Flow classification method and system based on smooth noise data enhancement

Abstract

The invention discloses a traffic classification method and system based on smooth noise data enhancement, and the method comprises the steps: generating unified normalized noise through a noise generation module, and converting the normalized noise into feature noise; the noise optimization module optimizes the noise shape through a gradient-based algorithm and optimizes the noise scale through an improved Bayesian optimizer; the data enhancement module generates optimized smooth noise according to the optimized noise shape and noise scale, and adds the optimized smooth noise to a benign sample and a malicious sample to obtain an enhanced new sample; and the integrated learning module uniformly takes the enhanced samples as pseudo malicious samples, trains the traffic classifier, collects results of the traffic classifier trained under multiple groups of noise scales, and combines the classification results by using an improved Boosting algorithm to obtain a final classification result. According to the method, the classification boundary of the traffic classifier is effectively optimized, the recall ratio of the traffic classifier to the unknown type of malicious traffic is improved, and the generalization of the classification result is enhanced.

Description

Technical Field

[0001] The present invention relates to the field of computer network security, and in particular to a traffic classification method and system based on smooth noise data enhancement. Background Art

[0002] Network traffic classification is an important task in the field of cyberspace security and network management. In cyberspace security technology, identifying malicious traffic from benign traffic for network anomaly detection is an important aspect. In recent years, researchers have mostly chosen to use machine learning and deep learning methods to identify malicious traffic. They extract multiple features from traffic and use traffic as sample nodes. Then, based on the traffic features, they use machine learning or deep learning models to detect the maliciousness of each node.

[0003] Current traffic classification methods can already meet the traffic classification needs under various conditions. However, most of these methods are limited to the traffic categories that appear in the training set, and cannot learn the data rules behind the traffic samples, and cannot output appropriate categories for data outside the training set. Compared with the classification performance on the test set, the traffic classifier cannot maintain a high accuracy when facing unknown types of malicious traffic. Summary of the invention

[0004] In view of the above defects or improvement needs of the prior art, the present invention provides a traffic classification method based on smooth noise data enhancement to improve the generalization of traffic classification.

[0005] In order to achieve the above object, the technical solution adopted by the present invention is as follows:

[0006] A first aspect provides a traffic classification method based on smooth noise data enhancement, comprising:

[0007] Generate uniform normalized noise, and use the cumulative distribution function of Gaussian function, ISRU function and inverse tangent function to process the normalized noise and convert it into characteristic noise;

[0008] The noise shape is optimized by a gradient-based algorithm, where the gradient-based algorithm uses a loss function based on the softmax probability of the traffic classifier; the noise scale is optimized by an improved Bayesian optimizer, where the sample is divided into several parts before optimization, and in each sample, the benign sample and each type of malicious sample are independently optimized;

[0009] Generate optimized smooth noise according to the optimized noise shape and noise scale, and add the smooth noise to the benign sample and the malicious sample respectively to obtain enhanced samples, wherein the enhanced samples include enhanced benign samples and enhanced malicious samples;

[0010] The enhanced benign samples and malicious samples are uniformly marked as pseudo-malicious samples and added to the original samples as training sets to train the traffic classifier. The classification results of the traffic classifier trained under multiple groups of enhanced samples are collected, and the weights are calculated using the improved Boosting algorithm. The classification results are weighted averaged to obtain the final classification results. Among them, the improved Boosting algorithm uses the recall rate of the traffic classifier on benign samples as the basis for weight calculation.

[0011] In one implementation, the formula used to convert normalized noise into characteristic noise is:

[0012]

[0013] p i =F n,i (ε n,i ),i=1,2…d

[0014] Where Ψ represents the noise conversion function, ε n is the normalized noise, ε n Contains d dimensions, and ε n Subordinate to the distribution Dn, ε n,i is the i-th dimension of the noise, Ψ i (ε n,i ) represents ε n,i The corresponding noise characteristic, F n,i is the cumulative distribution function of Dn, p i is the cumulative distribution function value of the i-th dimension, t is the noise scale factor, and is the target parameter for noise scale optimization. and is the noise shape factor, which is the target parameter for noise shape optimization. Shared by the noise of all dimensions, It is peculiar to the noise of a single dimension, k is the subscript of the noise shape factor, and represents three special distribution functions: Gaussian function, ISRU function and inverse tangent function. is the cumulative distribution function of the kth distribution function.

