Botnet traffic detection method and detection device based on space-time fusion features

Abstract

The invention discloses a botnet traffic detection method and device based on space-time fusion characteristics. The detection method comprises the following steps: firstly, cutting original network traffic into byte streams with the same source-target IP, the same source-target port and the same protocol; then the byte stream is processed into two different forms of space and time sequence; processing data in a spatial form by using a residual network so as to solve the problems of gradient disappearance and degradation in a traditional convolutional network; data in a time sequence form is processed by using a Transform architecture, the time sequence dependence is reduced compared with a traditional network architecture, and meanwhile, the parallel computing capability also enables the system to have faster training reasoning time; weighted feature fusion is carried out on feature vectors output by the residual network and the Transform architecture; and carrying out binary classification on the final feature vector by using a Softmax classifier, and carrying out parameter optimization by using an adaptive moment estimation algorithm to finally obtain a detection model.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a method and a device for detecting botnet traffic based on time-space fusion features. Background Art

[0002] With the rapid development of the Internet and the popularization of IoT devices, the network environment has become increasingly complex, and the traffic between user devices and servers has increased significantly. In this process, network security issues have become increasingly severe, and various malicious network activities have become more complex and hidden, especially the widespread use of botnets. The attack methods of botnets not only cause great harm to individual and corporate users, but also threaten the security and stability of the Internet as a whole. Therefore, how to efficiently and accurately detect and defend against botnet traffic has become an important topic in network security research.

[0003] A botnet is a network composed of a large number of maliciously controlled devices. Attackers remotely control these devices to launch various network attacks, such as DDoS attacks, spam sending, data theft, etc. With the popularization of IoT devices, the scale and complexity of botnets have increased significantly, making their attacks wide-ranging, highly destructive, and difficult to track. Because the communications and operations of botnets are usually mixed with normal traffic, they are extremely concealed. Traditional network protection technologies often have difficulty effectively detecting these malicious traffic, especially when botnets use complex evasion techniques.

[0004] A variety of methods have been proposed for detecting botnet traffic, including rule-based detection, traditional machine learning methods, and deep learning technology. Rule-based detection methods rely on pre-set attack features and network traffic patterns. Although they can identify known botnets to a certain extent, they are powerless in the face of ever-changing attack patterns. Traditional machine learning methods, such as decision trees and support vector machines, usually rely on manual feature extraction and have difficulty dealing with complex and diverse botnet behaviors. In recent years, deep learning technology, especially convolutional neural networks and recurrent neural networks, has shown good performance in traffic detection, but there are still problems such as insufficient capture of spatiotemporal features and long training time. Summary of the invention

[0005] The present invention aims to solve one of the technical problems existing in the related art at least to a certain extent.

[0006] One purpose of the present invention is to provide a botnet traffic detection method based on spatiotemporal fusion features, which combines the residual network and the Transformer architecture to process the spatial features and temporal features of the network traffic respectively, effectively improving the detection success rate of the botnet traffic. At the same time, through the feature fusion technology, the advantages of the two features are fully utilized, thereby realizing the accurate classification of complex network traffic.

[0007] Another object of the present invention is to provide a botnet traffic detection device based on time-space fusion features, which is used to apply the above-mentioned botnet traffic detection method based on time-space fusion features.

[0008] In order to achieve the above-mentioned purpose, the present invention provides a method for detecting botnet traffic based on spatiotemporal fusion features, comprising: S100, cutting the acquired original network traffic data into byte streams having the same five-tuple; Convert the byte stream into spatial form and temporal form respectively to obtain spatial form data set and temporal form data set; S200, constructing a detection model, and training and optimizing the constructed detection model according to the spatial form data set and the temporal form data set; The detection model adopts a dual-branch network framework consisting of a residual network and a Transformer network. First, the residual network is used to extract the feature vector of spatial form data, and the Transformer network is used to extract the feature vector of temporal form data. Then the output feature vectors of the residual network and the Transformer network are weighted fused; The fused feature vector is then mapped to two categories through a fully connected layer and input into the Softmax classifier to predict the probability distribution; S300: Input the network traffic data to be detected into the trained detection model to obtain a detection result of whether it is botnet traffic.

