Data detection method, classifier training method and related equipment

Abstract

The invention provides a data detection method, a classifier training method and related equipment, which are applied to the technical field of network security and are used for improving the accuracy of abnormal traffic detection. The method comprises the following steps: inputting a plurality of features of to-be-detected traffic into a first classifier, processing the plurality of features through the first classifier, and outputting a first weight of the to-be-detected traffic; calculating the difference between the first weight and a preset standard weight, and determining the credibility of the first weight based on the difference; if the credibility is not less than a preset threshold, determining whether the to-be-detected traffic is abnormal traffic based on the first weight; if the credibility is smaller than the preset threshold value, inputting the plurality of features into a second classifier, processing the plurality of features through the second classifier, and outputting a second weight of the to-be-detected traffic; and determining whether the to-be-detected traffic is abnormal traffic based on the first weight and the second weight.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a data detection method, a classifier training method and related equipment. Background Art

[0002] With the rapid and comprehensive development of the information industry, the popularization of the Internet and the widespread application of enterprise networks, vulnerabilities and threats in the field of network security are also showing an increasing trend. Traditional convenient protection measures such as firewalls are no longer sufficient to deal with complex internal and external threats, and it is difficult to accurately detect abnormal traffic in the network, such as malicious traffic.

[0003] In view of this, how to improve the accuracy of detecting abnormal traffic is an urgent problem to be solved. Summary of the invention

[0004] The present application provides a data detection method, a classifier training method and related equipment for improving the accuracy of detecting abnormal traffic.

[0005] In a first aspect, an embodiment of the present application provides a data detection method, which is applied to any electronic device with processing capability, and the method includes:

[0006] Inputting multiple features of the flow to be detected into a first classifier, processing the multiple features through the first classifier, and outputting a first weight of the flow to be detected;

[0007] Calculating a gap between the first weight and a preset standard weight, and determining the credibility of the first weight based on the gap;

[0008] If the credibility is not less than the threshold, determining whether the traffic to be detected is abnormal traffic based on the first weight;

[0009] If the credibility is less than the threshold, the multiple features are input into the second classifier, the multiple features are processed by the second classifier, and the second weight of the flow to be detected is output; based on the first weight and the second weight, it is determined whether the flow to be detected is abnormal flow;

[0010] The first classifier and the second classifier are different classifiers; the first weight and the second weight are used to indicate whether the traffic to be detected is abnormal.

[0011] In this scheme, after a first weight is obtained by processing multiple features of the traffic to be detected through a first classifier, the credibility of the first weight is determined based on the gap between the first weight and a preset standard weight, that is, whether the processing result of the first classifier on the traffic to be detected is credible is determined. If the credibility is not less than the preset threshold, it means that the credibility of the first weight is high, and whether the traffic to be detected is abnormal can be directly determined based on the first weight, thereby improving the efficiency of detecting abnormal traffic; if the credibility is less than the preset threshold, it means that the credibility of the first weight is low. Therefore, in order to ensure accurate detection of the traffic to be detected, multiple features are input into the second classifier for processing to obtain a second weight output by the second classifier. The processing results of the two classifiers are combined to determine whether the traffic to be detected is abnormal, which can more comprehensively identify and analyze the traffic to be detected, thereby improving the accuracy of detecting abnormal traffic.

[0012] Optionally, the first classifier is an extreme learning machine, and calculating the gap between the first weight and a preset standard weight, and determining the credibility of the first weight based on the gap includes:

[0013] The normalized distance between the first weight and the preset standard weight is calculated based on the following formula, and the normalized distance is used as the credibility of the first weight:

[0014] y wd =exp(-││X0│-│w││);

[0015] Among them, y wd represents credibility, X0 represents the first weight of the traffic to be detected, and w represents the preset standard weight; exp(-││X0│-│w││) represents the exponent of the distance between the absolute value of the first weight of the traffic to be detected and the absolute value of the preset standard weight.

[0016] Optionally, if the credibility is not less than a preset threshold, determining whether the traffic to be detected is abnormal traffic based on the first weight includes: wd When it is less than the preset threshold, if X0 is not less than 0, the traffic to be detected is determined to be abnormal traffic, and the closer X0 is to the absolute value of w, the greater the degree of abnormality of the traffic to be detected; if X0 is less than 0, the traffic to be detected is determined to be normal traffic.

[0017] Optionally, the second classifier includes multiple sub-classifiers; the second classifier processes multiple features and outputs a second weight of the traffic to be detected, including: identifying and predicting multiple features by each of the multiple sub-classifiers to obtain multiple prediction results of the multiple sub-classifiers for the traffic to be detected; the prediction results include the traffic type of the traffic to be detected, and the traffic type includes normal traffic and abnormal traffic; counting the number of occurrences of each traffic type according to the multiple prediction results, and determining the second weight based on the traffic type with the largest number of occurrences;

[0018] Determining whether the traffic to be detected is abnormal traffic based on the first weight and the second weight includes: if the first weight is not less than 0, and the second weight is used to indicate that the traffic to be detected is abnormal traffic, then determining that the traffic to be detected is abnormal traffic; otherwise, determining that the traffic to be detected is normal traffic.

[0019] Optionally, the second classifier is an extreme learning machine with different parameters from those of the first classifier; processing the multiple features by the second classifier and outputting a second weight of the flow to be detected includes: identifying each of the multiple features by the second classifier and predicting the probability that each feature is an abnormal feature and a normal feature; and weightedly calculating the probability of each feature to obtain a second weight;

[0020] Determining whether the traffic to be detected is abnormal traffic based on the first weight and the second weight includes: if the first weight is not less than 0 and the second weight is not less than 0, determining that the traffic to be detected is abnormal traffic; otherwise, determining that the traffic to be detected is normal traffic.

[0021] Optionally, determining whether the traffic to be detected is abnormal traffic based on the first weight and the second weight also includes: if the credibility of the first weight is less than the first threshold, determining whether the traffic to be detected is abnormal traffic based on the second weight; the first threshold is less than the preset threshold.

[0022] In a second aspect, the embodiments of the present application provide a classifier training method, which can be applied to any electronic device with processing capabilities, including:

[0023] Inputting multiple features of each sample flow in the first training set into the first classifier, processing the multiple features of each sample flow through the first classifier, and outputting a third weight of each sample flow;

[0024] Calculating the gap between the third weight of each sample flow and the preset standard weight, and determining the credibility of the third weight based on the gap;

[0025] Obtain at least one sample flow whose credibility of the third weight is less than a preset threshold; input multiple features of each sample flow in the at least one sample flow and the actual flow type of each sample flow into a second classifier, and process the multiple features of each sample flow through the second classifier to output a fourth weight of each sample flow; determine the flow type of each sample flow based on the fourth weight of each sample flow, where the flow type includes normal flow and abnormal flow;

[0026] Calculate the first loss value of the traffic type of each sample traffic and the real traffic type of each sample traffic, adjust the parameters of the second classifier with the goal of the first loss value being less than the second threshold, and obtain a trained second classifier;

[0027] The first classifier and the second classifier are different classifiers, and the third weight and the fourth weight are both used to indicate whether each sample flow is abnormal.

[0028] In this scheme, at least one traffic sample whose credibility output by the first classifier is lower than a preset threshold is used as a training sample for the second classifier, so that the trained second classifier can more accurately identify and predict the traffic to be detected that the first classifier cannot accurately identify, and the identification of the traffic to be detected is more comprehensive, thereby improving the accuracy of detecting abnormal traffic.

