A network unknown behavior detection method, device and equipment based on traffic feature analysis

Abstract

The application provides a network unknown behavior detection method and device based on traffic feature analysis and equipment, relates to the network security technical field, and aims to solve the problems that related technologies for network behavior detection are difficult to adapt to complex encrypted network environment and highly depend on artificial labels. The method comprises the following steps: performing byte encoding processing on original byte data of to-be-detected network traffic to obtain target traffic in the form of a single-channel grayscale image; performing feature extraction on the target traffic according to a traffic feature extractor based on an unsupervised training task; performing clustering and classification on a feature vector of the target traffic through a clustering algorithm group and an incrementally updatable classifier group; inputting the feature vector, clustering results and classification results into an MLP multi-layer perceptron model for training, and transforming the feature vector of the target traffic according to the trained metric learning model; and performing simple clustering division on the transformed feature vector to obtain a final detection result.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network security technology, and in particular to a method, device, and equipment for detecting unknown network behaviors based on traffic feature analysis. Background Art

[0002] Network behavior detection primarily monitors and analyzes user behavior and data transmission within a network to identify abnormal behavior, potential threats, or violations. Related network behavior detection methods can be categorized into four main types: port-based methods, deep packet inspection-based methods, machine learning-based methods, and deep learning-based methods.

[0003] Port-based methods and deep packet inspection-based methods are highly dependent on specific port or payload information, making it difficult for them to handle various traffic camouflage technologies and increasingly complex traffic information, and are also difficult to apply in widely encrypted network communication environments. Machine learning-based methods and deep learning-based methods are highly dependent on manual feature extraction and reasonable feature extraction methods, requiring high labor costs and sufficient prior knowledge. Summary of the Invention

[0004] The embodiments of the present application provide a method, device and equipment for detecting unknown network behaviors based on traffic feature analysis, aiming to solve the problem that related technologies for network behavior detection are difficult to handle complex encrypted traffic and are extremely dependent on high manual analysis costs and sufficient prior knowledge.

[0005] A first aspect of an embodiment of the present application provides a method for detecting unknown network behavior based on traffic feature analysis, comprising:

[0006] Perform byte encoding on the raw byte data of the network traffic to be detected to obtain the target traffic in the form of a single-channel grayscale image;

[0007] Extracting features of the target flow according to a flow feature extractor based on an unsupervised training task to obtain a feature vector of the target flow;

[0008] Clustering the feature vectors of the target traffic using a clustering algorithm group, and classifying the feature vectors of the target traffic using an incrementally updateable classifier group, wherein the clustering algorithm group includes a plurality of unsupervised clustering algorithms;

[0009] Inputting the feature vector, clustering results, and classification results of the target traffic into an MLP multi-layer perceptron model for training to obtain a trained metric learning model, and transforming the feature vector of the target traffic according to the metric learning model to obtain a feature representation of the target traffic in a target feature space;

[0010] The characteristic representation of the target traffic in the target feature space is processed multiple times by the k_means algorithm, and the result with the highest silhouette coefficient in the processing results is selected as the final detection result. The detection result is a cluster that characterizes different types of network traffic behavior.

[0011] In an optional implementation manner, performing byte encoding processing on the original byte data of the network traffic to be detected includes:

[0012] Creating a two-dimensional matrix corresponding to the network traffic to be detected according to the original byte data of the network traffic to be detected, wherein the original byte data includes: a header byte and a payload byte of each data packet of the network traffic to be detected;

[0013] The header bytes and payload bytes of each data packet are filled into the two-dimensional matrix row by row to obtain a target two-dimensional matrix, where the target two-dimensional matrix is ​​the target traffic in the form of the single-channel grayscale image.

[0014] In an optional embodiment, the unsupervised training process of the traffic feature extractor includes the following steps:

[0015] Obtain network traffic samples in the form of multiple single-channel grayscale images;

[0016] After randomly masking the network traffic sample, the sample is input into a first deep learning model based on an image encoder for feature extraction, and multiple small deep learning models are used as decoders to decode the extracted features to obtain a corresponding number of regional partial prediction features;

[0017] At the same time, the network traffic sample is input into a second deep learning model with the same structure as the first deep learning model to extract features and obtain overall features;

[0018] A first loss value is calculated based on the difference between the partial prediction features of all regions and the corresponding parts of the overall features, and the first deep learning model, the second deep learning model and all small deep learning models are optimized based on the first loss value, and the trained first deep learning model is used as the traffic feature extractor.

[0019] In an optional implementation, clustering the characteristic vectors of the target traffic using a clustering algorithm group includes:

[0020] The characteristic vector of the target flow is spatially divided from the perspectives of spatial distance, data density and hierarchical relationship through a clustering algorithm group to obtain a clustering result of the target flow. The clustering algorithm group includes: k_means algorithm, DBSCAN algorithm and IHC clustering algorithm.

[0021] In an optional embodiment, classifying the feature vector of the target traffic by using an incrementally updateable classifier group includes:

[0022] Inputting the feature vector of the target traffic into each classifier in the classifier group to obtain a second loss value of each classifier, wherein each classifier is trained using network traffic samples of the same network traffic behavior type, and each classifier corresponds to a unique second loss value threshold;

[0023] Selecting the minimum loss value that is less than the second loss value threshold of the corresponding classifier among the second loss values ​​of each classifier, and using the network traffic behavior type corresponding to the classifier corresponding to the loss value as the network traffic behavior type corresponding to the target traffic, to obtain a classification result of the target traffic;

[0024] When the second loss value of each classifier is greater than the corresponding second loss value threshold of the classifier, the network traffic behavior type of the target traffic is set to an unknown behavior type to obtain a classification result of the target traffic.

[0025] In an optional embodiment, the supervised training process of each classifier includes the following steps:

[0026] Obtain feature vectors of network traffic samples of the same type;

[0027] The feature vectors of each network traffic sample of the same type are respectively input into the autoencoder corresponding to each network traffic sample of the same type. The autoencoder reconstructs the input network traffic sample and compares the difference with the network traffic sample itself to calculate the loss. The autoencoder is optimized according to the calculation result to obtain each trained classifier. All network traffic samples are used to calculate the second loss value threshold on the trained classifier.