[0009] A further preferred technical solution of the present invention is that the original network traffic data obtained in step S100 is cut into byte streams having the same five-tuple; the specific method is: The network flow segmentation tool is used to segment the original traffic data into five-tuples, so that each network flow after segmentation has the same source IP address, destination IP address, source port, destination port and protocol. One original traffic data is decomposed into multiple network flows with unique five-tuple information. ; Each network flow Consists of multiple separate, time-sequential packets Each data packet is composed of a byte stream, defining each network flow .

[0010] Preferably, in step S100, the byte stream is converted into a spatial form and a temporal form respectively to obtain a spatial form data set and a temporal form data set; the specific method includes: For each network flow , perform spatial form conversion and intercept network flow The first 1024 bytes of are converted into a two-dimensional matrix with 32 bytes per row and 32 columns. If less than 1024 bytes, use Fill and compress all matrix element values ​​to [0,1], network flow is converted into a two-dimensional matrix form as a spatial form data set; For each network flow Intercept the first 10 packets, that is , for each data packet, the first 50 bytes are intercepted, that is, each data packet is a one-dimensional vector consisting of 50 elements. If the data packet is less than 50 bytes, use Then, fill in the values ​​of all one-dimensional vector elements to [0,1]. It is converted into a one-dimensional sequence form as a time form dataset.

[0011] Preferably, the residual network in the dual-branch network framework of the detection model in step S200 includes: Convolutional Layer : The input is a two-dimensional matrix, which is regarded as a single-channel image of 32*32*1. This layer uses a 7*7 convolution kernel, sets 64 convolution kernels, a stride of 1, and a padding of 1; Pooling Layer : Normalize the feature map of the upper layer, then apply the ReLU activation function, and the output maintains the shape of the previous step; Four residual structures , , and :Each residual structure contains two basic residual blocks, and , , Adjust the stride and number of channels in the network, and implement skip connections through 1*1 convolution to match the dimension changes; Average Pooling Layer : Downsample the input feature map; Fully connected layer : Map features to 10 output categories.

[0012] Preferably, the Transformer network in the dual-branch network framework of the detection model in step S200 includes: Input layer: processes time series data and formats it into a three-dimensional tensor form acceptable to the model; Position encoding layer: Use fixed sine and cosine functions to generate position encoding and learn position embedding to increase the position information of sequence elements; Multiple stacked encoder layers: The output of each encoder layer is used as the input of the next layer, and the final output dimension is consistent with the embedding dimension; each encoder layer contains an 8-head multi-head self-attention mechanism and a feedforward neural network, where the embedding dimension is 64 and the hidden layer dimension of the feedforward neural network is 256; Linear layer: maps the final output of multiple stacked encoder layers to 10 classes of output.

[0013] Preferably, in step S200, the output feature vectors of the residual network and the Transformer network are weightedly fused, specifically: set up is the weight of the residual network output feature vector, is the weight of the Transformer network output feature vector, ,and ; The final feature vector obtained by weighted fusion of the output feature vectors of the residual network and the Transformer network ,in is the feature vector after residual network processing, It is the feature vector processed by the Transformer network.

[0014] Preferably, when training the model in step S200, an adaptive moment estimation algorithm is used to optimize the model parameters; and a cross entropy loss function is used to calculate the difference between the probability distribution predicted by the model and the true label distribution, and finally a trained detection model is obtained.

[0015] Another aspect of the present invention provides a botnet traffic detection device based on time-space fusion features, comprising: The data collection and processing module is used to obtain the original network traffic data; and process the original network traffic data, and the processing process at least has the following steps: Cut the original network traffic data into byte streams with the same five-tuple; and converting the byte stream into a spatial form and a temporal form respectively to obtain a spatial form data set and a temporal form data set; Model building and training module, used to build a detection model and train and optimize the built detection model according to the spatial form data set and the temporal form data set; The detection model uses a dual-branch network framework consisting of a residual network and a Transformer network. The detection model processes data as follows: First, the feature vector of spatial data is extracted by residual network, and the feature vector of temporal data is extracted by Transformer network. Then the output feature vectors of the residual network and the Transformer network are weighted fused; The fused feature vector is then mapped to two categories through a fully connected layer and input into the Softmax classifier to predict the probability distribution; The botnet traffic detection module is used to collect the network traffic data to be detected, and input it into the data collection and processing module for data processing, and then input the processed data into the model building and training module, and use the trained detection model to detect whether it is botnet traffic.

