A method for identifying abnormal network traffic based on small sample data enhancement

Abstract

The present invention provides an abnormal network traffic identification method based on small sample data enhancement, comprising: S1, converting one-dimensional traffic data into a two-dimensional grayscale image, and using a twin network combined with a dynamic attention mechanism to analyze the differences between various types of traffic data pair by pair; analyzing the parameters of the attention mechanism in the twin attention network to identify the difference characteristics between classes; S2, using an inter-class feature difference matrix to select a training domain, introducing a comparative learning method to judge the difference between real data and generated data, and generating an enhanced data set for each type of traffic; S3, after receiving the enhanced data set sent by the central server, each edge server uses the enhanced data set and the local sample data to train the twin attention network in step S1; since the local sample data sets are different, each edge server is trained to obtain a personalized abnormal traffic identification and classification model suitable for the local data distribution, and effectively classifies the abnormal traffic.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic digital data processing, and in particular to a method for identifying abnormal network traffic based on small sample data enhancement. Background Art

[0002] In order to effectively deal with internal lateral attacks, the boundary-based security protection architecture is gradually being upgraded to a zero-trust-based security protection architecture. The zero-trust security protection architecture requires that data exposure between system servers be minimized to effectively protect system security. Classifying abnormal traffic can effectively analyze network attacks and strengthen system security protection in a targeted manner. It is an important means for the zero-trust architecture to protect system security. However, in actual applications, the amount of data in each category of abnormal traffic is much smaller than normal traffic, and there is a long-tail distribution problem in the classified abnormal traffic. When the zero-trust architecture restricts the sharing of data samples among servers, the long-tail distribution problem will be further aggravated. Therefore, in order to accurately classify abnormal traffic data while reducing data exposure between servers, the present invention proposes a training method for an abnormal traffic classification model based on data enhancement.

[0003] At present, the classification scheme of abnormal traffic mainly uses decision trees, encoders and contrastive learning methods to extract the characteristics of traffic data of each category, train models to analyze the difference in characteristics, and then use the obtained model to calculate the similarity score between the traffic to be judged and various types of traffic to complete the classification task of abnormal traffic. In order to solve the problem of long-tail distribution of network traffic data sets, some schemes use oversampling and undersampling methods to adjust the sampling ratio of various types of data to achieve the purpose of balancing the number of sample data pairs; other schemes use generative adversarial networks to learn the data characteristics of small samples, and then generate similar traffic data to expand the small sample data set to balance the amount of sample data of various types.

[0004] In actual production environments, most of the traffic data is normal traffic, and the data of some abnormal traffic accounts for a very small proportion. Models trained by existing abnormal traffic classification schemes tend to extract and match large sample features and ignore small sample features. Therefore, these schemes are difficult to accurately classify abnormal traffic with a small sample proportion, and there is a serious long-tail distribution problem. Some schemes improve the accuracy of abnormal traffic classification at the expense of recall rate, which reduces system performance.

[0005] In order to solve the long-tail distribution problem caused by the difference in the number of data in each category, existing solutions have proposed methods to transform the data set by oversampling or undersampling methods, or methods to enhance the data set by using generative adversarial networks. Data enhancement solutions that use oversampling and undersampling methods need to determine specific sampling strategies when all data are known. These solutions are difficult to protect data privacy and prevent lateral attacks within the system. The solution that uses generative adversarial networks to expand the data set cannot specifically identify the differences in features between various samples, is easily interfered by useless features in the samples, and has poor similarity between the generated data and the original data.

[0006] The zero-trust security protection architecture requires the system to expose private data to a minimum between servers, thereby protecting data security and limiting lateral attacks. This concept hinders the application of the central server's method of enhancing the data set by analyzing global data and changing the sampling method. The traditional method of generating adversarial network enhanced data sets based on global data training also cannot meet the requirements of the zero-trust architecture. Therefore, the application of the zero-trust architecture has brought huge challenges to the classification of abnormal traffic. Summary of the invention

[0007] Under the condition of protecting data privacy, the present invention proposes a method for identifying abnormal network traffic based on small sample data enhancement to solve the problem that the long-tail distribution of abnormal traffic data makes it difficult to accurately classify small sample data. This method constructs a fusion model of twin neural network and dynamic attention mechanism to extract the difference features between various types of traffic, and generates an enhanced data set based on the data enhancement method based on contrast generative adversarial network according to the difference features, and then personalizes the training of abnormal traffic classification model to efficiently classify abnormal traffic.

