Network unknown behavior detection method, device and equipment based on flow characteristic analysis

Abstract

The invention provides a network unknown behavior detection method, device and equipment based on flow feature analysis, relates to the technical field of network security, and aims to solve the problems that related technologies for network behavior detection are difficult to adapt to a complex encrypted network environment and highly depend on artificial tags. The method comprises the following steps: performing byte coding processing on original byte data of network traffic to be detected to obtain target traffic in a single-channel grayscale image form; performing feature extraction on the target traffic according to a traffic feature extractor based on an unsupervised training task; clustering and classifying the feature vectors of the target traffic through a clustering algorithm group and an incremental updating type classifier group; inputting the feature vector, the clustering result and the classification result into an MLP multilayer perceptron model for training, and converting the feature vector of the target flow according to a trained metric learning model; and performing simple clustering division on the converted feature vectors to obtain a final detection result.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network security technology, and in particular to a method, device and equipment for detecting unknown network behaviors based on traffic feature analysis. Background Art

[0002] Network behavior detection mainly monitors and analyzes user behavior and data transmission in the network to identify abnormal behavior, potential threats or violations. Network behavior detection methods in related technologies are mainly divided into four categories: port-based methods, deep packet inspection-based methods, machine learning-based methods and deep learning-based methods.

[0003] Port-based methods and deep packet inspection-based methods are highly dependent on specific port or payload information, and are difficult to handle various traffic camouflage techniques and increasingly complex traffic information, and are also difficult to apply in widely encrypted network communication environments. Machine learning-based methods and deep learning-based methods are highly dependent on manual feature extraction and reasonable feature extraction methods, requiring high labor costs and sufficient prior knowledge. Summary of the invention

[0004] The embodiments of the present application provide a method, device and equipment for detecting unknown network behaviors based on traffic feature analysis, aiming to solve the problem that related technologies for network behavior detection are difficult to handle complex encrypted traffic and are extremely dependent on high manual analysis costs and sufficient prior knowledge.

[0005] A first aspect of an embodiment of the present application provides a method for detecting unknown network behaviors based on traffic feature analysis, comprising: Perform byte encoding on the original byte data of the network traffic to be detected to obtain the target traffic in the form of a single-channel grayscale image; According to a traffic feature extractor based on an unsupervised training task, feature extraction is performed on the target traffic to obtain a feature vector of the target traffic; Clustering the feature vectors of the target traffic by a clustering algorithm group, and classifying the feature vectors of the target traffic by an incrementally updateable classifier group, wherein the clustering algorithm group includes a plurality of unsupervised clustering algorithms; Inputting the feature vector, clustering result and classification result of the target flow into an MLP multi-layer perceptron model for training to obtain a trained metric learning model, and transforming the feature vector of the target flow according to the metric learning model to obtain a feature representation of the target flow in a target feature space; The characteristic representation of the target traffic in the target feature space is processed multiple times by the k_means algorithm, and the result with the highest silhouette coefficient in the processing results is selected as the final detection result. The detection result is a cluster, which characterizes different types of network traffic behavior.

[0006] In an optional implementation manner, the performing byte encoding processing on the original byte data of the network traffic to be detected includes: Creating a two-dimensional matrix corresponding to the network traffic to be detected according to the original byte data of the network traffic to be detected, wherein the original byte data includes: a header byte and a payload byte of each data packet of the network traffic to be detected; The header bytes and the payload bytes of each data packet are filled into the two-dimensional matrix row by row to obtain a target two-dimensional matrix, where the target two-dimensional matrix is ​​the target flow in the form of the single-channel grayscale image.

[0007] In an optional embodiment, the unsupervised training process of the traffic feature extractor comprises the following steps: Obtain network traffic samples in the form of multiple single-channel grayscale images; After randomly masking the network traffic sample, the sample is input into a first deep learning model based on an image encoder for feature extraction, and multiple small deep learning models are used as decoders to decode the extracted features to obtain a corresponding number of regional partial prediction features; At the same time, the network traffic sample is input into a second deep learning model with the same structure as the first deep learning model to extract features and obtain overall features; A first loss value is calculated based on the difference between the partial prediction features of all regions and the corresponding parts of the overall features, and the first deep learning model, the second deep learning model and all small deep learning models are optimized based on the first loss value, and the trained first deep learning model is used as the traffic feature extractor.

[0008] In an optional implementation, clustering the feature vector of the target traffic by using a clustering algorithm group includes: The characteristic vector of the target flow is spatially divided from the perspectives of spatial distance, data density and hierarchical relationship through a clustering algorithm group to obtain a clustering result of the target flow. The clustering algorithm group includes: k_means algorithm, DBSCAN algorithm and IHC clustering algorithm.

[0009] In an optional implementation, classifying the feature vector of the target traffic by using an incrementally updateable classifier group includes: Inputting the feature vector of the target traffic into each classifier in the classifier group to obtain a second loss value of each classifier, wherein each classifier is trained by network traffic samples of the same network traffic behavior type, and each classifier corresponds to a unique second loss value threshold; Select the minimum loss value that is less than the second loss value threshold of the corresponding classifier among the second loss values ​​of each classifier, and use the network traffic behavior type corresponding to the classifier corresponding to the loss value as the network traffic behavior type corresponding to the target traffic, to obtain the classification result of the target traffic; When the second loss value of each classifier is greater than the corresponding second loss value threshold of the classifier, the network traffic behavior type of the target traffic is set to an unknown behavior type to obtain a classification result of the target traffic.

[0010] In an optional embodiment, the supervised training process of each classifier comprises the following steps: Obtain feature vectors of network traffic samples of the same type; The feature vectors of each network traffic sample of the same type are respectively input into the autoencoder corresponding to each network traffic sample of the same type. The autoencoder reconstructs the input network traffic sample and compares the difference with the network traffic sample itself to calculate the loss. The autoencoder is optimized according to the calculation result to obtain each trained classifier. All network traffic samples are used to calculate the second loss value threshold on the trained classifier.