[0015] In one embodiment, the noise shape is optimized by a gradient-based algorithm. The original samples are used as a training set and the noisy samples are used as a test set. The loss function used in the optimization process is as follows:

[0016]

[0017] in, is the loss function of the noise shape optimization process, and are the loss functions of misclassified samples and correctly classified samples, respectively, n is the normalized noise following the distribution Dn, x (ns) is the nsth original sample in the training set, the training set size is N, Θ is the set of noise shape factors, Λ(Θ) is the regularization term, λ is the hyperparameter controlling the regularization strength, is the indicator function, Ψ(ε n ) is the characteristic noise, f is the classification process of the traffic classifier, s is the scoring function of the traffic classifier, is the category space of traffic samples, and is the loss function for the misclassified samples and correctly classified samples of a certain category, c is a category in the category space, f is the classification result of the classifier on category c, s c is the scoring function value of category c.

[0018] In one embodiment, when optimizing the noise scale by using the improved Bayesian optimizer, the loss function used includes:

[0019] T={T 1 ,……,T ks}

[0020] T ks =x tr,ks ∪x te,ks

[0021]

[0022] Among them, T is the original sample set, T ks is the ksth sample, x tr,ks and x te,ks From T ks The training samples and test samples are divided into and are malicious samples and benign samples in the training samples, respectively. is a malicious sample with the category of ic in the training sample; is the loss function of malicious samples of category ic, is the loss function of benign samples; Tr is the training set, Te is the test set, and Accuracy is the accuracy of the traffic classifier on the test set Te after training on the training set Tr; A training set constructed for malicious samples of category ic, which contains original benign samples and the original malicious sample of category ic Also contains enhanced samples and A training set constructed for benign traffic, which contains original benign samples and enhanced samples In the corresponding training set, it is marked as a malicious sample; Te ks is the test set, which contains the original benign samples and all categories of original malicious samples Enhanced sample of malicious traffic From the original sample Add noise to get; enhance the sample A set of enhanced samples after adding noise to each type of benign samples.

[0023] In one implementation, smooth noise is added to benign samples and malicious samples respectively to obtain enhanced samples, including:

[0024] Split the training set into multiple training subsets, where each training subset includes benign samples and malicious samples, and each subset is used to optimize a set of noise scales;

[0025] Generate a corresponding batch of enhanced samples for each set of noise scales.

[0026] In one embodiment, the enhanced sample is obtained by:

[0027]

[0028] Among them, Optimizer is the noise scale optimizer, ks is the number of samples, ic is a certain category, is the loss function of benign samples, tb ks is the optimized benign sample noise scale, is the loss function of malicious samples, is the optimized malicious sample noise scale sequence, Large returns the sequence The pth optimal factor in is a factor group consisting of two noise factors, is the conversion function of normalized noise according to the noise factor group, x ks is the original sample, The enhanced sample.

[0029] In one implementation, the weights are calculated using an improved Boosting algorithm, including:

[0030] Select all benign samples as the test set, count the error rate of the weak classifier on the benign samples, and calculate the weight update factor;

[0031] The weights are calculated based on the weight update factor.