[0008] The technical means adopted by the present invention are as follows:

[0009] A method for identifying abnormal network traffic based on small sample data enhancement, comprising:

[0010] S1. Convert one-dimensional traffic data into two-dimensional grayscale images, and use the twin network combined with dynamic attention mechanism to analyze the differences between different types of traffic data pair by pair; analyze the parameters of the attention mechanism in the twin attention network to identify the difference characteristics between classes;

[0011] S2. Each edge server node uses a hierarchical clustering algorithm to select representative samples of each type of data locally and uploads the samples to the central server. The central server uses the samples uploaded by the edge server as the training set, uses the contrastive generative adversarial network to generate an enhanced data set, and sends it to each edge server. The training domain is selected using the inter-class feature difference matrix, and the contrastive learning method is introduced to determine the difference between the real data and the generated data, generating an enhanced data set for each type of traffic.

[0012] S3. After receiving the enhanced data set sent by the central server, each edge server uses the enhanced data set and local sample data to train the twin attention network in step S1; since the local sample data sets are different, each edge server is trained to obtain a personalized abnormal traffic recognition and classification model suitable for the local data distribution, and effectively classify abnormal traffic.

[0013] Furthermore, step S1 specifically includes:

[0014] S11, flow sample preprocessing;

[0015] In the flow sample preprocessing stage, the flow samples are first normalized and then converted into a two-dimensional grayscale image;

[0016] S12, build twin network;

[0017] The constructed twin network consists of two convolutional neural networks that share the same parameters The input of the twin network is a sample pair ,in , The input network is , During training, the convolutional neural network is initialized with random weights and the Euclidean distance between the two outputs is compared. , calculate the similarity of the network , and then update the network;

[0018] S13, build attention module;

[0019] Features are extracted using convolutional layers and pooling layers, where:

[0020] The feature extraction formula of the convolutional layer is:

[0021]

[0022] in, Indicates Layer features, Indicates Layer features, represents the layer weight, Indicates the offset, represents the extraction function;

[0023] The feature extraction formula of the pooling layer is:

[0024]

[0025] in, Indicates that the pooling scheme adopts maximum pooling;

[0026] The feature map input to the attention module is The output feature map is ,in, is the width of the feature map, is the height of the feature map, is the number of channels of the feature map, the input feature map And the output feature map The relational expression is:

[0027]

[0028]

[0029] in, , Represent the weight values ​​of the hidden layer and the fully connected layer respectively, and represents the pooling context, Represents the Sigmoid activation function;

[0030] S14, Twin Attention Network Federated Training;

[0031] After each round of local training in federated learning, each edge server uploads the parameters of the twin attention network. The central server aggregates the parameters of each pair of twin networks in turn, and sends the aggregated global parameters to each edge server to start a new round of iterative training.

[0032] The central server parameter aggregation formula is:

[0033]

[0034] in, Indicates that after aggregation Global parameters of the central server; Indicates Network parameters uploaded by edge servers; Indicates the number of edge servers, Indicates the edge server set to which it belongs;

[0035] The edge server parameter update formula is:

[0036]

[0037] in, , , They represent the parameters generated in this round, the parameters sent by the central server, and the original parameters respectively; represents the loss function of the edge server; represents the proximal term parameter;

[0038] S15, extracting difference feature matrix;

[0039] After completing the training of the twin attention network, each edge server extracts the output feature map of the attention module As a class , The key feature matrix of each category is expressed as:

[0040]

[0041] in, For Class , The difference characteristics between For Class The difference feature matrix, Indicates the number of categories.

[0042] Furthermore, step S11 specifically includes:

[0043] S111. Remove default values ​​and constants of the traffic sample and normalize data of each dimension of the traffic sample;

[0044] S112, convert the normalized sample into A pixel array, where is the normalized data dimension;

[0045] S113. According to the sample label category, take the Cartesian product of every two categories of samples, and then generate a sample pair .

[0046] Furthermore, in step S12, the similarity of the network The calculation formula is as follows:

[0047]

[0048] in, represents the total number of data logs; represents the boundary parameter; express Regularization term; For the for data pairs differences; Represents the data pair label; if the two data are of the same type, then On the contrary, .

