Risk protocol identification method and system based on fractal particle optimization GAN sample

Abstract

The invention discloses a risk protocol identification method and system based on fractal particle optimization GAN samples, and the method is characterized in that the method comprises the steps: extracting attribute information from a network protocol, and constructing a to-be-identified sample of the network protocol based on a plurality of pieces of attribute information; inputting a to-be-identified sample into a generator of the GAN network for sample expansion and feature extraction to obtain a feature sample, wherein a neural network weight and bias used for feature extraction in the generator are constructed based on a fractal particle swarm model; a self-encoding network is trained by taking the minimum nearest neighbor distance as a principle, random dimension reduction is performed on the feature samples by using the self-encoding network, and dimension-reduced samples are generated; and calculating the momentum of the hidden layer weight in the extreme learning machine by using the feedback error and carrying out iterative updating on the hidden layer weight of the extreme learning machine so as to obtain a pre-trained extreme learning machine, taking the pre-trained extreme learning machine as a discriminator of the GAN network, inputting the dimension reduction sample into the discriminator of the GAN network, and identifying the risk protocol.

Description

Technical Field

[0001] The present invention relates to the field of power systems, and more specifically, to a risk protocol identification method and system based on fractal particle optimization GAN samples. Background Art

[0002] With the rapid development of Internet technology, the interaction of network protocol data is frequent and complex, and network security threats are increasing. In this context, effectively identifying and classifying potential risks in network protocols has become an urgent need.

[0003] The Chinese invention patent with application number CN202110998618.1 proposes a risk identification model training method and device, and a risk identification method and device, wherein the risk identification model training method includes: the server obtains a sample set, and the sample set includes multiple specified operation data as training samples; divides the sample set into multiple item sets, and determines the risk identification rules corresponding to the item set according to the specified operation data in each item set; obtains the risk identification results of each specified operation data in the verification set using the risk identification rules corresponding to each item set, wherein the verification set includes multiple specified operation data as verification samples; determines the frequent item sets in the multiple item sets according to the risk identification results, and returns to execute the step of obtaining the sample set; when the preset training stop condition is reached, determines the risk identification model based on the risk identification rules corresponding to each frequent item set, and sends the risk identification model to the target client. This solution can improve the efficiency of risk identification.

[0004] The Chinese invention patent with application number CN202410311471.8 proposes a risk detection, risk detection of insurance services and risk detection model training method, wherein the risk detection method comprises: obtaining the dialogue data generated by the target service; performing risk identification on the dialogue data to obtain the risk identification result; in the case where it is determined based on the risk identification result that the dialogue data has a risk, using the risk detection model to perform semantic detection on the dialogue data based on the first risk warning information to obtain the first risk detection result, wherein the first risk warning information includes the scenario knowledge of the first risk dialogue scenario, and the first risk dialogue scenario is a scenario with preset risk monitoring rules; based on the first risk detection result, the risk information of the target service is determined. On the basis of risk identification, semantic detection is further performed on the risk identification result, so as to achieve more in-depth and accurate risk detection and improve the accuracy of risk detection.

[0005] The Chinese invention patent with application number CN202410213880.4 proposes a risk level assessment method, device, equipment and storage medium for network users, which can be used in the field of Internet information interaction technology. By acquiring and analyzing network log data, the target website with a risk index higher than the preset risk index is determined. The target website and network log data can determine the access information of the target assessment user, thereby performing a risk level assessment on the target assessment user. The accuracy, coverage and timeliness of this method are all at a high level. Assessing the risk level of network users can help relevant institutions and financial institutions identify and protect network users and prevent citizens from losing their funds.

[0006] In the existing technology, the risk identification of network protocols mostly relies on traditional data processing methods and pattern recognition technologies. These methods often perform poorly when the data volume is large and the data type is complex, and it is difficult to adapt to the rapid changes in network security needs. In addition, traditional methods often face problems such as insufficient samples, insufficient feature extraction, and low classification accuracy when processing network protocol data. These problems limit the effectiveness of the network protocol risk identification system, making it difficult for the system to effectively prevent and respond to complex and changing network security threats in actual deployment.

[0007] With the development of technology, machine learning methods have gradually been involved in the identification and classification of network protocols. At present, the application methods include the following: K-Means (K means) and FCM (Fuzzy C-means) clustering algorithms using unsupervised learning methods; semi-supervised learning methods using SVM (Support Vector Machine), RF (Random Forest), GBT (Gradient Boosting Tree), etc.; supervised learning using DNN (Deep Neural Networks), CNN (Convolutional Neural Networks), RNN (Recurrent Neural Networks), etc. Among them, clustering algorithms are often used for monitoring abnormal data. Such models can accurately identify typical network attacks, but cannot identify complex attack methods and unknown network risks. Semi-supervised learning methods usually only learn attack patterns with simple features in TCP / IP packets, and are usually ineffective for new intrusion processes. Deep learning methods can comprehensively learn complex hierarchical feature representations in TCP / IP data packets and have the ability to analyze and distinguish historical information.

[0008] However, up to now, even deep learning models still have the problem of inaccurate protocol recognition. On the one hand, the lack of data samples still leads to the poor generalization ability of the trained model, and the model performance is prone to degradation in the face of diverse network environments. In the process of implementing abnormal classification and extraction of network protocols, the model lacks adaptability and robustness to new data, especially in a dynamically changing network environment, the classification accuracy of the model is easily affected.

[0009] On the other hand, network protocols contain a large amount of network risk information, so it is possible to extract different attributes and features from network protocols in various ways. Each different feature and multiple different feature combinations may correspond to a known or urgently discovered network risk. However, when existing feature extraction methods are applied to big data models with complex network structures, they often encounter the problem of gradient vanishing or gradient exploding. A large number of reasonably extracted protocol features cannot actually participate in the model training process, which limits the efficiency and effectiveness of model training.

[0010] Furthermore, for network protocols, a large number of features are inherently related, but also different from each other, which comprehensively characterize the true state of the network protocol. Therefore, when analyzing network protocols based on a large number of features, there are problems such as difficulty in ranking the importance of features and difficulty in selecting a large number of features. When processing high-dimensional data, traditional feature dimensionality reduction methods often have difficulty in effectively retaining key information of the data, resulting in the difficulty of network protocol features to have a high information utilization rate in practical applications. Information loss also leads to inaccurate model training results.

[0011] In view of the above problems, a new risk agreement identification method and system is urgently needed. Summary of the invention

[0012] In order to solve the shortcomings of the prior art, the present invention provides a risk protocol identification method and system based on fractal particle optimization GAN samples, which integrates the fractal particle swarm model, autoencoder network, and extreme learning machine model into the GAN network, supports the addressing of the neural network on any sample feature dimension in a random fractal manner, and identifies the risk protocol through the optimal particle position obtained by addressing.

[0013] The present invention adopts the following technical solution.

[0014] The first aspect of the present invention relates to a method for identifying risk protocols based on fractal particle optimized GAN samples, the method comprising the following steps: extracting attribute information from a network protocol, and constructing a sample to be identified of the network protocol based on multiple attribute information; inputting multiple samples to be identified into a generator of a GAN network for sample expansion and feature extraction to obtain feature samples, and the weights and biases of a neural network used for feature extraction in the generator of the GAN network are constructed based on a fractal particle swarm model; training an autoencoder network based on the principle of minimizing the nearest neighbor distance, and using the autoencoder network to perform random dimensionality reduction on feature samples, and generating reduced dimensionality samples; using feedback errors to calculate the momentum of hidden layer weights in an extreme learning machine and iteratively updating the hidden layer weights of the extreme learning machine, thereby obtaining a pre-trained extreme learning machine, using the pre-trained extreme learning machine as a discriminator of the GAN network, inputting the reduced dimensionality samples into the discriminator of the GAN network, and identifying risk protocols.