[0016] Another aspect of the present invention provides a non-transitory computer-readable storage medium having computer instructions stored thereon, the computer instructions enabling a computer to execute the above-mentioned botnet traffic detection method based on spatiotemporal fusion features.

[0017] Another aspect of the present invention provides an electronic device, comprising: a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus, and the processor calls the logic instructions in the memory to execute the above-mentioned botnet traffic detection method based on time-space fusion features.

[0018] On the other hand, the present invention provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer executes the above-mentioned botnet traffic detection method based on spatiotemporal fusion features.

[0019] Beneficial effects: The botnet traffic detection method based on spatiotemporal fusion features of the present invention takes into account the extraction and analysis of spatial features and temporal features, solves the limitations of traditional detection methods in dealing with complex spatiotemporal feature changes, and generates a more comprehensive feature representation through weighted feature fusion technology, thereby improving the classifier's ability to judge the traffic type. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a flow chart of the botnet traffic detection method based on spatiotemporal fusion features of the present invention.

[0021] Figure 2 This is an example diagram of the present invention converting the byte stream into spatial form and temporal form respectively. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings in the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments, and they should not be understood as limitations on the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. In the description of the present invention, it should be understood that the terms used are only for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0023] In order to overcome the various deficiencies of the existing methods in the background technology, the present invention combines the spatial and temporal information of botnet traffic data and introduces residual networks and Transformer architectures. The residual network solves the gradient vanishing and degradation problems in traditional convolutional networks through jump connections, and can capture complex spatial features in deeper network structures. On the other hand, the Transformer architecture gets rid of the RNN's dependence on sequence information through the self-attention mechanism, can process time series data more efficiently, and has the advantages of parallel computing. Combining these two network structures, the present invention can simultaneously capture the spatial and temporal features in network traffic, and improve the accuracy and efficiency of detection through weighted feature fusion, providing a more efficient and accurate method for botnet traffic detection. The following is combined with Figure 1-Figure 2 The present invention describes a method and device for detecting botnet traffic based on spatiotemporal fusion features.

[0024] Embodiment 1: This embodiment provides a method for detecting botnet traffic based on spatiotemporal fusion features, with specific steps as follows: Figure 1 As shown, including: Step 1: Data preprocessing.

[0025] In this embodiment, the open source network flow analysis tool Splitcap is used to parse and split the original network flow data according to the unique source and destination IP, unique source and destination port and protocol. Then, an original flow file can be decomposed into many flows with unique five-tuple information. .

[0026] At the same time, in step 1, each network flow It is composed of several separate, time-ordered data packets. Each small data packet It is composed of byte streams, so for the convenience of subsequent description, define .

[0027] Step 2: Data normalization.

[0028] Combination Figure 2 In this embodiment, the image size in spatial form is taken as 32 bytes on a side, that is, 1024 bytes are intercepted, and then these bytes are arranged into a two-dimensional matrix form, that is, .

[0029] like If the total length is less than 1024 bytes, a null byte is used Complete.

[0030] Since a byte consists of 8 bits, its decimal representation has a total of It is possible that To eliminate the impact of data size on calculation, all byte values ​​are compressed to [0,1], that is .

[0031] Take the first 10 packets of each traffic data, and intercept the first 50 bytes of each packet, that is, , .

[0032] Similarly, if the data packet If the number is less than 10, fill it up to 10. If the number of bytes is less than 50, use null bytes. Complete.

[0033] To eliminate the impact of data size on calculation, execute , compress each value to [0,1].

[0034] Step 3: Spatial feature extraction.