[0011] In an optional implementation, the training process of the metric learning model includes the following steps: Create an MLP multi-layer perceptron model, which is used to nonlinearly map the input feature vector to a certain position of the target dimension; Randomly taking a pair of samples from the target flow, inputting the feature vectors corresponding to the sample pair into the MLP multi-layer perceptron model for transformation, and obtaining a transformed feature vector pair; According to the clustering results and classification results corresponding to the sample pair, determining whether the two samples of the sample pair belong to the same type; In the case where the two samples belong to the same type, the distance between the transformed feature vector pair in the feature space is used as a third loss value, and the model parameters of the MLP multi-layer perceptron model are updated according to the third loss value; In the case that the two samples do not belong to the same type, taking the difference between the distance of the transformed feature vector pair in the feature space and a preset distance as a fourth loss value, and minimizing the fourth loss value to update the model parameters of the MLP multi-layer perceptron model; The metric learning model is obtained by updating the model parameters of the MLP multi-layer perceptron model.

[0012] In an optional implementation, after obtaining the final detection result, the method further includes: Obtain manual annotation results of the network traffic to be detected; Based on the manual labeling results, the model parameters of the classifier group are updated.

[0013] A second aspect of an embodiment of the present application provides a network unknown behavior detection device based on traffic feature analysis, comprising: The first processing module is used to perform byte encoding processing on the original byte data of the network traffic to be detected to obtain the target traffic in the form of a single-channel grayscale image; A feature extraction module, used for extracting features of the target flow according to a flow feature extractor based on an unsupervised training task, to obtain a feature vector of the target flow; A second processing module, configured to cluster the feature vectors of the target traffic by using a clustering algorithm group, and classify the feature vectors of the target traffic by using an incrementally updateable classifier group, wherein the clustering algorithm group includes a plurality of unsupervised clustering algorithms; A metric learning module is used to input the feature vector, clustering result and classification result of the target flow into an MLP multi-layer perceptron model for training to obtain a trained metric learning model, and transform the feature vector of the target flow according to the metric learning model to obtain a feature representation of the target flow in a target feature space; The detection module is used to perform multiple processing on the characteristic representation of the target traffic in the target feature space through the k_means algorithm, and select the result with the highest silhouette coefficient in the processing results as the final detection result. The detection result is a cluster that characterizes different types of network traffic behavior.

[0014] A third aspect of an embodiment of the present application provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method for detecting unknown network behaviors based on traffic feature analysis of the first aspect of an embodiment of the present application is implemented.

[0015] In this embodiment, byte encoding is performed on the original byte data of the network traffic to be detected, and data is directly obtained from the byte level without considering whether the network traffic is encrypted; feature extraction is performed on the target traffic according to the traffic feature extractor based on the unsupervised training task, and the unsupervised training traffic feature extractor used can extract the characteristics of the network traffic through the original byte data of the network traffic without relying on manual labels; then, a clustering algorithm group and an incrementally updateable clustering algorithm group are combined, and the ability of the clustering algorithm and the classification algorithm to distinguish the characteristics of the network traffic samples is maximized through the metric learning model, so as to achieve a relatively ideal network unknown behavior type detection result without relying on a large amount of manually labeled data. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0017] Figure 1 This is a flowchart of the steps of a method for detecting unknown network behaviors based on traffic feature analysis proposed in one embodiment of the present application; Figure 2 It is a schematic diagram of the byte encoding process of the network unknown behavior detection method based on traffic feature analysis proposed in one embodiment of the present application; Figure 3 It is a schematic diagram of the detection process of a network unknown behavior detection method based on traffic feature analysis proposed in an embodiment of the present application; Figure 4 This is an algorithm execution flow chart of a network unknown behavior detection method based on traffic feature analysis proposed in an embodiment of the present application Figure 5 It is a schematic diagram of an electronic device proposed in an embodiment of the present application. DETAILED DESCRIPTION

[0018] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0019] Network behavior: refers to the collection of various communications and operations that occur in a network environment, involving data transmitted through the network and related activities. It mainly includes the following two categories: normal application behavior, which refers to the data communication behavior performed by legal, daily network applications and services; abnormal malicious behavior, which refers to malicious behavior that attempts to destroy, illegally access or exploit network resources.

[0020] Network traffic: refers to the basic unit of sending and receiving information on the Internet or any other type of network. In a network environment, a network flow can be defined as one or more data packets transmitted between two computer addresses using a specific protocol (such as TCP, UDP, ICMP, etc.), and using a pair of specific ports when appropriate. The algorithm in the present invention uses bidirectional network flow as the basic unit of feature extraction, and defines a bidirectional network flow as a sequence of data packets with the same five-tuple, that is, the data packets have the same source IP, source port, destination IP, destination port and protocol.

[0021] Traffic characteristics: refers to various attributes or parameters extracted from network traffic data, which are used to analyze, detect and identify the behavior patterns of network communications, and mainly reflect the characteristics and behaviors of network communications. Traffic characteristics are usually extracted through statistics, analysis and processing of network data packets or sessions.

[0022] Unsupervised training: A type of machine learning training in which the model is trained without labels or target outputs, automatically finding hidden patterns, relationships, or data structures by analyzing the characteristics of the data.

[0023] Metric learning: A class of methods that aims to learn similarity or distance metrics between data. Its goal is to learn a projection or transformation through the relationship between data samples (e.g., whether they belong to the same category), so that similar samples are closer in the transformed space, while different samples are farther away.

[0024] Network behavior detection mainly monitors and analyzes user behavior and data transmission in the network to identify abnormal behavior, potential threats or violations. Network behavior detection methods in related technologies are mainly divided into four categories: port-based methods, deep packet inspection-based methods, machine learning-based methods and deep learning-based methods.