[0015] Preferably, attribute information is extracted from the network protocol, and a sample to be identified of the network protocol is constructed based on multiple attribute information, including: the attribute information includes the data packet length, protocol type, source IP address, destination IP address, source port number, destination port number, timestamp, load size, encryption flag, and operating system of the network protocol; the sample to be identified is a multidimensional vector, and each dimension in the multidimensional vector is directly or indirectly obtained based on the attribute information.

[0016] Preferably, the sample to be identified is a multidimensional vector, and each dimension in the multidimensional vector is obtained directly or indirectly based on attribute information, including: the multidimensional vector also includes a labeling dimension, and the labeling dimension divides the sample to be identified into different behavior types of three network protocols: normal behavior, potential risk behavior, and risky behavior through manual labeling.

[0017] Preferably, the weights and biases of the neural network used for feature extraction in the generator of the GAN network are constructed based on a fractal particle swarm model, including: in the fractal particle swarm model, the loss function of the model is adjusted using the fitness function of the initial weights and biases in the neural network used for feature extraction; iteratively implementing dynamic migration of the initial weights and biases with the goal of making the loss function sufficiently small, and generating weights and biases after migration based on the optimal position after the dynamic migration.

[0018] Preferably, the dynamic migration of initial weights and biases is iteratively implemented with the goal of making the loss function sufficiently small, and the weights and biases after the migration are generated based on the optimal position after the dynamic migration, including: using the Softmax function to obtain the first fitness of the current particle in the initial weights and biases; using the sum of the loss gradients of the loss function of the model in the current particle and in all directions to construct the second fitness of the current particle; weighted summing the first fitness and the second fitness to obtain the fitness function of the current particle; using the first fitness, fitness function and particle fractal dimension in the current time period to provide the regularization strength of particle weights for the fractal particle swarm model of the next time period; updating the loss function of the model based on the regularization strength, and recording the optimal position after the iteration as the weights and biases after the migration.

[0019] Preferably, the first fitness, fitness function and particle fractal dimension in the current period are used to provide a regularization strength of particle weights for the fractal particle swarm model in the next period, including: the regularization strength is:

[0020] κ(t+1)=κ(t)·exp(-α pe g(t)+β pe ·(1-L(t)))

[0021] Where κ(t) is the regularization strength of the particle weight in the current period, κ(t+1) is the regularization strength in the next period,

[0022] α pe With β pe They are the fitness gradient hyperparameter and the learning progress hyperparameter,

[0023] g(t) is the fitness gradient, which is related to the fitness function and the particle fractal dimension.

[0024] L(t) is the learning progress, which is related to the first fitness.

[0025] Preferably, the fitness gradient is:

[0026]

[0027] In the formula, f(p (t) ) and f(p (t-1) ) are the fitness function f(·) of the current particle in the current time period t and the previous time period t-1, respectively.

[0028] γ pe is the fractal dimension adjustment factor,

[0029] ∈ br is the radius of the sphere, as implemented for the current period t under N t (∈ br) number of units of measurement, N t (∈ br ) is determined based on the number of particles that fall into the sphere.

[0030] Preferably, the loss function of the model is updated based on the regularization strength, including: the loss function of the model is:

[0031]

[0032] In the formula, is the cross entropy loss of the model,

[0033] N(p (t) ) is the total number of particles p in the current period (t) The set of numbers f,

[0034] W i is the weight w of all the f-th particles ij The sum of squares of , j is the number of other particles.

[0035] Preferably, the loss function of the model is updated based on the regularization strength, and the optimal position after the iteration is completed is recorded as the weight and bias after migration, including: calculating the dynamic migration direction and dynamic migration distance of the current particle in the current time period, and implementing dynamic migration based on the dynamic migration direction and the dynamic migration distance; recording the position of the current particle after migration, and updating the fitness function of the current particle and the loss function of the model until the iteration ends.

[0036] Preferably, the dynamic migration direction of a current particle is:

[0037]

[0038] The current dynamic migration distance of a particle is:

[0039]

[0040] In the formula, f avg is the average fitness of all samples in the current period,

[0041] is the current particle numbered f in the current time period t The fitness function of

[0042] γ vd , vd , η vd They are update step size hyperparameter, learning strategy hyperparameter, and interaction degree adjustment factor.

[0043] p bestis the current optimal individual position,

[0044] ρ ik is the weight of the interacting particle k, is the position of the interacting particles.

[0045] Preferably, the autoencoder network is trained based on the principle of minimizing the nearest neighbor distance, and the autoencoder network is used to randomly reduce the dimension of feature samples and generate reduced-dimensional samples, including: reducing the dimension of feature samples using random masks that conform to the Bernoulli distribution to obtain reduced-dimensional features; calculating the importance factors of the feature samples; using the autoencoder, the reduced-dimensional features are encoded multiple times considering the importance factors to obtain reduced-dimensional samples of the feature samples.

[0046] Preferably, the dimensionality reduction features are encoded by using an autoencoder and taking into account the importance factor to obtain a dimensionality reduction sample of the feature sample, including:

[0047] z i =Sigmoid(W e ·(1+γ csd β csd )·(x i ⊙m i )+b e )

[0048] Where W e and b e are the weights and biases of the autoencoder network, obtained based on the loss function of the autoencoder network,

[0049] γ csd is the preset scaling factor, β csd is the importance factor,

[0050] x i ⊙m i is the dimension reduction feature, m i is a random mask.

[0051] Preferably, the importance factor β of the feature sample csd is the hyperbolic tangent function of the average of the skewness and kurtosis of the feature samples.

[0052] Preferably, the weights and biases of the autoencoder network are obtained based on the loss function of the autoencoder network, including: iteratively improving the weights and biases of the autoencoder and autodecoder in a gradient manner, and calculating the loss function of the autoencoder network; with the goal of minimizing the loss function of the autoencoder network, obtaining the optimal weights and optimal biases of the autoencoder and autodecoder.

[0053] Preferably, the loss function of the autoencoder network is:

[0054]

[0055] In the formula, is the self-decoding representation of the fth self-encoded feature sample, n is the total number of feature samples,

[0056] NN k (x i ) is the feature sample x i The nearest neighbor x j A collection of

[0057] z i and z j They are feature samples x i 、x j The dimension reduction sample,

[0058] λ kc is the regularization parameter of the manifold constraint.

[0059] Preferably, the momentum of the hidden layer weights in the extreme learning machine is calculated using the feedback error and the hidden layer weights of the extreme learning machine are iteratively updated to obtain a pre-trained extreme learning machine, including: in the extreme learning machine, the hidden layer weights and biases in the extreme learning machine are adjusted by a self-adjusting feedback method to obtain initial weights and biases; the feedback error introduced by the fractal is calculated, and the feedback error is added to the corresponding dimension of the dimensionality reduction sample to obtain the momentum of the hidden layer weights in the extreme learning machine; the initial weights are adjusted using the momentum to obtain the hidden layer weights.

[0060] The second aspect of the present invention relates to a risk protocol identification system based on fractal particle optimization GAN samples using the method in the first aspect of the present invention, the system comprising an extraction module, an expansion module, a dimensionality reduction module, and a classification module; wherein the extraction module is used to extract attribute information from the network protocol, and construct a sample to be identified of the network protocol based on multiple attribute information; the expansion module is used to input multiple samples to be identified into the generator of the GAN network for sample expansion and feature extraction to obtain feature samples, and the neural network weights and biases used for feature extraction in the generator of the GAN network are constructed based on a fractal particle swarm model; the dimensionality reduction module is used to train the autoencoder network based on the principle of minimizing the nearest neighbor distance, and use the autoencoder network to randomly reduce the dimensionality of the feature samples, and generate reduced dimensionality samples; the classification module is used to use feedback errors to calculate the momentum of the hidden layer weights in the extreme learning machine and iteratively update the hidden layer weights of the extreme learning machine, thereby obtaining a pre-trained extreme learning machine, using the pre-trained extreme learning machine as the discriminator of the GAN network, inputting the reduced dimensionality samples into the discriminator of the GAN network, and identifying the risk protocol.