[0035] In this embodiment, in order to make the residual network more suitable for spatial form data, the stride and padding value of the first convolution layer of the residual network are reduced, and the convolution kernel and stride padding of each residual block are also set to smaller values. The residual network structure constructed by the present invention is as follows: Convolutional Layer : The input is a single-channel image of 32*32*1. This layer uses a 7*7 convolution kernel, sets 64 convolution kernels, a stride of 1, and a padding of 1. The output size calculation formula is: ; in For input size 32, is the convolution kernel size, For filling, is the stride. After the convolution operation, the number of output channels is 64, and the final output shape is 64*28*28.

[0036] Pooling Layer : The 64*28*28 feature map is normalized, and then the ReLU activation function is applied to keep the output in the shape of 64*28*28.

[0037] Residual structure : Contains two basic residual blocks. The input of the first basic residual block is 64*28*28. After two 3*3 convolutions (both with a stride of 1 and padding of 1), the output is still 64*28*28. Since the input channel and output channel are the same and the stride is 1, there is no need to adjust the size. The structure of the second basic residual block is the same as the first one, and the input and output are still 64*28*28.

[0038] Residual structure :It also contains two basic residual blocks. The input of the first basic residual block is 64*28*28. The stride of the first convolution layer is set to 2, and the downsampling is performed. After processing, the output is 128*14*14. The stride of the second convolution layer is kept at 1, and the output is still 128*14*14. Due to the change in stride and number of channels, the jump connection part uses 1*1 convolution adjustment. The input of the second basic residual block is 128*14*14. After two convolutions, the output remains at 128*14*14 and does not need to be adjusted.

[0039] Residual structure :It also contains two basic residual blocks. The input of the first basic residual block is 128*14*14, the stride of the first convolution is 2, and the output after convolution is 256*7*7. The output of the second convolution is also 256*7*7. The jump connection part uses 1*1 convolution to adjust the number of channels and size. The input of the second basic residual block is 256*7*7. After two convolutions, the output remains 256*7*7 and does not need to be adjusted.

[0040] Residual structure : It also contains two basic residual blocks. The input of the first basic residual block is 256*7*7, the stride of the first convolution is 2, the output is 512*4*4, and the output of the second convolution is still 512*4*4. The jump connection part is adjusted using 1*1 convolution. The input of the second basic residual block is 512*4*4, and after two convolutions, the output is still 512*4*4.

[0041] Average Pooling Layer : Downsample the input feature map, and then flatten the feature map into a one-dimensional vector, that is, the output is 512*1*1.

[0042] Fully connected layer : Map the 512*1*1 input to 10 types of output, that is, the output is a one-dimensional feature vector containing 10 elements.

[0043] Step 4: Temporal feature extraction.

[0044] In this embodiment, a Transformer model with a self-attention mechanism and parallel computing is used to extract the timing features of traffic data packets. Its specific structure is as follows: Input layer: This layer converts the raw data into a format that the model can process. The input is [number of samples, time series length, feature dimension], that is, 32*10*50.

[0045] Position encoding layer: Use fixed sine and cosine functions to generate position encoding, and learn position embedding to provide position information of each element in the sequence. Its formula is: ; ; in, represents the position code, Indicates the position of the current character in the input letters. Take the dimension subscript of the character modulo 2, The output of this layer is the input data with position information added, and the shape is still 32*10*50.

[0046] Encoder layer: This layer contains a multi-head self-attention mechanism and a feedforward neural network. In this embodiment, the number of heads is set to 8, the embedding dimension is set to 64, and the hidden layer dimension of the feedforward neural network is set to 256.

[0047] Encoder stacking: The encoder stack consists of 6 encoder layers, where the input dimension of each encoder is the output dimension of the previous layer. The output dimension of the final encoder is the same as the adjusted embedding dimension, that is, 64, and the shape is 32*10*64.

[0048] Linear layer: The input dimension is the final output dimension of the encoder stack, 64, and the shape is 32*10*64. After this layer, the output is 32*10*10, that is, 10 types of output, which is consistent with the feature vector form of the residual network output.

[0049] Step 5: Spatiotemporal feature fusion.