[0025] The first category, port-based methods, mainly classify by analyzing the port number of the transport layer protocol (UDP or TCP). Usually, you only need to parse the header data of the traffic data packet in the network, extract the port number and query the port behavior comparison table to know the specific behavior to which the traffic belongs. With the rapid development of Internet technology, this practice of relying on fixed ports for identification is becoming less and less reliable. The specific reasons include: as the number of various behaviors in the network increases, and many no longer have fixed port numbers that can be queried; many behaviors generally use port masquerading technology to avoid detection by firewalls or certain intrusion detection systems. This technology can help a certain behavior use certain recognized ports to achieve the purpose of deceiving firewalls or intrusion detection systems that rely on port filtering behaviors; due to the widespread use of the Network Address Translation Protocol (NAT), its operation of converting network addresses and ports greatly reduces the accuracy of the port identification method.

[0026] The second type, based on deep packet inspection, performs behavior detection by analyzing the payload of data packets in network flows. If there is a part in the payload that can match the known behavior in certain feature words (i.e., fingerprint), then it can be considered with a high probability that this network flow belongs to the known behavior type. There are three problems with this method: the method has a high computational complexity, which is particularly prominent when facing a large amount of data. This is because the method needs to match the traffic data byte by byte, and the time spent on detection will increase rapidly with the increase in data volume; it is difficult to extract the fingerprint of the network flow. The fingerprint of each type of traffic is a unique identifier that matches a type of traffic. These fingerprints need to be obtained by experts analyzing the network traffic, and this process takes a lot of time; it cannot solve the problem of data encryption. Nowadays, most network traffic has encrypted payloads. For encrypted traffic, the deep packet inspection method is no longer feasible.

[0027] The third type of method is based on machine learning, which uses the statistical characteristics of network traffic and machine learning algorithms to classify traffic. It mainly designs the statistical characteristics of network traffic, and then selects a machine learning model for training, such as decision trees, support vector machines, etc. The trained model can capture the characteristic differences between different traffic. Machine learning methods also have the problem of feature design. Researchers have proposed many traffic features, but which features are more effective, and whether there are different suitable traffic feature sets for network traffic classification in different segments, these problems are difficult to solve.

[0028] The fourth category is deep learning-based methods. Through deep learning models such as convolutional neural networks, the traffic data load is characterized and learned. Then, the deep learning model is used to train the model using loss functions such as cross entropy. The trained model can capture the characteristic differences between different traffic flows. Common behavior detection methods based on deep learning often rely on a large number of calibrated training samples. However, for new behaviors, due to the lack of new behavior samples, the deep learning model cannot effectively learn its traffic characteristics, resulting in low classification accuracy. In addition, deep learning models trained based on a small number of samples are prone to overfitting, resulting in poor model generalization ability. Specifically, these common methods, including new and more complex models such as FS-Net models and Transfomer models, all rely on a large number of training samples, and the models are trained in an offline training manner, that is, the models are trained through a large number of training sets collected in advance. This method has some problems in traffic detection in real scenarios: first, due to the high speed and real-time nature of Internet traffic, this offline training method is bound to lead to a lag in classifier performance; second, due to the extremely unbalanced distribution of network traffic, traffic samples of certain behavior types may be relatively scarce (such as traffic of malicious attacks), and it is difficult to meet the data volume requirements for training models.

[0029] In addition, deep learning-based methods also rely heavily on the characterization of traffic data, that is, by designing a method to process network traffic data, the original network traffic data is processed into representative feature information, such as a one-dimensional array as a feature vector. Common network traffic feature extraction methods can be divided into: feature extraction methods based on traditional machine learning and feature extraction methods based on deep learning.

[0030] The feature extraction method based on traditional machine learning first needs to construct features manually (such as feature engineering) and then train the machine learning model. The effect of the model depends largely on the quality of feature engineering. This method can be mainly divided into three common methods: content feature matching, data flow statistical features, and network connection behavior features. The method based on content feature matching is the most commonly used and reliable one, but this method faces the key problem of "difficulty in artificial feature extraction", that is, because the artificially extracted features rely heavily on the professional knowledge of researchers, and there are problems such as low traffic differentiation of artificially extracted features and these features are too complex to be used effectively, which makes it difficult for artificially extracted features to achieve ideal traffic classification effects. The most representative method based on data flow statistical features is the 248 statistical features proposed by Moore et al., including statistical features such as packet size and packet arrival time interval. Among the methods based on network connection behavior features, the most representative one is the traffic classification method based on connection graph. This method uses hosts, nodes or network flows to establish a connection graph, and then extracts communication behavior measurements based on the properties of the connection graph (such as the out-degree and in-degree of vertices), and finally establishes classification rules based on these measurements. Both methods face the same problem of difficulty in designing artificial features and high cost.

[0031] Feature extraction methods based on deep learning can adaptively extract deep features from network traffic, perform feature analysis, and then perform classification. Typical extraction methods such as convolutional neural networks and graph neural networks all use filters to extract local features of network traffic. This method needs to convert the one-dimensional form of network traffic data into a two-dimensional form to mine relevant information about traffic features. The main problem faced by this method is the discontinuity of deep learning functions, which will bring about sample interference problems and is very dependent on a well-designed feature extraction method.

[0032] To summarize, network behavior detection technology based on port and packet detection is highly dependent on specific port or payload information, and is difficult to handle various traffic camouflage technologies and increasingly complex traffic information, and is also difficult to apply in widely encrypted network communication environments. Recognition based on machine learning or deep learning is highly dependent on manual feature extraction and reasonable feature extraction methods, which requires high labor costs and sufficient prior knowledge.

[0033] This application proposes a method for detecting unknown network behaviors based on traffic feature analysis, aiming to solve the problem that the related technologies for network behavior detection are difficult to handle complex encrypted traffic and are extremely dependent on high manual analysis costs and sufficient prior knowledge. First, the original byte data of each traffic generated by various network behaviors collected from the network is processed into a numerical matrix using byte encoding, which can also be regarded as a single-channel grayscale image, that is, each traffic sample is converted into a grayscale image; then, a traffic feature extractor based on an unsupervised training task is used to directly extract features from these traffic samples; then, the extracted features are classified using an incrementally updateable classifier group, and multiple unsupervised clustering algorithms are used to cluster them separately; then, the traffic features are converted into features based on metric learning based on the results of the above two classifications and clustering; finally, the final clustering is performed to divide the input network traffic into different clustering clusters according to the behavior type to which it belongs, so as to achieve the goal of detecting and distinguishing various types of network behaviors.