[0032] Based on the same inventive concept, the second aspect of the present invention provides a traffic classification system based on smooth noise data enhancement, comprising:

[0033] A noise generation module is used to generate uniform normalized noise, and process the normalized noise using the cumulative distribution function of the Gaussian function, the ISRU function, and the inverse tangent function to convert it into characteristic noise;

[0034] The noise optimization module optimizes the noise shape through a gradient-based algorithm, where the gradient-based algorithm uses a loss function based on the softmax probability of the traffic classifier; the noise scale is optimized through an improved Bayesian optimizer, and the samples are divided into several parts before optimization. In each sample, independent optimization processes are performed on benign samples and each type of malicious samples;

[0035] A data enhancement module, used for generating optimized smooth noise according to the optimized noise shape and noise scale, and adding the smooth noise to the benign sample and the malicious sample respectively to obtain enhanced samples, wherein the enhanced samples include enhanced benign samples and enhanced malicious samples;

[0036] The integrated learning module is used to uniformly mark the enhanced benign samples and malicious samples as pseudo-malicious samples, add them to the original samples as training sets to train the traffic classifier, collect the classification results of the traffic classifier trained under multiple groups of enhanced samples, use the improved Boosting algorithm to calculate the weights, and perform weighted averaging on the classification results to obtain the final classification results. Among them, the improved Boosting algorithm uses the recall rate of the traffic classifier on benign samples as the basis for weight calculation.

[0037] Based on the same inventive concept, the third aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the traffic classification method based on smooth noise data enhancement described in the first aspect.

[0038] Based on the same inventive concept, the fourth aspect of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the traffic classification method based on smooth noise data enhancement described in the first aspect is implemented.

[0039] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows:

[0040] The system of the present invention includes a noise generation module, a noise optimization module, a data enhancement module and an integrated learning module; the noise generation module generates a unified normalized noise, and uses three functions such as ISRU to convert the normalized noise into characteristic noise; the noise optimization module optimizes the noise shape through a gradient-based algorithm, and optimizes the noise scale through an improved Bayesian optimizer; the data enhancement module generates optimized smooth noise according to the optimized noise shape and noise scale, and adds the noise to benign samples and malicious samples respectively to obtain enhanced samples; the integrated learning module uniformly uses the enhanced samples as pseudo-malicious samples, trains the traffic classifier, collects the results of the traffic classifier trained under multiple groups of noise scales, and uses an improved Boosting algorithm to combine the classification results to obtain the final classification results. The present invention effectively optimizes the classification boundary of the traffic classifier, improves the recall rate of the traffic classifier for unknown types of malicious traffic, and enhances the generalization of the classification results. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1 The overall flow chart of the traffic classification method based on smooth noise data enhancement according to an embodiment of the present invention;

[0043] Figure 2 A schematic diagram of the data enhancement and integrated learning module flow provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0044] The key points and main inventive concepts of the present invention include:

[0045] (1) The system of the present invention generates characteristic noise through a noise generation module, uses noise shape factors and noise scale factors to characterize the relative noise distribution between different dimensions and the overall noise distribution in all dimensions, and optimizes the noise through noise shape optimization methods and noise scale optimization methods. The noise shape optimization method superimposes three special distribution functions and searches for the optimal noise shape factor through a gradient-based algorithm; the noise scale optimization method constructs loss functions for benign samples and malicious samples respectively. In order to improve the generalization of classification results, when enhancing benign samples, the noise-added samples are set as known pseudo-malicious samples, and the original malicious samples are set as unknown samples; when enhancing malicious samples, malicious samples of a single category are set as known malicious samples, and the remaining types of malicious samples are set as unknown samples; the optimized noise shape factor and noise scale factor can achieve the anisotropy of the noise shape and the smoothness of the noise scale, so that the enhanced samples can converge to the classification boundary of the traffic classifier, and improve the generalization of the classification performance on real unknown malicious traffic.

[0046] (2) The present invention collects several groups of noise scale factors with the best optimization effect through a data enhancement module, combines the noise scale factors of benign samples and malicious samples into a noise scale factor group, generates feature noise through the noise scale factor group, and uses the feature noise to perform data enhancement on the original sample. Different factor groups improve the adaptability of feature noise to the heterogeneous features of samples, so that the enhanced samples form a smooth classification boundary, providing a strict generalization guarantee for the classification performance.