[0028] In an optional embodiment, the training process of the metric learning model includes the following steps:

[0029] Create an MLP multi-layer perceptron model, which is used to nonlinearly map the input feature vector to a certain position of the target dimension;

[0030] Randomly extract a pair of samples from the target traffic, input the feature vectors corresponding to the sample pair into the MLP multi-layer perceptron model for transformation, and obtain a transformed feature vector pair;

[0031] Determining whether the two samples of the sample pair belong to the same type according to the clustering results and classification results corresponding to the sample pair;

[0032] When the two samples belong to the same type, the distance between the transformed feature vectors in the feature space is used as a third loss value, and the model parameters of the MLP multi-layer perceptron model are updated according to the third loss value;

[0033] When the two samples do not belong to the same type, a difference between a distance between the transformed feature vector pair in the feature space and a preset distance is used as a fourth loss value, and the fourth loss value is minimized to update the model parameters of the MLP multi-layer perceptron model;

[0034] The metric learning model is obtained by updating the model parameters of the MLP multi-layer perceptron model.

[0035] In an optional embodiment, after obtaining the final detection result, the method further includes:

[0036] Obtain manual annotation results of the network traffic to be detected;

[0037] Based on the manual labeling results, the model parameters of the classifier group are updated.

[0038] A second aspect of an embodiment of the present application provides a network unknown behavior detection device based on traffic feature analysis, comprising:

[0039] The first processing module is used to perform byte encoding processing on the original byte data of the network traffic to be detected to obtain the target traffic in the form of a single-channel grayscale image;

[0040] A feature extraction module is used to extract features of the target flow according to a flow feature extractor based on an unsupervised training task to obtain a feature vector of the target flow;

[0041] a second processing module, configured to cluster the feature vectors of the target traffic using a clustering algorithm group, and classify the feature vectors of the target traffic using an incrementally updateable classifier group, wherein the clustering algorithm group includes a plurality of unsupervised clustering algorithms;

[0042] A metric learning module is used to input the feature vector, clustering results, and classification results of the target flow into an MLP multi-layer perceptron model for training to obtain a trained metric learning model, and transform the feature vector of the target flow according to the metric learning model to obtain a feature representation of the target flow in a target feature space;

[0043] The detection module is used to perform multiple processing on the characteristic representation of the target traffic in the target feature space through the k_means algorithm, and select the result with the highest silhouette coefficient as the final detection result. The detection result is a cluster that characterizes different types of network traffic behavior.

[0044] A third aspect of an embodiment of the present application provides an electronic device, comprising: a processor, a memory, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, the method for detecting unknown network behaviors based on traffic feature analysis according to the first aspect of an embodiment of the present application is implemented.

[0045] In this embodiment, the raw byte data of the network traffic to be detected is byte-encoded and data is obtained directly from the byte level without considering whether the network traffic is encrypted. Feature extraction is performed on the target traffic based on a traffic feature extractor based on an unsupervised training task. The unsupervised training traffic feature extractor used can extract the features of the network traffic from the raw byte data of the network traffic without relying on manual labels. Then, a clustering algorithm group and an incrementally updateable clustering algorithm group are combined to maximize the ability of the clustering algorithm and the classification algorithm to distinguish the features of the network traffic samples through a metric learning model, so as to achieve a relatively ideal network unknown behavior type detection result without relying on a large amount of manually labeled data. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0047] Figure 1 This is a flowchart of the steps of a method for detecting unknown network behaviors based on traffic feature analysis proposed in one embodiment of the present application;

[0048] Figure 2 This is a schematic diagram of the byte encoding process of the network unknown behavior detection method based on traffic feature analysis proposed in one embodiment of the present application;

[0049] Figure 3 This is a schematic diagram of the detection process of a network unknown behavior detection method based on traffic feature analysis proposed in one embodiment of the present application;

[0050] Figure 4 This is an algorithm execution flow chart of the network unknown behavior detection method based on traffic feature analysis proposed in an embodiment of the present application

[0051] Figure 5 This is a schematic diagram of an electronic device proposed in one embodiment of the present application. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0053] Network behavior refers to the collection of various communications and operations occurring in a network environment, involving data transmitted over the network and related activities. It primarily falls into two categories: normal application behavior, which refers to the data communications conducted by legitimate, everyday network applications and services; and abnormal malicious behavior, which refers to malicious attempts to damage, illegally access, or exploit network resources.

[0054] Network flow: The basic unit of information sent and received on the Internet or any other type of network. In a network context, a flow can be defined as one or more packets transmitted between two computer addresses using a specific protocol (e.g., TCP, UDP, ICMP, etc.), and, where appropriate, a pair of specific ports. The algorithm in this paper uses bidirectional network flows as the basic unit of feature extraction and defines a bidirectional network flow as a sequence of packets with the same five-tuple: packets with the same source IP address, source port, destination IP address, destination port, and protocol.

[0055] Traffic characteristics: These are the various attributes or parameters extracted from network traffic data. They are used to analyze, detect, and identify the behavioral patterns of network communications, primarily reflecting the characteristics and behavior of network communications. Traffic characteristics are typically extracted through the statistics, analysis, and processing of network packets or sessions.

[0056] Unsupervised training: A type of machine learning training in which the model is trained without labels or target outputs, automatically finding hidden patterns, relationships, or data structures by analyzing the characteristics of the data.

[0057] Metric learning: A class of methods that aims to learn similarity or distance metrics between data. Its goal is to learn a projection or transformation based on the relationship between data samples (e.g., whether they belong to the same category) so that similar samples are closer in the transformed space and dissimilar samples are farther apart.

[0058] Network behavior detection primarily monitors and analyzes user behavior and data transmission within a network to identify abnormal behavior, potential threats, or violations. Related network behavior detection methods can be categorized into four main types: port-based methods, deep packet inspection-based methods, machine learning-based methods, and deep learning-based methods.