[0050] In this embodiment, in order to comprehensively consider the impact of spatial and temporal features on the model detection effect, a weighted fusion scheme is used to combine the spatiotemporal features. The feature vector output by the residual network is assumed to be , the feature vector output by Transformer is , set the vector weight obtained by the residual network to , the vector weight obtained by Transformer is set to , then the final eigenvector is ,Right now .

[0051] Step 6: Classification and optimization.

[0052] This embodiment uses the Softmax algorithm to convert the two categories that have not been normalized into probability distribution, ensuring that the output value is between 0 and 1, and the sum of all output values ​​is 1. The formula is: ; The adaptive moment estimation algorithm is used for optimization. By combining the momentum method and the adaptive learning rate, it can adaptively adjust the learning rate according to the historical gradient of each parameter, thereby achieving fast and stable convergence. It has been widely used in various deep learning tasks. The core process is as follows: Initialization: Initial parameters and (first-order moment and first-order moment estimation), set hyperparameters: In the present invention, set the learning rate , attenuation rate and , and a small constant .

[0053] Update rule: At each time step t, perform the following calculations: Compute the gradient: ; First moment estimate: ; Second moment estimate: ; To perform bias correction: ; ; Update parameters: ; in, is the loss function, is the parameter to be optimized.

[0054] The cross entropy loss function is used to calculate the difference between the probability distribution predicted by the model and the true label distribution, which has significant advantages in classification tasks. The specific formula is: ; in is the true label distribution, is the probability distribution predicted by the model, is the number of samples.

[0055] After multiple rounds of training, the final botnet traffic detection model is obtained.

[0056] Step 7: Botnet traffic detection.

[0057] The network traffic data to be detected is input into the trained detection model to obtain the detection result of whether it is botnet traffic.

[0058] Embodiment 2: This embodiment provides a botnet traffic detection device based on time-space fusion features, including: The data collection and processing module is used to obtain the original network traffic data; and process the original network traffic data, and the processing process at least has the following steps: Cut the original network traffic data into byte streams with the same five-tuple; and converting the byte stream into a spatial form and a temporal form respectively to obtain a spatial form data set and a temporal form data set; Model building and training module, used to build a detection model and train and optimize the built detection model according to the spatial form data set and the temporal form data set; The detection model uses a dual-branch network framework consisting of a residual network and a Transformer network. The detection model processes data as follows: First, the feature vector of spatial data is extracted by residual network, and the feature vector of temporal data is extracted by Transformer network. Then the output feature vectors of the residual network and the Transformer network are weighted fused; The fused feature vector is then mapped to two categories through a fully connected layer and input into the Softmax classifier to predict the probability distribution; The botnet traffic detection module is used to collect the network traffic data to be detected, and input it into the data collection and processing module for data processing, and then input the processed data into the model building and training module, and use the trained detection model to detect whether it is botnet traffic.

[0059] Embodiment 3: This embodiment provides a non-transitory computer-readable storage medium, on which computer instructions are stored. The computer instructions enable a computer to execute a botnet traffic detection method based on spatiotemporal fusion features. The method includes the following steps: S100, cutting the acquired original network traffic data into byte streams having the same five-tuple; Convert the byte stream into spatial form and temporal form respectively to obtain spatial form data set and temporal form data set; S200, constructing a detection model, and training and optimizing the constructed detection model according to the spatial form data set and the temporal form data set; The detection model adopts a dual-branch network framework consisting of a residual network and a Transformer network. First, the residual network is used to extract the feature vector of spatial form data, and the Transformer network is used to extract the feature vector of temporal form data. Then the output feature vectors of the residual network and the Transformer network are weighted fused; The fused feature vector is then mapped to two categories through a fully connected layer and input into the Softmax classifier to predict the probability distribution; S300: Input the network traffic data to be detected into the trained detection model to obtain a detection result of whether it is botnet traffic.