[0047] (3) The integrated learning module of the present invention uniformly marks the enhanced benign samples and malicious samples as pseudo-malicious samples, adds them to the original samples, and uses them as training sets to train the traffic classifier. The trained classifier only learns the classification boundary under a single noise scale factor group. Therefore, the integrated learning module collects the classification results of multiple groups of trained weak classifiers, uses the improved Boosting algorithm to calculate the weights, and weights the classification results. The improved Boosting algorithm selects all benign samples as the test set, and counts the error rate of the weak classifier on the benign samples to calculate the weight update factor. The weighted classification results weaken the preference of smooth noise for malicious samples, maintain the recall rate of the classifier on benign samples, and improve the classification performance overall.

[0048] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0049] Embodiment 1

[0050] The present invention discloses a traffic classification method based on smooth noise data enhancement, comprising:

[0051] S1: Generate uniform normalized noise, and use the cumulative distribution function of the Gaussian function, ISRU function (Inverse Square RootUnit activation function) and inverse tangent function to process the normalized noise and convert it into characteristic noise;

[0052] S2: The noise shape is optimized by a gradient-based algorithm, where the gradient-based algorithm uses a loss function based on the softmax probability of the traffic classifier; the noise scale is optimized by an improved Bayesian optimizer, where the sample is divided into several parts before optimization, and in each sample, independent optimization processes are performed on benign samples and each type of malicious samples;

[0053] S3: generating optimized smooth noise according to the optimized noise shape and noise scale, and adding the smooth noise to the benign sample and the malicious sample respectively to obtain enhanced samples, wherein the enhanced samples include enhanced benign samples and enhanced malicious samples;

[0054] S4: The enhanced benign samples and malicious samples are uniformly marked as pseudo-malicious samples, added to the original samples as training sets to train the traffic classifier, and the classification results of the traffic classifier trained under multiple groups of enhanced samples are collected. The weights are calculated using the improved Boosting algorithm, and the classification results are weighted averaged to obtain the final classification results. Among them, the improved Boosting algorithm uses the recall rate of the traffic classifier on benign samples as the basis for weight calculation.

[0055] Specifically, the gradient-based algorithm in S2 uses a loss function based on the softmax probability of the traffic classifier, which can ensure that the optimized noise shape is close to the characteristics of the traffic sample; the noise scale is optimized by the improved Bayesian optimizer HEBO, and the sample is divided into several parts before optimization. The optimization process is performed on each benign sample and malicious sample separately to ensure that a variety of noise scales can be obtained and the noise scale is close to the category boundary of the sample.

[0056] The improved Boosting algorithm uses the recall rate of the traffic classifier on benign samples as the basis for weight calculation. The calculated weight can weaken the traffic classifier's preference for malicious samples and balance the classification performance of the classifier on all types of traffic samples.

[0057] In one implementation, the normalized noise is converted into characteristic noise, and the noise conversion method used adopts the following formula:

[0058]

[0059] p i =F n,i (ε n,i ),i=1,2…d

[0060] Where Ψ represents the noise conversion function, ε n is the normalized noise, ε n Contains d dimensions, and ε n Subordinate to the distribution Dn, ε n,i is the i-th dimension of the noise, F n,i is the cumulative distribution function of Dn, p i is the cumulative distribution function value of the i-th dimension, t is the noise scale factor, and is the target parameter for noise scale optimization. and is the noise shape factor, which is the target parameter for noise shape optimization. Shared by the noise of all dimensions, It is peculiar to the noise of a single dimension, k is the subscript of the noise shape factor, and represents three special distribution functions: Gaussian function, ISRU function and inverse tangent function. is the cumulative distribution function of the kth distribution function.

[0061] In one embodiment, a noise shape optimization method is used to optimize the noise shape by a gradient-based algorithm, wherein the original samples are used as a training set and the noisy samples are used as a test set during the optimization process, and the loss function used in the optimization process is as follows:

[0062]

[0063]

[0064] in, is the loss function, and are the loss functions of misclassified samples and correctly classified samples, respectively, n is the normalized noise following the distribution Dn, x (ns) is the nsth original sample in the training set, the training set size is N, Θ is the set of noise shape factors, Λ(Θ) is the regularization term, λ is the hyperparameter controlling the regularization strength, is the indicator function, Ψ(ε n ) is the characteristic noise, f is the classification process of the traffic classifier, s is the scoring function of the traffic classifier, such as softmax probability, is the category space of traffic samples, and is the loss function for the misclassified samples and correctly classified samples of a certain category, c is a category in the category space, f is the classification result of the classifier on category c, s c is the scoring function value of category c.

