Network traffic classification model construction method, and network traffic classification method and device

Abstract

The invention relates to the technical field of network traffic classification, and discloses a network traffic classification model construction method and a network traffic classification method and device, and the method comprises the steps: obtaining historical network traffic, and carrying out the shunting of the historical network traffic; performing feature extraction on the historical network traffic offloading to obtain traffic features corresponding to the historical network traffic offloading; inputting the traffic features into a trained network traffic uniflow feature extraction model; and training the network traffic fusion rule tree model by using the uniflow features to obtain a target network traffic classification model. According to the invention, through the network flow uniflow feature extraction model based on the neural network, the corresponding uniflow features are extracted, and the interpretability of the classification features of the network flow uniflow feature extraction model is improved; and the classification accuracy of the network traffic classification model is improved. The input data volume of the classification model is reduced, the calculation time of the rule tree model is shortened, the model classification speed is increased, and the classification real-time performance is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of network traffic classification, and in particular to a network traffic classification model construction method, a network traffic classification method and a device. Background Art

[0002] Network traffic classification not only supports network management and network security behavior analysis, but is also a core element for in-depth exploration of network operations and their security. Network traffic classification is to check network traffic to characterize the ports and protocols used, establish monitoring and response for the network environment used, ensure real-time understanding of whether network organization behavior has abnormal conditions, timely discover security threats in the network, and ensure the normal operation of the network.

[0003] In the related technology, the existing network traffic classification methods mainly include classification methods based on port number matching, payload and transport layer behavior patterns, and machine learning classification methods based on traffic statistical characteristics. The classification methods based on port number matching, payload and transport layer behavior patterns cannot achieve accurate classification due to the influence of factors such as encrypted data packet headers; and the classification methods based on machine learning need to use a large amount of traffic data from different applications, or build a more complex deep learning network model in order to improve the accuracy of classification. Although the accuracy has been significantly improved, the speed of classification has been sacrificed, and more real-time classification cannot be achieved. In a high-speed network environment, network traffic changes rapidly, and a short classification delay may result in the inability to detect network traffic anomalies in a timely manner, which affects network management and network security behavior analysis. Summary of the invention

[0004] In view of this, the present invention provides a network traffic classification model construction method, a network traffic classification method and a device to solve the problem of being unable to timely discover network traffic anomalies.

[0005] In a first aspect, the present invention provides a method for constructing a network traffic classification model, comprising:

[0006] Obtain historical network traffic and classification labels corresponding to the historical network traffic, divert the historical network traffic, and obtain a number of historical network traffic diversions;

[0007] Extract features of historical network traffic diversion to obtain traffic features corresponding to historical network traffic diversion;

[0008] Input the traffic features into the trained network traffic single-flow feature extraction model to obtain the single-flow features corresponding to the traffic features;

[0009] The network traffic fusion rule tree model is trained using single-flow features and corresponding classification labels to obtain a target network traffic classification model, wherein the target network traffic classification model is used to classify network traffic.

[0010] In the present invention, by collecting historical network traffic and performing shunting, the traffic features corresponding to the historical network traffic shunting are input into the trained network traffic single-flow feature extraction model based on a neural network, and the corresponding single-flow features are extracted, thereby improving the interpretability of the classification features of the network traffic single-flow feature extraction model; by training the network traffic fusion rule tree model, the classification accuracy of the network traffic classification model is further improved. At the same time, the network traffic single-flow feature extraction model based on a neural network reduces the amount of input data of the classification model, thereby reducing the calculation time of the rule tree model, thereby improving the classification speed and ensuring the real-time nature of the classification.

[0011] In an optional implementation, the historical network traffic diversion includes a plurality of data packets, and feature extraction is performed on the historical network traffic diversion to obtain traffic features corresponding to the historical network traffic diversion, including:

[0012] The pyshark library is used to extract the packet size characteristics of a preset number of packets in the historical network traffic diversion, and the packet size characteristics are determined to be the traffic characteristics corresponding to the historical network traffic diversion.

[0013] In this method, by extracting the packet size features of a preset number of packets in historical network traffic diversion, the packet size features are determined as the traffic features corresponding to the historical network traffic diversion, thereby further improving the detection efficiency.