[0061] A third aspect of the present invention relates to a terminal, comprising a processor and a storage medium; the storage medium is used to store instructions; the processor is used to operate according to the instructions to execute the steps of the method in the first aspect of the present invention.

[0062] A fourth aspect of the present invention relates to a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method in the first aspect of the present invention.

[0063] The beneficial effect of the present invention is that, compared with the prior art, the risk protocol identification method and system based on fractal particle optimization GAN samples in the present invention integrates the fractal particle swarm model, the autoencoder network, and the extreme learning machine model into the GAN network, supports the addressing of the neural network on any sample feature dimension in a random fractal manner, and identifies the risk protocol through the optimal particle position obtained by addressing. The present invention is effective and reliable, and the calculation results are highly accurate.

[0064] The beneficial effects of the present invention also include:

[0065] 1. The present invention adopts a generative adversarial network algorithm based on an adaptive memory network architecture to perform data expansion on network protocol data. The high-quality samples generated in the initial training phase are recorded by memory units, so that these high-quality samples can be reused in the data generation process, solving the problem of weak model generalization ability caused by insufficient data samples.

[0066] 2. The present invention adopts a neural network model based on a dynamic niche neural optimization algorithm for feature extraction, and seeks the optimal configuration of neural network parameters by imitating the niche theory. It randomly addresses in any dimension, thus overcoming the problems of gradient vanishing, gradient exploding, or falling into local optimal solutions that may be encountered by conventional neural networks, and ensures that the optimal particles can freely and randomly migrate their positions, thereby enhancing the diversity and quality of training data, improving the availability and authenticity of generated samples, and ultimately improving the confidence of the model discrimination results.

[0067] In addition, the neural network algorithm based on dynamic niche optimizes the parameter configuration during the model operation process, so that the network can perform better on given tasks, which also enhances the stability and efficiency of the model.

[0068] 3. The present invention adopts an autoencoder neural network based on manifold learning to perform feature dimensionality reduction, and cleverly applies the manifold learning method to the sample construction process of the GAN network generator, effectively extracting and retaining key information from high-dimensional data, so that important information can be retained while reducing the processing complexity of the model, solving the problems of information loss or high processing complexity in traditional methods, providing support for the diversified sample expansion process of the GAN network generator, and creating a data foundation for the accurate classification of the GAN network.

[0069] 4. The extreme learning machine based on the self-regulating feedback loop is used for data classification, which solves the problems of insufficient adaptability and robustness that are easily caused by the model classification process in a one-step manner. At the same time, the method analyzes the process of implementing adjustments based on dynamic niches in the sample by introducing feedback errors, and updates the network weights and biases again by momentum to prevent the discriminator from identifying the offset of fractal particles as errors, ensuring the accuracy of the classification process and compliance with the dynamic niche method to implement sample migration, thereby improving the classification accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] Figure 1 It is a flow chart of a risk protocol identification method based on fractal particle optimization GAN samples in the present invention;

[0071] Figure 2 A schematic diagram of a feature sample extraction process of a fractal particle swarm model in a risk protocol identification method based on fractal particle optimized GAN samples of the present invention;

[0072] Figure 3 A schematic diagram of a feature dimensionality reduction process implemented by an autoencoder network in a risk protocol identification method based on fractal particle optimized GAN samples of the present invention;

[0073] Figure 4 A schematic diagram of a model training and use process in a risk protocol identification method based on fractal particle optimization GAN samples of the present invention;

[0074] Figure 5 This is a schematic diagram of the module structure of a risk protocol identification system based on fractal particle optimization GAN samples in the present invention. DETAILED DESCRIPTION

[0075] In order to make the purpose, technical scheme and advantages of the present invention clearer, the technical scheme of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. The embodiments described in the present invention are only embodiments of a part of the present invention, not all embodiments. Based on the spirit of the present invention, all other embodiments not recorded in the present invention obtained by ordinary technicians in this field according to the embodiments recorded in the present invention without making creative work should belong to the protection scope of the present invention.

[0076] Figure 1 FIG. 1 is a flow chart of a risk protocol identification method based on fractal particle optimization GAN samples in the present invention. Figure 1 As shown, the first aspect of the present invention relates to a risk protocol identification method based on fractal particle optimization GAN samples, and the method includes steps 1 to 4.

[0077] Step 1: extract attribute information from the network protocol, and construct a sample to be identified of the network protocol based on multiple attribute information.

[0078] Preferably, attribute information is extracted from the network protocol, and a sample to be identified of the network protocol is constructed based on multiple attribute information, including: the attribute information includes the data packet length, protocol type, source IP address, destination IP address, source port number, destination port number, timestamp, load size, encryption flag, and operating system of the network protocol; the sample to be identified is a multidimensional vector, and each dimension in the multidimensional vector is directly or indirectly obtained based on the attribute information.

[0079] The data of the present invention is collected from a variety of network protocol interaction data. In one embodiment, network protocol data is obtained from an enterprise-level network environment and a public data set, including interaction data of HTTP, FTP, and TCP / IP protocols. The data to be collected is stored in a structured form, and the specific storage format is JSON format. Attribute information in the collected data is extracted.

[0080] In one embodiment, the attributes of the data include:

[0081] a1: Data packet length, indicating the byte length of a single data packet.

[0082] a2: Protocol type, indicating the network protocol followed by the data packet (such as HTTP, FTP, etc.).

[0083] a3: Source IP address, the IP address of the sender of the data packet.

[0084] a4: Destination IP address, the IP address of the data packet receiver.

[0085] a5: Source port number, the port number of the data packet sender.

[0086] a6: Destination port number, the port number of the data packet receiver.

[0087] a7: Timestamp, the specific time when the data packet is sent.

[0088] a8: Payload size, the byte size of the payload in the data packet.

[0089] a9: Encryption flag, indicating whether the data packet is encrypted.

[0090] a 10 : Operating system, the type of operating system that sends the data packet.

[0091] Some attribute information is read from specific fields of the network protocol, and some attribute information is obtained through further analysis and calculation.

[0092] It should be noted that this embodiment is only used to illustrate one data format and type of the present invention. In actual applications, the attributes of data are usually more than 10 attributes, and the number of attributes of data may reach dozens or even hundreds.

[0093] Preferably, the sample to be identified is a multidimensional vector, and each dimension in the multidimensional vector is directly or indirectly obtained based on the attribute information, including: the multidimensional vector also includes a labeling dimension, and the labeling dimension divides the sample to be identified into different behavior types of three network protocols: normal behavior, potential risk behavior and risky behavior through manual labeling.

[0094] Furthermore, the collected data is labeled. The labeling method of the present invention is manual labeling. In one embodiment, the labeled categories include: normal behavior, potential risk behavior, and risky behavior, a total of 3 categories.

[0095] By collecting the above attribute information of each network protocol, a multidimensional vector is constructed for each network protocol, which is a sample to be identified. After obtaining multiple important or typical network protocols, multiple samples to be identified are combined into an input matrix and input into the GAN network for data expansion and classification of the expanded data, thereby implementing risk protocol identification.

[0096] Step 2: Input multiple samples to be identified into the generator of the GAN network for sample expansion and feature extraction to obtain feature samples. The neural network weights and biases used for feature extraction in the generator of the GAN network are constructed based on the fractal particle swarm model.