[0034] Reference Figure 1 , Figure 1 This is a flowchart of a method for detecting unknown network behaviors based on traffic feature analysis proposed in an embodiment of the present application, including the following steps S11 to S15: Step S11: byte encoding is performed on the original byte data of the network traffic to be detected to obtain the target traffic in the form of a single-channel grayscale image.

[0035] In this embodiment, the original byte data of the network traffic to be detected generated by various network behaviors collected from the network is processed into a numerical matrix form, such as a two-dimensional matrix, using a byte encoding method. The numerical matrix form can also be regarded as a single-channel grayscale image form.

[0036] Furthermore, the byte encoding process of the original byte data of the network traffic to be detected includes: Creating a two-dimensional matrix corresponding to the network traffic to be detected according to the original byte data of the network traffic to be detected, wherein the original byte data includes: a header byte and a payload byte of each data packet of the network traffic to be detected; The header bytes and the payload bytes of each data packet are filled into the two-dimensional matrix row by row to obtain a target two-dimensional matrix, where the target two-dimensional matrix is ​​the target flow in the form of the single-channel grayscale image.

[0037] In this embodiment, a network flow can be defined as one or more data packets transmitted between two computer addresses using a specific protocol. Select the first few data packets of the network flow to be detected, remove the Ethernet headers therein, set the port numbers of the data packets to zero, and replace the IP addresses with random addresses, but keep their directions to avoid introducing biased interference. Create a two-dimensional matrix corresponding to the network flow to be detected based on the raw byte data of the network flow to be detected. The raw byte data includes: the header bytes and payload bytes of each data packet of the network flow to be detected, that is, create a two-dimensional matrix based on the raw byte data of the data packet to represent the network flow to be detected. Each data packet is filled into the matrix row by row according to the header bytes and payload bytes. If the number of valid bytes exceeds the number of matrix elements, it is truncated. If it is insufficient, it is filled with fixed bytes to form a fixed-size representation matrix. After such data packet standardization, a target two-dimensional matrix in the form of numerical matrix is ​​obtained. The target two-dimensional matrix can be regarded as a single-channel grayscale image. For an example of this process, see. Figure 2 .

[0038] Step S12: extracting features of the target flow according to the flow feature extractor based on the unsupervised training task to obtain a feature vector of the target flow.

[0039] In this embodiment, the network traffic to be detected, i.e., the target traffic, which is converted into a single-channel grayscale image, is input into the traffic feature extractor for feature extraction to obtain a feature vector of the target traffic. The traffic feature extractor is a deep learning model based on an image encoder (ViT), which is trained through an unsupervised training task and can output a feature vector corresponding to each network traffic, specifically in the form of a 1-dimensional sequence. The traffic feature extractor is very important. The quality of the features it extracts from the raw data of the network traffic will directly affect the execution effect of the subsequent classifier group and clustering algorithm group, and further affect the final network unknown behavior detection results. High-quality features can make each traffic sample belonging to different network behavior types have good discrimination in the feature space.

[0040] Furthermore, the unsupervised training process of the traffic feature extractor comprises the following steps: Obtain network traffic samples in the form of multiple single-channel grayscale images; After randomly masking the network traffic sample, the sample is input into a first deep learning model based on an image encoder for feature extraction, and multiple small deep learning models are used as decoders to decode the extracted features to obtain a corresponding number of regional partial prediction features; At the same time, the network traffic sample is input into a second deep learning model with the same structure as the first deep learning model to extract features and obtain overall features; A first loss value is calculated based on the difference between the partial prediction features of all regions and the corresponding parts of the overall features, and the first deep learning model, the second deep learning model and all small deep learning models are optimized based on the first loss value, and the trained first deep learning model is used as the traffic feature extractor.

[0041] In this embodiment, in order to get rid of the dependence on manually labeled data, an unsupervised training method is used to pre-train the traffic feature extractor. The specific pre-training method is: first, collect a large number of network traffic samples in the form of multiple single-channel grayscale images; then randomly mask the samples and input them into the first deep learning model to output features; then use multiple small decoders to decode the acquired features, and obtain partial prediction features of multiple regions of the samples respectively; at the same time, use another second deep learning model with the same structure (the parameter is the exponential average weighted value optimized each time by the traffic feature extractor) to directly extract the overall features of the sample; finally, calculate the first loss value based on the difference between the partial prediction features and the overall features of the region to optimize the first deep learning model, the second deep learning model and all small deep learning models to obtain a trained traffic feature extractor. It can be seen that this training method does not require clear sample labels, and secondly, the loss value is calculated in the feature space, which can enhance the feature learning ability of the sample and improve the quality of the extracted features. Through pre-training, a traffic feature extractor with good parameters can be obtained, which can be directly used to extract the features of the actual input network traffic. Moreover, the feature extractor can be fine-tuned or retrained at any time using new network traffic data to adapt to changes in data distribution caused by changes in the network environment.

[0042] Step S13: clustering the feature vectors of the target traffic through a clustering algorithm group, and classifying the feature vectors of the target traffic through an incrementally updateable clustering algorithm group, wherein the clustering algorithm group includes a variety of unsupervised clustering algorithms.

[0043] In this embodiment, the clustering algorithm group includes a variety of unsupervised clustering algorithms, which can discover the relationship between each traffic sample and preliminarily determine which traffic samples belong to a type of network behavior. The classifier group can detect the specific behavior type of network traffic, directly output the label of the network traffic sample, mark the currently unrecognized network traffic as an unknown type, and can perform incremental updates at any time based on newly acquired labeled data to continuously expand the range of recognizable types. Clustering the feature vectors of the target traffic through the clustering algorithm group and classifying the feature vectors of the target traffic through the incrementally updateable clustering algorithm group provide a data basis for the subsequent transformation of the feature vectors of the target traffic.