[0060] Embodiment 4: This embodiment provides an electronic device, which may include: a processor, a communications interface, a memory, and a communications bus, wherein the processor, the communications interface, and the memory communicate with each other via the communications bus. The processor may call the logic instructions in the memory to execute a botnet traffic detection method based on spatiotemporal fusion features, the method comprising the following steps: S100, cutting the acquired original network traffic data into byte streams having the same five-tuple; Convert the byte stream into spatial form and temporal form respectively to obtain spatial form data set and temporal form data set; S200, constructing a detection model, and training and optimizing the constructed detection model according to the spatial form data set and the temporal form data set; The detection model adopts a dual-branch network framework consisting of a residual network and a Transformer network. First, the residual network is used to extract the feature vector of spatial form data, and the Transformer network is used to extract the feature vector of temporal form data. Then the output feature vectors of the residual network and the Transformer network are weighted fused; The fused feature vector is then mapped to two categories through a fully connected layer and input into the Softmax classifier to predict the probability distribution; S300: Input the network traffic data to be detected into the trained detection model to obtain a detection result of whether it is botnet traffic.

[0061] In addition, the logic instructions in the above-mentioned memory can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program code.

[0062] Embodiment 5: This embodiment provides a computer program product, which includes a computer program. The computer program can be stored in a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute a botnet traffic detection method based on spatiotemporal fusion features. The method includes the following steps: S100, cutting the acquired original network traffic data into byte streams having the same five-tuple; Convert the byte stream into spatial form and temporal form respectively to obtain spatial form data set and temporal form data set; S200, constructing a detection model, and training and optimizing the constructed detection model according to the spatial form data set and the temporal form data set; The detection model adopts a dual-branch network framework consisting of a residual network and a Transformer network. First, the residual network is used to extract the feature vector of spatial form data, and the Transformer network is used to extract the feature vector of temporal form data. Then the output feature vectors of the residual network and the Transformer network are weighted fused; The fused feature vector is then mapped to two categories through a fully connected layer and input into the Softmax classifier to predict the probability distribution; S300: Input the network traffic data to be detected into the trained detection model to obtain a detection result of whether it is botnet traffic.

[0063] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0064] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0065] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting botnet traffic based on spatiotemporal fusion features, characterized in that: include: S100, cutting the acquired original network traffic data into byte streams having the same five-tuple; Convert the byte stream into spatial form and temporal form respectively to obtain spatial form data set and temporal form data set; S200, constructing a detection model, and training and optimizing the constructed detection model according to the spatial form data set and the temporal form data set; The detection model adopts a dual-branch network framework consisting of a residual network and a Transformer network. First, the residual network is used to extract the feature vector of spatial form data, and the Transformer network is used to extract the feature vector of temporal form data. Then the output feature vectors of the residual network and the Transformer network are weighted fused; The fused feature vector is then mapped to two categories through a fully connected layer and input into the Softmax classifier to predict the probability distribution; S300: Input the network traffic data to be detected into the trained detection model to obtain a detection result of whether it is botnet traffic.

2. The method for detecting botnet traffic based on spatiotemporal fusion features according to claim 1 is characterized in that: In step S100, the original network traffic data obtained is cut into byte streams with the same five-tuple; the specific method is: The network flow segmentation tool is used to segment the original traffic data into five-tuples, so that each network flow after segmentation has the same source IP address, destination IP address, source port, destination port and protocol. One original traffic data is decomposed into multiple network flows with unique five-tuple information. ; Each network flow Consists of multiple separate, time-sequential packets Each data packet is composed of a byte stream, defining each network flow .

3. The method for detecting botnet traffic based on spatiotemporal fusion features according to claim 2 is characterized in that: In step S100, the byte stream is converted into a spatial form and a temporal form respectively to obtain a spatial form data set and a temporal form data set. The specific method includes: For each network flow , perform spatial form conversion and intercept network flow The first 1024 bytes of are converted into a two-dimensional matrix with 32 bytes per row and 32 columns. If less than 1024 bytes, use Fill and compress all matrix element values ​​to [0,1], network flow is converted into a two-dimensional matrix form as a spatial form data set; For each network flow Intercept the first 10 packets, that is , for each data packet, the first 50 bytes are intercepted, that is, each data packet is a one-dimensional vector consisting of 50 elements. If the data packet is less than 50 bytes, use Then, fill in the values ​​of all one-dimensional vector elements to [0,1]. It is converted into a one-dimensional sequence form as a time form dataset.