[0065] In one embodiment, the noise scale optimization method is used to optimize the noise scale by using a heteroscedastic evolutionary Bayesian optimizer (HEBO). Before the optimization, the sample is divided into several parts. In each sample, an independent optimization process is performed on the benign sample and each type of malicious sample. The loss function used in the optimization process is as follows:

[0066] T={T 1 ,……,T ks}

[0067] T ks =x tr,ks ∪x te,ks

[0068]

[0069] Among them, T is the original sample set, T ks is the ksth sample, x tr,ks and x te,ks From T ks The training samples and test samples are divided into and are malicious samples and benign samples in the training samples, respectively. is a malicious sample with the category of ic in the training sample; is the loss function of malicious samples of category ic, is the loss function of benign samples; Tr is the training set, Te is the test set, and Accuracy is the accuracy of the traffic classifier on the test set Te after training on the training set Tr; The training set is constructed for malicious samples of category ic, and the training set contains original benign samples and the original malicious sample of category ic Also contains enhanced samples and The training set is constructed for benign traffic, and the training set contains original benign samples and enhanced samples The samples are marked as malicious in the training set; ks is the test set, which contains the original benign samples and all categories of original malicious samples Enhanced sample of malicious traffic From the original sample Add noise to obtain; In order to obtain more pseudo-malicious samples with more noise scales, the optimization process will cluster the original benign samples and enhance the samples A set of enhanced samples after adding noise to each type of benign samples.

[0070] In one embodiment, the data enhancement module is used to statistically optimize several groups of noise scale factors with good effects, generate smooth noise through the optimized noise shape factor and noise scale factor, and use the smooth noise to perform data enhancement on the original sample. The data enhancement process formula is as follows:

[0071]

[0072] Among them, Optimizer is the noise scale optimizer, ks is the number of samples, ic is a certain category, is the loss function of benign samples, tb ks is the optimized benign sample noise scale, is the loss function of malicious samples, is the optimized malicious sample noise scale sequence, Large returns the sequence The pth optimal factor in is a factor group consisting of two noise factors, is the conversion function of normalized noise according to the noise factor group, x ks is the original sample, To enhance the sample.

[0073] Furthermore, an integrated learning module is used to uniformly mark the enhanced benign samples and malicious samples as pseudo-malicious samples, add them to the original samples, and use them as training sets to train the traffic classifier. The classification results of the traffic classifier trained under multiple sets of enhanced samples are collected, and the weights are calculated using the improved Boosting algorithm. The classification results are weighted to obtain the final classification results. The improved Boosting algorithm process is as follows:

[0074]

[0075] initialization

[0076] 1. Initial weight vector The weight calculation formula is as follows:

[0077]

[0078] in, represents the iwth weight in the initial weight vector, Tr iw is the iwth training set, Te b is a test set that contains only benign samples.

[0079] 2. Call the traffic classifier Learner and obtain KS×P classifiers f1,…,f according to the training set Tr. KS×P .

[0080] 3. Calculate the classification results of f on Te f1(Te), ..., f K×P (Te).

[0081] Fornt=1,……,NT

[0082] 1. Normalize the weight vector:

[0083]

[0084] Among them, NT is the total number of iterations, represents the iwth weight in the weight vector of the ntth iteration, is the sum of weights;

[0085] 2. Calculate the classifier f in Te b The ntth sample x nt Error rate on:

[0086]

[0087] in, represents the iwth weight in the weight vector of the ntth iteration, f iw (x nt ) represents the iwth classifier for the ntth sample x nt The classification result, c(x nt ) represents the original category of the sample.