[0014] In an optional implementation, the network traffic single-flow feature extraction model is constructed in the following manner:

[0015] Get the single-flow feature label corresponding to the traffic feature;

[0016] Construct an initial traffic single-flow feature extraction model, which uses a shallow neural network;

[0017] Set the maximum number of iterations and minimum accuracy;

[0018] The initial traffic single-flow feature extraction model is trained using traffic features and single-flow feature labels until the accuracy of the initial traffic single-flow feature extraction model reaches a minimum accuracy, or the number of training iterations of the initial traffic single-flow feature extraction model reaches a maximum number of iterations, thereby obtaining a trained network traffic single-flow feature extraction model.

[0019] In this method, by constructing a single-flow feature extraction model for network traffic, the output of the constructed single-flow feature extraction model is to calculate and reduce the amount of input data of the classification model, thereby reducing the calculation time of the rule tree model and further improving the classification speed.

[0020] In an optional implementation, the network traffic fusion rule tree model is constructed in the following manner:

[0021] Using single-stream features, construct a neuron-output tree;

[0022] Based on the neuron-output tree, construct the input-neuron tree;

[0023] The neuron-output tree and the input-neuron tree are combined to generate a network traffic fusion rule tree model.

[0024] In this method, a neuron-output tree is constructed, and an input-neuron tree is constructed based on the neuron-output tree. The neuron-output tree and the input-neuron tree are merged to obtain a network traffic fusion rule tree model. The network traffic fusion rule tree model has stronger classification capabilities and higher classification accuracy. While improving the classification speed, it further ensures the accuracy of classification.

[0025] In a second aspect, the present invention provides a network traffic classification method, the method comprising:

[0026] Obtain the network traffic to be detected, split the network traffic to be detected, and obtain the split network traffic to be detected;

[0027] Extract features of the network traffic diversion to be detected, and obtain traffic features of the network traffic diversion to be detected;

[0028] The traffic characteristics are input into the target network traffic classification model to obtain the classification result corresponding to the network traffic to be detected, wherein the target network traffic classification model is constructed using any network traffic classification model construction method of the first aspect.

[0029] In the present invention, the network traffic to be detected is diverted and features are extracted to obtain traffic features, and the traffic features are input into a trained network traffic classification model to obtain classification results. While ensuring the accuracy of classification, the speed of classification is greatly improved, and timely detection of network traffic anomalies is achieved.

[0030] In a third aspect, the present invention provides a network traffic classification model construction device, the device comprising:

[0031] The first network traffic acquisition and diversion module is used to obtain historical network traffic and classification labels corresponding to the historical network traffic, divert the historical network traffic, and obtain a number of historical network traffic diversions;

[0032] The first feature extraction module is used to extract features of historical network traffic diversion to obtain traffic features corresponding to the historical network traffic diversion;

[0033] The single-flow feature extraction module is used to input the traffic features into the trained network traffic single-flow feature extraction model to obtain the single-flow features corresponding to the traffic features;

[0034] The classification model training module is used to train the network traffic fusion rule tree model using single-flow features and corresponding classification labels to obtain a target network traffic classification model, wherein the target network traffic classification model is used to classify network traffic.

[0035] In a fourth aspect, the present invention provides a network traffic classification device, the device comprising:

[0036] The second network traffic acquisition and diversion module is used to acquire the network traffic to be detected, divert the network traffic to be detected, and obtain the diversion of the network traffic to be detected;

[0037] The second feature extraction module is used to extract features of the network traffic diversion to be detected, and obtain traffic features of the network traffic diversion to be detected;

[0038] The network traffic classification module is used to input traffic features into a network traffic classification model to obtain classification results corresponding to the network traffic to be detected, wherein the network traffic classification model is constructed using the network traffic classification model construction device of the third aspect.

[0039] In a fifth aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor are communicatively connected to each other, computer instructions are stored in the memory, and the processor executes the network traffic classification model construction method of the first aspect or any corresponding embodiment thereof, or executes the network traffic classification method of the second aspect, by executing the computer instructions.

[0040] In a sixth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the network traffic classification model building method of the first aspect or any corresponding embodiment thereof, or to execute the network traffic classification method of the second aspect.

[0041] In a seventh aspect, the present invention provides a computer program product, comprising computer instructions, wherein the computer instructions are used to enable a computer to execute the network traffic classification model construction method of the first aspect or any corresponding embodiment thereof, or to execute the network traffic classification method of the second aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 It is a flowchart of a method for constructing a network traffic classification model according to an embodiment of the present invention.

[0044] Figure 2 It is a flowchart of a network traffic classification method based on machine learning according to an embodiment of the present invention.