4. The method for detecting botnet traffic based on spatiotemporal fusion features according to claim 3 is characterized in that: The residual network in the dual-branch network framework of the detection model in step S200 includes: Convolutional Layer : The input is a two-dimensional matrix, which is regarded as a single-channel image of 32*32*1. This layer uses a 7*7 convolution kernel, sets 64 convolution kernels, a stride of 1, and a padding of 1; Pooling Layer : Normalize the feature map of the upper layer, then apply the ReLU activation function, and the output maintains the shape of the previous step; Four residual structures , , and :Each residual structure contains two basic residual blocks, and , , Adjust the stride and number of channels in the network, and implement skip connections through 1*1 convolution to match the dimension changes; Average Pooling Layer : Downsample the input feature map; Fully connected layer : Map features to 10 output categories.

5. The method for detecting botnet traffic based on spatiotemporal fusion features according to claim 3 is characterized in that: The Transformer network in the dual-branch network framework of the detection model in step S200 includes: Input layer: processes time series data and formats it into a three-dimensional tensor form acceptable to the model; Position encoding layer: Use fixed sine and cosine functions to generate position encoding and learn position embedding to increase the position information of sequence elements; Multiple stacked encoder layers: The output of each encoder layer is used as the input of the next layer, and the final output dimension is consistent with the embedding dimension; each encoder layer contains an 8-head multi-head self-attention mechanism and a feedforward neural network, where the embedding dimension is 64 and the hidden layer dimension of the feedforward neural network is 256; Linear layer: maps the final output of multiple stacked encoder layers to 10 classes of output.

6. The method for detecting botnet traffic based on spatiotemporal fusion features according to claim 1 is characterized in that: In step S200, the output feature vectors of the residual network and the Transformer network are weightedly fused, specifically: set up is the weight of the residual network output feature vector, is the weight of the Transformer network output feature vector, ,and ; The final feature vector obtained by weighted fusion of the output feature vectors of the residual network and the Transformer network ,in is the feature vector after residual network processing, It is the feature vector processed by the Transformer network.

7. The method for detecting botnet traffic based on spatiotemporal fusion features according to claim 1 is characterized in that: When training the model in step S200, an adaptive moment estimation algorithm is used to optimize the model parameters; and a cross entropy loss function is used to calculate the difference between the probability distribution predicted by the model and the true label distribution, and finally a trained detection model is obtained.

8. A botnet traffic detection device based on spatiotemporal fusion features, characterized in that: include: The data collection and processing module is used to obtain the original network traffic data; and process the original network traffic data, and the processing process at least has the following steps: Cut the original network traffic data into byte streams with the same five-tuple; and converting the byte stream into a spatial form and a temporal form respectively to obtain a spatial form data set and a temporal form data set; Model building and training module, used to build a detection model and train and optimize the built detection model according to the spatial form data set and the temporal form data set; The detection model uses a dual-branch network framework consisting of a residual network and a Transformer network. The detection model processes data as follows: First, the feature vector of spatial data is extracted by residual network, and the feature vector of temporal data is extracted by Transformer network. Then the output feature vectors of the residual network and the Transformer network are weighted fused; The fused feature vector is then mapped to two categories through a fully connected layer and input into the Softmax classifier to predict the probability distribution; The botnet traffic detection module is used to collect the network traffic data to be detected, and input it into the data collection and processing module for data processing, and then input the processed data into the model building and training module, and use the trained detection model to detect whether it is botnet traffic.

9. A non-transitory computer-readable storage medium, characterized in that: Computer instructions are stored thereon, and the computer instructions enable the computer to execute the botnet traffic detection method based on time-space fusion features as described in any one of claims 1-7.

10. An electronic device, characterized in that: include: A processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus, and the processor calls the logic instructions in the memory to execute the botnet traffic detection method based on spatiotemporal fusion features as described in any one of claims 1-7.

Images