[0029] Optionally, the first classifier is an extreme learning machine, and the gap between the third weight of each sample flow and a preset standard weight is calculated, and the credibility of the third weight is determined based on the gap, including: calculating a normalized distance between the third weight and the preset standard weight based on the following formula, and using the normalized distance as the credibility of the third weight:

[0030] y wd =exp(-││X i │-│w││);

[0031] Among them, y wd Indicates credibility, X i represents the third weight of the i-th sample flow, w represents the preset standard weight; exp(-││X i │-│w││) represents an exponent for calculating the distance between the absolute value of the third weight of the i-th sample flow and the absolute value of the preset standard weight.

[0032] Optionally, before inputting multiple features of each sample flow in the first training set into the first classifier, the method also includes: inputting multiple features of each sample flow in the second training set into the first classifier, processing the multiple features of each sample flow through the first classifier, and outputting the fifth weight of each sample flow; determining the flow type of each sample flow based on the fifth weight of each sample flow; calculating the second loss value based on the flow type of each sample flow and the true type of each sample flow, and adjusting the parameters of the first classifier with the purpose of making the second loss value less than a third threshold to obtain a trained first classifier.

[0033] Optionally, before inputting multiple features of each sample flow in the first training set into the first classifier, the method also includes: for each sample flow in the first training set, performing the following operations: inputting several features of each sample flow into a preset tree model, scoring the feature importance of each of the several features through the tree model to obtain a score for each feature; sorting each feature in descending order of score, obtaining the first n features from the sorting, and obtaining multiple features of each sample flow; n is a positive integer greater than 1.

[0034] In a third aspect, an embodiment of the present application provides a data detection device, including:

[0035] A first detection module is used to: input multiple features of the flow to be detected into a first classifier, process the multiple features through the first classifier, and output a first weight of the flow to be detected;

[0036] A processing module, configured to: calculate a gap between the first weight and a preset standard weight, and determine the credibility of the first weight based on the gap;

[0037] The first detection module is further used to: if the credibility is not less than the threshold, determine whether the flow to be detected is abnormal flow based on the first weight;

[0038] A second detection module is used to: if the credibility is less than a threshold, input the multiple features into a second classifier, process the multiple features through the second classifier, and output a second weight of the flow to be detected; determine whether the flow to be detected is abnormal flow based on the first weight and the second weight;

[0039] The first classifier and the second classifier are different classifiers; the first weight and the second weight are used to indicate whether the traffic to be detected is abnormal.

[0040] Optionally, the first classifier is an extreme learning machine, and when the processing module calculates the gap between the first weight and a preset standard weight and determines the credibility of the first weight based on the gap, it is specifically used to:

[0041] The normalized distance between the first weight and the preset standard weight is calculated based on the following formula, and the normalized distance is used as the credibility of the first weight:

[0042] y wd =exp(-││X0│-│w││);

[0043] Among them, y wd represents credibility, X0 represents the first weight of the traffic to be detected, and w represents the preset standard weight; exp(-││X0│-│w││) represents the exponent of the distance between the absolute value of the first weight of the traffic to be detected and the absolute value of the preset standard weight.

[0044] Optionally, when the credibility is not less than a preset threshold, the first detection module determines whether the flow to be detected is abnormal flow based on the first weight, specifically for: wd When it is less than the preset threshold, if X0 is not less than 0, the traffic to be detected is determined to be abnormal traffic, and the closer X0 is to the absolute value of w, the greater the degree of abnormality of the traffic to be detected; if X0 is less than 0, the traffic to be detected is determined to be normal traffic.

[0045] Optionally, the second classifier includes multiple sub-classifiers; when the second detection module processes multiple features through the second classifier and outputs the second weight of the traffic to be detected, it is specifically used to: identify and predict the multiple features through each sub-classifier in the multiple sub-classifiers to obtain multiple prediction results of the multiple sub-classifiers for the traffic to be detected; the prediction results include the traffic type of the traffic to be detected, and the traffic type includes normal traffic and abnormal traffic; count the number of occurrences of each traffic type according to the multiple prediction results, and determine the second weight based on the traffic type with the largest number of occurrences;

[0046] When the second detection module determines whether the traffic to be detected is abnormal traffic based on the first weight and the second weight, it is specifically used to: if the first weight is not less than 0, and the second weight is used to indicate that the traffic to be detected is abnormal traffic, then determine that the traffic to be detected is abnormal traffic; otherwise, determine that the traffic to be detected is normal traffic.

[0047] Optionally, the second classifier is an extreme learning machine with different parameters from those of the first classifier; when the second detection module processes the multiple features through the second classifier and outputs the second weight of the flow to be detected, it is specifically used to: identify each of the multiple features through the second classifier, and predict the probability of each feature being an abnormal feature and a normal feature; and weightedly calculate the probability of each feature to obtain the second weight;

[0048] When the second detection module determines whether the traffic to be detected is abnormal traffic based on the first weight and the second weight, it is specifically used to: if the first weight is not less than 0 and the second weight is not less than 0, determine that the traffic to be detected is abnormal traffic; otherwise, determine that the traffic to be detected is normal traffic.

[0049] Optionally, when the second detection module determines whether the traffic to be detected is abnormal traffic based on the first weight and the second weight, it is also used to: if the credibility of the first weight is less than the first threshold, determine whether the traffic to be detected is abnormal traffic based on the second weight; the first threshold is less than the preset threshold.

[0050] In a fourth aspect, an embodiment of the present application provides a classifier training device, comprising:

[0051] A first detection module is used to: input multiple features of each sample flow in the first training set into a first classifier, process the multiple features of each sample flow through the first classifier, and output a third weight of each sample flow;

[0052] A processing module, used to: calculate the gap between the third weight of each sample flow and a preset standard weight, and determine the credibility of the third weight based on the gap;

[0053] The second detection module is used to: obtain at least one sample flow whose credibility of the third weight is less than a preset threshold; input multiple features of each sample flow in the at least one sample flow and the actual flow type of each sample flow into the second classifier, and process the multiple features of each sample flow through the second classifier to output the fourth weight of each sample flow; determine the flow type of each sample flow based on the fourth weight of each sample flow, and the flow type includes normal flow and abnormal flow;

[0054] The optimization module is used to calculate the first loss value of the traffic type of each sample flow and the real traffic type of each sample flow, and adjust the parameters of the second classifier with the first loss value being less than the second threshold as the goal to obtain a trained second classifier.

[0055] The first classifier and the second classifier are different classifiers, and the third weight and the fourth weight are both used to indicate whether each sample flow is abnormal.

[0056] Optionally, the first classifier is an extreme learning machine, and when the processing module calculates the gap between the third weight of each sample flow and the preset standard weight, and determines the credibility of the third weight based on the gap, it is specifically used to: calculate the normalized distance between the third weight and the preset standard weight based on the following formula, and use the normalized distance as the credibility of the third weight:

[0057] y wd =exp(-││X i │-│w││);

[0058] Among them, y wd Indicates credibility, X i represents the third weight of the i-th sample flow, w represents the preset standard weight; exp(-││X i │-│w││) represents an exponent for calculating the distance between the absolute value of the third weight of the i-th sample flow and the absolute value of the preset standard weight.