[0059] The first category, port-based methods, primarily analyze the port numbers of transport layer protocols (UDP or TCP) for classification. Typically, simply parsing the packet headers of traffic packets on the network, extracting the port numbers, and querying a port behavior comparison table reveals the specific behavior to which the traffic belongs. With the rapid development of internet technology, this reliance on fixed ports for identification has become increasingly unreliable. Specific reasons include: the increasing number of behaviors on the network, many of which no longer have fixed, queryable port numbers; the widespread use of port masquerading techniques to evade detection by firewalls or certain intrusion detection systems. This technique allows a behavior to use recognized ports, thereby deceiving firewalls or intrusion detection systems that rely on port filtering; and the widespread use of the Network Address Translation (NAT) protocol, which converts network addresses and ports, significantly reduces the accuracy of port identification methods.

[0060] The second type, deep packet inspection (DPI), analyzes the payload of packets in a network flow to detect behavior. If the payload contains a portion (i.e., a fingerprint) that matches certain signatures of a known behavior, the flow can be considered to belong to that known behavior type with a high probability. This approach has three drawbacks: 1. It is computationally complex, particularly when dealing with large amounts of data. This is because it requires byte-by-byte matching of traffic data, and the detection time increases rapidly with the amount of data; 2. Extracting fingerprints from network flows is difficult. Each type of traffic has a unique fingerprint, which uniquely identifies it. These fingerprints require expert analysis of network traffic, a time-consuming process; 3. It cannot address data encryption. Most network traffic now uses encrypted payloads, making DPI infeasible for encrypted traffic.

[0061] The third category, machine learning-based methods, utilize statistical features of network traffic and machine learning algorithms to classify traffic. These methods primarily design statistical features of network traffic and then select a machine learning model for training, such as a decision tree or support vector machine. The trained model is then able to capture the characteristic differences between different types of traffic. Machine learning methods also face the challenge of feature design. Researchers have proposed numerous traffic features, but determining which features are most effective and whether there are appropriate sets of traffic features for classifying network traffic in different segments remains a challenge.

[0062] The fourth category, deep learning-based methods, uses deep learning models such as convolutional neural networks to learn a representation of traffic data payloads. These deep learning models are then trained using loss functions such as cross-entropy. The trained models are then able to capture the characteristic differences between different types of traffic. Common deep learning-based behavior detection methods often rely on a large number of calibrated training samples. However, for newly emerging behaviors, the lack of new behavior samples prevents the deep learning models from effectively learning the corresponding traffic characteristics, resulting in low classification accuracy. Deep learning models trained on a small number of samples are also prone to overfitting, resulting in poor generalization. Specifically, these common methods, including emerging and more complex models such as FS-Net and Transformer, rely on a large number of training samples and are trained offline, using a large pre-collected training set. This approach presents several challenges in real-world traffic detection scenarios: First, due to the high speed and real-time nature of internet traffic, this offline training method inevitably leads to lagging classifier performance. Second, due to the extremely uneven distribution of network traffic, traffic samples for certain behavior types (such as malicious attack traffic) may be relatively scarce, making it difficult to meet the data volume requirements for model training.

[0063] Furthermore, deep learning-based methods rely heavily on the characterization of traffic data. This involves designing methods to process raw network traffic data into representative features, such as a one-dimensional array of feature vectors. Common network traffic feature extraction methods can be categorized as those based on traditional machine learning and those based on deep learning.

[0064] Traditional machine learning-based feature extraction methods first require manual feature construction (e.g., feature engineering) and then training a machine learning model. The model's effectiveness depends largely on the quality of the feature engineering. These methods can be broadly categorized into three common categories: content-based feature matching, data flow statistical features, and network connection behavior features. Content-based feature matching is the most commonly used and reliable approach, but it faces the key challenge of manual feature extraction. This is because manually extracted features rely heavily on the researcher's expertise, have low traffic differentiation, and are often too complex to be effectively used. Consequently, these manually extracted features struggle to achieve ideal traffic classification results. The most representative approach based on data flow statistical features is the 248 statistical features proposed by Moore et al., which include features such as packet size and packet arrival time interval. Among the methods based on network connection behavior features, the most representative is the connection graph-based traffic classification method. This approach uses hosts, nodes, or network flows to construct a connection graph. Communication behavior metrics are then extracted based on the graph's properties (e.g., vertex out-degree and in-degree). Classification rules are ultimately established based on these metrics. Both methods face the same problem of difficulty in designing artificial features and high cost.

[0065] Deep learning-based feature extraction methods can adaptively extract deep features from network traffic, perform feature analysis, and then perform classification. Typical extraction methods, such as convolutional neural networks and graph neural networks, all use filters to extract local features of network traffic. This method requires converting the one-dimensional form of network traffic data into a two-dimensional form to mine relevant information about traffic characteristics. The main challenge faced by this method is the discontinuity of deep learning functions, which can lead to sample interference and is highly dependent on a well-designed feature extraction method.

[0066] In summary, network behavior detection technologies based on port and packet inspection rely heavily on specific port or payload information, making them difficult to handle various traffic masquerading techniques and increasingly complex traffic information. They are also difficult to apply to widely encrypted network communication environments. Recognition based on machine learning or deep learning relies heavily on manual feature extraction and appropriate feature extraction methods, requiring high labor costs and sufficient prior knowledge.

[0067] This application proposes a method for detecting unknown network behaviors based on traffic feature analysis, aiming to solve the problem that related technologies for network behavior detection are difficult to handle complex encrypted traffic and are extremely dependent on high manual analysis costs and sufficient prior knowledge. First, the original byte data of each traffic generated by various network behaviors collected from the network is processed into a numerical matrix using byte encoding, which can also be regarded as a single-channel grayscale image, that is, each traffic sample is converted into a grayscale image; then, a traffic feature extractor based on an unsupervised training task is used to directly extract features from these traffic samples; then, the extracted features are classified using an incrementally updateable classifier group, and multiple unsupervised clustering algorithms are used to cluster them separately; then, the traffic features are converted into features based on metric learning based on the results of the above two classification and clustering methods; finally, the final clustering is performed to divide the input network traffic into different cluster clusters according to the behavior type to which it belongs, so as to achieve the goal of detecting and distinguishing various types of network behaviors.

[0068] Reference Figure 1 , Figure 1 This is a flowchart of a method for detecting unknown network behaviors based on traffic feature analysis proposed in an embodiment of the present application, including the following steps S11 to S15:

[0069] Step S11: performing byte encoding processing on the original byte data of the network traffic to be detected to obtain the target traffic in the form of a single-channel grayscale image.