[0045] Figure 3 It is a flowchart of another method for constructing a network traffic classification model according to an embodiment of the present invention.

[0046] Figure 4 It is a flow chart of a network traffic diversion feature extraction module according to an embodiment of the present invention.

[0047] Figure 5 It is a flowchart of constructing a network traffic fusion rule tree model according to an embodiment of the present invention.

[0048] Figure 6 It is a flowchart of a network traffic classification method according to an embodiment of the present invention.

[0049] Figure 7 It is a structural block diagram of a network traffic classification model building device according to an embodiment of the present invention.

[0050] Figure 8 is a structural block diagram of a network traffic classification device according to an embodiment of the present invention.

[0051] Fig. 9 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0053] In the related technology, the existing network traffic classification methods mainly include classification methods based on port number matching, payload and transport layer behavior patterns, and machine learning classification methods based on traffic statistical characteristics. The classification methods based on port number matching, payload and transport layer behavior patterns cannot achieve accurate classification due to the influence of factors such as encrypted data packet headers; and the classification methods based on machine learning need to use a large amount of traffic data from different applications, or build a more complex deep learning network model in order to improve the accuracy of classification. Although the accuracy has been significantly improved, the speed of classification has been sacrificed, and more real-time classification cannot be achieved. In a high-speed network environment, network traffic changes rapidly, and a short classification delay may result in the inability to detect network traffic anomalies in a timely manner, which affects network management and network security behavior analysis.

[0054] In order to solve the above problems, a method for building a network traffic classification model is provided in an embodiment of the present invention, which is used in a computer device. It should be noted that its execution subject can be a network traffic classification model construction device, which can be implemented as part or all of the computer device through software, hardware, or a combination of software and hardware. The computer device can be a terminal, a client, or a server. The server can be a single server or a server cluster composed of multiple servers. The terminal in the embodiment of the present application can be a smart phone, a personal computer, a tablet computer, or other intelligent hardware devices. In the following method embodiments, the execution subject is taken as an example of a computer device for explanation.

[0055] The computer equipment in this embodiment is suitable for current corporate offices that mostly rely on network offices on a unified platform, and uses network traffic classification technology to implement the use scenario of enterprise internal network detection. The present invention provides a method for building a network traffic classification model, which collects historical network traffic and performs diversion, inputs the traffic characteristics corresponding to the historical network traffic diversion into a trained network traffic single-stream feature extraction model based on a neural network, extracts the corresponding single-stream characteristics, and improves the interpretability of the classification characteristics of the network traffic single-stream feature extraction model; by training the network traffic fusion rule tree model, the classification accuracy of the network traffic classification model is further improved. At the same time, the network traffic single-stream feature extraction model based on a neural network reduces the amount of input data of the classification model, thereby reducing the calculation time of the rule tree model, thereby improving the classification speed and ensuring the real-time classification.

[0056] According to an embodiment of the present invention, an embodiment of a method for building a network traffic classification model is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0057] In this embodiment, a method for constructing a network traffic classification model is provided, which can be used in the above-mentioned computer device. Figure 1 is a flow chart of a method for constructing a network traffic classification model according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0058] Step S101, obtaining historical network traffic and classification labels corresponding to the historical network traffic, and diverting the historical network traffic to obtain a number of historical network traffic diversions.

[0059] In one example, network traffic generated by different types of applications, such as video applications and browser applications, is obtained and stored in pcap format; the acquisition method can use the T-shark command, specifically tshark-b duration:<duration for capturing a packet>-i<network interface>. The network traffic generated by the application is diverted based on the type of application. Network traffic consists of several streams, each of which contains several data packets. The diversion process divides the large pcap file of the entire network traffic into small pcap files for each stream, which are still stored in the pcap file format.

[0060] Step S102, extracting features of historical network traffic diversion to obtain traffic features corresponding to the historical network traffic diversion.

[0061] In one example, using the flow obtained by the above steps, the sizes of the first n data packets are extracted as features, where n can be set according to actual conditions, and can be 10, 12, 14, etc. The selection of numbers is not limited in the present invention. Each small pcap file is a sample data, and each sample has n traffic features.

[0062] Step S103, input the traffic feature into the trained network traffic single-flow feature extraction model to obtain the single-flow feature corresponding to the traffic feature.

