A network traffic anomaly detection method based on online continuous learning

Abstract

The present invention discloses a network traffic anomaly detection method based on online continuous learning, which uses an MLP neural network based on wavelet transform to detect network traffic anomalies in an online continuous learning manner, has continuous adaptive intelligent detection capabilities, efficient system performance, excellent detection effects, strong practicality, solves the model forgetting problem in traditional methods, balances real-time and accuracy, reduces resource consumption, improves system scalability, and sets a network traffic reconstruction model based on time series analysis theory and wavelet transform, which significantly improves computational efficiency while maintaining a high sensitivity to sudden anomalies. After using Haar wavelet to perform discrete wavelet transform on network traffic, only a single-layer MLP network is used to learn the network traffic pattern. This lightweight design greatly reduces resource occupation, enables the system to be flexibly deployed on various network devices, and effectively supports anomaly detection tasks in large-scale network environments.

Description

Technical Field

[0001] The invention belongs to the technical field of network flow detection, and in particular, is a network flow anomaly detection method based on online continuous learning. Background Art

[0002] At present, the development of modern electronic technologies such as cloud server clusters, IoT terminal devices, 4 / 5G communications, etc. is inseparable from the large-scale application of the network. The communication traffic between electronic devices reflects the health of the network environment. Abnormal traffic, such as abnormal message information or key performance indicator (KPI) curves, may indicate that the network device is under network attack or that there is a problem with the device operation. Network traffic anomaly detection refers to the analysis of messages or device KPIs in the network environment, the detection of abnormal traffic and the alarm to the user or manufacturer, so as to further analyze the abnormal situation and find out the cause, and improve the security of the network environment.

[0003] Multivariate time series analysis is an important means to achieve network traffic anomaly detection, and it is also one of the best detection methods currently. By extracting features such as message address, port number, and message length, they are arranged in chronological order to form time series data and processed by the time series model. The current time series model mainly reduces the non-stationarity of time series data by reconstructing the attention mechanism, extracting frequency domain features, and fusing features in time and frequency, helping to model time series data and then perform anomaly detection. However, the above methods require complex deep learning models to process data. During training and inference, there are large requirements for storage resources, computing power resources, etc., which are difficult to deploy on devices with high resource requirements. Complex inference calculations also lead to slower inference speeds.

[0004] Existing network anomaly detection models based on multivariate time series face the following problems:

[0005] (1) The test results have large errors and lack practical value;

[0006] (2) High deployment cost, high resource consumption, and limited application scenarios;

[0007] (3) Lack of continuous learning ability and difficulty in adapting to the dynamically changing network environment;

[0008] (4) There is a lack of actual application data. Only public data sets are used for model verification, and the performance of the model in actual scenarios is difficult to verify.

[0009] The above four problems make it difficult for existing network anomaly detection models to meet actual application needs and be applied in the industry. Summary of the invention

[0010] In order to overcome the problems existing in the prior art, the present invention provides a network traffic anomaly detection method based on online continuous learning, which is achieved through the following technical solutions:

[0011] The present invention discloses a network traffic anomaly detection method based on online continuous learning, comprising:

[0012] 1). Set up a network traffic reconstruction model based on time series analysis theory and wavelet transform;

[0013] 2). Set up a local data buffer that can store 500-2000 current traffic data prototypes and a global data buffer that can store 500-2000 traffic data prototypes in all tasks;

[0014] 3). Obtain a normal network traffic data stream with at least 20,000 timestamps, and store the traffic data in a local data buffer in the time sequence of the traffic data;

[0015] 4). According to the content of the local data buffer, extract the current traffic data prototype and store it in the global data buffer;

[0016] 5). Sample 8-16 local prototypes and global prototypes from the local data buffer and the global data buffer respectively;

[0017] 6). Get 8-16 current network flows from the normal network flow data stream;

[0018] 7). Use 8-16 current network traffic, local prototypes and global prototypes to train the reconstruction model based on the Bayesian uncertainty principle to obtain a trained reconstruction model;

[0019] 8). Calculate the reconstruction error as the anomaly score through the trained reconstruction model;

[0020] 9) Network traffic with anomaly scores exceeding the preset threshold is considered abnormal traffic, otherwise it is considered normal traffic;

[0021] 10). Whenever the method is deployed on a new network device, repeat steps 3)-9).