[0049] Further, step S2 specifically includes:

[0050] S21, edge server uploads representative samples;

[0051] The difference feature matrix is ​​used to select the effective range of the image, and the mean square error is used as the hierarchical clustering distance calculation method;

[0052] Set upload thresholds for each type of data on each edge server , the number of uploaded samples of each category for:

[0053]

[0054] in, Indicates the number of samples of this type; Indicates the upload threshold;

[0055] S22, training contrast adversarial generative network;

[0056] Improve the loss function of the discriminator to increase intra-class differences Differences between classes Two parameters;

[0057] The optimization function formula of the contrast adversarial generation network is:

[0058]

[0059] in, For the generator With the discriminator The combined loss of represents the distribution of real data, represents the noise distribution, and Represent the outputs of the discriminator and the generator respectively; Represents the probability that the discriminator identifies a real sample as true; represents the probability that the discriminator identifies a false sample as false;

[0060] In contrast to the adversarial generative network, the loss function of the generator is The loss function of the discriminator They are:

[0061]

[0062]

[0063] in, represents the non-saturated loss function; and denote positive hyperparameters respectively; and They represent the contrast loss of similar samples and heterogeneous samples respectively. The formula of contrast loss is as follows:

[0064]

[0065]

[0066] in, and are the same type of samples and different type of samples generated respectively. Indicates the differences within and between classes;

[0067] S23, generate and distribute enhanced datasets;

[0068] In the process of generating enhanced data sets, a contrastive generative adversarial network is trained for each type of traffic sample based on the original sample labels. In order to prevent the difference in the number of samples between classes from affecting the subsequent abnormal traffic classification, the contrastive generative adversarial network stipulates the minimum and maximum number of enhanced data for each type. Finally, the number of enhanced data for each type of sample is:

[0069]

[0070] in, Indicates the minimum amount of data. Represents a variable parameter.

[0071] Furthermore, in step S21, the distance calculation formula of hierarchical clustering is:

[0072]

[0073]

[0074]

[0075] in, and is the length and width of the feature matrix; , Represents the original sample of a type of traffic; Represent the key feature matrix of this type of traffic; , Indicates a valid feature.

[0076] Further, in step S22, the intra-class and inter-class differences The calculation formula is:

[0077]

[0078] in, represents the number of samples, and k represent the generated samples and the original samples respectively, Representation sample Its own feature matrix, Indicates the generated sample , Representation sample With sample The difference feature matrix, represents a positive sample, represents positive or negative samples, Indicates the variable temperature coefficient.

[0079] Further, step S3 specifically includes:

[0080] S31, generating a local enhanced data set;

[0081] Each edge server selects samples from the enhanced data set according to the number of local samples of each type, and synthesizes the two types of samples into a local enhanced data set;

[0082] S32, train the local twin attention network;

[0083] Each edge server uses the enhanced local dataset to train the twin attention network in step S1. The trained model contains A twin attention network is used to identify abnormal traffic. A network is used to classify abnormal traffic. is the number of traffic categories;

[0084] S33, identifying abnormal traffic;

[0085] The traffic samples to be identified are randomly paired with various traffic samples in the local enhanced dataset. The binary classification twin attention network identifies abnormal traffic by calculating the distance between the sample pairs and normal and abnormal traffic samples respectively.

[0086] S34, determining the abnormal traffic category;

[0087] The abnormal traffic is paired with multiple instances from each abnormal class, and the generated sample pairs will be input into the corresponding twin attention network to calculate the distance between samples. The category with the smallest total sample distance will be determined as the category of abnormal traffic.

[0088] Compared with the prior art, the present invention has the following advantages:

[0089] 1. The present invention provides an abnormal network traffic identification method based on small sample data enhancement. It constructs an abnormal traffic classification model by integrating the dynamic attention mechanism and the twin neural network, and uses contrastive learning to increase the inter-class differences of the generated data, so that the generated enhanced data set is more suitable for the traffic classification task, improves the recall rate of the data set with a small sample size, and solves the problem that irrelevant features reduce the classification accuracy.

[0090] 2. The present invention provides an abnormal network traffic identification method based on small sample data enhancement, which constructs a traffic data enhancement model based on a comparative generative adversarial network, improves the similarity between the generated data and the original data, and solves the long-tail distribution problem in the classification process.

[0091] 3. The present invention provides an abnormal network traffic identification method based on small sample data enhancement. In the abnormal traffic classification process, a class difference feature extraction model based on a twin attention network is proposed. The model uses the attention mechanism to extract the key features of the traffic class, reduces the interference of irrelevant features, and improves the detection speed; the traffic classification model is trained by federated learning, which reduces the data exposure between edge servers and effectively improves the accuracy of abnormal traffic classification of each edge server while ensuring data privacy.

[0092] Based on the above reasons, the present invention can be widely promoted in the fields of electronic digital data processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0093] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0094] Figure 1 The figure is a flow chart of the method of the present invention.