[0063] In one example, the sample data set obtained in the above steps is divided into a training set and a test set in a ratio of 8:2, of which 80% is a training set and 20% is a test set, and the two parts are relatively independent and have no crossover samples; the packet size feature of each flow is used as the input of the network traffic single-flow feature extraction model to train the network traffic single-flow feature extraction model, and obtain the single-flow feature corresponding to the traffic feature.

[0064] Step S104, using the single flow features and the corresponding classification labels to train the network traffic fusion rule tree model to obtain a target network traffic classification model.

[0065] In the embodiment of the present invention, the target network traffic classification model is used to classify network traffic.

[0066] In one example, the output result of a network traffic single-flow feature extraction model is used to train a network traffic fusion rule tree model to obtain a target network traffic classification model.

[0067] In one implementation scenario, Figure 2 FIG. 1 is a flow chart of a network traffic classification method based on machine learning according to an embodiment of the present invention. Figure 2 As shown, the network traffic classification method based on machine learning includes: Step 1: Collecting historical network traffic and diverting the collected historical network traffic.

[0068] Step 2: Using the historical network traffic diversion obtained in step 1, extract the sizes of the first n data packets as input data for the classification model.

[0069] Step 3: Use the traffic features obtained in step 2 to train the network traffic single-flow feature extraction model.

[0070] Step 4: Use the output of the network traffic single-flow feature extraction model obtained in step 3 to train the network traffic fusion rule tree model.

[0071] Step 5: Collect and divert the network traffic to be tested in real time.

[0072] Step 6: After the network traffic to be detected is processed in step 5, the sizes of the first n data packets are extracted.

[0073] Step 7: Input the size of each data packet of the network traffic to be detected extracted in step 6 into the network traffic fusion rule tree model trained in step 4 to obtain the final classification result.

[0074] The network traffic classification model construction method provided in this embodiment collects historical network traffic and performs diversion, inputs the traffic features corresponding to the historical network traffic diversion into the trained network traffic single-flow feature extraction model based on a neural network, extracts the corresponding single-flow features, and improves the interpretability of the classification features of the network traffic single-flow feature extraction model; by training the network traffic fusion rule tree model, the classification accuracy of the network traffic classification model is further improved. At the same time, the network traffic single-flow feature extraction model based on a neural network reduces the amount of input data of the classification model, thereby reducing the calculation time of the rule tree model, thereby improving the classification speed and ensuring the real-time nature of the classification.

[0075] In this embodiment, a method for constructing a network traffic classification model is provided, which can be used in the above-mentioned computer device. Figure 3 is a flow chart of another method for constructing a network traffic classification model according to an embodiment of the present invention. Figure 3 As shown, the process includes the following steps:

[0076] Step S301, obtain historical network traffic and classification labels corresponding to the historical network traffic, and divide the historical network traffic to obtain several historical network traffic diversions. Figure 3 Step S301 of the illustrated embodiment will not be described in detail here.

[0077] Step S302: extract features of historical network traffic diversion to obtain traffic features corresponding to the historical network traffic diversion.

[0078] Specifically, the historical network traffic diversion includes several data packets, and the above step S302 includes:

[0079] Step S3021, using the pyshark library, extracting the data packet size characteristics of a preset number of data packets in the historical network traffic diversion, and determining that the data packet size characteristics are the traffic characteristics corresponding to the historical network traffic diversion.

[0080] In one example, Figure 4 FIG. 1 is a flow chart of a network traffic diversion feature extraction module according to an embodiment of the present invention. Figure 4 As shown, the process of extracting network traffic diversion features may include: using the flow obtained in the above steps, extracting the size of the first n data packets as features, where n can be set according to actual conditions, and can be 10, 12, 14, etc. The extraction method is specifically to use the pyshark library in python to extract; each small pcap file is a sample data, and each sample has n features.

[0081] Specifically, step a1, Lua script diversion: the diversion method uses the network packet analysis software Wireshark to provide an API interface for Lua, which can include three classes: Dumper, Field, and Listener. Dumper is a file writer, Field is for obtaining message attributes, and Listener is a listener for listening to messages that meet the filtering rules.

[0082] Step a2, extract features using Pyshark: The small pcap file obtained after diversion in step a1 uses the Pyshark library in Python to extract the sizes of the first n packets as features of the network traffic.

[0083] Step a3, store features: From step a2, each pcap file generates a vector containing n features. After extracting features from all samples, the extracted features are written into a csv file through the pandas library in Python.