[0059] Optionally, before inputting the multiple features of each sample flow in the first training set into the first classifier, the first detection module is also used to: input the multiple features of each sample flow in the second training set into the first classifier, process the multiple features of each sample flow through the first classifier, and output the fifth weight of each sample flow; determine the flow type of each sample flow based on the fifth weight of each sample flow; calculate the second loss value based on the flow type of each sample flow and the true type of each sample flow, and adjust the parameters of the first classifier with the purpose of making the second loss value less than the third threshold, so as to obtain a trained first classifier.

[0060] Optionally, before inputting multiple features of each sample flow in the first training set into the first classifier, the first detection module is also used to: perform the following operations for each sample flow in the first training set: input several features of each sample flow into a preset tree model, and score the feature importance of each of the several features through the tree model to obtain a score for each feature; sort each feature in descending order of the score, obtain the first n features from the sorting, and obtain multiple features of each sample flow; n is a positive integer greater than 1.

[0061] In a fifth aspect, an embodiment of the present application provides an electronic device comprising at least one processor, which is used to implement a method as in the first aspect or any optional implementation of the first aspect or a method as in the second aspect or any optional implementation of the second aspect when executing a computer program stored in a memory.

[0062] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, which is used to store instructions. When the instructions are executed, the method in the first aspect or any optional implementation of the first aspect or the method in the second aspect or any optional implementation of the second aspect is implemented.

[0063] In the seventh aspect, an embodiment of the present application provides a computer program product, including a computer program code, which, when executed on a computer, enables a method as in the first aspect or any optional implementation of the first aspect, or a method as in the second aspect or any optional implementation of the second aspect to be implemented.

[0064] The technical effects or advantages of one or more technical solutions provided in the third, fourth, fifth, sixth and seventh aspects of the embodiments of the present application can be correspondingly explained by the technical effects or advantages of one or more corresponding technical solutions provided in the first or second aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1A flow chart of a data detection method provided in an embodiment of the present application;

[0066] Figure 2 An example diagram of test results of different preset thresholds provided in an embodiment of the present application;

[0067] Figure 3 An example diagram of experimental results of a combination of an RF classifier and an ELM classifier provided in an embodiment of the present application;

[0068] Figure 4 An example diagram of experimental results of different numbers of classifiers provided in an embodiment of the present application;

[0069] Figure 5 A structural diagram of a data detection device provided in an embodiment of the present application;

[0070] Figure 6 A structural diagram of a classifier training device provided in an embodiment of the present application;

[0071] Figure 7 A structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0072] In the technical solution of this application, the collection, dissemination, and use of data are in compliance with the requirements of relevant national laws and regulations.

[0073] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0074] The technical solution of the present application is described in detail below through the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present application and the specific features in the embodiments are detailed descriptions of the technical solution of the present application, rather than limitations on the technical solution of the present application. In the absence of conflict, the embodiments of the present application and the technical features in the embodiments can be combined with each other.

[0075] It should be understood that "multiple" in the description of the embodiment of the present application refers to two or more. "First", "second" etc. in the embodiment of the present application are used to distinguish different objects, rather than to describe a specific order. The term "and / or" in the embodiment of the present application is merely a kind of association relationship describing associated objects, indicating that three relationships may exist, for example, A and / or B, which may represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "includes" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. The module in the embodiment of the present application refers to a part with independent functions in a software system.

[0076] For ease of understanding, the following is an introduction to some of the professional terms involved in the embodiments of this application:

[0077] 1. Intrusion Detection System (IDS) is a security technology used to monitor unauthorized activities or abnormal behaviors in a network or system. It monitors and responds to various attack attempts, attack behaviors or attack results by monitoring and analyzing network traffic, system logs, audit data, etc.

[0078] 2. Extreme Learning Machine (ELM) is a fast single-layer feedforward neural network used to solve classification and regression problems. It is suitable for supervised learning and unsupervised learning problems. It usually consists of three layers: input layer, hidden layer and output layer. The connection between each layer is completed through the feature mapping function. During the training process, the weights and biases of the hidden layer are usually randomly generated or given manually. They do not need to be updated. The training process can be completed by calculating the weights of the output layer. The learning process is relatively simple, the learning speed is fast, and the generalization ability is strong.

[0079] 3. Random Forest (RF) is a commonly used machine learning algorithm and a type of ensemble learning method. It constructs multiple decision trees for classification or regression prediction. Each decision tree is trained on a randomly selected data set and features. Random Forest uses a technique called "bagging" to build each decision tree through random bootstrap sampling (with replacement sampling). This randomness ensures that the correlation between each tree is low, thereby reducing the risk of overfitting. Ultimately, the output of the random forest is the average or majority vote of the prediction results of all decision trees.

[0080] In today's highly digital and hyper-connected era, the impact of cyber attacks has penetrated into every aspect of our daily lives, from financial networks and critical infrastructure to healthcare systems and government agencies, all of which are facing security risks. Moreover, the number of vulnerabilities and threats in the field of network security has shown a significant growth trend over time, and the speed and impact of attacks are also continuing to increase. Faced with the rapid and comprehensive development of the information industry, the popularization of the Internet and the widespread application of enterprise networks, network attacks are frequent, and traditional border protection measures such as firewalls are no longer sufficient to deal with complex internal and external threats. Therefore, IDS came into being as a proactive security protection mechanism.

[0081] The main function of IDS is to monitor and analyze traffic and system activities in the network to identify possible malicious behavior or policy violations. The development and application of IDS rely on a number of key technologies, including but not limited to network protocol analysis, feature matching, anomaly detection, statistical analysis, machine learning, behavioral analysis, real-time response, log analysis, protocol fuzz testing and honeypot technology. With the development and improvement of these technologies, IDS can also effectively detect and respond to various types of network attacks and protect the security of networks and systems. The IDS method based on machine learning mainly focuses on two major directions: feature optimization and model improvement. Specifically, the difference between normal and abnormal traffic is magnified through methods such as feature grouping and feature generation to discover the imperceptible features between normal and abnormal traffic. However, in the summary of fast detection scenarios, complex technical features will cause the feature calculation time to be too long, thereby affecting the detection speed; the model performance can be improved by increasing the number of model layers and the number of classifiers, but the importance of features as the basis for classification is ignored, and the excessive use of deep learning models makes the model poorly interpretable and difficult to analyze in depth.

[0082] In view of this, an embodiment of the present application is proposed, in which a plurality of features of the traffic to be detected are input into a first classifier to obtain a first weight of the traffic to be detected, the gap between the first weight and a preset standard weight is calculated, and the credibility of the first weight is determined based on the gap. If the credibility is not less than a preset threshold, that is, it means that the prediction result of the first classifier for the traffic to be detected is credible, then whether the traffic to be detected is abnormal traffic is directly determined based on the first weight, which can improve the efficiency of detecting abnormal traffic. If the credibility is less than the preset threshold, that is, it means that the prediction result of the first classifier for the traffic to be detected is unreliable, then a plurality of features are input into a second classifier to obtain a second weight, and the first weight and the second weight are combined to determine whether the traffic to be detected is abnormal, so as to more comprehensively identify and analyze the traffic to be detected, thereby improving the accuracy of detecting abnormal traffic.

[0083] The data detection method provided in the embodiment of the present application can be applied to any scenario of detecting abnormal traffic, including but not limited to the above-mentioned detection of traffic with malicious behavior.