[0095] Figure 2 This is a diagram of the inter-class difference feature recognition model provided by an embodiment of the present invention.

[0096] Figure 3 A comparative generative adversarial network model diagram provided in an embodiment of the present invention.

[0097] Figure 4 A flow chart of abnormal traffic classification provided by an embodiment of the present invention.

[0098] Figure 5 A twin attention network training flow chart provided for an embodiment of the present invention. DETAILED DESCRIPTION

[0099] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0100] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0101] Under the condition of protecting data privacy, the present invention proposes a method for identifying abnormal network traffic based on small sample data enhancement to solve the problem that the long-tail distribution of abnormal traffic data makes it difficult to accurately classify small sample data. This method constructs a fusion model of twin neural network and dynamic attention mechanism to extract the difference features between various types of traffic, and generates an enhanced data set based on the data enhancement method based on contrast generative adversarial network according to the difference features, and then personalizes the training of abnormal traffic classification model to efficiently classify abnormal traffic. Figure 1 As shown, the present invention provides an abnormal network traffic identification method based on small sample data enhancement, comprising:

[0102] S1. Convert the one-dimensional traffic data into a two-dimensional grayscale image, and use the twin network combined with the dynamic attention mechanism to analyze the differences between each type of traffic data pair by pair; the trained twin network can maximize the differences between each type of traffic data. Analyze the parameters of the attention mechanism in the twin attention network and identify the difference characteristics between classes;

[0103] S2. Each edge server node uses a hierarchical clustering algorithm to select representative samples of each type of data locally and uploads the samples to the central server. The central server uses the samples uploaded by the edge server as the training set, uses the contrastive generative adversarial network to generate an enhanced data set, and sends it to each edge server. In the process of generating the enhanced data set, the scheme uses the inter-class feature difference matrix to select the training domain, introduces the contrastive learning method to judge the difference between the real data and the generated data, and generates an enhanced data set for each type of traffic.

[0104] S3. After receiving the enhanced data set sent by the central server, each edge server uses the enhanced data set and local sample data to train the twin attention network in step S1; since the local sample data sets are different, each edge server is trained to obtain a personalized abnormal traffic recognition and classification model suitable for the local data distribution, and effectively classify abnormal traffic.

[0105] In specific implementation, as a preferred embodiment of the present invention, step S1, in the process of identifying the difference characteristics between classes, the present invention converts the one-dimensional flow data into a two-dimensional grayscale image, and uses a twin network combined with a dynamic attention mechanism to analyze the differences between each type of flow data pair by pair. The twin network obtained by training can maximize the differences between each type of flow data. Analyzing the parameters of the attention mechanism in the twin attention network can identify the difference characteristics between classes. Figure 2 It is the model diagram of the inter-class difference feature recognition of the present invention. Figure 2 As shown in the figure, identifying inter-class difference features is mainly divided into five steps, namely, traffic sample preprocessing, building a twin network, building an attention module, federated training of the twin attention network, and extracting a difference feature matrix, including:

[0106] S11, flow sample preprocessing;

[0107] In the flow sample preprocessing stage, the flow samples are first normalized and then converted into a two-dimensional grayscale image;

[0108] S12, build twin network;

[0109] Since the number of samples of some categories of abnormal traffic in the network traffic samples is small, it is difficult to accurately classify small sample traffic by constructing a global traffic classification model. The present invention uses a twin network to train a classification model for every two types of traffic. The twin network stage constructed in this step can effectively distinguish the two types of traffic samples by learning the differences between the samples. The twin network constructed in this embodiment consists of two convolutional neural networks that share the same parameters. The input of the twin network is a sample pair ,in , The input network is , During training, the convolutional neural network is initialized with random weights and the Euclidean distance between the two outputs is compared. , calculate the similarity of the network , and then update the network;

[0110] S13, build attention module;

[0111] Since the data features of some categories of abnormal traffic samples have high similarity, the present invention uses a dynamic attention mechanism to analyze the influence of different features on the difference between classes. The output of the attention module can be regarded as a weight matrix. Each type of feature of the traffic data has a corresponding weight value. The larger the weight, the greater the influence on the difference between classes. In this embodiment, convolutional layers and pooling layers are used to extract features, where:

[0112] The feature extraction formula of the convolutional layer is:

[0113]

[0114] in, Indicates Layer features, Indicates Layer features, represents the layer weight, Indicates the offset, represents the extraction function;