[0084] In this method, by extracting the packet size features of a preset number of packets in historical network traffic diversion, the packet size features are determined as the traffic features corresponding to the historical network traffic diversion, thereby further improving the detection efficiency.

[0085] Step S303: input the traffic feature into the trained network traffic single-flow feature extraction model to obtain the single-flow feature corresponding to the traffic feature.

[0086] In an optional embodiment, a network traffic single-flow feature extraction model is constructed in the following manner: obtaining a single-flow feature label corresponding to a traffic feature; constructing an initial traffic single-flow feature extraction model, wherein the initial traffic single-flow feature extraction model adopts a shallow neural network; setting a maximum number of iterations and a minimum accuracy; using traffic features and single-flow feature labels, training the initial traffic single-flow feature extraction model until the accuracy of the initial traffic single-flow feature extraction model reaches the minimum accuracy, or the number of training iterations of the initial traffic single-flow feature extraction model reaches the maximum number of iterations, thereby obtaining a trained network traffic single-flow feature extraction model.

[0087] In one example, construction of a single-flow feature extraction model for network traffic may include: step b1: dividing the sample set obtained in step 201 into a training set and a test set in a ratio of 8:2, wherein 80% is a training set and 20% is a test set, and the two parts are relatively independent and have no crossover samples; using the packet size feature of each flow as the input of the single-flow feature extraction model for network traffic.

[0088] Step b2: Construct a single-flow feature extraction model for network traffic; the model adopts a shallow neural network, and sets the number of input neurons, the number of hidden layers, the number of neurons in each hidden layer, and the number of output neurons of the shallow neural network respectively.

[0089] Step b3: Use the n features of each sample obtained in the above step after diversion as the input of the network traffic single-flow feature extraction model to train the network traffic single-flow feature extraction model.

[0090] Step b4: Set the maximum number of iterations and use accuracy as the evaluation indicator. The training model has the highest and most stable accuracy, or the number of training iterations reaches the set value.

[0091] Step b5: Further use the test set samples to test the reliability of the feature extraction model. When its accuracy reaches the preset minimum accuracy, the model is retained. Otherwise, return to steps b3-b4 until the preset minimum accuracy is reached to obtain the optimal feature extraction model.

[0092] In this method, by constructing a single-flow feature extraction model for network traffic, the output of the constructed single-flow feature extraction model is to calculate and reduce the amount of input data of the classification model, thereby reducing the calculation time of the rule tree model and further improving the classification speed.

[0093] Step S304, using the single flow features and the corresponding classification labels to train the network traffic fusion rule tree model to obtain a target network traffic classification model.

[0094] In an optional embodiment, the network traffic fusion rule tree model is constructed in the following manner: using single-flow features to construct a neuron-output tree; based on the neuron-output tree, constructing an input-neuron tree; merging the neuron-output tree and the input-neuron tree to generate a network traffic fusion rule tree model.

[0095] In one example, the process of constructing a network traffic fusion rule tree model may include:

[0096] Step c1: constructing a neuron-output tree may include: Step c11: using the data packet size feature of each flow obtained in step 301 as the optimal feature extraction model obtained in the above steps.

[0097] Step c12: Extract the output of each neuron in each hidden layer in the optimal feature extraction model for each sample, the number of samples is A; specifically, there are l hidden layers, the i-th hidden layer contains k i neurons, i∈(0,l).

[0098] Step c13: Save the output of each neuron in each hidden layer in step c12. Each hidden layer is saved as a csv file. The size of the matrix in the i-th csv file is A*k i .

[0099] Step c14: Calculate the average of each sample for each csv document obtained in step c13, that is, calculate the average of each row of data in each document, and save it as a csv document. The document consists of an N*M matrix, where N represents the number of training set samples and M represents the number of neurons. Assuming that the number of training set samples is X and the first hidden layer has Y neurons, the csv is an X*Y matrix. The formula for calculating the average of each row is: Among them, I i represents the output of the ith neuron.

[0100] Step c15: Use the data generated in step c14 to train the decision tree. The sample labels of the data are consistent with the labels of the feature extraction model, and a neuron-output tree is obtained.

[0101] Step c2: constructing an input-neuron tree may include: Step c21: using the data of step c14 as the output of the decision tree regression algorithm, that is, the target value fitted by the decision regression algorithm.

[0102] Step c22: Input the features obtained in the above steps into the decision tree regression algorithm.