[0044] Furthermore, clustering the characteristic vectors of the target traffic by using a clustering algorithm group includes: The characteristic vector of the target flow is spatially divided from the perspectives of spatial distance, data density and hierarchical relationship through a clustering algorithm group to obtain a clustering result of the target flow. The clustering algorithm group includes: k_means algorithm, DBSCAN algorithm and IHC clustering algorithm.

[0045] In this embodiment, the clustering algorithm group includes a variety of unsupervised clustering algorithms, specifically including: k_means algorithm, DBSCAN algorithm and IHC clustering algorithm. These three clustering algorithms perform spatial division of data (characteristic vector of target traffic) from three different perspectives: spatial distance, data density and hierarchical relationship, which can cover the data characteristics in most network application scenarios. In addition, in order to eliminate the influence of clustering algorithm parameters, the clustering algorithm group configures different parameters for the above three clustering algorithms, and forms a total of multiple clustering algorithms according to the parameter configuration number of each algorithm, and finally outputs all clustering results.

[0046] Furthermore, the feature vector of the target traffic is classified by an incrementally updateable classifier group, including: Inputting the feature vector of the target traffic into each classifier in the classifier group to obtain a second loss value of each classifier, wherein each classifier is trained by network traffic samples of the same network traffic behavior type, and each classifier corresponds to a unique second loss value threshold; Select the minimum loss value that is less than the second loss value threshold of the corresponding classifier among the second loss values ​​of each classifier, and use the network traffic behavior type corresponding to the classifier corresponding to the loss value as the network traffic behavior type corresponding to the target traffic, to obtain the classification result of the target traffic; When the second loss value of each classifier is greater than the corresponding second loss value threshold of the classifier, the network traffic behavior type of the target traffic is set to an unknown behavior type to obtain a classification result of the target traffic.

[0047] In this embodiment, the feature vector of the target flow is input into each classifier in the classifier group to obtain the second loss value of each classifier. Each classifier is trained by a network flow sample of the same network flow behavior type, and can output a second loss value. The minimum loss value that is less than the second loss value threshold of the corresponding classifier is selected from the second loss value of each classifier, and the network flow behavior type corresponding to the classifier corresponding to the loss value is used as the network flow behavior type corresponding to the target flow to obtain the classification result of the target flow. Among them, the minimum loss value represents that the classifier corresponding to the network flow behavior type can better fit the target flow, and then the type corresponding to the target flow can be identified according to the minimum loss value. Of course, if the second loss value obtained by a certain network flow on each classifier of all existing types is greater than the corresponding classifier second loss value threshold, it can be judged that the network flow does not belong to any existing type, and the network flow behavior type of the target flow is set to an unknown behavior type.

[0048] Furthermore, the supervised training process of each classifier includes the following steps: Obtain feature vectors of network traffic samples of the same type; The feature vectors of each network traffic sample of the same type are respectively input into the autoencoder corresponding to each network traffic sample of the same type. The autoencoder reconstructs the input network traffic sample and compares the difference with the network traffic sample itself to calculate the loss. The autoencoder is optimized according to the calculation result to obtain each trained classifier. All network traffic samples are used to calculate the second loss value threshold on the trained classifier.

[0049] In this embodiment, the classifier group can be trained using the currently available limited labeled data, and can be incrementally updated at any time based on the newly acquired labeled data, continuously expanding the range of identifiable types. Each classifier in the classifier group is an autoencoder model trained with network traffic data of the same behavior type. The specific training process is: the feature vectors of known network traffic samples of the same type are input into each independent autoencoder of the same type, and the autoencoder reconstructs the input network traffic sample and compares the difference with the network traffic sample itself to calculate the loss, and optimizes each independent autoencoder of the same type based on the calculation results to obtain each trained classifier. Finally, all network traffic samples are used to calculate the second loss value threshold on the trained classifier. In this way, each autoencoder can only fit the corresponding type of network traffic, and the fitting degree for other types of network traffic is poor.

[0050] Step S14: Input the feature vector, clustering result and classification result of the target flow into the MLP multi-layer perceptron model for training to obtain a trained metric learning model, and transform the feature vector of the target flow according to the metric learning model to obtain the feature representation of the target flow in the target feature space.

[0051] In this embodiment, the feature vector, clustering result and classification result of the target traffic are input into the MLP multi-layer perceptron model for training to obtain a trained metric learning model, and the feature vector of the target traffic is transformed according to the metric learning model to obtain the feature representation of the target traffic in the target feature space. After the metric learning feature transformation, the position of the feature vector of the target traffic in the feature space will change, the positions of target traffic belonging to the same type will be closer, and the positions of target traffic belonging to different types will be relatively far away, so that network traffic belonging to different types can be better divided, thereby ultimately detecting various types of behavior in the network.

[0052] Furthermore, the training process of the metric learning model includes the following steps: Create an MLP multi-layer perceptron model, which is used to nonlinearly map the input feature vector to a certain position of the target dimension; Randomly taking a pair of samples from the target flow, inputting the feature vectors corresponding to the sample pair into the MLP multi-layer perceptron model for transformation, and obtaining a transformed feature vector pair; According to the clustering results and classification results corresponding to the sample pair, determining whether the two samples of the sample pair belong to the same type; In the case where the two samples belong to the same type, the distance between the transformed feature vector pair in the feature space is used as a third loss value, and the model parameters of the MLP multi-layer perceptron model are updated according to the third loss value; In the case that the two samples do not belong to the same type, taking the difference between the distance of the transformed feature vector pair in the feature space and a preset distance as a fourth loss value, and minimizing the fourth loss value to update the model parameters of the MLP multi-layer perceptron model; The metric learning model is obtained by updating the model parameters of the MLP multi-layer perceptron model.

