic identification method according to any one of claims 1 to 3, characterized in that: Before obtaining a plurality of feature vectors of the traffic to be identified, the method further includes: Acquire multiple initial feature vectors of the traffic to be identified to obtain a feature vector data set; Calculating the mean and standard deviation of the feature vector data set; The multiple eigenvectors are obtained by respectively subtracting the mean from each of the multiple initial eigenvectors and dividing the result by the standard deviation.

5. An abnormal flow identification device, characterized in that: include: An acquisition module, used for acquiring multiple feature vectors of traffic to be identified; A first execution module is used to input the multiple feature vectors into the trained long short-term memory network to obtain a hidden state vector output by the trained long short-term memory network; A second execution module is used to input the hidden state vector into the trained autoencoder to obtain a reconstructed vector output by the trained autoencoder; A marking module, configured to mark the traffic to be identified as abnormal traffic when a reconstruction error value between the hidden state vector and the reconstruction vector is greater than an error threshold; The error threshold is updated by the following steps: Obtain the current error average of the reconstruction error values ​​of multiple normal flows in the current period; updating the error threshold according to the current error average value to obtain an updated error threshold, wherein the updated error threshold is applied to a time period next to the current time period; The step of obtaining a current error average value of reconstruction error values ​​of a plurality of normal flows in a current period includes: Classifying the multiple identified flows in the current time period by a density-based spatial clustering algorithm with noise to obtain the multiple normal flows; Calculating an average of the reconstruction error values ​​of the plurality of normal flows to obtain the current error average value; The updating the error threshold according to the current error average value to obtain an updated error threshold includes: The updated error threshold is determined by the following formula: ； in, is the updated error threshold, is the error threshold, The value range is The adjustment factor, is the current error average.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the abnormal traffic identification method according to any one of claims 1 to 4 is implemented.

7. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the abnormal traffic identification method according to any one of claims 1 to 4 is implemented.

8. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the abnormal traffic identification method according to any one of claims 1 to 4 is implemented.

Images