[0088] 3. Calculate the weight update factor:

[0089]

[0090] 4. Set the new weight vector as follows:

[0091]

[0092] Output the final classification results

[0093]

[0094] Embodiment 2

[0095] Based on the same inventive concept, this embodiment discloses a traffic classification system based on smooth noise data enhancement, see Figure 1 ,include:

[0096] A noise generation module is used to generate uniform normalized noise, and process the normalized noise using the cumulative distribution function of the Gaussian function, the ISRU function, and the inverse tangent function to convert it into characteristic noise;

[0097] The noise optimization module optimizes the noise shape through a gradient-based algorithm, where the gradient-based algorithm uses a loss function based on the softmax probability of the traffic classifier; the noise scale is optimized through an improved Bayesian optimizer, and the samples are divided into several parts before optimization. In each sample, independent optimization processes are performed on benign samples and each type of malicious samples;

[0098] A data enhancement module, used for generating optimized smooth noise according to the optimized noise shape and noise scale, and adding the smooth noise to the benign sample and the malicious sample respectively to obtain enhanced samples, wherein the enhanced samples include enhanced benign samples and enhanced malicious samples;

[0099] The integrated learning module is used to uniformly mark the enhanced benign samples and malicious samples as pseudo-malicious samples, add them to the original samples as training sets to train the traffic classifier, collect the classification results of the traffic classifier trained under multiple groups of enhanced samples, use the improved Boosting algorithm to calculate the weights, and perform weighted averaging on the classification results to obtain the final classification results. Among them, the improved Boosting algorithm uses the recall rate of the traffic classifier on benign samples as the basis for weight calculation.

[0100] The present invention provides a traffic classification generalization improvement system based on smooth noise data enhancement, which optimizes the noise shape and noise scale through a gradient-based search algorithm, and uses the optimized smooth noise to perform data enhancement on the training set. The enhanced training set enables the traffic classifier to learn smoother classification boundaries, thereby improving the generalization of classification performance on unknown types of malicious samples.

[0101] Specifically, the noise generation module and the noise optimization module generate normalized noise and convert the normalized noise into characteristic noise using optimized noise shape factor and noise scale factor.

[0102] The data enhancement module receives characteristic noise, adds noise to the original sample to generate an enhanced sample, and mixes the original sample and the enhanced sample to obtain a mixed sample. (The data enhancement module splits the training set into multiple training subsets, each subset is used to optimize a set of noise scales, each set of noise scales will generate a corresponding batch of enhanced samples, and the traffic classifier will be trained on each batch of enhanced samples and produce classification results).

[0103] The ensemble learning module trains weak classifiers on mixed samples, collects the classification results of weak classifiers on unknown types of malicious traffic, combines the classification results using an improved boosting algorithm, and weights the weak classifiers into a strong classifier.

[0104] The detailed process of the data enhancement and integrated learning module provided by the present invention is as follows: Figure 2 As shown, the basic steps are as follows:

[0105] A1 divides the training set into ks mutually disjoint sub-training sets;

[0106] A2 applies p groups of different smooth noise to each sub-training set to obtain ks×p groups of enhanced training sets;

[0107] A3 sets the enhanced training set as the training set and the unknown type malicious samples as the test set, trains the weak classifier for classification, and collects the classification results;

[0108] A4 uses an improved boosting algorithm to calculate the weights of the classification results and weights the classification results into the final result.

[0109] Since the system introduced in the second embodiment of the present invention is a system used to implement the traffic classification method based on smooth noise data enhancement in the first embodiment of the present invention, based on the method introduced in the first embodiment of the present invention, those skilled in the art can understand the specific structure and deformation of the system, so it is not described here. All systems used in the method in the first embodiment of the present invention belong to the scope of protection of the present invention.

[0110] Embodiment 3

[0111] Based on the same inventive concept, the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method described in the first embodiment is implemented.