[0053] In this embodiment, an MLP multi-layer perceptron model is created, which can nonlinearly map the input feature vector to positions of different dimensions. A training task is designed, a pair of samples are randomly selected from the target flow, and the feature vectors corresponding to the sample pair are input into the MLP multi-layer perceptron model for feature conversion; the transformed feature vector pair is used to determine whether the two samples of the sample pair belong to the same type according to the previous clustering results and classification results (here, the classification result is given a higher weight, and the remaining clustering results have the same weight. If the classification result of any sample pair is unknown, the classification result is not used, and the remaining clustering results are used for metric learning). If the two samples belong to the same type, the distance between the two transformed sample feature vectors in the feature space is used as the third loss value, and the model parameters of the MLP multi-layer perceptron model are updated according to the third loss value; if the two samples do not belong to the same type, otherwise the difference between the distance between the two transformed sample feature vectors in the feature space and a relatively large distance (preset distance) is used as the fourth loss value, and the loss value is minimized to update the model parameters of the MLP multi-layer perceptron model. In this way, the distance between sample features of the same type in the feature space will continue to decrease after the feature changes, while the distance between sample features of different types in the feature space will continue to tend to a relatively far distance after the feature changes.

[0054] Step S15: The characteristic representation of the target traffic in the target feature space is processed multiple times by the k_means algorithm, and the result with the highest silhouette coefficient in the processing results is selected as the final detection result. The detection result is a cluster, which characterizes different types of network traffic behavior.

[0055] In this embodiment, after metric learning, the feature vectors of all target traffic will be transformed into a feature space with discrimination, that is, the feature representation of the target traffic in the target feature space is obtained, and a simple k_means clustering is used at this time. Since the k_means algorithm requires a k parameter as the number of output clusters, and this number cannot be known at this time, different k parameters are set, and the k_means algorithm is executed multiple times. The result with the highest silhouette coefficient in the processing result is selected as the final output result. The detection result is a cluster, which can represent different types of network traffic behavior.

[0056] Furthermore, after obtaining the final test result, it also includes: Obtain manual annotation results of the network traffic to be detected; Based on the manual labeling results, the model parameters of the classifier group are updated.

[0057] In this embodiment, considering the variability of the network environment, for the traffic feature extractor, since it adopts an unsupervised training method, it can be relatively easy to use the newly obtained network traffic data for fine-tuning training updates (the method is consistent with pre-training) or retraining after a certain period of time. For the classifier group, the network behavior type detection result output at the end is handed over to manual analysis, and some network traffic samples are labeled as much as possible, so that the manual labeling results of the network traffic to be detected can be obtained. Update the classifier group based on the manual labeling results (for existing classifier models, the new data can be combined with historical data to fine-tune the model so that the classifier model adapts to the changes in the distribution of this type of data; for non-existent types, directly train a new classifier model). The remaining algorithm parameters are only used in each detection, and each detection is different, so there is no need to save and update. If there are some data with clear labels, it can also improve the detection effect of this application. This part of the data with clear labels can come from prior knowledge or from subsequent manual analysis of the detection results.

[0058] The network unknown behavior detection method based on traffic feature analysis provided by the present application directly obtains data from the byte level by byte encoding the original byte data of the network traffic to be detected, without considering whether the network traffic is encrypted; according to the traffic feature extractor based on the unsupervised training task, the target traffic is feature extracted, and the unsupervised training traffic feature extractor used can extract the characteristics of the network traffic through the original byte data of the network traffic without relying on artificial labels; then, the clustering algorithm group and the incrementally updateable clustering algorithm group are combined, and the clustering algorithm and the classification algorithm are used to maximize the ability to distinguish the characteristics of network traffic samples through the metric learning model, so as to achieve a relatively ideal network unknown behavior type detection result without relying on a large amount of artificially labeled data. Among them, the unsupervised pre-training method of calculating the loss in the feature space is applied to the network traffic feature extractor to improve the quality of the extracted features; through the metric learning method, the classifier group is combined with the clustering algorithm group to give full play to the respective advantages of the supervised classification task and the unsupervised clustering task, and the type of network traffic is detected.

[0059] Reference Figure 3 , Figure 3 FIG. 1 is a schematic diagram of the detection process of a network unknown behavior detection method based on traffic feature analysis proposed in an embodiment of the present application. Figure 3 As shown in the figure, the detection process is as follows: The traffic sample to be identified (network traffic to be detected) is byte-encoded; the processed traffic sample to be identified is input into the feature extractor to extract the feature vector of the processed traffic sample to be identified, and the feature extractor is updated with the newly processed traffic sample data to be identified; the feature vector is input into the classifier group for classification, and each classifier in the classifier group is trained by a network traffic sample of the same network traffic behavior type; at the same time, the feature vector is input into the clustering algorithm group for clustering, and the clustering algorithm group includes: k_means algorithm, DBSCAN algorithm and IHC clustering algorithm; based on the feature vector, classification result and clustering result corresponding to the traffic sample to be identified, the features (feature vector) are transformed and clustered through the metric learning model to obtain the unknown behavior detection result, and the detection result is a cluster cluster, which represents different network traffic behavior types; according to the unknown behavior detection result, it is analyzed manually and the traffic sample to be identified is labeled, and according to the manual labeling result of the traffic sample to be identified, the classifier group is incrementally updated.

[0060] Reference Figure 4 , Figure 4 FIG. 1 is an algorithm execution flow chart of a network unknown behavior detection method based on traffic feature analysis proposed in an embodiment of the present application. Figure 4 As shown, the algorithm execution process is: Input the traffic sample to be identified (network traffic to be detected); perform byte encoding on the traffic sample to be identified; extract feature vectors from the processed traffic sample to be identified through a feature extractor; input the feature vectors into a classifier group for classification, and input the feature vectors into a clustering algorithm group for clustering; transform features (feature vectors) and cluster them through a metric learning model, and output cluster clusters (detection results).