[0103] Step c23: Match each column of the csv file generated in step c14 to the features obtained in the above steps one by one, and input the decision tree regression algorithm to generate a tree, that is, each hidden layer generates an input-neuron tree.

[0104] Step c3: merging the tree obtained by merging the neuron-output tree and the input-neuron tree to generate a rule tree may include: Step c31: merging the input-neuron tree and the neuron-output tree with the hidden layer as the relationship link.

[0105] Step c32: Save the rule tree obtained in step c31.

[0106] Specifically, Figure 5 FIG. 1 is a flow chart of constructing a network traffic fusion rule tree model according to an embodiment of the present invention. Figure 5 As shown, the process of constructing a network traffic fusion rule tree model may include: step d1, inputting training set data features into a trained feature extraction model.

[0107] Step d2, obtain the output data of each neuron in the hidden layer.

[0108] Step d3, determine whether the output data of all hidden layer neurons are obtained. If the output data of each hidden layer is not completely obtained, return to step d2; if it is completely obtained, enter step d4.

[0109] Step d4, the data of step d3 is used as the input of the decision tree classification algorithm, and the output of the decision tree is the output result of the optimal feature extraction model, and a neuron-output tree is obtained.

[0110] Step d5, generating an input-neuron tree, using the data of the input feature extraction model as the input of the decision tree regression algorithm, and using the data of step d3 as the output of the decision tree regression algorithm to obtain an input-neuron tree.

[0111] Step d6, determining whether all input-neuron trees have been generated; Step d6, combining the neuron-output tree of step d4 and the input-neuron tree of step d6 into a complete rule tree according to the relationship of the hidden layer data.

[0112] In this method, a neuron-output tree is constructed, and an input-neuron tree is constructed based on the neuron-output tree. The neuron-output tree and the input-neuron tree are merged to obtain a network traffic fusion rule tree model. The network traffic fusion rule tree model has stronger classification capabilities and higher classification accuracy. While improving the classification speed, it further ensures the accuracy of classification.

[0113] The network traffic classification model construction method provided in this embodiment further improves the detection efficiency by extracting the packet size features of a preset number of packets in the historical network traffic diversion, and determining the packet size features as the traffic features corresponding to the historical network traffic diversion. By constructing a single-stream feature extraction model for network traffic, the output of the constructed single-stream feature extraction model for network traffic is calculated to reduce the amount of input data of the classification model, thereby reducing the calculation time of the rule tree model and further improving the classification speed. By constructing a neuron-output tree, an input-neuron tree is constructed based on the neuron-output tree, and the neuron-output tree and the input-neuron tree are merged to obtain a network traffic fusion rule tree model. The network traffic fusion rule tree model has a stronger classification ability and a higher classification accuracy. While improving the classification speed, the accuracy of classification is further guaranteed.

[0114] In this embodiment, a network traffic classification method is provided, which can be used for the above-mentioned computer device. Figure 6 is a flow chart of a network traffic classification method according to an embodiment of the present invention. Figure 6 As shown, the process includes the following steps:

[0115] Step S601, obtaining the network traffic to be detected, and diverting the network traffic to be detected to obtain the diverted network traffic to be detected.

[0116] In one example, the network traffic to be detected is collected and diverted in real time, specifically including: Step e1: obtaining the network traffic generated by different types of applications, such as video applications and browser applications, and storing it in pcap format; the acquisition method can use the T-shark command, specifically tshark -b duration:<duration for capturing a packet> -i<network interface>.

[0117] Step e2: Divide the network traffic generated by the application based on its type. Network traffic consists of several flows, each of which contains several data packets. Dividing the large pcap file of the entire network traffic into small pcap files for each flow is still stored in the pcap file format.

[0118] Step S602, extracting features of the network traffic diversion to be detected, and obtaining traffic features of the network traffic diversion to be detected.

[0119] In one example, after the network traffic to be detected is processed by the above steps, the size features of the first n data packets are extracted, specifically including: using the flow obtained by the above steps, extracting the sizes of the first n data packets as features, where n can be set according to actual conditions, and numbers such as 10, 12, and 14 can be selected; the extraction method is specifically to use the pyshark library in python to extract; each small pcap file is a sample data, and each sample has n features.

[0120] Step S603, inputting the traffic characteristics into the target network traffic classification model to obtain the classification result corresponding to the network traffic to be detected.

[0121] In the embodiment of the present invention, the target network traffic classification model is constructed by using the network traffic classification model construction method in the above steps.