[0070] In this embodiment, the raw byte data of the network traffic to be detected, generated by various network behaviors, collected from the network, is processed into a numerical matrix form, such as a two-dimensional matrix, using a byte encoding method. The numerical matrix form can also be viewed as a single-channel grayscale image form.

[0071] Furthermore, the byte encoding processing of the original byte data of the network traffic to be detected includes:

[0072] Creating a two-dimensional matrix corresponding to the network traffic to be detected according to the original byte data of the network traffic to be detected, wherein the original byte data includes: a header byte and a payload byte of each data packet of the network traffic to be detected;

[0073] The header bytes and payload bytes of each data packet are filled into the two-dimensional matrix row by row to obtain a target two-dimensional matrix, where the target two-dimensional matrix is ​​the target traffic in the form of the single-channel grayscale image.

[0074] In this embodiment, a network flow can be defined as one or more data packets transmitted between two computer addresses using a specific protocol. The first few data packets of the network traffic to be detected are selected, and the Ethernet headers therein are removed, the port numbers of the data packets are set to zero, and the IP addresses are replaced with random addresses, but their directions are maintained to avoid introducing biased interference. Based on the raw byte data of the network traffic to be detected, a two-dimensional matrix corresponding to the network traffic to be detected is created. The raw byte data includes: the header bytes and payload bytes of each data packet of the network traffic to be detected, that is, a two-dimensional matrix is ​​created based on the raw byte data of the data packet to represent the network traffic to be detected. Each data packet is filled into the matrix row by row according to the header bytes and payload bytes. If the number of valid bytes exceeds the number of matrix elements, it is truncated. If it is insufficient, it is filled with fixed bytes to form a fixed-size representation matrix. After such data packet standardization, a target two-dimensional matrix in the form of numerical matrix is ​​obtained. The target two-dimensional matrix can be regarded as a single-channel grayscale image. For an example of this process, see. Figure 2 .

[0075] Step S12: performing feature extraction on the target flow according to the flow feature extractor based on the unsupervised training task to obtain a feature vector of the target flow.

[0076] In this embodiment, the network traffic to be detected, i.e., the target traffic, which is converted into a single-channel grayscale image, is input into the traffic feature extractor for feature extraction to obtain a feature vector of the target traffic. The traffic feature extractor is a deep learning model based on an image encoder (ViT), which is trained through an unsupervised training task and can output a feature vector corresponding to each network traffic, specifically in the form of a 1-dimensional sequence. The traffic feature extractor is very important. The quality of the features it extracts from the raw data of the network traffic will directly affect the execution effect of the subsequent classifier group and clustering algorithm group, and thus affect the final network unknown behavior detection results. High-quality features can make each traffic sample belonging to a different network behavior type have good discrimination in the feature space.

[0077] Furthermore, the unsupervised training process of the traffic feature extractor includes the following steps:

[0078] Obtain network traffic samples in the form of multiple single-channel grayscale images;

[0079] After randomly masking the network traffic sample, the sample is input into a first deep learning model based on an image encoder for feature extraction, and multiple small deep learning models are used as decoders to decode the extracted features to obtain a corresponding number of regional partial prediction features;

[0080] Meanwhile, the network traffic sample input is input into a second deep learning model with the same structure as the first deep learning model for feature extraction, to obtain overall features.

[0081] A first loss value is calculated according to the difference between the corresponding part of the overall features and the region part prediction features, and the first deep learning model, the second deep learning model and all small deep learning models are optimized according to the first loss value, and the trained first deep learning model is used as the traffic feature extractor.

[0082] In the embodiment, in order to get rid of the dependence on artificial marking data, an unsupervised training method is used to pre-train the traffic feature extractor. The specific pre-training method is as follows: first, a plurality of network traffic samples in the form of single-channel gray images are collected; then the samples are randomly masked and input into the first deep learning model to output features; then a plurality of small decoders are used to decode the obtained features to obtain part prediction features of a plurality of regions of the samples; meanwhile, another second deep learning model (the parameter is the exponentially weighted average value of each optimization of the traffic feature extractor) with the same structure is used to directly extract overall features of the samples; finally, the first loss value is calculated according to the difference between the region part prediction features and the overall features to optimize the first deep learning model, the second deep learning model and all small deep learning models, to obtain the trained traffic feature extractor. It can be seen that the training method has two advantages: first, it does not need explicit sample labels; second, the loss value is calculated in the feature space, which can strengthen the feature learning ability of the sample and improve the quality of the extracted features. Through pre-training, a traffic feature extractor with good parameters can be obtained, which can be directly used to extract the features of the actual input network traffic. Moreover, the feature extractor can be fine-tuned or retrained at any time using new network traffic data to adapt to the data distribution changes caused by changes in the network environment.

[0083] Step S13: clustering the feature vector of the target traffic by a clustering algorithm group, and classifying the feature vector of the target traffic by an incrementally updatable clustering algorithm group, the clustering algorithm group including a plurality of unsupervised clustering algorithms.

[0084] In this embodiment, the clustering algorithm group includes multiple unsupervised clustering algorithms that can discover the relationship between each traffic sample and preliminarily determine which traffic samples belong to a certain type of network behavior. The classifier group can detect the specific behavior type of network traffic, directly output the label of the network traffic sample, mark currently unidentified network traffic as an unknown type, and can be incrementally updated at any time based on newly acquired labeled data, continuously expanding the range of identifiable types. Clustering the feature vectors of the target traffic through the clustering algorithm group and classifying the feature vectors of the target traffic through the incrementally updateable clustering algorithm group provide a data foundation for the subsequent transformation of the feature vectors of the target traffic.

[0085] Furthermore, clustering the characteristic vectors of the target traffic using a clustering algorithm group includes:

[0086] The characteristic vector of the target flow is spatially divided from the perspectives of spatial distance, data density and hierarchical relationship through a clustering algorithm group to obtain a clustering result of the target flow. The clustering algorithm group includes: k_means algorithm, DBSCAN algorithm and IHC clustering algorithm.