[0097] The present invention adopts a generative adversarial network algorithm based on an adaptive memory network architecture for data expansion. The generative adversarial network based on an adaptive memory network architecture includes two components: a generator and a discriminator. The generator G is responsible for generating new data similar to real network protocol data, and the discriminator D is responsible for distinguishing the generated data from the real data. The present invention adopts a memory unit, which allows the generator to memorize high-quality samples generated in the past so that these samples can be reused in future training, thereby improving the diversity and quality of generated samples.

[0098] Assuming that the samples obtained by the generator and the discriminator conform to the normal distribution, the initialization parameters of the generator and the discriminator are defined respectively and The above parameters include the mean and variance of the normal distribution. In one embodiment, there are:

[0099]

[0100]

[0101] During the initialization of the GAN network, the memory unit in the generator is activated to ensure that the network can generate high-quality samples during the training phase. The memory unit is updated as follows:

[0102] M(t)=βM(t-1)+(1-β)z g

[0103] Where M(t) is the memory unit in the current period t, M(t-1) is the memory unit in the previous period, β is the memory decay factor, and z g High-quality augmented samples generated by the generator for the current period.

[0104] After GAN obtains the augmented samples, it evaluates the sample quality through the evaluation function and selects high-quality samples based on the evaluation results. g In the original conformity θ g Add random noise z to the sample of the distribution, denoted as x g =G(z,θ g ). Random noise conforms to the distribution z~p z , p z is the prior distribution of random noise.

[0105] The evaluation function for all samples is Q(x g ), under the premise of adding random noise to the sample, the item with the largest function value is selected from the evaluation function as a high-quality sample, that is, feature extraction is implemented. The high-quality sample is expressed as:

[0106]

[0107] Typically, the evaluation function Q(·) is pre-obtained based on the reconstruction loss between real samples and generated samples.

[0108] In the present invention, this evaluation process is obtained based on the fractal particle swarm model.

[0109] The present invention uses a 3-layer fully connected neural network for feature extraction. The network uses a neural network model based on a dynamic niche neural optimization algorithm, which is inspired by the niche theory in ecology. Each species seeks its optimal position in the ecosystem to achieve an advantage in the competition for survival. Similarly, the dynamic niche neural optimization algorithm aims to find the optimal configuration of neural network parameters so that the network performs best on a given task.

[0110] Figure 2 Schematic diagram of the feature sample extraction process of the fractal particle swarm model in the risk protocol identification method based on fractal particle optimization GAN sample of the present invention. Figure 2As shown in Figure 1, the three-layer neural network model obtains the neural network weights and biases through the fractal particle swarm model. In the initialization phase, the fractal particle swarm model generates a diverse primary population, and each individual represents a set of neural network parameters, such as the weights and biases of the network.

[0111] Therefore, the initial population p is set (0) , then each individual is p i , then

[0112]

[0113] In the above formula, W i is the weight matrix of the neuron numbered f in the neural network, b i is the corresponding bias, In one embodiment, p (0) The initialization method is random initialization.

[0114] Preferably, the weights and biases of the neural network used for feature extraction in the generator of the GAN network are constructed based on a fractal particle swarm model, including: in the fractal particle swarm model, the loss function of the model is adjusted using the fitness function of the initial weights and biases in the neural network used for feature extraction; iteratively implementing dynamic migration of the initial weights and biases with the goal of making the loss function sufficiently small, and generating weights and biases after migration based on the optimal position after the dynamic migration.

[0115] In the fractal particle swarm model, the weights and biases corresponding to each neuron of the neural network are spliced ​​into a particle, and the multiple dimensions of the particle correspond to the weights and biases of other different neurons. Multiple particles are input into the fractal particle swarm model, and after multiple processes such as inheritance, crossover, and mutation, the position of the optimal particle is finally obtained, that is, the optimal weight and bias.

[0116] Preferably, the dynamic migration of initial weights and biases is iteratively implemented with the goal of making the loss function sufficiently small, and the weights and biases after the migration are generated based on the optimal position after the dynamic migration, including: using the Softmax function to obtain the first fitness of the current particle in the initial weights and biases; using the sum of the loss gradients of the model's loss function in the current particle and in all directions to construct the second fitness of the current particle; weighted summing the first fitness and the second fitness to obtain the fitness function of the current particle; using the first fitness, fitness function and particle fractal dimension in the current time period to provide the regularization strength of particle weights for the fractal particle swarm model of the next time period; updating the loss function of the model based on the regularization strength, and recording the optimal position after the iteration as the weights and biases after the migration.

[0117] In the dynamic evaluation stage, the performance of each particle is calculated according to the attractor properties of the dynamic trajectory using the fitness function in the particle swarm algorithm. The attractor properties of the dynamic trajectory essentially mean the properties of each individual. The present invention uses the accuracy of the training data annotation in the network and the dynamic stability of the parameters to characterize the attractor properties of the dynamic trajectory.

[0118] The fitness function is:

[0119] f(p i )=α Ts ·Acc(p i )+β Ts Stab(p i )

[0120] In the formula, Acc(p i ) is the softmax function of the current particle, which is equivalent to all particles in the network. i The first fitness of is used to indicate the accuracy of the particle. Stab(p i ) represents the dynamic stability of the particle, which is the current particle p i The second fitness of α Ts With β Ts are performance hyperparameters and stability hyperparameters, respectively. In one embodiment, the above hyperparameters are set to 0.7 and 0.3, respectively. The first fitness and the second fitness are weightedly summed by the above two data to obtain the fitness function.

[0121] Among them, the second fitness is expressed as:

[0122]

[0123] In the formula, δ sta is the attenuation coefficient, which is set to 0.05 in one embodiment.

[0124] w ij is the particle p i is the jth weight in , Mu is the number of weights, is the loss function of the 3-layer neural network. For the loss function, partial differentials are solved under j weights respectively to obtain multiple loss gradients of the particle in each weight direction, and multiple loss gradients are summed and further calculated to obtain the second fitness.

[0125] Preferably, the first fitness, fitness function and particle fractal dimension in the current period are used to provide a regularization strength of particle weights for the fractal particle swarm model in the next period, including: the regularization strength is:

[0126] κ(t+1)=κ(t)·exp(-α peg(t)+β pe ·(1-L(t)))

[0127] Where κ(t) is the regularization strength of the particle weight in the current period, κ(t+1) is the regularization strength in the next period,

[0128] α pe With β pe are the fitness gradient hyperparameter and the learning progress hyperparameter, which are set to 0.3 and 0.7 respectively in one embodiment.

[0129] g(t) is the fitness gradient, which is related to the fitness function and the particle fractal dimension.

[0130] L(t) is the learning progress, which is related to the first fitness.

[0131] By adding a regularization term in the objective function, the generalization ability of the model can be improved. To this end, the present invention adds a regularization term in the objective function, which is represented by the L2 norm of each dimension, and the coefficient is the regularization strength.

[0132] In the present invention, as the number of iterations changes, the speed of change of the fitness function gradually slows down, and the accuracy of the particles gradually stabilizes. Therefore, the regularization strength is used to characterize the degree of particle change in all iterations, and the regularization strength is adjusted accordingly. Therefore, the regularization strength also changes iteratively in each iteration.

[0133] Preferably, the fitness gradient measures the rate of change of the fitness function over time and is expressed as:

[0134]

[0135] In the formula, f(p (t) ) and f(p (t-1) ) are the fitness function f(·) of the current particle in the current time period t and the previous time period t-1, respectively.