[0084] See also Figure 1 , is a flow chart of a data detection method provided in an embodiment of the present application. The method can be applied to any electronic device with processing capabilities, such as a virtual machine, a tablet, a computer, etc. The method includes steps S101 to S103:

[0085] S101. Input multiple features of the traffic to be detected into a first classifier, process the multiple features through the first classifier, and output a first weight of the traffic to be detected.

[0086] The first weight is used to indicate whether the traffic to be detected is abnormal.

[0087] Exemplarily, the multiple features mainly include multiple statistical features of the traffic to be detected, such as data packet size, number of data packets, maximum value of data packets, time interval of data packets, average rate of message transmission, etc.; the multiple features may also include behavioral characteristics, content characteristics, etc. of the traffic to be detected, which can be selected according to actual needs, and the embodiments of the present application do not limit this.

[0088] In a possible example, the first classifier is a pre-trained extreme learning machine ELM; a specific implementation method of processing multiple features by the first classifier and outputting the first weight of the traffic to be detected is as follows:

[0089] Each of the multiple features of the traffic to be detected is identified by the ELM classifier, and the probability of each feature being an abnormal feature or a normal feature is predicted;

[0090] The probability of each feature is weighted to obtain the first weight.

[0091] Exemplarily, the output form of the ELM classifier can be [-m, m], where m is a positive number; wherein -m represents the probability that the traffic to be detected is normal traffic, and m represents the probability that the traffic to be detected is abnormal traffic, and m can be used as the first weight of the traffic to be detected, used to indicate the probability that the traffic to be detected is abnormal traffic and the degree of abnormality of the traffic to be detected; or m represents the probability that the traffic to be detected is normal traffic, and -m represents the probability that the traffic to be detected is abnormal traffic, and -m is used as the first weight of the traffic to be detected.

[0092] In the embodiment of the present application, -m is used to represent the probability that the traffic to be detected is normal traffic, and m is used to represent the probability that the traffic to be detected is abnormal traffic.

[0093] S102: Calculate the difference between the first weight and a preset standard weight, and determine the credibility of the first weight based on the difference.

[0094] In a possible embodiment, the specific implementation of step S102 is as follows:

[0095] The normalized distance between the first weight and the preset standard weight is calculated based on the following formula, and the normalized distance is used as the credibility of the first weight:

[0096] y wd =exp(-││X0│-│w││);

[0097] Among them, y wd represents credibility, X0 represents the first weight of the traffic to be detected, and w represents the preset standard weight; exp(-││X0│-│w││) represents the exponent of the distance between the absolute value of the first weight of the traffic to be detected and the absolute value of the preset standard weight.

[0098] Exemplarily, the preset standard weight may be [-1, 1], where -1 represents normal traffic and 1 represents abnormal traffic; or 1 represents normal traffic and -1 represents abnormal traffic. In practical applications, the specific value of the preset standard weight may also be selected according to actual needs. The standard weight in the embodiment of the present application only takes -1 to represent normal traffic and 1 to represent abnormal traffic as an example, and the value range of X0 is between -1 and 1.

[0099] It can be understood that when the absolute value of X0 is farther from 1 (that is, the absolute value of the standard weight), that is, y wd When it is closer to 0, it means that ELM cannot accurately classify the traffic to be detected, that is, the credibility of the first weight obtained by ELM to identify and predict the traffic to be detected is low, and there may be misclassification; when the absolute value of X0 is closer to 1 (that is, the absolute value of the standard weight), that is, y wd The closer it is to 1, the more accurately ELM can classify the traffic to be detected, that is, the credibility of the first weight obtained by ELM to identify and predict the traffic to be detected is higher.

[0100] Therefore, based on the obtained credibility, a method for determining whether the traffic to be detected is abnormal traffic can be further selected. Specifically, for the two cases where the credibility is not less than the preset threshold and is less than the preset threshold, the following embodiments of the present application are introduced in detail through step S103-1 and step S103-2 respectively.

[0101] S103-1. If the credibility is not less than the preset threshold, determine whether the traffic to be detected is abnormal traffic based on the first weight.

[0102] It can be understood that if the credibility is not less than the preset threshold, it means that the first weight obtained by the first classifier to identify and predict the traffic to be detected is credible, and the classification accuracy is high. Therefore, it is possible to directly determine whether the traffic to be detected is abnormal traffic based on the first weight to improve the efficiency of detecting abnormal traffic.

[0103] Specifically, a specific method for determining whether the traffic to be detected is abnormal traffic based on the first weight is as follows:

[0104] In y wd When it is less than the preset threshold, if X0 is not less than 0, the traffic to be detected is determined to be abnormal traffic, and the closer X0 is to the absolute value of w, the greater the degree of abnormality of the traffic to be detected; if X0 is less than 0, the traffic to be detected is determined to be normal traffic.

[0105] It can be understood that according to the above step S102, the standard weight is -1 to represent normal traffic, 1 to represent abnormal traffic, and the value range of X0 is between -1 and 1. In this case, if X0 is not less than 0, the traffic to be detected is determined to be abnormal traffic, and the closer X0 is to 1, the closer the first classifier determines that the traffic to be detected is to the standard abnormal traffic, that is, the greater the degree of abnormality of the traffic to be detected; similarly, if X0 is less than 0, the traffic to be detected is determined to be normal traffic, and the closer X0 is to -1, the closer the first classifier determines that the traffic to be detected is to the standard normal traffic, and the smaller the degree of abnormality of the traffic to be detected.

[0106] In the above, when the standard weight is -1 for normal traffic and 1 for abnormal traffic, determining whether the traffic to be detected is abnormal traffic based on whether X0 is greater than 0 is only a possible example. In practice, the corresponding judgment condition of X0 can be set according to the value of the selected standard weight.

[0107] S103-2. If the credibility is less than the preset threshold, multiple features are input into the second classifier, the multiple features are processed by the second classifier, and the second weight of the flow to be detected is output; based on the first weight and the second weight, it is determined whether the flow to be detected is abnormal flow.

[0108] It can be understood that if the credibility is less than the preset threshold, it means that the first weight obtained by the first classifier to identify and predict the traffic to be detected is unreliable, the classification accuracy is low, and further detection of the traffic to be detected is required. The second classifier is a pre-trained classifier.

[0109] Among them, the second weight is also used to indicate whether the traffic to be detected is abnormal, and the first classifier and the second classifier are different classifiers. The first classifier and the second classifier can be integrated in one model or in two different models respectively. The model where the first classifier is located can call the model where the second classifier is located.

[0110] It can be understood that the first classifier and the second classifier are different, and the first classifier and the second classifier may be classifiers of different types, or the first classifier and the second classifier may be classifiers of the same type but with different parameters. For these two situations, the embodiments of the present application respectively introduce two implementation methods of step S103-2 through the following embodiment 1 and embodiment 2:

[0111] In the first embodiment, the first classifier and the second classifier are classifiers of different types.

[0112] Specifically, the second classifier includes multiple sub-classifiers; and a specific implementation method of processing multiple features by the second classifier and outputting the second weight of the flow to be detected includes:

[0113] By identifying and predicting multiple features by each of the multiple sub-classifiers, multiple prediction results of the multiple sub-classifiers for the traffic to be detected are obtained; the prediction results include the traffic type of the traffic to be detected, and the traffic type includes normal traffic and abnormal traffic;

[0114] Counting the number of occurrences of each traffic type according to the multiple prediction results, and determining a second weight based on the traffic type with the largest number of occurrences;

[0115] Determining whether the traffic to be detected is abnormal traffic based on the first weight and the second weight includes: if the first weight is not less than 0, and the second weight is used to indicate that the traffic to be detected is abnormal traffic, then determining that the traffic to be detected is abnormal traffic; otherwise, determining that the traffic to be detected is normal traffic.