[0122] In one example, the size features of each data packet of the network traffic to be detected extracted in the above steps are respectively input into the target network traffic classification model constructed using the network traffic classification model construction method in the above steps to obtain the final classification result.

[0123] The network traffic classification method provided in this embodiment diverts the network traffic to be detected, extracts features of the diverted network traffic to be detected, obtains traffic features, inputs the traffic features into a trained network traffic classification model, and obtains classification results. While ensuring classification accuracy, the classification speed is greatly improved, and timely detection of network traffic anomalies is achieved.

[0124] In this embodiment, a network traffic classification model construction device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware for a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0125] This embodiment provides a network traffic classification model construction device, such as Figure 7 As shown, including:

[0126] The first network traffic acquisition and diversion module 701 is used to obtain historical network traffic and classification labels corresponding to the historical network traffic, divert the historical network traffic, and obtain a number of historical network traffic diversions. Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0127] The first feature extraction module 702 is used to extract features from historical network traffic diversion to obtain traffic features corresponding to historical network traffic diversion. Figure 1 Step S102 of the illustrated embodiment will not be described in detail here.

[0128] The single-flow feature extraction module 703 is used to input the traffic feature into the trained network traffic single-flow feature extraction model to obtain the single-flow feature corresponding to the traffic feature. Figure 1 Step S103 of the illustrated embodiment will not be described in detail here.

[0129] The classification model training module 704 is used to train the network traffic fusion rule tree model using single-flow features and corresponding classification labels to obtain a target network traffic classification model, wherein the target network traffic classification model is used to classify network traffic. Figure 1 Step S104 of the illustrated embodiment will not be described in detail here.

[0130] In some optional implementations, the first feature extraction module 702 includes:

[0131] The first feature extraction unit is used to use the pyshark library to extract the data packet size features of a preset number of data packets in the historical network traffic diversion, and determine that the data packet size features are the traffic features corresponding to the historical network traffic diversion.

[0132] In some optional implementations, the network traffic single-flow feature extraction model is constructed in the following manner:

[0133] The single-flow feature label acquisition unit is used to acquire the single-flow feature label corresponding to the traffic feature.

[0134] The initial traffic single-flow feature extraction model is used to construct the initial traffic single-flow feature extraction model according to the unit, and the initial traffic single-flow feature extraction model adopts a shallow neural network.

[0135] Threshold setting unit, used to set the maximum number of iterations and the minimum accuracy.

[0136] The model training unit is used to train the initial traffic single-flow feature extraction model using traffic features and single-flow feature labels until the accuracy of the initial traffic single-flow feature extraction model reaches a minimum accuracy, or the number of training iterations of the initial traffic single-flow feature extraction model reaches a maximum number of iterations, thereby obtaining a trained network traffic single-flow feature extraction model.

[0137] In some optional implementations, the network traffic fusion rule tree model is constructed in the following manner:

[0138] The neuron-output tree construction unit is used to construct a neuron-output tree using single-stream features.

[0139] The input-neuron tree construction unit is used to construct an input-neuron tree based on the neuron-output tree.

[0140] The network traffic fusion rule tree model generation unit is used to merge the neuron-output tree and the input-neuron tree to generate a network traffic fusion rule tree model.

[0141] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0142] The network traffic classification model building device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0143] In this embodiment, a network traffic classification device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0144] This embodiment provides a network traffic classification device, such as Figure 8 As shown, including:

[0145] The second network traffic acquisition and diversion module 801 is used to obtain the network traffic to be detected, divert the network traffic to be detected, and obtain the diversion of the network traffic to be detected. Figure 6 Step S601 of the illustrated embodiment will not be described in detail here.

[0146] The second feature extraction module 802 is used to extract features of the network traffic diversion to be detected, and obtain the traffic features of the network traffic diversion to be detected. Figure 6 Step S602 of the illustrated embodiment will not be described in detail here.

[0147] The network traffic classification module 803 is used to input the traffic characteristics into the network traffic classification model to obtain the classification result corresponding to the network traffic to be detected, wherein the network traffic classification model is constructed by using the network traffic classification model construction device of the third aspect. Figure 6 Step S603 of the illustrated embodiment will not be described in detail here.

[0148] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0149] The network traffic classification device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0150] The embodiment of the present invention also provides a computer device having the above Figure 7 The network traffic classification model building device shown and Figure 8 The network traffic classification model shown.