[0087] In this embodiment, the clustering algorithm group includes multiple unsupervised clustering algorithms, specifically the k-means algorithm, the DBSCAN algorithm, and the IHC clustering algorithm. These three clustering algorithms spatially partition data (the feature vectors of target traffic) based on spatial distance, data density, and hierarchical relationships, respectively. These algorithms can cover the data characteristics of most network application scenarios. Furthermore, to eliminate the influence of clustering algorithm parameters, the clustering algorithm group configures different parameters for each of these three clustering algorithms. Multiple clustering algorithms are formed based on the number of parameter configurations for each algorithm, and all clustering results are output.

[0088] Furthermore, the feature vector of the target traffic is classified by an incrementally updateable classifier group, including:

[0089] Inputting the feature vector of the target traffic into each classifier in the classifier group to obtain a second loss value of each classifier, wherein each classifier is trained using network traffic samples of the same network traffic behavior type, and each classifier corresponds to a unique second loss value threshold;

[0090] Selecting the minimum loss value that is less than the second loss value threshold of the corresponding classifier among the second loss values ​​of each classifier, and using the network traffic behavior type corresponding to the classifier corresponding to the loss value as the network traffic behavior type corresponding to the target traffic, to obtain a classification result of the target traffic;

[0091] When the second loss value of each classifier is greater than the corresponding second loss value threshold of the classifier, the network traffic behavior type of the target traffic is set to an unknown behavior type to obtain a classification result of the target traffic.

[0092] In this embodiment, the feature vector of the target traffic is input into each classifier in the classifier group to obtain the second loss value of each classifier. Each classifier is trained by a network traffic sample of the same network traffic behavior type and can output a second loss value. The minimum loss value that is less than the second loss value threshold of the corresponding classifier is selected from the second loss value of each classifier, and the network traffic behavior type corresponding to the classifier corresponding to the loss value is used as the network traffic behavior type corresponding to the target traffic to obtain the classification result of the target traffic. Among them, the minimum loss value represents that the classifier corresponding to the network traffic behavior type can better fit the target traffic, and then the type corresponding to the target traffic can be identified based on the minimum loss value. Of course, if the second loss value obtained by a certain network traffic on each classifier of all existing types is greater than the second loss value threshold of the corresponding classifier, it can be judged that the network traffic does not belong to any existing type, and the network traffic behavior type of the target traffic is set to an unknown behavior type.

[0093] Furthermore, the supervised training process of each classifier includes the following steps:

[0094] Obtain feature vectors of network traffic samples of the same type;

[0095] The feature vectors of each network traffic sample of the same type are respectively input into the autoencoder corresponding to each network traffic sample of the same type. The autoencoder reconstructs the input network traffic sample and compares the difference with the network traffic sample itself to calculate the loss. The autoencoder is optimized according to the calculation result to obtain each trained classifier. All network traffic samples are used to calculate the second loss value threshold on the trained classifier.

[0096] In this embodiment, the classifier group can be trained using the currently available limited labeled data, and can be incrementally updated at any time based on newly acquired labeled data, continuously expanding the range of identifiable types. Each classifier in the classifier group is an autoencoder model trained with network traffic data of the same behavior type. The specific training process is as follows: the feature vectors of known network traffic samples of the same type are input into each independent autoencoder of the same type. The autoencoder reconstructs the input network traffic sample and compares it with the network traffic sample itself to calculate the loss difference. Based on the calculation results, each independent autoencoder of the same type is optimized to obtain each trained classifier. Finally, all network traffic samples are used to calculate the second loss value threshold on the trained classifier. In this way, each autoencoder can only fit the corresponding type of network traffic, and the fitting degree for other types of network traffic is poor.

[0097] Step S14: Input the feature vector, clustering result and classification result of the target flow into the MLP multi-layer perceptron model for training to obtain a trained metric learning model, and transform the feature vector of the target flow according to the metric learning model to obtain the feature representation of the target flow in the target feature space.

[0098] In this embodiment, the target traffic feature vector, clustering results, and classification results are input into an MLP multi-layer perceptron model for training, resulting in a trained metric learning model. The target traffic feature vector is then transformed based on the metric learning model to obtain a feature representation of the target traffic in the target feature space. After the metric learning feature transformation, the position of the target traffic feature vector in the feature space changes, with target traffic of the same type positioned closer together and target traffic of different types positioned further apart. This allows for better classification of different types of network traffic, ultimately detecting various types of network behavior.

[0099] Furthermore, the training process of the metric learning model includes the following steps:

[0100] Create an MLP multi-layer perceptron model, which is used to nonlinearly map the input feature vector to a certain position of the target dimension;

[0101] Randomly extract a pair of samples from the target traffic, input the feature vectors corresponding to the sample pair into the MLP multi-layer perceptron model for transformation, and obtain a transformed feature vector pair;

[0102] Determining whether the two samples of the sample pair belong to the same type according to the clustering results and classification results corresponding to the sample pair;

[0103] When the two samples belong to the same type, the distance between the transformed feature vectors in the feature space is used as a third loss value, and the model parameters of the MLP multi-layer perceptron model are updated according to the third loss value;

[0104] When the two samples do not belong to the same type, a difference between a distance between the transformed feature vector pair in the feature space and a preset distance is used as a fourth loss value, and the fourth loss value is minimized to update the model parameters of the MLP multi-layer perceptron model;

[0105] The metric learning model is obtained by updating the model parameters of the MLP multi-layer perceptron model.

[0106] In this embodiment, an MLP multi-layer perceptron model is created that can nonlinearly map input feature vectors to locations of different dimensions. A training task is designed to randomly select a pair of samples from the target traffic. The feature vectors corresponding to the sample pair are input into the MLP multi-layer perceptron model for feature transformation. The transformed feature vector pair is then used to determine whether the two samples in the sample pair belong to the same type based on the previous clustering and classification results. (Here, the classification result is given a higher weight, while the remaining clustering results have the same weight. If the classification result of any sample pair is unknown, the classification result is not used, and the remaining clustering results are used for metric learning.) If the two samples belong to the same type, the distance between the two transformed sample feature vectors in feature space is used as a third loss value, and the model parameters of the MLP multi-layer perceptron model are updated based on the third loss value. If the two samples do not belong to the same type, the difference between the distance between the two transformed sample feature vectors in feature space and a relatively large distance (preset distance) is used as a fourth loss value, and this loss value is minimized to update the model parameters of the MLP multi-layer perceptron model. In this way, the distance between sample features of the same type in the feature space will continue to decrease after the feature changes, while the distance between sample features of different types in the feature space will continue to tend to a relatively far distance after the feature changes.