[0116] Exemplarily, the second classifier can be an RF classifier, which includes multiple decision trees (i.e., multiple sub-classifiers), each decision tree processes each of the multiple features and obtains a prediction result for each feature; through a voting decision-making method, the traffic types in the multiple prediction results are counted, and the traffic type with the largest number of occurrences is used as the prediction result of the second classifier, and the traffic type or the digital identifier of the traffic type (i.e., the second weight) is output.

[0117] The second classifier may also use other binary classifiers, and this embodiment of the present application does not limit this.

[0118] It can be understood that since the second classifier and the first classifier are classifiers of different types, before inputting multiple features of the traffic to be detected into the second classifier, it is necessary to re-extract the features of the traffic to be detected or perform data conversion on the multiple features so that the input features can be recognized and processed by the second classifier.

[0119] Embodiment 2: The first classifier and the second classifier are classifiers of the same type but with different parameters. Take the first classifier as the extreme learning machine cited in the above embodiment as an example.

[0120] Specifically, the second classifier is an extreme learning machine with different parameters from the first classifier; and a specific implementation method of processing multiple features by the second classifier and outputting a second weight of the flow to be detected includes:

[0121] Using a second classifier, each of the multiple features is identified, and the probability of each feature being an abnormal feature or a normal feature is predicted; the probability of each feature is weighted to obtain a second weight;

[0122] Determining whether the traffic to be detected is abnormal traffic based on the first weight and the second weight includes: if the first weight is not less than 0 and the second weight is not less than 0, determining that the traffic to be detected is abnormal traffic; otherwise, determining that the traffic to be detected is normal traffic.

[0123] The above-mentioned Embodiment 1 and Embodiment 2 are merely possible examples and are not limited thereto.

[0124] It can be understood that when determining whether the traffic to be detected is abnormal traffic, considering the first weight and the second weight at the same time, that is, the prediction result of the first classifier and the prediction result of the second classifier, can more comprehensively perform anomaly detection on the traffic to be detected and improve the accuracy of anomaly detection.

[0125] However, according to the above embodiment, the credibility of the first weight is calculated, and the credibility of the obtained first weight may be extremely low, resulting in the first weight being unreliable. In order to avoid misjudgment due to the first weight, the method for determining whether the traffic to be detected is abnormal traffic based on the first weight and the second weight may also include:

[0126] If the credibility of the first weight is less than the first threshold, it is determined whether the traffic to be detected is abnormal traffic based on the second weight.

[0127] The first threshold is less than the preset threshold. The first threshold can be selected according to actual needs. In this way, the accuracy of abnormality detection can be avoided from being further improved.

[0128] In this scheme, after a first weight is obtained by processing multiple features of the traffic to be detected through a first classifier, the credibility of the first weight is determined based on the gap between the first weight and a preset standard weight, that is, whether the processing result of the first classifier on the traffic to be detected is credible is determined. If the credibility is not less than the preset threshold, it means that the credibility of the first weight is high, and whether the traffic to be detected is abnormal can be directly determined based on the first weight, thereby improving the efficiency of detecting abnormal traffic; if the credibility is less than the preset threshold, it means that the credibility of the first weight is low. Therefore, in order to ensure accurate detection of the traffic to be detected, multiple features are input into the second classifier for processing to obtain a second weight output by the second classifier. The processing results of the two classifiers are combined to determine whether the traffic to be detected is abnormal, which can more comprehensively identify and analyze the traffic to be detected, thereby improving the accuracy of detecting abnormal traffic.

[0129] In a possible design, the embodiment of the present application further provides a classifier training method, which includes steps S201 to S204:

[0130] S201. Input multiple features of each sample flow in the first training set into a first classifier, process the multiple features of each sample flow through the first classifier, and output a third weight of each sample flow.

[0131] In a possible embodiment, before inputting the multiple features of each sample flow in the first training set into the first classifier, the method further includes:

[0132] For each sample flow in the first training set, perform the following operations:

[0133] Input several features of each sample flow into a preset tree model, and use the tree model to score the feature importance of each of the several features to obtain a score for each feature;

[0134] Each feature is sorted in descending order according to the score, and the first n features are obtained from the sorting to obtain multiple features of each sample flow; n is a positive integer greater than 1.

[0135] Exemplarily, the preset tree model can be an extreme tree and a random forest. Based on the tree model, the feature importance of each feature is scored, that is, the contribution of each feature to the prediction result of abnormal traffic, the frequency of occurrence and other factors are scored, and the top n features are obtained. It can be achieved to screen several features of each sample traffic, reduce the feature dimension, and be based on features that are easier to identify and classify.

[0136] Among them, the value of n can be selected according to actual conditions. For example, starting from the first feature in order, features are added one by one (i.e., the number of features is gradually increased) to train the first classifier, and the accuracy of the first classifier under different n values ​​is analyzed to obtain the n value with the highest accuracy (or meeting the actual requirements).

[0137] S202: Calculate the difference between the third weight of each sample flow and the preset standard weight, and determine the credibility of the third weight based on the difference.

[0138] Exemplarily, the first classifier is an extreme learning machine, and the gap between the third weight of each sample flow and the preset standard weight is calculated, and the credibility of the third weight is determined based on the gap, including: calculating the normalized distance between the third weight and the preset standard weight based on the following formula, and using the normalized distance as the credibility of the third weight:

[0139] y wd =exp(-││X i │-│w││);

[0140] Among them, y wd Indicates credibility, X i represents the third weight of the i-th sample flow, w represents the preset standard weight; exp(-││X i │-│w││) represents an exponent for calculating the distance between the absolute value of the third weight of the i-th sample flow and the absolute value of the preset standard weight.

[0141] S203. Obtain at least one sample flow whose credibility of the third weight is less than a preset threshold; input multiple features of each sample flow in the at least one sample flow and the actual flow type of each sample flow into the second classifier, and process the multiple features of each sample flow through the second classifier to output the fourth weight of each sample flow; determine the flow type of each sample flow based on the fourth weight of each sample flow, and the flow type includes normal flow and abnormal flow.

[0142] It can be understood that the third weight and the fourth weight are both used to indicate whether each sample flow is abnormal. If the credibility of the third weight is less than the preset threshold, it means that the first classifier cannot achieve a relatively accurate classification of the at least one sample flow. Therefore, it is necessary to learn the at least one sample flow through the second classifier, so that the subsequent integration of the first classifier and the second classifier can more comprehensively identify each flow and improve the accuracy of detecting abnormal flow.

[0143] Similarly, the first classifier and the second classifier are different classifiers. For the two cases where the first classifier and the second classifier are classifiers of different types, and the first classifier and the second classifier are classifiers of the same type but with different parameters, the specific implementation methods of step S203 are described in detail below through Example 3 and Example 4 respectively:

[0144] Embodiment 3: The first classifier and the second classifier are classifiers of different types.