[0136] γ pe is the fractal dimension adjustment factor,

[0137] ∈ br is the radius of the sphere, as implemented for the current period t under N t (∈ br ) number of units of measurement, N t (∈ br ) is determined based on the number of particles that fall into the sphere.

[0138] In the above formula, To define the particle p (t)The local fractal dimension in a multidimensional vector space. In a multidimensional vector space, with a particle p (t) The location is the center of the sphere, and a radius of ∈ br For this sphere, particle p (t) It can be migrated in any spatial direction with the radius as the variable scale. In one embodiment, ∈ br Set to 0.0001. D is the fractal dimension.

[0139] Preferably, the loss function of the model is updated based on the regularization strength, including:

[0140] The loss function of the model is:

[0141]

[0142] In the formula, is the cross entropy loss of the model,

[0143] N(p (t) ) is the total number of particles p in the current period (t) The set of numbers f,

[0144] W i is the weight w of all the f-th particles ij The sum of squares of , j is the number of other particles.

[0145] In the above formula, the network loss function includes two parts: cross entropy loss and regularization term. The regularization term uses the regularization strength κ(t) as a coefficient to modify its weight in the loss function.

[0146] W i is the weight vector of particle numbered f, which includes multiple weights w ij .

[0147] According to the above formula, the model is trained with the goal of minimizing the loss function. By modifying the position of the particles, the fitness function and regularization strength are obtained, so as to iteratively improve the model and ensure the minimum loss.

[0148] Preferably, the loss function of the model is updated based on the regularization strength, and the optimal position after the iteration is completed is recorded as the weight and bias after migration, including: calculating the dynamic migration direction and dynamic migration distance of the current particle in the current time period, and implementing dynamic migration based on the dynamic migration direction and dynamic migration distance; recording the position of the current particle after migration, and updating the fitness function of the current particle and the loss function of the model until the iteration ends.

[0149] Individuals move in the ecological niche according to their fitness. Excellent individuals occupy the dominant ecological niche, and weaker individuals explore new ecological niches or are eliminated. The adjustment method is expressed as:

[0150]

[0151] Therefore, the current dynamic migration direction of a particle is:

[0152]

[0153] The dynamic migration distance of the current particle is:

[0154]

[0155] In the formula, f avg is the average fitness of all samples in the current period,

[0156] is the current particle numbered f in the current time period t The fitness function of

[0157] γ vd , vd , η vd They are update step size hyperparameter, learning strategy hyperparameter, and interaction degree adjustment factor, respectively. In one embodiment, the above parameters are set to 0.1, 0.05, and 0.1, respectively.

[0158] p best is the current optimal individual position,

[0159] ρ ik is the weight of the interacting particle k, is the position of the interacting particles.

[0160] The particles obtained in this way also use crossover, mutation and other methods to implement the calculation of the optimal particles.

[0161] In the crossover and update operations, the new individual p new May inherit two individuals p parent1 、p parent2 or more characteristics of excellent individuals, expressed as:

[0162] p new =ζ kg ·p parent1 +(1-ζ kg )·p parent2

[0163] ζ kg is a randomly generated crossover factor between 0 and 1. parent1 、pparent2 are two randomly selected parent individuals.

[0164] In the mutation and mutation operations, a mutation mechanism based on nonlinear dynamics theory is used, so that individual parameters can perform random jumps in a large range, which can be expressed as:

[0165] p′ i =p i +∈ bg randN() mask()

[0166] The individual p′ after mutation i

[0167] Compared with the previous individual p i The difference between them is given by ∈ bg ·randN()·mask() indicates that randN() is a random number that conforms to the normal distribution. mask() is used to generate a random number that is consistent with p i A random binary mask of the same size to extract the i Select some dimensions to perform mutation. The calculation process of mask() is expressed as:

[0168] mask()=rand(size(p i )) and mask()<μ bg

[0169] In the formula, size(p i ) is the individual p i The length measurement function. rand() is a random number generation function.

[0170] In one embodiment, ∈ bg 0.01, μ bg Set to 0.1.

[0171] Finally, a global dynamic update is performed, and the entire population is updated according to the theory of ecological dynamic systems. The strategies of excellent individuals will be imitated and spread, while the unsuitable strategies will gradually disappear, which is expressed as:

[0172] P (t+1) = sort(P (t) , f)

[0173] The sort() function sorts the population by fitness, retains individuals with high fitness, and eliminates individuals with low fitness.

[0174] Repeat the above steps until the preset stop iteration condition is met, which means that the model training is completed. In one embodiment, the preset stop iteration condition is reaching a preset maximum number of iterations. Preferably, the preset maximum number of iterations is set to 1000 times.

[0175] In the GAN generation network, the neural network weights used for feature extraction are iteratively improved through particle inheritance, crossover, and mutation. The finally trained neural network can be used to evaluate the sample quality of the GAN expansion samples, thereby obtaining high-quality samples, that is, implementing feature sample extraction.

[0176] Step 3: train the autoencoder network based on the principle of minimizing the nearest neighbor distance, and use the autoencoder network to randomly reduce the dimension of the feature samples and generate reduced-dimensional samples.

[0177] The extracted feature samples are input into a feature dimension reduction model for training. The present invention uses an autoencoder neural network algorithm based on manifold learning to perform feature dimension reduction.

[0178] The autoencoder neural network based on manifold learning consists of two parts: an encoder and a decoder. The function of the encoder is to map the high-dimensional input features to a low-dimensional latent space, and the decoder attempts to reconstruct the original input from this low-dimensional latent space. The present invention adopts the principle of manifold learning to enable the network to better understand and retain the intrinsic structure of the data, and at the same time adopts a mask transformation mechanism to enhance the robustness of the model to noise and outliers in the input data.

[0179] Figure 3 Schematic diagram of the feature dimensionality reduction process implemented by the autoencoder network in the risk protocol identification method based on fractal particle optimization GAN samples of the present invention. Figure 3 As shown in the figure, the training process of the autoencoder neural network algorithm based on manifold learning includes reducing the dimensionality of high-dimensional samples through the manifold structure, adjusting the low-dimensional representation using the manifold constraint, reconstructing the input data through the decoder, and updating the network parameters through back propagation.

[0180] The weights and biases of the encoder and decoder are used as parameters to be trained. During the initialization process, the parameters are randomly expressed as:

[0181]

[0182] W e and b e is the weight matrix and bias vector of the encoder, W d and b d is the weight matrix and bias vector of the decoder. In one embodiment, σ 2 is 0.01.

[0183] Preferably, the autoencoder network is trained based on the principle of minimizing the nearest neighbor distance, and the autoencoder network is used to randomly reduce the dimension of feature samples and generate reduced-dimensional samples, including: reducing the dimension of feature samples using random masks that conform to the Bernoulli distribution to obtain reduced-dimensional features; calculating the importance factors of the feature samples; using the autoencoder, the reduced-dimensional features are encoded multiple times considering the importance factors to obtain reduced-dimensional samples of the feature samples.

[0184] For each feature sample, a random mask that conforms to the Bernoulli distribution is generated. The mask is used to simulate the partial loss of the input data, so it is randomly generated multiple times, and the number of generation times is preset. A random mask is expressed as:

[0185] m im = Bernoulli(p)

[0186] m is the number of times generated, and f corresponds to the feature sample number. In the random mask, each element independently takes the value of 0 or 1, and p represents the probability that the element in the distribution is 1. In the sampling process, any element U is a random number drawn from the uniform distribution Uniform (0, 1). A threshold parameter pr is set. If U is less than pr, the element takes the value of 1, otherwise it takes the value of 0. In one embodiment, pr = 0.45.

[0187] After generating a random mask, the input data is calculated with multiple random numbers in the mask in sequence to obtain a low-dimensional potential representation of the feature sample.