[0107] Step S15: The characteristic representation of the target traffic in the target feature space is processed multiple times by the k_means algorithm, and the result with the highest silhouette coefficient in the processing results is selected as the final detection result. The detection result is a cluster that characterizes different network traffic behavior types.

[0108] In this embodiment, after metric learning, the feature vectors of all target traffic are transformed into a discriminative feature space, resulting in a characteristic representation of the target traffic in the target feature space. A simple k-means clustering algorithm is then used. Since the k-means algorithm requires a k parameter as the number of output clusters, and this number is unknown at this time, the k-means algorithm is executed multiple times with different k parameters. The result with the highest silhouette coefficient is selected as the final output. The detected clusters represent different types of network traffic behavior.

[0109] Furthermore, after obtaining the final test results, the following steps are also included:

[0110] Obtain manual annotation results of the network traffic to be detected;

[0111] Based on the manual labeling results, the model parameters of the classifier group are updated.

[0112] In this embodiment, considering the variability of network environments, the traffic feature extractor, due to its unsupervised training approach, can be easily fine-tuned and updated using newly acquired network traffic data (using the same method as pre-training) or retrained after a certain period of time. For the classifier group, the final output of the network behavior type detection results is manually analyzed, and as many network traffic samples as possible are annotated to obtain manually annotated results for the network traffic to be detected. The classifier group is updated based on the manually annotated results. (For existing classifier models, new data can be combined with historical data to fine-tune the model to adapt to the changes in the data distribution of the type; for non-existent types, a new classifier model can be directly trained.) The remaining algorithm parameters are only used during each test and are different for each test, so they do not need to be saved or updated. The presence of clearly labeled data can also improve the detection performance of this application. This clearly labeled data can be derived from prior knowledge or from subsequent manual analysis of the test results.

[0113] The network unknown behavior detection method based on traffic feature analysis provided by this application performs byte encoding processing on the raw byte data of the network traffic to be detected, and obtains data directly from the byte level without considering whether the network traffic is encrypted; based on the traffic feature extractor based on the unsupervised training task, the target traffic is subjected to feature extraction. The unsupervised training traffic feature extractor used can extract the characteristics of the network traffic from the raw byte data of the network traffic without relying on manual labels; then, a clustering algorithm group and an incrementally updateable clustering algorithm group are combined to maximize the ability of the clustering algorithm and the classification algorithm to distinguish the characteristics of the network traffic samples through the metric learning model, so as to achieve a relatively ideal network unknown behavior type detection result without relying on a large amount of manually labeled data. Among them, the unsupervised pre-training method of calculating the loss in the feature space is applied to the network traffic feature extractor to improve the quality of the extracted features; through the metric learning method, the classifier group and the clustering algorithm group are combined to give full play to the respective advantages of the supervised classification task and the unsupervised clustering task to detect the type of network traffic.

[0114] Reference Figure 3 , Figure 3 FIG. 1 is a schematic diagram of the detection process of a method for detecting unknown network behaviors based on traffic feature analysis proposed in an embodiment of the present application. Figure 3 As shown in the figure, the detection process is as follows:

[0115] The traffic sample to be identified (network traffic to be detected) is byte-encoded; the processed traffic sample to be identified is input into the feature extractor to extract the feature vector of the processed traffic sample to be identified, and the feature extractor is updated with the newly processed traffic sample data to be identified; the feature vector is input into the classifier group for classification, and each classifier in the classifier group is trained by a network traffic sample of the same network traffic behavior type; at the same time, the feature vector is input into the clustering algorithm group for clustering, and the clustering algorithm group includes: k_means algorithm, DBSCAN algorithm and IHC clustering algorithm; based on the feature vector, classification result and clustering result corresponding to the traffic sample to be identified, the features (feature vectors) are transformed and clustered through the metric learning model to obtain the unknown behavior detection result, and the detection result is a cluster cluster, which represents different network traffic behavior types; according to the unknown behavior detection result, it is analyzed manually and the traffic sample to be identified is labeled. According to the manual labeling result of the traffic sample to be identified, the classifier group is incrementally updated.

[0116] Reference Figure 4 , Figure 4 This is an algorithm execution flow chart of a method for detecting unknown network behaviors based on traffic feature analysis proposed in one embodiment of the present application. Figure 4 As shown, the algorithm execution process is:

[0117] Input the traffic sample to be identified (network traffic to be detected); perform byte encoding processing on the traffic sample to be identified; extract feature vectors from the processed traffic sample to be identified through a feature extractor; input the feature vectors into the classifier group for classification, and input the feature vectors into the clustering algorithm group for clustering; transform the features (feature vectors) and cluster them through the metric learning model, and output cluster clusters (detection results).

[0118] Based on the same inventive concept, an embodiment of the present application provides a network unknown behavior detection device based on traffic feature analysis, the device comprising:

[0119] The first processing module is used to perform byte encoding processing on the original byte data of the network traffic to be detected to obtain the target traffic in the form of a single-channel grayscale image;

[0120] A feature extraction module is used to extract features of the target flow according to a flow feature extractor based on an unsupervised training task to obtain a feature vector of the target flow;

[0121] a second processing module, configured to cluster the feature vectors of the target traffic using a clustering algorithm group, and classify the feature vectors of the target traffic using an incrementally updateable classifier group, wherein the clustering algorithm group includes a plurality of unsupervised clustering algorithms;

[0122] A metric learning module is used to input the feature vector, clustering results, and classification results of the target flow into an MLP multi-layer perceptron model for training to obtain a trained metric learning model, and transform the feature vector of the target flow according to the metric learning model to obtain a feature representation of the target flow in a target feature space;

[0123] The detection module is used to perform multiple processing on the characteristic representation of the target traffic in the target feature space through the k_means algorithm, and select the result with the highest silhouette coefficient as the final detection result. The detection result is a cluster that characterizes different types of network traffic behavior.