[0145] Specifically, the second classifier includes multiple sub-classifiers, and the second classifier processes multiple features of each sample flow and outputs a fourth weight of each sample flow, including:

[0146] Identify and predict multiple features of each sample flow by each sub-classifier in the multiple sub-classifiers, and obtain multiple prediction results of each sample flow by the multiple sub-classifiers; the prediction results include the flow type of each sample flow; count the number of occurrences of each flow type according to the multiple prediction results of each sample flow, and determine the fourth weight of each sample flow based on the flow type with the largest number of occurrences;

[0147] The traffic type of each sample traffic is determined based on the fourth weight of each sample traffic, where the traffic type includes normal traffic and abnormal traffic, including:

[0148] The traffic type with the largest number of occurrences corresponding to the fourth weight of each sample traffic is the traffic type of each sample traffic.

[0149] It can be understood that, since the second classifier and the first classifier are of different types, before inputting the multiple features of at least one sample flow into the second classifier, it is necessary to re-extract the features of at least one sample flow so that the features can be recognized and processed by the second classifier;

[0150] Optionally, after extracting the features of at least one sample flow, the features of at least one sample flow may be ranked and screened by importance using the same method as in the embodiment of step S201 above.

[0151] Embodiment 4: The first classifier and the second classifier are classifiers of the same type but with different parameters.

[0152] Specifically, the second classifier is an extreme learning machine with different parameters from those of the first classifier; the second classifier processes multiple features of each sample flow and outputs a fourth weight of each sample flow, including:

[0153] Each of the multiple features of each sample flow is identified by the second classifier, and the probability of each feature of each sample flow being an abnormal feature or a normal feature is predicted; the probability of each feature of each sample flow is weighted and calculated to obtain a fourth weight of each sample flow;

[0154] The traffic type of each sample traffic is determined based on the fourth weight of each sample traffic, where the traffic type includes normal traffic and abnormal traffic, including:

[0155] For each sample flow, if the fourth weight is not less than 0, the sample flow is determined to be abnormal flow; if the fourth weight is less than 0, the sample flow is determined to be normal flow.

[0156] It can be understood that the specific implementation method of determining the traffic type of each sample traffic based on the fourth weight is the same as the method of determining whether the traffic to be detected is abnormal traffic based on the first weight in the above step S102, and the embodiments of the present application will not be repeated here.

[0157] The above-mentioned Embodiment 3 and Embodiment 4 are merely possible examples and are not limited thereto.

[0158] In a possible design, the preset threshold can be selected according to actual needs. An example of selecting a preset threshold provided in an embodiment of the present application is:

[0159] It can be understood that the number of sample flows that need to be input into the second classifier for processing is affected by the preset threshold. In theory, the larger the value of the preset threshold, the more sample flows that need to be input into the second classifier will be screened out, and the accuracy of anomaly detection will be higher. In order to verify the relationship between the preset threshold and the accuracy of anomaly detection and determine the value of the preset threshold that has the highest accuracy of anomaly detection, the embodiments of the present application set up two different experimental combinations based on the corresponding data sets CSE-CIC-IDS2018 (IDS2018) and NF-UQ-NIDS-v2 (NIDS) for testing, and compared the scores F1 of the classification models (the classification model includes the first classifier and the second classifier) ​​under 9 thresholds. The score is used to indicate the accuracy of the classification model (i.e., the accuracy of anomaly detection). The test results of the preset threshold α are shown in the figure. Figure 2 And as shown in Table 1 below.

[0160] Table 1 Test results of different preset thresholds

[0161]

[0162] Among them, Ave is used to indicate the average score of the classification model of the two data sets under the same threshold α, and the data in the middle part (such as 0.91, 0.93, etc.) are the scores of the classification models based on each data set under each threshold α. According to the above results, it can be seen that as α increases, the score of the classification model also increases. When α = 0.9, the score of the classification model is the largest. This is because the larger the threshold α, the more samples with low classification credibility of the first classifier can be included, so that better feature selection can be performed. Therefore, according to the above test results, the threshold α can be selected as 0.9.

[0163] Similarly, when the threshold α increases, the computational cost will also increase. In practical applications, the specific value of the preset threshold can be selected based on requirements such as cost and accuracy.

[0164] S204, calculating the first loss value of the traffic type of each sample traffic and the real traffic type of each sample traffic, adjusting the parameters of the second classifier with the goal of the first loss value being less than the second threshold, and obtaining a trained second classifier.

[0165] It can be understood that the method for calculating the loss value can be selected according to actual needs, and the second threshold can also be set according to actual needs. The embodiments of the present application do not limit this.

[0166] In a possible example, before training the second classifier, the first classifier needs to be trained. The specific method of training the first classifier is as follows:

[0167] Inputting multiple features of each sample flow in the second training set into the first classifier, processing the multiple features of each sample flow through the first classifier, and outputting the fifth weight of each sample flow; determining the flow type of each sample flow based on the fifth weight of each sample flow;

[0168] The second loss value is calculated based on the traffic type of each sample traffic and the true type of each sample traffic. With the purpose of the second loss value being less than the third threshold, the parameters of the first classifier are adjusted to obtain a trained first classifier.

[0169] In this way, the first classifier is trained first, and the second classifier is trained based on the trained first classifier, so that the training effect of the second classifier can be improved.

[0170] It can be understood that the method for calculating the second loss value and the third threshold can be selected according to actual needs, and the embodiments of the present application do not limit this.

[0171] Optionally, before inputting multiple features of each sample flow in the second training set into the first classifier, the features of each sample flow can be sorted and screened by importance using the same method as in the embodiment of step S201 to improve the training efficiency and accuracy of the first classifier.

[0172] The first classifiers selected in the above embodiments are all ELM classifiers. In practical applications, other classifiers may also be selected as the first classifier.

[0173] In an optional embodiment, the first classifier may also be an RF classifier or other classifiers. Accordingly, the method for setting the credibility of the first classifier and the preset threshold are determined according to the specific classifier.

[0174] For example, if the first classifier is an RF classifier, the multiple features are identified and predicted according to each of the multiple decision trees in the RF classifier to obtain multiple prediction results, and the information entropy is calculated based on the multiple prediction results. The information entropy is used as the credibility of the first classifier, and the preset threshold corresponding to the information entropy is tested using the above-mentioned method of testing the preset threshold corresponding to the normalized distance.

[0175] Optionally, a combination of the first classifier and the second classifier can be selected according to the specific application scenario and data set, see Figure 3 The following Table 2 is an experimental example of abnormal traffic detection based on different combinations of RF classifiers and ELM classifiers provided by the present application.

[0176] Table 2 Example of combined experimental results of RF classifier and ELM classifier

[0177]

[0178] The numbers in the middle of the table (such as 0.96, 0.93, etc.) are the scores of each combination trained based on different data sets (i.e., the accuracy of anomaly detection); ER means that the first classifier is an ELM classifier and the second classifier is an RF classifier; RE means that the first classifier is an RF classifier and the second classifier is an ELM classifier; EE means that both the first classifier and the second classifier are ELM classifiers, but with different parameters; RR means that both the first classifier and the second classifier are RF classifiers, but with different parameters.

[0179] According to the above experimental results, it can be concluded that when training based on the IDS2018 dataset and the NIDS dataset, the ER combination has the best effect. The ELM classifier combined with the normalized weight distance is more suitable for screening samples with low classification credibility; the RF classifier is more suitable for the binary classification of traffic (i.e., identifying normal traffic and abnormal traffic). Therefore, the use of different types of classifiers has better accuracy and robustness for abnormal traffic detection in IDS scenarios. The embodiments of the present application only cite some possible combination examples. In actual applications, the combination of classifiers and the type of classifiers can also be selected according to actual needs.