[0151] See also Fig. 9 , Fig. 9 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Fig. 9 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Fig. 9 A processor 10 is taken as an example.

[0152] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0153] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0154] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0155] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0156] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Fig. 9 The example of connecting through bus is taken in the following.

[0157] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0158] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0159] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0160] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for constructing a network traffic classification model, characterized in that: The method comprises: Acquire historical network traffic and classification labels corresponding to the historical network traffic, and divert the historical network traffic to obtain a number of historical network traffic diversions; Extracting features of the historical network traffic diversion to obtain traffic features corresponding to the historical network traffic diversion; Input the traffic feature into a trained network traffic single-flow feature extraction model to obtain a single-flow feature corresponding to the traffic feature; The network traffic fusion rule tree model is trained using the single-flow features and the corresponding classification labels to obtain a target network traffic classification model, wherein the target network traffic classification model is used to classify network traffic.

2. The method according to claim 1, characterized in that: The historical network traffic diversion includes a plurality of data packets, and the feature extraction of the historical network traffic diversion is performed to obtain the traffic features corresponding to the historical network traffic diversion, including: The pyshark library is used to extract the data packet size characteristics of a preset number of data packets in the historical network traffic diversion, and the data packet size characteristics are determined to be the traffic characteristics corresponding to the historical network traffic diversion.

3. The method according to claim 1, characterized in that The network traffic single-flow feature extraction model is constructed in the following way: Obtaining a single flow feature label corresponding to the traffic feature; Constructing an initial traffic single-flow feature extraction model, wherein the initial traffic single-flow feature extraction model adopts a shallow neural network; Set the maximum number of iterations and minimum accuracy; The initial traffic single-flow feature extraction model is trained using the traffic characteristics and the single-flow feature labels until the accuracy of the initial traffic single-flow feature extraction model reaches the minimum accuracy, or the number of training iterations of the initial traffic single-flow feature extraction model reaches the maximum number of iterations, thereby obtaining a trained network traffic single-flow feature extraction model.

4. The method according to claim 1, characterized in that: The network traffic fusion rule tree model is constructed in the following way: Using the single stream features, constructing a neuron-output tree; Based on the neuron-output tree, construct an input-neuron tree; The neuron-output tree and the input-neuron tree are combined to generate a network traffic fusion rule tree model.

5. A network traffic classification method, characterized in that: The method comprises: Acquire the network traffic to be detected, and divert the network traffic to be detected to obtain diverted network traffic to be detected; Extracting features of the network traffic diversion to be detected to obtain traffic features of the network traffic diversion to be detected; The traffic characteristics are input into a target network traffic classification model to obtain a classification result corresponding to the network traffic to be detected, wherein the target network traffic classification model is constructed using the network traffic classification model construction method described in any one of claims 1-4.

6. A network traffic classification model construction device, characterized in that: The device comprises: A first network traffic acquisition and diversion module is used to acquire historical network traffic and classification labels corresponding to the historical network traffic, and divert the historical network traffic to obtain a number of historical network traffic diversions; A first feature extraction module is used to extract features of the historical network traffic diversion to obtain traffic features corresponding to the historical network traffic diversion; A single-flow feature extraction module, used for inputting the traffic feature into a trained network traffic single-flow feature extraction model to obtain a single-flow feature corresponding to the traffic feature; The classification model training module is used to train the network traffic fusion rule tree model using the single-flow features and the corresponding classification labels to obtain a target network traffic classification model, wherein the target network traffic classification model is used to classify network traffic.

7. A network traffic classification device, characterized in that: The device comprises: A second network traffic acquisition and diversion module is used to acquire the network traffic to be detected, and divert the network traffic to be detected to obtain the diversion of the network traffic to be detected; A second feature extraction module is used to extract features of the network traffic diversion to be detected to obtain traffic features of the network traffic diversion to be detected; A network traffic classification module is used to input the traffic characteristics into a network traffic classification model to obtain a classification result corresponding to the network traffic to be detected, wherein the network traffic classification model is constructed using the network traffic classification model construction device described in claim 6.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the network traffic classification model construction method described in any one of claims 1 to 4 or the network traffic classification method described in claim 5 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the network traffic classification model construction method described in any one of claims 1 to 4 or the network traffic classification method described in claim 5.

10. A computer program product, characterized in that It includes computer instructions, and the computer instructions are used to enable a computer to execute the network traffic classification model construction method described in any one of claims 1 to 4 or the network traffic classification method described in claim 5.

Images