[0115] The feature extraction formula of the pooling layer is:

[0116]

[0117] in, Indicates that the pooling scheme adopts maximum pooling;

[0118] The feature map input to the attention module is The output feature map is ,in, is the width of the feature map, is the height of the feature map, is the number of channels of the feature map, the input feature map And the output feature map The relational expression is:

[0119]

[0120]

[0121] in, , Represent the weight values ​​of the hidden layer and the fully connected layer respectively, and represents the pooling context, Represents the Sigmoid activation function;

[0122] S14, Twin Attention Network Federated Training;

[0123] In this embodiment, the twin network integrated with the attention module is trained to maximize the inter-class distance, minimize the intra-class distance, and generate feature weights for distinguishing the two types of traffic. To protect the security of the system, the training process of the twin attention network is performed locally on each edge server. In order to make full use of the feature information contained in the samples of each edge server, this scheme uses a federated learning method to train the global optimal twin attention network. After completing the global twin attention network federation training, the feature weights of the attention module in the twin network are extracted, and the inter-class difference features and the important features of each type of sample are determined accordingly.

[0124] After each round of local training in federated learning, each edge server uploads the parameters of the twin attention network. The central server aggregates the parameters of each pair of twin networks in turn, and sends the aggregated global parameters to each edge server to start a new round of iterative training.

[0125] The central server parameter aggregation formula is:

[0126]

[0127] in, Indicates that after aggregation Global parameters of the central server; Indicates Network parameters uploaded by edge servers; Indicates the number of edge servers, Indicates the edge server set to which it belongs;

[0128] The edge server parameter update formula is:

[0129]

[0130] in, , , They represent the parameters generated in this round, the parameters sent by the central server, and the original parameters respectively; represents the loss function of the edge server; represents the proximal term parameter;

[0131] S15, extracting difference feature matrix;

[0132] After completing the training of the twin attention network, each edge server extracts the output feature map of the attention module As a class , The key feature matrix of each category is expressed as:

[0133]

[0134] in, For Class , The difference characteristics between For Class The difference feature matrix, Indicates the number of categories.

[0135] In specific implementation, as a preferred embodiment of the present invention, step S11 specifically includes:

[0136] S111. Remove default values ​​and constants of the traffic sample and normalize data of each dimension of the traffic sample;

[0137] S112, convert the normalized sample into A pixel array, where is the normalized data dimension;

[0138] S113. According to the sample label category, take the Cartesian product of every two categories of samples, and then generate a sample pair .

[0139] In specific implementation, as a preferred embodiment of the present invention, in step S12, the similarity of the network The calculation formula is as follows:

[0140]

[0141] in, represents the total number of data logs; represents the boundary parameter; express Regularization term; For the for data pairs differences; Represents the data pair label; if the two data are of the same type, then On the contrary, .

[0142] During specific implementation, as a preferred embodiment of the present invention, in order to solve the problem that the number of some abnormal traffic samples in the traffic data set is too small, step S2 proposes a solution to generate an enhanced data set using a contrastive generative adversarial network to improve detection accuracy. In this solution, each edge server node uses a hierarchical clustering algorithm to select representative samples of each type of data locally, and uploads the samples to the central server. The central server uses the samples uploaded by the edge server as a training set, uses a contrastive generative adversarial network to generate an enhanced data set, and sends it to each edge server. In the process of generating an enhanced data set, the scheme uses an inter-class feature difference matrix to select a training domain, introduces a contrastive learning method to determine the difference between real data and generated data, and generates similar data for each type of traffic. This solution includes 3 steps: the edge server uploads representative samples, trains a contrastive generative adversarial network, and generates and distributes an enhanced data set. Figure 3 It is a comparative generative adversarial network model diagram of the present invention, specifically including:

[0143] S21, edge server uploads representative samples;

[0144] In this embodiment, the edge server divides the samples into different clustering domains according to the traffic sample labels, uses a clustering algorithm to divide the samples with different labels into multiple categories, and selects the central sample of each category as a representative sample. Since the number of samples on each edge server is unevenly distributed, this solution uses a hierarchical clustering algorithm to adaptively output the number of classifications of each label data. Since the traffic data has been converted into an image form in the stage of identifying inter-class difference features, this solution uses a difference feature matrix to select the effective range of the image, and uses the mean square error as the hierarchical clustering distance calculation method;

[0145] In order to alleviate the adverse impact of sample imbalance on the subsequent generation of enhanced datasets, this scheme sets an upload threshold for each type of data on each edge server. , the number of uploaded samples of each category for:

[0146]

[0147] in, Indicates the number of samples of this type; Indicates the upload threshold;

[0148] S22, training contrast adversarial generative network;

[0149] After each edge server sends traffic data to the central server, the central server uses the contrastive generative adversarial network to generate an enhanced data set based on this data. Due to the scarcity of samples of some abnormal traffic, conventional generative adversarial networks cannot effectively learn their features, and the generated false data is difficult to use for subsequent abnormal traffic classification tasks. Therefore, this solution uses contrastive learning to enhance the generative adversarial network, and at the same time learns the differences between representative features within the class and between different categories, so that the generated data of different categories are far away from each other, and the same data are close to each other.