[0022] As a further improvement, the present invention sets up a local data buffer capable of storing 500-2000 current traffic data prototypes and a global data buffer capable of storing 500-2000 traffic data prototypes in all tasks, specifically: initializing the local data buffer ML and the global data buffer MG to a size of 500 to 2000.

[0023] As a further improvement, the present invention extracts the prototype of the current task network traffic according to the content of the local data buffer and stores it in the global data buffer, specifically:

[0024] When the local data buffer ML space is full, clustering theory is used to extract global prototypes from ML:

[0025]

[0026] in is the center of cluster Ci, K is the number of clusters, K is traversed from 10 to 30, and the silhouette score is used to quantify the clustering results, that is, the quality of the extracted prototype is calculated, and the cluster center of the clustering result with the largest silhouette score is selected and stored.

[0027] As a further improvement, the present invention provides a network traffic reconstruction model based on time series analysis theory and wavelet transform, specifically:

[0028] The network traffic features are intercepted according to the length of the time window size W, recorded as x, and x is reversibly normalized and transformed into a matrix x with a mean of 0 and a variance of 1;

[0029] Convert x from the time domain to the wavelet domain by discrete wavelet transform DWT:

[0030] ;

[0031] Where cD is the detail component of network traffic in the wavelet domain, and cA is the estimated component of network traffic in the wavelet domain. The detail component cD and the estimated component cA of network traffic are transformed into cD' and cA' through a single-layer linear transformation layer:

[0032]

[0033] in , , and is a trainable parameter;

[0034] cD' and cA' are restored from the wavelet domain to the time domain data through inverse wavelet transform, and the inverse reversible normalization is performed to restore the data to x'. The reconstruction error between x and x' is calculated, and the model parameters are updated according to the reconstruction error.

[0035] As a further improvement, the present invention uses the current network traffic, local prototypes and global prototypes to train the reconstruction model based on the Bayesian uncertainty principle to obtain a trained reconstruction model, specifically: for the reconstruction model M and the training data x, use L d Calculate the loss optimization model:

[0036]

[0037] Based on Bayesian uncertainty theory, the following loss function L is used to update the network anomaly detection model:

[0038]

[0039] in, , and They are from the training set, local prototype buffer and global prototype buffer respectively. , and are learnable parameters.

[0040] As a further improvement, the repeated steps 3)-9) described in the present invention are specifically: when the present invention is deployed on a new network device, at least 20,000 timestamped network traffic data streams are collected, the local data buffer is cleared and the global data buffer is retained, and the above-mentioned model training steps are re-executed.

[0041] The beneficial effects of the present invention are as follows:

[0042] (1) The present invention adopts an online continuous learning method and carries out an MLP neural network based on wavelet transform to detect anomalies in network traffic. It has continuous adaptive intelligent detection capability, efficient system performance, excellent detection effect, strong practicality, solves the model forgetting problem in traditional methods, balances real-time performance and accuracy, reduces resource consumption, and improves system scalability.

[0043] (2) The present invention sets up a reconstruction model of network traffic based on time series analysis theory and wavelet transform, realizes data dimension reduction through multi-scale analysis, significantly improves computational efficiency while maintaining high sensitivity to sudden anomalies. After using Haar wavelet to perform discrete wavelet transform on network traffic, only a single-layer MLP network is used to learn the network traffic pattern. This lightweight design greatly reduces resource usage, enables the system to be flexibly deployed on various network devices, and effectively supports anomaly detection tasks in large-scale network environments.

[0044] (3) The present invention sets up a local data buffer that can store 500-2000 current traffic data prototypes and a global data buffer that can store 500-2000 traffic data prototypes in all tasks, which effectively solves the model forgetting problem in continuous learning. This design not only significantly reduces storage overhead, but also enables the system to quickly adapt to new network attacks while maintaining historical knowledge, successfully achieving a balance between real-time response and long-term memory.

[0045] (4) The present invention samples 8-16 local prototypes and global prototypes from the local data buffer and the global data buffer respectively for model updating, which significantly reduces the computational overhead while ensuring the quality of training samples, thereby achieving high efficiency and high quality of the model updating process.