[0112] Since the computer-readable storage medium introduced in the third embodiment of the present invention is a computer-readable storage medium used to implement the traffic classification method based on smooth noise data enhancement in the first embodiment of the present invention, based on the method introduced in the first embodiment of the present invention, those skilled in the art can understand the specific structure and deformation of the computer-readable storage medium, so it is not repeated here. All computer-readable storage media used in the method of the first embodiment of the present invention belong to the scope of protection of the present invention.

[0113] Embodiment 4

[0114] The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in Embodiment 1 when executing the program.

[0115] Since the computer device introduced in the fourth embodiment of the present invention is a computer device used to implement the traffic classification method based on smooth noise data enhancement in the first embodiment of the present invention, based on the method introduced in the first embodiment of the present invention, the person skilled in the art can understand the specific structure and deformation of the computer device, so it is not repeated here. All computer devices used in the method of the first embodiment of the present invention belong to the scope of protection of the present invention.

[0116] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0117] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0118] Although preferred embodiments of the present invention have been described, additional changes and modifications may be made to these embodiments by those skilled in the art once the basic creative concepts are known. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention. Obviously, those skilled in the art may make various changes and modifications to the embodiments of the present invention without departing from the spirit and scope of the embodiments of the present invention. Thus, if these modifications and variations of the embodiments of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A traffic classification method based on smooth noise data enhancement, characterized in that: include: Generate uniform normalized noise, and use the cumulative distribution function of Gaussian function, ISRU function and inverse tangent function to process the normalized noise and convert it into characteristic noise; The noise shape is optimized by a gradient-based algorithm, where the gradient-based algorithm uses a loss function based on the softmax probability of the traffic classifier; the noise scale is optimized by an improved Bayesian optimizer, where the sample is divided into several parts before optimization, and in each sample, the benign sample and each type of malicious sample are independently optimized; Generate optimized smooth noise according to the optimized noise shape and noise scale, and add the smooth noise to the benign sample and the malicious sample respectively to obtain enhanced samples, wherein the enhanced samples include enhanced benign samples and enhanced malicious samples; The enhanced benign samples and malicious samples are uniformly marked as pseudo-malicious samples and added to the original samples as training sets to train the traffic classifier. The classification results of the traffic classifier trained under multiple groups of enhanced samples are collected, and the weights are calculated using the improved Boosting algorithm. The classification results are weighted averaged to obtain the final classification results. Among them, the improved Boosting algorithm uses the recall rate of the traffic classifier on benign samples as the basis for weight calculation.

2. The traffic classification method based on smooth noise data enhancement according to claim 1, characterized in that: The formula used to convert normalized noise into characteristic noise is: p i =F n,i (ε n,i ),i=1,2…d Where Ψ represents the noise conversion function, ε n is the normalized noise, ε n Contains d dimensions, and ε n Subordinate to the distribution Dn, ε n,i is the i-th dimension of the noise, Ψ i (ε n,i ) represents ε n,i The corresponding noise characteristic, F n,i is the cumulative distribution function of Dn, p i is the cumulative distribution function value of the i-th dimension, t is the noise scale factor, and is the target parameter for noise scale optimization. and is the noise shape factor, which is the target parameter for noise shape optimization. Shared by the noise of all dimensions, It is peculiar to the noise of a single dimension, k is the subscript of the noise shape factor, and represents three special distribution functions: Gaussian function, ISRU function and inverse tangent function. is the cumulative distribution function of the kth distribution function.

3. The traffic classification method based on smooth noise data enhancement according to claim 1, characterized in that: The noise shape is optimized by a gradient-based algorithm. The original samples are used as the training set and the noisy samples are used as the test set. The loss function used in the optimization process is as follows: in, is the loss function of the noise shape optimization process, and are the loss functions of misclassified samples and correctly classified samples, respectively, n is the normalized noise following the distribution Dn, x (ns) is the nsth original sample in the training set, the training set size is N, Θ is the set of noise shape factors, Λ(Θ) is the regularization term, λ is the hyperparameter controlling the regularization strength, is the indicator function, Ψ(ε n ) is the characteristic noise, f is the classification process of the traffic classifier, s is the scoring function of the traffic classifier, is the category space of traffic samples, and is the loss function for the misclassified samples and correctly classified samples of a certain category, c is a category in the category space, f is the classification result of the classifier on category c, s c is the scoring function value of category c.