[0150] The traditional generative adversarial network iteratively trains the generator and the discriminator, so that the generator can generate fake data that is closest to the original data, and the discriminator can effectively identify the difference between the generated data and the original data. The comparative generative adversarial network of this solution follows this process and improves the loss function of the discriminator to increase the intra-class difference. Differences between classes Two parameters;

[0151] The optimization function formula of the contrast adversarial generation network is:

[0152]

[0153] in, For the generator With the discriminator The combined loss of represents the distribution of real data, represents the noise distribution, and Represent the outputs of the discriminator and the generator respectively; Represents the probability that the discriminator identifies a real sample as true; represents the probability that the discriminator identifies a false sample as false;

[0154] In the contrastive adversarial generative network, the loss functions of the generator and the discriminator are:

[0155]

[0156]

[0157] in, represents the non-saturated loss function; and denote positive hyperparameters respectively; and They represent the contrast loss of similar samples and heterogeneous samples respectively. The formula of contrast loss is as follows:

[0158]

[0159]

[0160] in, and are the same type of samples and different type of samples generated respectively. Indicates the differences within and between classes;

[0161] S23, generate and distribute enhanced datasets;

[0162] After completing the training of the contrastive generative adversarial network, the central server generates a global enhanced dataset, which contains traffic data of each category and is distributed to each edge server. In the process of generating the enhanced dataset, a contrastive generative adversarial network is trained for each type of traffic sample based on the original sample label. In order to prevent the difference in the number of samples between classes from affecting the subsequent classification of abnormal traffic, the contrastive generative adversarial network stipulates the minimum and maximum number of enhanced data for each category. Finally, the number of enhanced data for each category of samples is:

[0163]

[0164] in, Indicates the minimum amount of data. Represents a variable parameter.

[0165] In specific implementation, as a preferred embodiment of the present invention, in step S21, the distance calculation formula of hierarchical clustering is:

[0166]

[0167]

[0168]

[0169] in, and is the length and width of the feature matrix; , Represents the original sample of a type of traffic; Represent the key feature matrix of this type of traffic; , Indicates a valid feature.

[0170] In specific implementation, as a preferred embodiment of the present invention, in step S22, the intra-class and inter-class differences The calculation formula is:

[0171]

[0172] in, represents the number of samples, and k represent the generated samples and the original samples respectively, Representation sample Its own feature matrix, Indicates the generated sample , Representation sample With sample The difference feature matrix, represents a positive sample, represents positive or negative samples, Indicates the variable temperature coefficient.

[0173] In specific implementation, as a preferred embodiment of the present invention, after receiving the enhanced data set sent by the central server, each edge server uses the enhanced data set and local sample data to train the twin attention network proposed in the first part of the present invention. Since the local sample data sets are different, each edge server can be trained to obtain a personalized abnormal traffic identification and classification model suitable for the local data distribution, and effectively classify abnormal traffic. Step S3, identifying and classifying abnormal traffic includes 4 steps: generating a local enhanced data set, training a local twin attention network, identifying abnormal traffic, and determining the category of abnormal traffic. Figure 4 This is a flowchart for abnormal traffic identification and classification, which specifically includes:

[0174] S31, generating a local enhanced data set;

[0175] In this step, each edge server selects samples from the enhanced data set according to the number of local samples of each type, and synthesizes the two types of samples into a local enhanced data set; the number of traffic samples of each type in this data set is balanced and is used for subsequent training.

[0176] S32, train the local twin attention network;

[0177] In this step, each edge server uses the enhanced local data set to train the twin attention network in step S1. The newly trained twin attention network can effectively improve the long-tail distribution problem. The trained model contains A twin attention network is used to identify abnormal traffic. A network is used to classify abnormal traffic. is the number of traffic categories; Figure 5 Flowchart for training a Siamese Attention Network.