[0061] Based on the same inventive concept, an embodiment of the present application provides a network unknown behavior detection device based on traffic feature analysis, the device comprising: The first processing module is used to perform byte encoding processing on the original byte data of the network traffic to be detected to obtain the target traffic in the form of a single-channel grayscale image; A feature extraction module, used for extracting features of the target flow according to a flow feature extractor based on an unsupervised training task, to obtain a feature vector of the target flow; A second processing module, configured to cluster the feature vectors of the target traffic by using a clustering algorithm group, and classify the feature vectors of the target traffic by using an incrementally updateable classifier group, wherein the clustering algorithm group includes a plurality of unsupervised clustering algorithms; A metric learning module is used to input the feature vector, clustering result and classification result of the target flow into an MLP multi-layer perceptron model for training to obtain a trained metric learning model, and transform the feature vector of the target flow according to the metric learning model to obtain a feature representation of the target flow in a target feature space; The detection module is used to perform multiple processing on the characteristic representation of the target traffic in the target feature space through the k_means algorithm, and select the result with the highest silhouette coefficient in the processing results as the final detection result. The detection result is a cluster that characterizes different types of network traffic behavior.

[0062] In an optional implementation, the first processing module is specifically configured to: Creating a two-dimensional matrix corresponding to the network traffic to be detected according to the original byte data of the network traffic to be detected, wherein the original byte data includes: a header byte and a payload byte of each data packet of the network traffic to be detected; The header bytes and the payload bytes of each data packet are filled into the two-dimensional matrix row by row to obtain a target two-dimensional matrix, where the target two-dimensional matrix is ​​the target flow in the form of the single-channel grayscale image.

[0063] In an optional implementation, the feature extraction module is specifically used to: Obtain network traffic samples in the form of multiple single-channel grayscale images; After randomly masking the network traffic sample, the sample is input into a first deep learning model based on an image encoder for feature extraction, and multiple small deep learning models are used as decoders to decode the extracted features to obtain a corresponding number of regional partial prediction features; At the same time, the network traffic sample is input into a second deep learning model with the same structure as the first deep learning model to extract features and obtain overall features; A first loss value is calculated based on the difference between the partial prediction features of all regions and the corresponding parts of the overall features, and the first deep learning model, the second deep learning model and all small deep learning models are optimized based on the first loss value, and the trained first deep learning model is used as the traffic feature extractor.

[0064] In an optional implementation, the second processing module is specifically configured to: The characteristic vector of the target flow is spatially divided from the perspectives of spatial distance, data density and hierarchical relationship through a clustering algorithm group to obtain a clustering result of the target flow. The clustering algorithm group includes: k_means algorithm, DBSCAN algorithm and IHC clustering algorithm.

[0065] In an optional implementation, the second processing module is specifically configured to: Inputting the feature vector of the target traffic into each classifier in the classifier group to obtain a second loss value of each classifier, wherein each classifier is trained by network traffic samples of the same network traffic behavior type, and each classifier corresponds to a unique second loss value threshold; Select the minimum loss value that is less than the second loss value threshold of the corresponding classifier among the second loss values ​​of each classifier, and use the network traffic behavior type corresponding to the classifier corresponding to the loss value as the network traffic behavior type corresponding to the target traffic, to obtain the classification result of the target traffic; When the second loss value of each classifier is greater than the corresponding second loss value threshold of the classifier, the network traffic behavior type of the target traffic is set to an unknown behavior type to obtain a classification result of the target traffic.

[0066] In an optional implementation, the second processing module is specifically configured to: Obtain feature vectors of network traffic samples of the same type; The feature vectors of each network traffic sample of the same type are respectively input into the autoencoder corresponding to each network traffic sample of the same type. The autoencoder reconstructs the input network traffic sample and compares the difference with the network traffic sample itself to calculate the loss. The autoencoder is optimized according to the calculation result to obtain each trained classifier. All network traffic samples are used to calculate the second loss value threshold on the trained classifier.

[0067] In an optional implementation, the metric learning module is specifically used to: Create an MLP multi-layer perceptron model, which is used to nonlinearly map the input feature vector to a certain position of the target dimension; Randomly taking a pair of samples from the target flow, inputting the feature vectors corresponding to the sample pair into the MLP multi-layer perceptron model for transformation, and obtaining a transformed feature vector pair; According to the clustering results and classification results corresponding to the sample pair, determining whether the two samples of the sample pair belong to the same type; In the case where the two samples belong to the same type, the distance between the transformed feature vector pair in the feature space is used as a third loss value, and the model parameters of the MLP multi-layer perceptron model are updated according to the third loss value; In the case that the two samples do not belong to the same type, taking the difference between the distance of the transformed feature vector pair in the feature space and a preset distance as a fourth loss value, and minimizing the fourth loss value to update the model parameters of the MLP multi-layer perceptron model; The metric learning model is obtained by updating the model parameters of the MLP multi-layer perceptron model.

[0068] In an optional embodiment, the device further comprises: The updating module is used to obtain the manual labeling results of the network traffic to be detected; based on the manual labeling results, the model parameters of the classifier group are updated.

[0069] Based on the same inventive concept, an embodiment of the present application provides an electronic device, such as Figure 5 shown. Figure 5 This is a schematic diagram of an electronic device shown in an embodiment of the present application. The electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and when the processor executes, the steps in the method for detecting unknown network behaviors based on traffic feature analysis described in any of the above embodiments of the present application are implemented.

[0070] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0071] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present application may adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the embodiments of the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0072] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1A device that provides the functions specified in a block or multiple blocks.

[0073] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0074] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0075] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0076] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0077] The above is a detailed introduction to the network unknown behavior detection method, device and equipment based on traffic feature analysis provided by the present application. This article uses specific examples to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for detecting unknown network behaviors based on traffic feature analysis, characterized in that: include: Perform byte encoding on the original byte data of the network traffic to be detected to obtain the target traffic in the form of a single-channel grayscale image; According to a traffic feature extractor based on an unsupervised training task, feature extraction is performed on the target traffic to obtain a feature vector of the target traffic; Clustering the feature vectors of the target traffic by a clustering algorithm group, and classifying the feature vectors of the target traffic by an incrementally updateable classifier group, wherein the clustering algorithm group includes a plurality of unsupervised clustering algorithms; Inputting the feature vector, clustering result and classification result of the target flow into an MLP multi-layer perceptron model for training to obtain a trained metric learning model, and transforming the feature vector of the target flow according to the metric learning model to obtain a feature representation of the target flow in a target feature space; The characteristic representation of the target traffic in the target feature space is processed multiple times by the k_means algorithm, and the result with the highest silhouette coefficient in the processing results is selected as the final detection result. The detection result is a cluster, which characterizes different types of network traffic behavior.