[0188] Preferably, the dimensionality reduction features are encoded by using an autoencoder and taking into account the importance factor to obtain a dimensionality reduction sample of the feature sample, including:

[0189] z i =Sigmoid(W e ·(1+γ csd β csd )·(x i ⊙m i )+b e )

[0190] Where W e and b e are the weights and biases of the autoencoder network, obtained based on the loss function of the autoencoder network,

[0191] γ csd is the preset scaling factor, β csd is the importance factor,

[0192] x i ⊙m i is the dimension reduction feature, which is obtained by multiplying the mask and the feature sample bit by bit, m iis a random mask. In one embodiment, m i The length can be x i The length of is multiple times, thus fully representing all the information of the high-dimensional feature samples.

[0193] Preferably, the importance factor β of the feature sample csd is the hyperbolic tangent function of the average of the skewness and kurtosis of the feature samples.

[0194] The dynamic coding adjustment coefficient is dynamically adjusted based on the statistical characteristics of the input data. Specifically, the skewness S(x i ) and kurtosis K(x i ), expressed as:

[0195]

[0196] μ pd , σ pd x i The mean and standard deviation of .

[0197] x il is the feature sample x i The statistic is d times.

[0198] Thus, the importance factor of each feature sample is obtained as:

[0199]

[0200] Preferably, the weights and biases of the autoencoder and the autodecoder are iteratively improved in a gradient manner, and the loss function of the autoencoder network is calculated; with the goal of minimizing the loss function of the autoencoder network, the optimal weights and optimal biases of the autoencoder and the autodecoder are obtained.

[0201] The gradient descent method is used to optimize the network parameters and continuously reduce the total loss. The way to update the parameters is expressed as:

[0202]

[0203] In the formula, α gk is the learning rate, which is set to 0.04 in one embodiment. In the above formula, L is the loss function.

[0204] Repeat the above steps until the preset stop iteration condition is met, which means that the model training is completed. In one embodiment, the preset stop iteration condition is reaching a preset maximum number of iterations. Preferably, the preset maximum number of iterations is set to 1000 times.

[0205] Preferably, the loss function of the autoencoder network is:

[0206]

[0207] In the formula, is the self-decoding representation of the fth self-encoded feature sample, n is the total number of feature samples,

[0208] NN k (x i ) is the feature sample x i The nearest neighbor x j A collection of

[0209] z i and z j They are feature samples x i 、x j The dimension reduction sample,

[0210] λ kc is the regularization parameter of the manifold constraint, which is set to 0.2 in one embodiment.

[0211] In the above formula, z i and z j is the dimension reduction sample obtained by the encoder calculation in the above way, and x i and x j is the original feature sample. In the process of encoding by the above method, the decoder is trained at the same time and obtains the restored representation of the decoded feature sample, which is In one implementation, according to the structure of the decoder, the calculation process of recovering the representation is:

[0212]

[0213] Calculating the difference between the two is part of the network loss function. In addition, the network loss also emphasizes the loss of dimensionality reduction samples. In the latent space, the manifold constraint is used To adjust the low-dimensional representation, ensuring that the geometric and topological properties of the data are preserved.

[0214] The above loss function uses the features of the nearest neighbor algorithm as the features of the manifold dimensionality reduction data. Specifically, the process of solving the features of the dimensionality reduction data includes sampling the manifold structure of the training data to estimate the local manifold structure of the data. In one embodiment, the data features are obtained by using K nearest neighbor algorithms. For each data point x i Sampling is performed and the average distance D(x i ), expressed as:

[0215]

[0216] In the formula, NN k (x i ) is the set of K nearest neighbors, xj is any element in the set. In one embodiment, the distance is the square of the Euclidean distance.

[0217] In this way, the high-level features of the feature samples are mapped to the low-level features. This process is actually part of the GAN generator. Therefore, the inter-layer information feedback mechanism is used to adjust the low-level parameters, such as the distribution parameter θ mentioned above. g Then the training of GAN network can be implemented. Parameter θ g The training process is expressed as:

[0218]

[0219] η cv L is the learning rate of the generator, which is set to 0.01 in one embodiment. d () is the loss of the discriminator in GAN, G(z;θ g ) is an extension of the GAN generator, which includes the feature extraction process in step 2, that is, high-quality samples. D(x) represents the classification result of the discriminator for high-quality samples, that is, the output of the discriminator.

[0220] Similarly, the parameters θ of the discriminator d The training process is expressed as:

[0221]

[0222] η dc is the learning rate of the discriminator, which is set to 0.03 in one embodiment.

[0223] In the above formula, the loss function of the discriminator is calculated in the same way as the general GAN ​​network, and the loss function is:

[0224]

[0225] x~pdata(x) means sampling x from the sample set, and z~pz(z) means obtaining random noise from the noise distribution.

[0226] Multiple calculations of the loss function are used to iteratively improve the parameters of the GAN generator and discriminator. The parameters of the generator and discriminator are gradually iterated and optimized using a gradient method. However, the above process does not fully describe the parameter improvement process of GAN.

[0227] In step 4, the GAN network implements the construction of the discriminator by means of an extreme learning machine, and the extreme learning machine takes into account the process of sample expansion, extraction and encoding, improves the discriminant method, and adds a momentum term of the weight based on the fractal dimension. Therefore, in the process of training the GAN network, the present invention also adjusts the parameter θ g and θd The dynamic quantity is adjusted accordingly during each iteration, which will be described after step 4 is described.

[0228] Step 4: Use the feedback error to calculate the momentum of the hidden layer weights in the extreme learning machine and iteratively update the hidden layer weights of the extreme learning machine to obtain a pre-trained extreme learning machine. Use the pre-trained extreme learning machine as the discriminator of the GAN network, input the reduced dimensionality sample into the discriminator of the GAN network, and identify the risky protocol.

[0229] In order to input the dimension reduction samples into the discriminator for discrimination, the present invention adopts an extreme learning machine algorithm based on a self-regulating feedback loop as a discriminator. The extreme learning machine algorithm based on a self-regulating feedback loop is improved based on the extreme learning machine basic model, and its input layer receives the feature vector from the data dimension reduction model, and the output layer generates the final classification decision according to the training data. The present invention adopts a self-regulating mechanism, allowing the model to adjust the weight and bias of the hidden layer according to the output of the previous stage, thereby enhancing the adaptability and robustness of the model to new data, thereby improving the accuracy of classification.

[0230] In the extreme learning machine with a self-regulating feedback loop, the weights qW of all hidden layers of the extreme learning machine are first initialized (0) and bias qb (0) , expressed as:

[0231] QW (0) =σ qW ×randn(d in , d out )

[0232] qb (0) =σ qb ×randn(d out )

[0233] The randn() function generates random numbers from a standard normal distribution.

[0234] d in and d out are the input and output dimensions respectively.

[0235] After the data passes through the input layer, it is passed to the hidden layer. In the hidden layer, the activation value of each neuron is a nonlinear function of its weighted input and bias. The present invention uses the Sigmoid activation function to increase the nonlinear processing capability of the model, which is expressed as:

[0236] qz=Sigmoid(qW×qx+qb)

[0237] qx is the input feature vector and qz is the output after activation.

[0238] The extreme learning machine performs the parameter adjustment process in two steps during each iteration. The adjustment strategy of the first step is expressed as:

[0239] qW←qW-η qW ×(qo-qy)×qz T

[0240] qb←qb-η qb ×(qo-qy)

[0241] In the formula, qo is the current predicted output, qy is the actual label, η qW and η qb are the learning rates of weight and bias, respectively, which are set to 0.03 and 0.05 in one embodiment, qz T is the transpose of qz.

[0242] In the second step, a momentum term is introduced to implement the identification of feedback errors and the updating of parameters, which is used to update the increment of weights.