[0046] (5) The present invention uses the current network traffic, local prototypes and global prototypes to train the reconstruction model based on the Bayesian uncertainty principle, and realizes the dynamic update and fusion of knowledge through prior distribution, likelihood function and posterior distribution. The system encodes historical and current knowledge into the prior probability of the global prototype and the likelihood probability of the local prototype, respectively, and realizes the intelligent adjustment of parameters through probability weighting. This method not only has strong robustness, but also can accurately quantify the uncertainty of the prediction, providing a reliable explanation basis for decision-making.

[0047] (6) Whenever the present invention is deployed on a new network device, automatic model retraining in the new device environment is achieved through online continuous learning, which quickly adapts to the feature differences of different network environments, greatly improving the portability and versatility of the system.

[0048] (7) This method is deployed in real vehicle CAN bus message detection. The detection speed is fast, and a CAN bus message frame can be detected in an average of 0.35ms. The detection accuracy is also high. The performance of this method in actual scenarios has been verified in practice, and the verification results are reliable.

[0049] (8) The prototypes are extracted from the network traffic using a clustering method and stored. The Bayesian uncertainty principle is then used to balance the loss functions of the training data, local prototypes, and global prototypes during online continuous learning. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 It is a training flow chart of the network traffic anomaly detection method based on online continuous learning;

[0051] Figure 2 This is a diagram of a network anomaly detection model based on wavelet transform. DETAILED DESCRIPTION

[0052] The invention discloses a network traffic anomaly detection method based on online continuous learning.

[0053] In view of the main defects of the current scheme, the present invention proposes the following two designs for improvement: (1) Designing a network traffic anomaly detection model based on wavelet transform and shallow MLP network to achieve lightweight, fast and accurate network traffic anomaly detection; (2) Adopting a newly designed online continuous learning method based on prototype replay to enhance the model's continuous learning ability. Based on the above two designs, the present invention can be divided into two mutually coupled parts: online continuous learning based on prototype replay and network anomaly detection model, Figure 1 It is a training flow chart of the network traffic anomaly detection method based on online continuous learning; Figure 2 This is a diagram of a network anomaly detection model based on wavelet transform.

[0054] The network anomaly detection module introduces reversible regularization to eliminate non-stationarity in traffic data, helping the model to better learn network traffic characteristics. Then, the regularized data is converted from the time domain to the wavelet domain using discrete wavelet transform. The wavelet domain combines the characteristics of network traffic in both the time domain and the frequency domain, and can provide more learnable information compared to the time domain features or frequency domain features alone. In addition, the wavelet transform performs multi-scale decomposition of network traffic, providing multi-scale feature information from global features to horizontal local features, vertical local features, etc., which improves the learning ability of the model and provides more accurate detection results.

[0055] In addition, the online continuous learning module based on prototype replay abandons the traditional experience replay (ER) method and extracts data prototypes for replay instead of directly replaying data instances (i.e., experience), thereby reducing the buffer size required for ER and improving learning efficiency.

[0056] The technical solution of the present invention is further described below through a specific embodiment: The network traffic anomaly detection method based on online continuous learning of the present invention specifically comprises the following steps:

[0057] 1. Set up a network traffic reconstruction model based on time series analysis theory and wavelet transform. The model consists of the following parts:

[0058] 1.1 Reversible Normalization. Calculate the input model data The average value mean( ) and standard deviation std( ), thus obtaining the normalized data :

[0059] .

[0060] 1.2 Discrete wavelet transform. Through discrete wavelet transform DWT Convert from the time domain to the wavelet domain:

[0061]

[0062] Where cD is the detail component of network traffic in the wavelet domain, and cA is the estimated component of network traffic in the wavelet domain.

[0063] 1.3 Linear transformation. The detailed component cD and the estimated component cA of the network traffic are obtained through a single-layer linear transformation layer. and cA :

[0064]

[0065] in , , and are trainable parameters.

[0066] 1.4 Inverse discrete wavelet transform. Through inverse discrete wavelet transform iDWT and Convert from wavelet domain to time domain:

[0067]

[0068] in is the flow data reconstructed after inverse wavelet transform, but it has not yet been restored to the shape of the original data. is the detail component of the network traffic in the wavelet domain after linear transformation, and cA' is the estimated component of the network traffic in the wavelet domain after linear transformation.

[0069] 1.5 Reverse normalization. Using the average value mean calculated in the first step ( ) and standard deviation std( )Will Inverse normalization restores the data shape:

[0070] = ×std( ) +mean( )

[0071] It is the reconstructed network traffic data.