[0124] In an optional embodiment, the first processing module is specifically configured to:

[0125] Creating a two-dimensional matrix corresponding to the network traffic to be detected according to the original byte data of the network traffic to be detected, wherein the original byte data includes: a header byte and a payload byte of each data packet of the network traffic to be detected;

[0126] The header bytes and payload bytes of each data packet are filled into the two-dimensional matrix row by row to obtain a target two-dimensional matrix, where the target two-dimensional matrix is ​​the target traffic in the form of the single-channel grayscale image.

[0127] In an optional implementation, the feature extraction module is specifically configured to:

[0128] Obtain network traffic samples in the form of multiple single-channel grayscale images;

[0129] After randomly masking the network traffic sample, the sample is input into a first deep learning model based on an image encoder for feature extraction, and multiple small deep learning models are used as decoders to decode the extracted features to obtain a corresponding number of regional partial prediction features;

[0130] At the same time, the network traffic sample is input into a second deep learning model with the same structure as the first deep learning model to extract features and obtain overall features;

[0131] A first loss value is calculated based on the difference between the partial prediction features of all regions and the corresponding parts of the overall features, and the first deep learning model, the second deep learning model and all small deep learning models are optimized based on the first loss value, and the trained first deep learning model is used as the traffic feature extractor.

[0132] In an optional embodiment, the second processing module is specifically configured to:

[0133] The characteristic vector of the target flow is spatially divided from the perspectives of spatial distance, data density and hierarchical relationship through a clustering algorithm group to obtain a clustering result of the target flow. The clustering algorithm group includes: k_means algorithm, DBSCAN algorithm and IHC clustering algorithm.

[0134] In an optional embodiment, the second processing module is specifically configured to:

[0135] Inputting the feature vector of the target traffic into each classifier in the classifier group to obtain a second loss value of each classifier, wherein each classifier is trained using network traffic samples of the same network traffic behavior type, and each classifier corresponds to a unique second loss value threshold;

[0136] Selecting the minimum loss value that is less than the second loss value threshold of the corresponding classifier among the second loss values ​​of each classifier, and using the network traffic behavior type corresponding to the classifier corresponding to the loss value as the network traffic behavior type corresponding to the target traffic, to obtain a classification result of the target traffic;

[0137] When the second loss value of each classifier is greater than the corresponding second loss value threshold of the classifier, the network traffic behavior type of the target traffic is set to an unknown behavior type to obtain a classification result of the target traffic.

[0138] In an optional implementation, the second processing module is specifically configured to:

[0139] obtain feature vectors of network traffic samples of the same type;

[0140] input the feature vectors of the network traffic samples of the same type into corresponding autoencoders of the network traffic samples of the same type respectively, perform loss calculation on differences between the reconstructed network traffic samples and the network traffic samples themselves after the autoencoders reconstruct the input network traffic samples, and optimize the autoencoders according to the calculation results to obtain trained classifiers, and calculate a second loss value threshold on the trained classifiers using all network traffic samples.

[0141] In an optional implementation, the metric learning module is specifically configured to:

[0142] create an MLP (Multi-Layer Perceptron) model, the MLP model being configured to nonlinearly map an input feature vector to a certain position in a target dimension;

[0143] randomly select a pair of samples from the target traffic, input corresponding feature vectors of the pair of samples into the MLP model to obtain a pair of transformed feature vectors;

[0144] determine whether the two samples of the pair of samples belong to the same type according to clustering results and classification results corresponding to the pair of samples;

[0145] in a case where the two samples belong to the same type, take a distance between the pair of transformed feature vectors in a feature space as a third loss value, and update model parameters of the MLP model according to the third loss value;

[0146] in a case where the two samples do not belong to the same type, take a difference between the distance between the pair of transformed feature vectors in the feature space and a preset distance as a fourth loss value, and update the model parameters of the MLP model by minimizing the fourth loss value;

[0147] obtain the metric learning model by updating the model parameters of the MLP model.

[0148] In an optional implementation, the apparatus further includes:

[0149] an updating module configured to obtain an artificial labeling result of the network traffic to be detected, and update model parameters of the group of classifiers based on the artificial labeling result.

[0150] Based on the same inventive concept, an embodiment of the present application provides an electronic device, which comprises the apparatus. Figure 5 shown. Figure 5 This is a schematic diagram of an electronic device according to one embodiment of the present application. The electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When executed by the processor, the computer program implements the steps of the method for detecting unknown network behavior based on traffic feature analysis described in any of the above embodiments of the present application.

[0151] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0152] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, devices, or computer program products. Therefore, the embodiments of the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0153] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0154] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0155] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0156] Although preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they become aware of the basic inventive concepts. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0157] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or terminal device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or terminal device that includes the element.

[0158] The above is a detailed introduction to the network unknown behavior detection method, device and equipment based on traffic feature analysis provided by this application. This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method of this application and its core idea; at the same time, for general technical personnel in this field, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on this application.

Claims

1. A method for detecting unknown network behaviors based on traffic feature analysis, characterized in that: include: Perform byte encoding on the raw byte data of the network traffic to be detected to obtain the target traffic in the form of a single-channel grayscale image; Extracting features of the target flow according to a flow feature extractor based on an unsupervised training task to obtain a feature vector of the target flow; Clustering the feature vectors of the target traffic using a clustering algorithm group, and classifying the feature vectors of the target traffic using an incrementally updateable classifier group, wherein the clustering algorithm group includes a plurality of unsupervised clustering algorithms; Inputting the feature vector, clustering results, and classification results of the target traffic into an MLP multi-layer perceptron model for training to obtain a trained metric learning model, and transforming the feature vector of the target traffic according to the metric learning model to obtain a feature representation of the target traffic in a target feature space; The characteristic representation of the target traffic in the target feature space is processed multiple times by the k_means algorithm, and the result with the highest silhouette coefficient among the processed results is selected as the final detection result. The detection result is a cluster that represents different types of network traffic behavior; The byte encoding process of the original byte data of the network traffic to be detected includes: Creating a two-dimensional matrix corresponding to the network traffic to be detected according to the original byte data of the network traffic to be detected, wherein the original byte data includes: a header byte and a payload byte of each data packet of the network traffic to be detected; Filling the header bytes and payload bytes of each data packet into the two-dimensional matrix row by row to obtain a target two-dimensional matrix, wherein the target two-dimensional matrix is ​​the target flow in the form of the single-channel grayscale image; The unsupervised training process of the traffic feature extractor includes the following steps: Obtain network traffic samples in the form of multiple single-channel grayscale images; After randomly masking the network traffic sample, the sample is input into a first deep learning model based on an image encoder for feature extraction, and multiple small deep learning models are used as decoders to decode the extracted features to obtain a corresponding number of regional partial prediction features; At the same time, the network traffic sample is input into a second deep learning model with the same structure as the first deep learning model to extract features and obtain overall features; A first loss value is calculated based on the difference between the partial prediction features of all regions and the corresponding parts of the overall features, and the first deep learning model, the second deep learning model and all small deep learning models are optimized based on the first loss value, and the trained first deep learning model is used as the traffic feature extractor.