[0243] Preferably, the momentum of the hidden layer weights in the extreme learning machine is calculated using the feedback error and the hidden layer weights of the extreme learning machine are iteratively updated to obtain a pre-trained extreme learning machine, including: in the extreme learning machine, the hidden layer weights and biases in the extreme learning machine are adjusted by a self-adjusting feedback method to obtain initial weights and biases; the feedback error introduced by the fractal is calculated, and the feedback error is added to the corresponding dimension of the dimensionality reduction sample to obtain the momentum of the hidden layer weights in the extreme learning machine; the initial weights are adjusted using the momentum to obtain the hidden layer weights.

[0244] This method arbitrarily adds feedback errors to one or more dimensions of the weight matrix. This feedback error is usually caused by sample migration implemented by the fractal dimension in the feature extraction process of step 2. Therefore, this iterative method helps the extreme learning machine to effectively explore the parameter space and avoid falling into local optimality.

[0245] The calculation process of iteratively improving parameters in momentum mode is expressed as:

[0246]

[0247] qW←qW+ΔqW-η qW ×(fer×qz T )

[0248] Where fer is the feedback error rate, ΔqW is the momentum term, and γ qW and η qW They are learning rate and momentum factor respectively. In one embodiment, the momentum factor is 0.9. is the loss function, usually cross entropy loss or mean square error.

[0249] In the above calculation process, the gradient of the loss function in different weight directions is calculated as follows:

[0250]

[0251] For the loss function, only its partial differential in the direction of the predicted output is considered; for the predicted output, only its partial differential relative to the reduced-dimensionality sample is considered; for the reduced-dimensionality sample, only the weight direction related to it is considered.

[0252] The feedback error rate is used to further update the weights, which ensures that the weight update process depends not only on the output error qo-qy, but also on the gradient of the activation function in the neural network at the current activation position qz. Since the activation function is used to implement nonlinearity in the neural network, if there is a feedback error rate, it means that the error is likely caused by a nonlinear process such as multidimensional spherical migration. Therefore, when the feedback error rate is found, it is added to the momentum to further adjust the weights to ensure that the neural network supports the calculation of the fractal dimension.

[0253] In one embodiment, the calculation process of the feedback error rate is:

[0254] fer=(qo-qy)×f′(qz)

[0255] f′(qz) is the derivative of the activation function with respect to qz. The activation function in one embodiment is the ReLU function.

[0256] The error rate mentioned here includes qo-qy, that is, the error between the output layer and the actual label. Therefore, the present invention back-propagates these errors to the hidden layer to optimize the model parameters. After the error back-propagates, it is used to affect the partial differential operation result of the loss function on the weight and bias, that is:

[0257]

[0258] This part of the content is used as the basis for the momentum term or feedback adjustment parameter in this iteration or the next iteration according to the actual iteration method.

[0259] Repeat the above steps until the preset stop iteration condition is met, which means that the model training is completed. In one embodiment, the preset stop iteration condition is reaching a preset maximum number of iterations. Preferably, the preset maximum number of iterations is set to 1000 times.

[0260] Figure 4 Schematic diagram of the model training and use process in a risk protocol identification method based on fractal particle optimization GAN samples of the present invention. Figure 4As shown, network protocol risk identification is completed through a trained model. In one embodiment, the newly collected network protocol data is first passed through a fractal particle swarm model as a feature extraction model to extract key features. Then, the extracted feature samples are input into a data dimension reduction model implemented by an autoencoder network to reduce the dimension of the data in the feature space. Further, the reduced-dimensional data is input into a classifier model constructed by an extreme learning mechanism to classify the data into risk levels. In this embodiment, a state judgment of the risk protocol is finally obtained, such as any one of normal behavior, potential risk behavior, and risky behavior.

[0261] Figure 5 This is a schematic diagram of the module structure of a risk protocol identification system based on fractal particle optimization GAN samples in the present invention. Figure 5 As shown, the second aspect of the present invention relates to a risk protocol identification system based on fractal particle optimization GAN samples using the method in the first aspect of the present invention, the system includes an extraction module, an expansion module, a dimensionality reduction module, and a classification module; wherein the extraction module is used to extract attribute information from the network protocol, and construct a sample to be identified of the network protocol based on multiple attribute information; the expansion module is used to input multiple samples to be identified into the generator of the GAN network for sample expansion and feature extraction to obtain feature samples, and the neural network weights and biases used for feature extraction in the generator of the GAN network are constructed based on the fractal particle swarm model; the dimensionality reduction module is used to train the autoencoder network based on the principle of minimum nearest neighbor distance, and use the autoencoder network to randomly reduce the dimension of the feature samples and generate reduced dimension samples; the classification module is used to use feedback errors to calculate the momentum of the hidden layer weights in the extreme learning machine and iteratively update the hidden layer weights of the extreme learning machine, thereby obtaining a pre-trained extreme learning machine, using the pre-trained extreme learning machine as the discriminator of the GAN network, inputting the reduced dimension samples into the discriminator of the GAN network, and identifying the risk protocol.

[0262] A third aspect of the present invention relates to a terminal, comprising a processor and a storage medium; the storage medium is used to store instructions; the processor is used to operate according to the instructions to execute the steps of the method according to the first aspect of the present invention.

[0263] A fourth aspect of the present invention relates to a computer-readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the steps of the method in the first aspect of the present invention.

[0264] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A risk protocol identification method based on fractal particle optimization GAN samples, characterized in that: The method comprises the following steps: Extracting attribute information from a network protocol, and constructing a sample to be identified of the network protocol based on multiple attribute information; Inputting a plurality of samples to be identified into a generator of a GAN network for sample expansion and feature extraction to obtain feature samples, wherein the neural network weights and biases for feature extraction in the generator of the GAN network are constructed based on a fractal particle swarm model; The autoencoder network is trained based on the principle of minimizing the nearest neighbor distance, and the autoencoder network is used to randomly reduce the dimension of the feature samples and generate reduced-dimensional samples; The momentum of the hidden layer weights in the extreme learning machine is calculated using feedback errors, and the hidden layer weights of the extreme learning machine are iteratively updated to obtain the pre-trained extreme learning machine. The pre-trained extreme learning machine is used as the discriminator of the GAN network, and the reduced dimensionality sample is input into the discriminator of the GAN network to identify the risky protocol.

2. According to claim 1, a risk protocol identification method based on fractal particle optimization GAN samples is characterized by: The extracting attribute information from the network protocol and constructing a sample to be identified of the network protocol based on multiple attribute information includes: The attribute information includes the packet length, protocol type, source IP address, destination IP address, source port number, destination port number, timestamp, payload size, encryption flag, and operating system of the network protocol; The sample to be identified is a multi-dimensional vector, and each dimension of the multi-dimensional vector is directly or indirectly obtained based on the attribute information.

3. According to claim 2, a risk protocol identification method based on fractal particle optimization GAN samples is characterized by: The sample to be identified is a multidimensional vector, and each dimension of the multidimensional vector is directly or indirectly obtained based on the attribute information, including: The multidimensional vector also includes a labeling dimension, which divides the samples to be identified into three different behavior types of network protocols: normal behavior, potential risk behavior and risk behavior through manual labeling.

4. According to claim 1, a risk protocol identification method based on fractal particle optimization GAN samples is characterized by: The neural network weights and biases used for feature extraction in the generator of the GAN network are constructed based on a fractal particle swarm model, including: In the fractal particle swarm model, the loss function of the model is adjusted using the fitness function of the initial weights and biases in the neural network for feature extraction; The dynamic migration of the initial weights and biases is iteratively implemented with the goal of making the loss function sufficiently small, and the migrated weights and biases are generated based on the optimal position after the dynamic migration.