[0072] 2. Set up a local data buffer that can store 500-2000 current traffic data prototypes and a global data buffer that can store 500-2000 traffic data prototypes in all tasks. The buffer is implemented using a bidirectional queue. When the local data buffer is full, extract the data prototype to the end of the global data buffer; when adding data to the global buffer but the global data buffer is full, remove the data at the head of the global data buffer.

[0073] 3. Obtain a normal network traffic data stream with at least 20,000 timestamps, and store the traffic data in a local data buffer in the time sequence of the traffic data;

[0074] 4. According to the content of the local data buffer, extract the current traffic data prototype and store it in the global data buffer. When the local data buffer space is full, use clustering theory to extract the global prototype from the local data buffer:

[0075]

[0076] in is the center of cluster Ci, K is the number of clusters, K is traversed from 10 to 30, and the silhouette score is used to quantify the clustering results, that is, the quality of the extracted prototype is calculated, and the cluster center of the clustering result with the largest silhouette score is selected and stored;

[0077] 5. Sample 8-16 local prototypes and global prototypes from the local data buffer and the global data buffer respectively;

[0078] 6. Get 8-16 current network flows from the normal network flow data stream;

[0079] 7. Use the current network traffic, local prototypes, and global prototypes to train the reconstruction model based on the Bayesian uncertainty principle to obtain a trained reconstruction model. For the reconstruction model M and training data x, use L d Calculate the loss optimization model:

[0080]

[0081] Based on Bayesian uncertainty theory, the following loss function L is used to update the network anomaly detection model:

[0082] in, , and They are from the training set, local prototype buffer and global prototype buffer respectively. , and are learnable parameters.

[0083] After calculating the loss function L, the Adam optimizer is used to perform gradient updates on the model parameters, and the learning rate of the optimizer is set to 0.0001.

[0084] 8. Calculate the reconstruction error as the anomaly score through the trained reconstruction model. After the reconstruction model is trained, it can be deployed on the network device. For the current traffic X of the network device, use the reconstruction model M to calculate the anomaly score:

[0085]

[0086] 9. Network traffic whose anomaly score exceeds the preset threshold is identified as abnormal traffic, otherwise it is normal traffic.

[0087] 10. Whenever the method is deployed on a new network device, repeat steps 3-9. When the present invention is deployed on a new network device, collect at least 20,000 timestamped network traffic data, clear the local data buffer and retain the global data buffer, and re-execute the above model training steps.

[0088] The present invention uses F1-scores, precision and recall to evaluate detection capabilities. The higher the F1-score, precision and recall, the stronger the network traffic anomaly detection capability. At the same time, floating point operations (FLOPs) and model parameters (Params) are used to evaluate the computational complexity and size of the model. The lighter the detection model, the faster the detection speed.

[0089] Table 1 shows the test results of this method on the public dataset.

[0090]

[0091] Table 1 shows that, on the spacecraft sensor datasets (SMAP and MSL) and server KPI datasets (SMD and PSM), the proposed method achieves the best results compared with other methods.

[0092] Table 2 shows the floating point operation size of this method on the public dataset

[0093]

[0094] Table 2 shows that, on the spacecraft sensor datasets (SMAP and MSL) and the server KPI datasets (SMD and PSM), the amount of computation required by the present invention for network traffic detection is minimal.

[0095] Table 3 shows the test results of this method when deployed on Tesla Model 3

[0096]

[0097] Table 3 shows that when the present invention is deployed on Tesla Model 3 for CAN bus message detection, the detection effect (F1 score) for four types of network attacks is greater than 97%, with extremely low false alarm rate and missed alarm rate. In addition, the average detection delay per frame is only 0.35ms, the detection is highly real-time, and has practical application value. It should be understood that the above description of the preferred embodiment is relatively detailed, and it cannot be regarded as a limitation on the scope of protection of the patent of the present invention. Under the enlightenment of the present invention, ordinary technicians in this field can also make substitutions or deformations without departing from the scope of protection of the claims of the present invention, which all fall within the scope of protection of the present invention. The scope of protection of the present invention shall be subject to the attached claims.