[0180] Optionally, two classifiers are used in the embodiment of the present application. In practical applications, other number of classifiers can be combined according to the needs, such as a single classifier, three classifiers, etc. In theory, the more classifiers there are, the more detailed the feature recognition is, but it will also be affected by the concentrated features. Figure 4 Table 3 is an experimental example of the relationship between the number of different classifiers and the accuracy of detecting abnormal traffic provided in the embodiments of the present application.

[0181] Table 3 Experimental results examples of different number of classifiers

[0182]

[0183] According to the above results, it can be seen that using two classifiers can significantly improve the score (i.e. the accuracy of detecting abnormal traffic) compared to using one classifier, but the score does not continue to improve as the number of classifiers increases. It can be understood that as the number of classifiers increases, the number of traffic that needs to be detected multiple times decreases, and the classification performance is not further improved. On the contrary, over-screening may lead to overfitting. Therefore, when training based on the IDS2018 dataset and the NIDS dataset, selecting two classifiers has a better effect on anomaly detection. In practical applications, the number of classifiers can be selected according to actual needs.

[0184] It is understood that the methods in the above embodiments can be used alone or in combination, and the embodiments of the present application do not limit this. In addition, the above embodiments are only some of the best examples given in the present application, and are not actually limited to this.

[0185] The method provided by the embodiment of the present application is introduced above, and the device provided by the embodiment of the present application is introduced below.

[0186] Based on the same technical concept, the embodiment of the present application provides a data detection device, which includes a module / unit / means for executing the method executed by the electronic device in the above method embodiment. The module / unit / means can be implemented by software, or by hardware, or the corresponding software can be implemented by hardware.

[0187] For example, see Figure 5 , the device 500 comprises:

[0188] The first detection module 501 is used to: input multiple features of the traffic to be detected into a first classifier, process the multiple features through the first classifier, and output a first weight of the traffic to be detected;

[0189] The processing module 502 is used to calculate the difference between the first weight and the preset standard weight, and determine the credibility of the first weight based on the difference;

[0190] The first detection module 501 is further configured to: if the credibility is not less than a threshold, determine whether the traffic to be detected is abnormal traffic based on the first weight;

[0191] The second detection module 503 is used to: if the credibility is less than the threshold, input the multiple features into the second classifier, process the multiple features through the second classifier, and output the second weight of the flow to be detected; determine whether the flow to be detected is abnormal flow based on the first weight and the second weight;

[0192] The first classifier and the second classifier are different classifiers; the first weight and the second weight are used to indicate whether the traffic to be detected is abnormal.

[0193] It should be understood that all relevant contents of each step involved in the above data detection method embodiment can be referred to the functional description of the corresponding functional module, and will not be repeated here.

[0194] Based on the same technical concept, the embodiment of the present application provides a classifier training device, which includes a module / unit / means for executing the method executed by the electronic device in the above method embodiment. The module / unit / means can be implemented by software, or by hardware, or the corresponding software can be implemented by hardware.

[0195] For example, see Figure 6 , the device 600 comprises:

[0196] The first detection module 601 is used to: input multiple features of each sample flow in the first training set into the first classifier, process the multiple features of each sample flow through the first classifier, and output a third weight of each sample flow;

[0197] The processing module 602 is used to calculate the difference between the third weight of each sample flow and the preset standard weight, and determine the credibility of the third weight based on the difference;

[0198] The second detection module 603 is used to: obtain at least one sample flow whose third weight is less than a preset threshold; input multiple features of each sample flow in the at least one sample flow and the real flow type of each sample flow into a second classifier, and process the multiple features of each sample flow through the second classifier to output a fourth weight of each sample flow;

[0199] The optimization module 604 is used to: determine the traffic type of each sample flow based on the fourth weight of each sample flow, the traffic type including normal traffic and abnormal traffic; calculate the first loss value of the traffic type of each sample flow and the actual traffic type of each sample flow, and adjust the parameters of the second classifier with the goal of the first loss value being less than the second threshold to obtain a trained second classifier.

[0200] It should be understood that all relevant contents of each step involved in the above-mentioned classifier training method embodiment can be referred to the functional description of the corresponding functional module, and will not be repeated here.

[0201] Based on the same technical concept, see Figure 7 The embodiment of the present application further provides an electronic device 700, including:

[0202] At least one processor 701; and a communication interface 703 that is communicatively connected to the at least one processor 701; the at least one processor 701 executes instructions stored in the memory 702, so that the electronic device 700 executes the method steps performed by the billboard in the above method embodiment through the communication interface 703.

[0203] Optionally, the memory 702 is located outside the electronic device 700 .

[0204] Optionally, the electronic device 700 includes the memory 702, the memory 702 is connected to the at least one processor 701, and the memory 702 has instructions that can be executed by the at least one processor 701. Figure 7 The dashed lines indicate that the memory 702 is optional for the electronic device 700 .

[0205] The at least one processor 701 and the memory 702 may be coupled via an interface circuit or may be integrated together, which is not limited here.

[0206] The specific connection medium between the at least one processor 701, the memory 702 and the communication interface 703 is not limited in the embodiment of the present application. Figure 7In the embodiment, at least one processor 701, a memory 702 and a communication interface 703 are connected via a bus 704. Figure 7 The connection between other components is only for schematic illustration and is not intended to be limiting. The bus part may be an address bus, a data bus, a control bus, etc. For ease of representation, Figure 7 It is represented by only one thick line, but it does not mean that there is only one bus or one type of bus.

[0207] It should be understood that the processor mentioned in the embodiments of the present application can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc. When implemented by software, the processor can be a general-purpose processor implemented by reading software code stored in a memory.

[0208] Exemplarily, the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0209] It should be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both a volatile memory and a non-volatile memory. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which acts as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DirectRambus RAM, DR RAM).

[0210] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) can be integrated into the processor.

[0211] It should be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0212] Based on the same technical concept, an embodiment of the present application also provides a computer-readable storage medium, which is used to store instructions. When the instructions are executed, the computer executes the method steps executed by any device in the above method embodiments.

[0213] Based on the same technical concept, an embodiment of the present application also provides a computer program product, including computer program code. When the computer program code is executed on a computer, the method steps executed by any device in the above method embodiment are implemented.

[0214] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0215] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0216] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0217] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0218] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A data detection method, characterized in that: include: Inputting a plurality of features of the flow to be detected into a first classifier, processing the plurality of features by the first classifier, and outputting a first weight of the flow to be detected; Calculating a gap between the first weight and a preset standard weight, and determining the credibility of the first weight based on the gap; If the credibility is not less than a preset threshold, determining whether the flow to be detected is abnormal flow based on the first weight; If the credibility is less than the preset threshold, the multiple features are input into a second classifier, the multiple features are processed by the second classifier, and a second weight of the flow to be detected is output; based on the first weight and the second weight, it is determined whether the flow to be detected is abnormal flow; The first classifier and the second classifier are different classifiers; the first weight and the second weight are used to indicate whether the traffic to be detected is abnormal.

2. The method according to claim 1, characterized in that The first classifier is an extreme learning machine, and the calculating the gap between the first weight and a preset standard weight, and determining the credibility of the first weight based on the gap, includes: The normalized distance between the first weight and the preset standard weight is calculated based on the following formula, and the normalized distance is used as the credibility of the first weight: and wd =exp(-││X0│-│w││); Among them, the y wd represents the credibility, X0 represents the first weight of the traffic to be detected, and w represents the preset standard weight; the exp(-││X0│-│w││) represents the exponent of the distance between the absolute value of the first weight of the traffic to be detected and the absolute value of the preset standard weight.