4. The traffic classification method based on smooth noise data enhancement according to claim 1, characterized in that: When optimizing the noise scale through the improved Bayesian optimizer, the loss functions used include: T={T 1 ,……,T ks } T ks =x tr,ks ∪x te,ks Among them, T is the original sample set, T ks is the ksth sample, x tr,ks and x te,ks From T ks The training samples and test samples are divided into and are malicious samples and benign samples in the training samples, respectively. is a malicious sample with the category of ic in the training sample; is the loss function of malicious samples with category ic, is the loss function of benign samples; Tr is the training set, Te is the test set, and Accuracy is the accuracy of the traffic classifier on the test set Te after training on the training set Tr; A training set constructed for malicious samples of category ic, which contains original benign samples and the original malicious sample of category ic Also contains enhanced samples and A training set constructed for benign traffic, which contains original benign samples and enhanced samples In the corresponding training set, it is marked as a malicious sample; Te ks is the test set, which contains the original benign samples and all categories of original malicious samples Enhanced sample of malicious traffic From the original sample Add noise to get; enhance the sample A set of enhanced samples after adding noise to each type of benign samples.

5. The traffic classification method based on smooth noise data enhancement according to claim 1, characterized in that: Smooth noise is added to benign samples and malicious samples respectively to obtain enhanced samples, including: Split the training set into multiple training subsets, where each training subset includes benign samples and malicious samples, and each subset is used to optimize a set of noise scales; Generate a corresponding batch of enhanced samples for each set of noise scales.

6. The traffic classification method based on smooth noise data enhancement as claimed in claim 5, characterized in that: The enhanced samples are obtained as follows: Among them, Optimizer is the noise scale optimizer, ks is the number of samples, ic is a certain category, is the loss function of benign samples, tb ks is the optimized benign sample noise scale, is the loss function of malicious samples, is the optimized malicious sample noise scale sequence, Large returns the sequence The pth optimal factor in is a factor group consisting of two noise factors, is the conversion function of normalized noise according to the noise factor group, x ks is the original sample, The enhanced sample.

7. The traffic classification method based on smooth noise data enhancement according to claim 1, characterized in that: The weights are calculated using an improved Boosting algorithm, including: Select all benign samples as the test set, count the error rate of the weak classifier on the benign samples, and calculate the weight update factor; Calculate the weights based on the weight update factor.

8. A traffic classification system based on smooth noise data enhancement, characterized in that: include: A noise generation module is used to generate uniform normalized noise, and process the normalized noise using the cumulative distribution function of the Gaussian function, the ISRU function, and the inverse tangent function to convert it into characteristic noise; The noise optimization module optimizes the noise shape through a gradient-based algorithm, where the gradient-based algorithm uses a loss function based on the softmax probability of the traffic classifier; the noise scale is optimized through an improved Bayesian optimizer, and the samples are divided into several parts before optimization. In each sample, independent optimization processes are performed on benign samples and each type of malicious samples; A data enhancement module, used for generating optimized smooth noise according to the optimized noise shape and noise scale, and adding the smooth noise to the benign sample and the malicious sample respectively to obtain enhanced samples, wherein the enhanced samples include enhanced benign samples and enhanced malicious samples; The integrated learning module is used to uniformly mark the enhanced benign samples and malicious samples as pseudo-malicious samples, add them to the original samples as training sets to train the traffic classifier, collect the classification results of the traffic classifier trained under multiple groups of enhanced samples, use the improved Boosting algorithm to calculate the weights, and perform weighted averaging on the classification results to obtain the final classification results. Among them, the improved Boosting algorithm uses the recall rate of the traffic classifier on benign samples as the basis for weight calculation.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the traffic classification method based on smooth noise data enhancement as claimed in any one of claims 1 to 7 is implemented.

10. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the traffic classification method based on smooth noise data enhancement as described in any one of claims 1 to 7 is implemented.

Images