[0098] The above is only a preferred embodiment of the present invention. Although the present invention has disclosed the preferred embodiment as above, it is not intended to limit the present invention. Any technician familiar with the art can make many possible changes and modifications to the technical solution of the present invention by using the above disclosed methods and technical contents without departing from the scope of the technical solution of the present invention, or modify it into an equivalent embodiment of equivalent changes. Therefore, any simple modification, equivalent change and modification made to the above embodiments according to the technical essence of the present invention without departing from the content of the technical solution of the present invention still falls within the scope of protection of the technical solution of the present invention.

Claims

1. A network traffic anomaly detection method based on online continuous learning, characterized in that: include: 1). Set up a network traffic reconstruction model based on time series analysis theory and wavelet transform; 2). Set up a local data buffer that can store 500-2000 current traffic data prototypes and a global data buffer that can store 500-2000 traffic data prototypes in all tasks; 3). Obtain a normal network traffic data stream with at least 20,000 timestamps, and store the traffic data in a local data buffer in the time sequence of the traffic data; 4). According to the content of the local data buffer, extract the current traffic data prototype and store it in the global data buffer; 5). Sample 8-16 local prototypes and global prototypes from the local data buffer and the global data buffer respectively; 6). Get 8-16 current network flows from the normal network flow data stream; 7). Use 8-16 current network traffic, local prototypes and global prototypes to train the reconstruction model based on the Bayesian uncertainty principle to obtain a trained reconstruction model; 8). Calculate the reconstruction error as the anomaly score through the trained reconstruction model; 9) Network traffic with anomaly scores exceeding the preset threshold is considered abnormal traffic, otherwise it is considered normal traffic; 10). Whenever the method is deployed on a new network device, repeat steps 3)-9); The setting of a network traffic reconstruction model based on time series analysis theory and wavelet transform is specifically as follows: The network traffic features are intercepted according to the length of the time window size W, recorded as x, and x is reversibly normalized and transformed into a matrix x with a mean of 0 and a variance of 1; Convert x from the time domain to the wavelet domain by discrete wavelet transform DWT: cD,cA=DWT(x); Where cD is the detail component of network traffic in the wavelet domain, and cA is the estimated component of network traffic in the wavelet domain; the detail component cD and the estimated component cA of network traffic are obtained by a single-layer linear transformation layer to obtain cD' and cA' CD'=W1cD+B1, cA'=W2cA+B2; Among them, W1, W2, B1 and B2 are trainable parameters; cD' and cA' are restored from the wavelet domain to the time domain data through inverse wavelet transform, and the inverse reversible normalization is performed to restore the data to x', the reconstruction error between x and x' is calculated, and the model parameters are updated according to the reconstruction error; the reconstruction model is trained based on the Bayesian uncertainty principle using the current network traffic, local prototypes and global prototypes to obtain a trained reconstruction model, specifically: for the reconstruction model M and the training data x, use L d Calculate the loss optimization model: L a (x)=(x-M(x)) 2 ; Based on Bayesian uncertainty theory, the following loss function L is used to update the network anomaly detection model: Among them, B n , B L and B G are from the training set, the local prototype buffer and the global prototype buffer respectively, σ1, σ2 and σ3 are learnable parameters.

2. The network traffic anomaly detection method based on online continuous learning according to claim 1 is characterized in that: The setting of one local data buffer capable of storing 500-2000 current traffic data prototypes and one global data buffer capable of storing 500-2000 traffic data prototypes in all tasks is specifically as follows: initializing the size of the local data buffer ML and the global data buffer MG to 500 to 2000.

3. The network traffic anomaly detection method based on online continuous learning according to claim 1 is characterized in that: The above method extracts the prototype of the current task network traffic according to the content of the local data buffer and stores it in the global data buffer, specifically: When the local data buffer ML space is full, clustering theory is used to extract global prototypes from ML: where μ i is the center of cluster Ci, K is the number of clusters, K is traversed from 10 to 30, and the silhouette score is used to quantify the clustering results, that is, the quality of the extracted prototype is calculated, and the cluster center of the clustering result with the largest silhouette score is selected and stored.

4. The network traffic anomaly detection method based on online continuous learning according to claim 1, 2 or 3, characterized in that: Whenever the method is deployed on a new network device, steps 3)-9) are repeated, specifically: when the method is deployed on a new network device, at least 20,000 timestamped network traffic data streams are collected, the local data buffer is cleared and the global data buffer is retained, and the above model training steps are re-executed.

Images