[0178] S33, identifying abnormal traffic;

[0179] In this step, the traffic samples to be identified are randomly paired with various types of traffic samples in the local enhanced dataset. The binary classification twin attention network identifies abnormal traffic by calculating the distance between the sample pairs and the normal and abnormal traffic samples respectively;

[0180] S34, determining the abnormal traffic category;

[0181] To effectively classify the abnormal traffic categories, in this step, the abnormal traffic is paired with multiple instances from each abnormal class, and the generated sample pairs will be input into the corresponding twin attention network to calculate the distance between samples, and the category with the smallest total sample distance will be determined as the category of abnormal traffic.

[0182] In summary, the present invention proposes a method for identifying abnormal network traffic based on small sample data enhancement, which includes three parts: identifying inter-class difference features, generating enhanced data sets, and classifying abnormal traffic.

[0183] To solve the problem of irrelevant features interfering with data enhancement and traffic classification, this paper proposes a model for extracting inter-class difference features based on a twin attention network. First, the model constructs a twin neural network for classification for every two types of traffic. Then, the classification performance of the model is continuously improved by training the attention module. Finally, representative inter-class difference features are extracted from the feature matrix of the attention module after iteration.

[0184] In the process of enhancing the abnormal traffic data set generation, in order to improve the quality of the enhanced data set, the present invention proposes a traffic data enhancement model based on a contrastive generative adversarial network. The model first uses a contrastive learning algorithm instead of a traditional distance algorithm to better analyze the differences between different categories of data. Then, the method of the present invention improves the loss function of the generative adversarial network discriminator from three aspects: global data, similar data, and heterogeneous data, so that the generated data of each category is significantly different from other categories of data, which can better support subsequent traffic classification tasks. Finally, the method of the present invention uses the generated data to balance the traffic data set, improving the long-tail distribution problem caused by uneven data distribution.

[0185] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for identifying abnormal network traffic based on small sample data enhancement, characterized in that: include: S1. Convert one-dimensional traffic data into two-dimensional grayscale images, and use the twin network combined with dynamic attention mechanism to analyze the differences between different types of traffic data pair by pair; analyze the parameters of the attention mechanism in the twin attention network to identify the difference characteristics between classes; S2. Each edge server node uses a hierarchical clustering algorithm to select representative samples of each type of data locally and uploads the samples to the central server. The central server uses the samples uploaded by the edge server as the training set, uses the contrastive generative adversarial network to generate an enhanced data set, and sends it to each edge server. The training domain is selected using the inter-class feature difference matrix, and the contrastive learning method is introduced to determine the difference between the real data and the generated data, generating an enhanced data set for each type of traffic. Step S2 specifically includes: S21, edge server uploads representative samples; The difference feature matrix is ​​used to select the effective range of the image, and the mean square error is used as the hierarchical clustering distance calculation method; Set upload thresholds for each type of data on each edge server , the number of uploaded samples of each category for: in, Indicates the number of samples of this type; Indicates the upload threshold; S22, training contrast adversarial generative network; Improve the loss function of the discriminator to increase intra-class differences Differences between classes Two parameters; The optimization function formula of the contrast adversarial generation network is: in, For the generator With the discriminator The combined loss of represents the distribution of real data, represents the noise distribution, and Represent the outputs of the discriminator and the generator respectively; Represents the probability that the discriminator identifies a real sample as true; represents the probability that the discriminator identifies a false sample as false; In contrast to the adversarial generative network, the loss function of the generator is The loss function of the discriminator They are: in, represents the non-saturated loss function; and denote positive hyperparameters respectively; and They represent the contrast loss of similar samples and heterogeneous samples respectively. The formula of contrast loss is as follows: in, and are the same type of samples and different type of samples generated respectively. Indicates the differences within and between classes; S23, generate and distribute enhanced datasets; In the process of generating enhanced data sets, a contrastive generative adversarial network is trained for each type of traffic sample based on the original sample labels. In order to prevent the difference in the number of samples between classes from affecting the subsequent abnormal traffic classification, the contrastive generative adversarial network stipulates the minimum and maximum number of enhanced data for each type. Finally, the number of enhanced data for each type of sample is: in, Indicates the minimum amount of data, Indicates variable parameters; S3. After receiving the enhanced data set sent by the central server, each edge server uses the enhanced data set and the local sample data to train the twin attention network in step S1; since the local sample data sets are different, each edge server trains a personalized abnormal traffic recognition and classification model suitable for the local data distribution, and effectively classifies the abnormal traffic; Step S3 specifically includes: S31, generating a local enhanced data set; Each edge server selects samples from the enhanced data set according to the number of local samples of each type, and synthesizes the two types of samples into a local enhanced data set; S32, train the local twin attention network; Each edge server uses the enhanced local dataset to train the twin attention network in step S1. The trained model contains A twin attention network is used to identify abnormal traffic. A network is used to classify abnormal traffic. is the number of traffic categories; S33, identifying abnormal traffic; The traffic samples to be identified are randomly paired with various traffic samples in the local enhanced dataset. The binary classification twin attention network identifies abnormal traffic by calculating the distance between the sample pairs and normal and abnormal traffic samples respectively. S34, determining the abnormal traffic category; The abnormal traffic is paired with multiple instances from each abnormal class, and the generated sample pairs will be input into the corresponding twin attention network to calculate the distance between samples. The category with the smallest total sample distance will be determined as the category of abnormal traffic.