2. The method for detecting unknown network behaviors based on traffic feature analysis according to claim 1 is characterized in that: The byte encoding process of the original byte data of the network traffic to be detected includes: Creating a two-dimensional matrix corresponding to the network traffic to be detected according to the original byte data of the network traffic to be detected, wherein the original byte data includes: a header byte and a payload byte of each data packet of the network traffic to be detected; The header bytes and the payload bytes of each data packet are filled into the two-dimensional matrix row by row to obtain a target two-dimensional matrix, where the target two-dimensional matrix is ​​the target flow in the form of the single-channel grayscale image.

3. The method for detecting unknown network behaviors based on traffic feature analysis according to claim 1 is characterized in that: The unsupervised training process of the traffic feature extractor comprises the following steps: Obtain network traffic samples in the form of multiple single-channel grayscale images; After randomly masking the network traffic sample, the sample is input into a first deep learning model based on an image encoder for feature extraction, and multiple small deep learning models are used as decoders to decode the extracted features to obtain a corresponding number of regional partial prediction features; At the same time, the network traffic sample is input into a second deep learning model with the same structure as the first deep learning model to extract features and obtain overall features; A first loss value is calculated based on the difference between the partial prediction features of all regions and the corresponding parts of the overall features, and the first deep learning model, the second deep learning model and all small deep learning models are optimized based on the first loss value, and the trained first deep learning model is used as the traffic feature extractor.

4. The method for detecting unknown network behaviors based on traffic feature analysis according to claim 1 is characterized in that: The clustering of the characteristic vectors of the target traffic by a clustering algorithm group includes: The characteristic vector of the target flow is spatially divided from the perspectives of spatial distance, data density and hierarchical relationship through a clustering algorithm group to obtain a clustering result of the target flow. The clustering algorithm group includes: k_means algorithm, DBSCAN algorithm and IHC clustering algorithm.

5. The method for detecting unknown network behaviors based on traffic feature analysis according to claim 1 is characterized in that: The feature vector of the target traffic is classified by an incrementally updateable classifier group, including: Inputting the feature vector of the target traffic into each classifier in the classifier group to obtain a second loss value of each classifier, wherein each classifier is trained by network traffic samples of the same network traffic behavior type, and each classifier corresponds to a unique second loss value threshold; Select the minimum loss value that is less than the second loss value threshold of the corresponding classifier among the second loss values ​​of each classifier, and use the network traffic behavior type corresponding to the classifier corresponding to the loss value as the network traffic behavior type corresponding to the target traffic, to obtain the classification result of the target traffic; When the second loss value of each classifier is greater than the corresponding second loss value threshold of the classifier, the network traffic behavior type of the target traffic is set to an unknown behavior type to obtain a classification result of the target traffic.

6. The method for detecting unknown network behaviors based on traffic feature analysis according to claim 5 is characterized in that: The supervised training process of each classifier includes the following steps: Obtain feature vectors of network traffic samples of the same type; The feature vectors of each network traffic sample of the same type are respectively input into the autoencoder corresponding to each network traffic sample of the same type. The autoencoder reconstructs the input network traffic sample and compares the difference with the network traffic sample itself to calculate the loss. The autoencoder is optimized according to the calculation result to obtain each trained classifier. All network traffic samples are used to calculate the second loss value threshold on the trained classifier.

7. The method for detecting unknown network behaviors based on traffic feature analysis according to claim 1 is characterized in that: The training process of the metric learning model includes the following steps: Create an MLP multi-layer perceptron model, which is used to nonlinearly map the input feature vector to a certain position of the target dimension; Randomly taking a pair of samples from the target flow, inputting the feature vectors corresponding to the sample pair into the MLP multi-layer perceptron model for transformation, and obtaining a transformed feature vector pair; According to the clustering results and classification results corresponding to the sample pair, determining whether the two samples of the sample pair belong to the same type; In the case where the two samples belong to the same type, the distance between the transformed feature vector pair in the feature space is used as a third loss value, and the model parameters of the MLP multi-layer perceptron model are updated according to the third loss value; In the case that the two samples do not belong to the same type, taking the difference between the distance of the transformed feature vector pair in the feature space and a preset distance as a fourth loss value, and minimizing the fourth loss value to update the model parameters of the MLP multi-layer perceptron model; The metric learning model is obtained by updating the model parameters of the MLP multi-layer perceptron model.

8. The method for detecting unknown network behaviors based on traffic feature analysis according to claim 1 is characterized in that: After obtaining the final test results, it also includes: Obtain manual annotation results of the network traffic to be detected; Based on the manual labeling results, the model parameters of the classifier group are updated.

9. A network unknown behavior detection device based on traffic feature analysis, characterized in that: include: The first processing module is used to perform byte encoding processing on the original byte data of the network traffic to be detected to obtain the target traffic in the form of a single-channel grayscale image; A feature extraction module, used for extracting features of the target flow according to a flow feature extractor based on an unsupervised training task, to obtain a feature vector of the target flow; A second processing module, configured to cluster the feature vectors of the target traffic by using a clustering algorithm group, and classify the feature vectors of the target traffic by using an incrementally updateable classifier group, wherein the clustering algorithm group includes a plurality of unsupervised clustering algorithms; A metric learning module, used for inputting the feature vector, clustering result and classification result of the target flow into an MLP multi-layer perceptron model for training to obtain a trained metric learning model, and transforming the feature vector of the target flow according to the metric learning model to obtain a feature representation of the target flow in a target feature space; The detection module is used to perform multiple processing on the characteristic representation of the target traffic in the target feature space through the k_means algorithm, and select the result with the highest silhouette coefficient in the processing results as the final detection result. The detection result is a cluster that characterizes different types of network traffic behavior.

10. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the network unknown behavior detection method based on traffic feature analysis as described in any one of claims 1 to 8 when executing the computer program.

Images