5. According to claim 4, a risk protocol identification method based on fractal particle optimization GAN samples is characterized in that: The iterative implementation of the dynamic migration of the initial weights and biases with the loss function being sufficiently small as a goal, and generating the migrated weights and biases based on the optimal position after the dynamic migration, comprises: Using the Softmax function to obtain the first fitness of the current particle in the initial weight and bias; Constructing a second fitness of the current particle by using the sum of the loss gradients of the loss function of the model in each direction of the current particle; Taking a weighted sum of the first fitness and the second fitness to obtain a fitness function of the current particle; Using the first fitness, the fitness function and the particle fractal dimension in the current period to provide a regularization strength of particle weights for the fractal particle swarm model in the next period; The loss function of the model is updated based on the regularization strength, and the optimal position after the iteration is recorded as the migrated weight and bias.

6. According to claim 5, a risk protocol identification method based on fractal particle optimization GAN samples is characterized by: The using the first fitness, the fitness function and the particle fractal dimension in the current period to provide the regularization strength of the particle weight for the fractal particle swarm model in the next period includes: The regularization strength is: k(t)+1)=k(t)·exp(-α pe ·g(t)+β pe ·(1-L(t))) Where κ(t) is the regularization strength of the particle weight in the current period, k(t+1) is the regularization strength in the next period, α pe With β pe They are the fitness gradient hyperparameter and the learning progress hyperparameter, g(t) is the fitness gradient, which is related to the fitness function and the particle fractal dimension. L(t) is the learning progress, which is related to the first fitness.

7. The risk protocol identification method based on fractal particle optimization GAN samples according to claim 6 is characterized by: The fitness gradient is: In the formula, f(p (t) ) and f(p (t-1) ) are the fitness function f(·) of the current particle in the current time period t and the previous time period t-1, respectively. γ pe is the fractal dimension adjustment factor, ∈ br is the radius of the sphere, as implemented for the current period t under N t (∈ br ) number of units of measurement, N t (∈ br ) is determined based on the number of particles that fall into the sphere.

8. The risk protocol identification method based on fractal particle optimization GAN samples according to claim 7 is characterized by: The updating of the loss function of the model based on the regularization strength includes: The loss function of the model is: In the formula, is the cross entropy loss of the model, N(p (t) ) is the total number of particles p in the current period (t) The set of numbers i, W i is the weight w of all particles of the ith ij The sum of squares of , j is the number of other particles.

9. The risk protocol identification method based on fractal particle optimization GAN samples according to claim 8 is characterized by: The updating of the loss function of the model based on the regularization strength and recording the optimal position after the iteration as the weight and bias after the migration include: Calculating the dynamic migration direction and dynamic migration distance of the current particle in the current time period, and performing dynamic migration based on the dynamic migration direction and the dynamic migration distance; The position of the current particle after migration is recorded, and the fitness function of the current particle and the loss function of the model are updated until the iteration ends.

10. The risk protocol identification method based on fractal particle optimization GAN samples according to claim 9 is characterized in that: The dynamic migration direction of the current particle is: The dynamic migration distance of the current particle is: In the formula, f avg is the average fitness of all samples in the current period, is the current particle numbered i in the current time period t The fitness function of γ vd , vd , η vd They are update step size hyperparameter, learning strategy hyperparameter, and interaction degree adjustment factor. p best is the current optimal individual position, ρ ik is the weight of the interacting particle k, is the location of the interacting particles.

11. The risk protocol identification method based on fractal particle optimization GAN samples according to claim 1 is characterized by: The method of training the autoencoder network based on the principle of minimizing the nearest neighbor distance and using the autoencoder network to randomly reduce the dimension of the feature samples and generate reduced-dimensional samples includes: Performing dimensionality reduction on the feature samples using a random mask that conforms to Bernoulli distribution to obtain dimensionality reduction features; Calculating the importance factor of the feature sample; The reduced-dimensional features are encoded multiple times by using an autoencoder and taking the importance factor into consideration to obtain reduced-dimensional samples of the feature samples.

12. The risk protocol identification method based on fractal particle optimization GAN samples according to claim 11 is characterized in that: The step of encoding the dimension reduction feature by using the autoencoder and taking the importance factor into consideration to obtain a dimension reduction sample of the feature sample comprises: z i =Sigmoid(W e ·(1+γ csd β csd )·(x i ⊙m i )+b e ) Where W e and b e are the weights and biases of the autoencoder network, obtained based on the loss function of the autoencoder network, γ csd is the preset scaling factor, β csd is the importance factor, x i ⊙m i is the dimension reduction feature, m i is a random mask.

13. The risk protocol identification method based on fractal particle optimization GAN samples according to claim 12 is characterized in that: The importance factor β of the feature sample csd is the hyperbolic tangent function of the average of the skewness and kurtosis of the feature samples.

14. The risk protocol identification method based on fractal particle optimization GAN samples according to claim 13 is characterized in that: The weights and biases of the autoencoder network are obtained based on the loss function of the autoencoder network, including: Iteratively improving the weights and biases of the autoencoder and autodecoder in a gradient manner, and calculating the loss function of the autoencoder network; Taking the minimization of the loss function of the autoencoder network as the goal, the optimal weights and optimal biases of the autoencoder and autodecoder are obtained.

15. The risk protocol identification method based on fractal particle optimization GAN samples according to claim 14 is characterized in that: The loss function of the autoencoder network is: In the formula, is the self-decoding representation of the feature sample of the ith self-encoding, n is the total number of the feature samples, NN k (x i ) is the feature sample x i The nearest neighbor x j A collection of z i and z j are the feature samples x respectively. i 、x j The dimension reduction sample, λ kc is the regularization parameter of the manifold constraint.

16. The risk protocol identification method based on fractal particle optimization GAN samples according to claim 1 is characterized by: The step of calculating the momentum of the hidden layer weights in the extreme learning machine by using feedback errors and iteratively updating the hidden layer weights of the extreme learning machine to obtain the pre-trained extreme learning machine comprises: In the extreme learning machine, a hidden layer weight and bias in the extreme learning machine are adjusted by a self-adjusting feedback method to obtain an initial weight and bias; Calculating a feedback error introduced by the fractal, and adding the feedback error to a corresponding dimension of the reduced-dimensional sample to obtain a momentum of a hidden layer weight in the extreme learning machine; The initial weight is adjusted using the momentum to obtain the hidden layer weight.

17. A risk protocol identification system based on fractal particle optimized GAN samples using the method according to any one of claims 1 to 16, characterized in that: The system includes an extraction module, an expansion module, a dimensionality reduction module, and a classification module; wherein, The extraction module is used to extract attribute information from the network protocol and construct a sample to be identified of the network protocol based on multiple attribute information; The expansion module is used to input the plurality of samples to be identified into the generator of the GAN network for sample expansion and feature extraction to obtain feature samples, and the neural network weights and biases used for feature extraction in the generator of the GAN network are constructed based on a fractal particle swarm model; The dimension reduction module is used to train the autoencoder network based on the principle of minimizing the nearest neighbor distance, and use the autoencoder network to randomly reduce the dimension of the feature samples and generate reduced-dimensional samples; The classification module is used to calculate the momentum of the hidden layer weights in the extreme learning machine using feedback errors and iteratively update the hidden layer weights of the extreme learning machine, thereby obtaining the pre-trained extreme learning machine, using the pre-trained extreme learning machine as the discriminator of the GAN network, inputting the dimensionality reduction sample into the discriminator of the GAN network, and identifying the risky protocol.

18. A terminal comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is configured to operate according to the instructions to execute the steps of the method according to any one of claims 1-16.

19. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 16 are implemented.

Images