2. The method for detecting unknown network behaviors based on traffic feature analysis according to claim 1 is characterized in that: The clustering of the characteristic vectors of the target traffic by a clustering algorithm group includes: The characteristic vector of the target flow is spatially divided from the perspectives of spatial distance, data density and hierarchical relationship through a clustering algorithm group to obtain a clustering result of the target flow. The clustering algorithm group includes: k_means algorithm, DBSCAN algorithm and IHC clustering algorithm.

3. The method for detecting unknown network behaviors based on traffic feature analysis according to claim 1, characterized in that: The feature vector of the target traffic is classified by an incrementally updateable classifier group, including: Inputting the feature vector of the target traffic into each classifier in the classifier group to obtain a second loss value of each classifier, wherein each classifier is trained using network traffic samples of the same network traffic behavior type, and each classifier corresponds to a unique second loss value threshold; Selecting the minimum loss value that is less than the second loss value threshold of the corresponding classifier among the second loss values ​​of each classifier, and using the network traffic behavior type corresponding to the classifier corresponding to the loss value as the network traffic behavior type corresponding to the target traffic, to obtain a classification result of the target traffic; When the second loss value of each classifier is greater than the corresponding second loss value threshold of the classifier, the network traffic behavior type of the target traffic is set to an unknown behavior type to obtain a classification result of the target traffic.

4. The method for detecting unknown network behaviors based on traffic feature analysis according to claim 3 is characterized in that: The supervised training process of each classifier includes the following steps: Obtain feature vectors of network traffic samples of the same type; The feature vectors of each network traffic sample of the same type are respectively input into the autoencoder corresponding to each network traffic sample of the same type. The autoencoder reconstructs the input network traffic sample and compares the difference with the network traffic sample itself to calculate the loss. The autoencoder is optimized according to the calculation result to obtain each trained classifier. All network traffic samples are used to calculate the second loss value threshold on the trained classifier.

5. The method for detecting unknown network behaviors based on traffic feature analysis according to claim 1, characterized in that: The training process of the metric learning model includes the following steps: Create an MLP multi-layer perceptron model, which is used to nonlinearly map the input feature vector to a certain position of the target dimension; Randomly extract a pair of samples from the target traffic, input the feature vectors corresponding to the sample pair into the MLP multi-layer perceptron model for transformation, and obtain a transformed feature vector pair; Determining whether the two samples of the sample pair belong to the same type according to the clustering results and classification results corresponding to the sample pair; When the two samples belong to the same type, the distance between the transformed feature vectors in the feature space is used as a third loss value, and the model parameters of the MLP multi-layer perceptron model are updated according to the third loss value; When the two samples do not belong to the same type, a difference between a distance between the transformed feature vector pair in the feature space and a preset distance is used as a fourth loss value, and the fourth loss value is minimized to update the model parameters of the MLP multi-layer perceptron model; The metric learning model is obtained by updating the model parameters of the MLP multi-layer perceptron model.

6. The method for detecting unknown network behaviors based on traffic feature analysis according to claim 1, characterized in that: After obtaining the final test results, it also includes: Obtain manual annotation results of the network traffic to be detected; Based on the manual labeling results, the model parameters of the classifier group are updated.

7. A network unknown behavior detection device based on traffic feature analysis, characterized in that: include: The first processing module is used to perform byte encoding processing on the original byte data of the network traffic to be detected to obtain the target traffic in the form of a single-channel grayscale image; A feature extraction module is used to extract features of the target flow according to a flow feature extractor based on an unsupervised training task to obtain a feature vector of the target flow; a second processing module, configured to cluster the feature vectors of the target traffic using a clustering algorithm group, and classify the feature vectors of the target traffic using an incrementally updateable classifier group, wherein the clustering algorithm group includes a plurality of unsupervised clustering algorithms; a metric learning module, configured to input the target traffic feature vector, clustering results, and classification results into an MLP multi-layer perceptron model for training to obtain a trained metric learning model, and transform the target traffic feature vector according to the metric learning model to obtain a feature representation of the target traffic in a target feature space; A detection module is used to perform multiple processing on the characteristic representation of the target traffic in the target feature space using the k-means algorithm, and select the result with the highest silhouette coefficient among the processed results as the final detection result. The detection result is a cluster that represents different types of network traffic behavior; The first processing module is specifically configured to: Creating a two-dimensional matrix corresponding to the network traffic to be detected according to the original byte data of the network traffic to be detected, wherein the original byte data includes: a header byte and a payload byte of each data packet of the network traffic to be detected; Filling the header bytes and payload bytes of each data packet into the two-dimensional matrix row by row to obtain a target two-dimensional matrix, wherein the target two-dimensional matrix is ​​the target flow in the form of the single-channel grayscale image; The feature extraction module is specifically used for: Obtain network traffic samples in the form of multiple single-channel grayscale images; After randomly masking the network traffic sample, the sample is input into a first deep learning model based on an image encoder for feature extraction, and multiple small deep learning models are used as decoders to decode the extracted features to obtain a corresponding number of regional partial prediction features; At the same time, the network traffic sample is input into a second deep learning model with the same structure as the first deep learning model to extract features and obtain overall features; A first loss value is calculated based on the difference between the partial prediction features of all regions and the corresponding parts of the overall features, and the first deep learning model, the second deep learning model and all small deep learning models are optimized based on the first loss value, and the trained first deep learning model is used as the traffic feature extractor.

8. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the network unknown behavior detection method based on traffic feature analysis as described in any one of claims 1 to 6 when executing the computer program.

Images