3. The method according to claim 2, characterized in that If the credibility is not less than a preset threshold, determining whether the traffic to be detected is abnormal traffic based on the first weight includes: In the y wd When it is not less than the preset threshold, if X0 is not less than 0, the flow to be detected is determined to be abnormal flow, and the closer X0 is to the absolute value of w, the greater the degree of abnormality of the flow to be detected; if X0 is less than 0, the flow to be detected is determined to be normal flow.

4. The method according to claim 2, characterized in that The second classifier includes a plurality of sub-classifiers; the processing of the plurality of features by the second classifier to output a second weight of the traffic to be detected includes: By identifying and predicting the multiple features by each of the multiple sub-classifiers, multiple prediction results of the multiple sub-classifiers on the flow to be detected are obtained; the prediction results include the flow type of the flow to be detected, and the flow type includes normal flow and abnormal flow; Counting the number of occurrences of each traffic type according to the multiple prediction results, and determining the second weight based on the traffic type with the largest number of occurrences; The determining whether the to-be-detected traffic is abnormal traffic based on the first weight and the second weight includes: If the first weight is not less than 0, and the second weight is used to indicate that the traffic to be detected is abnormal traffic, the traffic to be detected is determined to be abnormal traffic; otherwise, the traffic to be detected is determined to be normal traffic.

5. The method according to claim 2, characterized in that The second classifier is an extreme learning machine having different parameters from those of the first classifier; and the processing of the plurality of features by the second classifier to output a second weight of the flow to be detected includes: Identify each of the multiple features by using the second classifier, and predict the probability of each feature being an abnormal feature or a normal feature; and calculate the probability of each feature by weight to obtain the second weight; The determining whether the traffic to be detected is abnormal traffic based on the first weight and the second weight includes: if the first weight is not less than 0 and the second weight is not less than 0, determining that the traffic to be detected is abnormal traffic; otherwise, determining that the traffic to be detected is normal traffic.

6. The method according to claim 1, characterized in that The determining whether the to-be-detected traffic is abnormal traffic based on the first weight and the second weight includes: If the credibility of the first weight is less than a first threshold, whether the flow to be detected is abnormal flow is determined based on the second weight; and the first threshold is less than the preset threshold.

7. A classifier training method, characterized in that: include: Inputting multiple features of each sample flow in the first training set into a first classifier, processing the multiple features of each sample flow through the first classifier, and outputting a third weight of each sample flow; Calculating a difference between the third weight of each sample flow and a preset standard weight, and determining the credibility of the third weight based on the difference; Acquire at least one sample flow whose credibility of the third weight is less than a preset threshold; Inputting multiple features of each sample flow in the at least one sample flow and the real flow type of each sample flow into a second classifier, processing the multiple features of each sample flow through the second classifier, and outputting a fourth weight of each sample flow; Determine the traffic type of each sample traffic based on the fourth weight of each sample traffic, where the traffic type includes normal traffic and abnormal traffic; Calculating a first loss value of the traffic type of each sample traffic and a real traffic type of each sample traffic, adjusting the parameters of the second classifier with the goal of the first loss value being less than a second threshold, and obtaining a trained second classifier; The first classifier and the second classifier are different classifiers, and the third weight and the fourth weight are both used to indicate whether each sample flow is abnormal.

8. The method according to claim 7, characterized in that The first classifier is an extreme learning machine, and the calculating the gap between the third weight of each sample flow and a preset standard weight, and determining the credibility of the third weight based on the gap, includes: The normalized distance between the third weight and the preset standard weight is calculated based on the following formula, and the normalized distance is used as the credibility of the third weight: and wd =exp(-││X i │-│w││); Among them, the y wd represents the credibility, the X i represents the third weight of the i-th sample flow, wherein w represents the preset standard weight; wherein exp(-││X i │-│w││) represents an exponent for calculating the distance between the absolute value of the third weight of the i-th sample flow and the absolute value of the preset standard weight.

9. The method according to claim 7, characterized in that Before inputting a plurality of features of each sample flow in the first training set into the first classifier, the method further includes: Input multiple features of each sample flow in the second training set into the first classifier, process the multiple features of each sample flow through the first classifier, and output the fifth weight of each sample flow; determine the flow type of each sample flow based on the fifth weight of each sample flow; A second loss value is calculated based on the traffic type of each sample flow and the actual traffic type of each sample flow, and the parameters of the first classifier are adjusted with the purpose of reducing the second loss value to a third threshold to obtain a trained first classifier.

10. The method according to claim 7, characterized in that Before inputting a plurality of features of each sample flow in the first training set into the first classifier, the method further includes: For each sample flow in the first training set, perform the following operations: Inputting the several features of each sample flow into a preset tree model, scoring the feature importance of each of the several features through the tree model, and obtaining a score for each feature; Each feature is sorted in descending order of score, and the first n features are obtained from the sorting to obtain multiple features of each sample flow; n is a positive integer greater than 1.

11. A data detection device, characterized in that: include: A first detection module, configured to: input a plurality of features of the flow to be detected into a first classifier, process the plurality of features through the first classifier, and output a first weight of the flow to be detected; A processing module, configured to: calculate a gap between the first weight and a preset standard weight, and determine the credibility of the first weight based on the gap; The first detection module is further configured to: if the credibility is not less than a preset threshold, determine whether the flow to be detected is abnormal flow based on the first weight; A second detection module is used to: if the credibility is less than the preset threshold, input the multiple features into a second classifier, process the multiple features through the second classifier, and output a second weight of the flow to be detected; determine whether the flow to be detected is abnormal flow based on the first weight and the second weight; The first classifier and the second classifier are different classifiers; the first weight and the second weight are used to indicate whether the traffic to be detected is abnormal.

12. A classifier training device, characterized in that: include: A first detection model is used to: input multiple features of each sample flow in the first training set into a first classifier, process the multiple features of each sample flow through the first classifier, and output a third weight of each sample flow; A processing module, configured to: calculate a gap between the third weight of each sample flow and a preset standard weight, and determine the credibility of the third weight based on the gap; A second detection module is used to: obtain at least one sample flow whose credibility of the third weight is less than a preset threshold; Inputting a plurality of features of the at least one sample flow and a true flow type of each sample flow into a second classifier, processing the plurality of features through the second classifier, and outputting a fourth weight of each sample flow; Determine the traffic type of each sample traffic based on the fourth weight of each sample traffic, where the traffic type includes normal traffic and abnormal traffic; An optimization module, used to: calculate the loss value of the flow type of each sample flow and the real flow type of each sample flow, and adjust the parameters of the second classifier with the loss value being less than a second threshold as the goal, to obtain a trained second classifier; The first classifier and the second classifier are different classifiers, and the third weight and the fourth weight are both used to indicate whether each sample flow is abnormal.

13. An electronic device, characterized in that: include: A memory for storing program instructions; A processor is used to call the program instructions stored in the memory, and execute the steps included in the method according to any one of claims 1 to 6 or any one of claims 7 to 10 according to the obtained program instructions.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used for having a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a computer, the method according to any one of claims 1 to 6 or the method according to any one of claims 7 to 10 is implemented.

Images