2. According to claim 1, a method for identifying abnormal network traffic based on small sample data enhancement is characterized in that: Step S1 specifically includes: S11, flow sample preprocessing; In the flow sample preprocessing stage, the flow samples are first normalized, and then the one-dimensional flow samples are converted into two-dimensional grayscale images; S12, build twin network; The constructed twin network consists of two convolutional neural networks that share the same parameters The input of the twin network is a sample pair ,in , The input network is , During training, the convolutional neural network is initialized with random weights and the Euclidean distance between the two outputs is compared. , calculate the similarity of the network , and then update the network; S13, build attention module; Features are extracted using convolutional layers and pooling layers, where: The feature extraction formula of the convolutional layer is: in, Indicates Layer features, Indicates Layer features, represents the layer weight, Indicates the offset, represents the extraction function; The feature extraction formula of the pooling layer is: in, Indicates that the pooling scheme adopts maximum pooling; The feature map input to the attention module is The output feature map is ,in, is the width of the feature map, is the height of the feature map, is the number of channels of the feature map, the input feature map And the output feature map The relational expression is: in, , Represent the weight values ​​of the hidden layer and the fully connected layer respectively, and represents the pooling context, Represents the Sigmoid activation function; S14, Twin Attention Network Federated Training; After each round of local training in federated learning, each edge server uploads the parameters of the twin attention network. The central server aggregates the parameters of each pair of twin networks in turn, and sends the aggregated global parameters to each edge server to start a new round of iterative training. The central server parameter aggregation formula is: in, Indicates that after aggregation Global parameters of the central server; Indicates Network parameters uploaded by edge servers; Indicates the number of edge servers, Indicates the edge server set to which it belongs; The edge server parameter update formula is: in, , , They represent the parameters generated in this round, the parameters sent by the central server, and the original parameters respectively; represents the loss function of the edge server; represents the proximal term parameter; S15, extracting difference feature matrix; After completing the training of the twin attention network, each edge server extracts the output feature map of the attention module As a class , The key feature matrix of each category is expressed as: in, For Class , The difference characteristics between For Class The difference feature matrix, Indicates the number of categories.

3. According to claim 2, the method for identifying abnormal network traffic based on small sample data enhancement is characterized in that: Step S11 specifically includes: S111. Remove default values ​​and constants of the traffic sample and normalize data of each dimension of the traffic sample; S112, convert the normalized sample into A pixel array, where is the normalized data dimension; S113. According to the sample label category, take the Cartesian product of every two categories of samples, and then generate a sample pair .

4. According to claim 2, a method for identifying abnormal network traffic based on small sample data enhancement is characterized in that: In step S12, the similarity of the network The calculation formula is as follows: in, represents the total number of data logs; represents the boundary parameter; express Regularization term; For the for data pairs differences; Represents the data pair label; if the two data are of the same type, then On the contrary, .

5. According to claim 1, the method for identifying abnormal network traffic based on small sample data enhancement is characterized in that: In step S21, the distance calculation formula of hierarchical clustering is: in, and is the length and width of the feature matrix; , Represents the original sample of a type of traffic; Represent the key feature matrix of this type of traffic; , Indicates a valid feature.

6. According to claim 1, the method for identifying abnormal network traffic based on small sample data enhancement is characterized in that: In step S22, the intra-class and inter-class differences The calculation formula is: in, represents the number of samples, and k represent the generated samples and the original samples respectively, Representation sample Its own feature matrix, Indicates the generated sample , Representation sample With sample The difference feature matrix, represents a positive sample, represents positive or negative samples, Indicates the variable temperature coefficient.

Images