A data detection method, a classifier training method, and related equipment

Abstract

This application provides a data detection method, a classifier training method, and related equipment, applied in the field of network security technology, to improve the accuracy of detecting abnormal traffic. The method includes inputting multiple features of the traffic to be detected into a first classifier, processing the multiple features through the first classifier, and outputting a first weight of the traffic to be detected; calculating the difference between the first weight and a preset standard weight, and determining the reliability of the first weight based on the difference; if the reliability is not less than a preset threshold, determining whether the traffic to be detected is abnormal traffic based on the first weight; if the reliability is less than the preset threshold, inputting the multiple features into a second classifier, processing the multiple features through the second classifier, and outputting a second weight of the traffic to be detected; and determining whether the traffic to be detected is abnormal traffic based on the first weight and the second weight.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a data detection method, a classifier training method, and related equipment. Background Technology

[0002] With the rapid and comprehensive development of the information industry, the popularization of the Internet and the widespread application of enterprise networks, vulnerabilities and threats in the field of network security are also showing an increasing trend. Traditional firewalls and other convenient protection measures are no longer sufficient to deal with complex internal and external threats and are difficult to accurately detect abnormal traffic in the network, such as malicious traffic.

[0003] Therefore, improving the accuracy of abnormal traffic detection is an urgent problem to be solved. Summary of the Invention

[0004] This application provides a data detection method, a classifier training method, and related equipment to improve the accuracy of detecting abnormal traffic.

[0005] In a first aspect, embodiments of this application provide a data detection method applicable to any electronic device with processing capabilities, the method comprising:

[0006] Multiple features of the traffic to be detected are input into the first classifier. The first classifier processes the multiple features and outputs the first weight of the traffic to be detected.

[0007] Calculate the difference between the first weight and the preset standard weight, and determine the credibility of the first weight based on this difference;

[0008] If the confidence level is not less than the threshold, then the traffic to be detected is determined to be abnormal traffic based on the first weight.

[0009] If the confidence level is less than the threshold, multiple features are input into the second classifier. The second classifier processes the multiple features and outputs the second weight of the traffic to be detected. Based on the first weight and the second weight, it is determined whether the traffic to be detected is abnormal traffic.

[0010] The first classifier and the second classifier are different classifiers; the first weight and the second weight are used to indicate whether the traffic to be detected is abnormal.

[0011] In this scheme, a first classifier processes multiple features of the traffic to be detected to obtain a first weight. The reliability of the first weight is determined based on the difference between this first weight and a preset standard weight. This determines whether the first classifier's processing result for the traffic to be detected is reliable. If the reliability is not less than a preset threshold, the first weight is considered highly reliable, and the detection of abnormal traffic can be directly determined based on this weight, thus improving the efficiency of detecting abnormal traffic. If the reliability is less than the preset threshold, the first weight is considered less reliable. Therefore, to ensure accurate detection of the traffic to be detected, multiple features are input into a second classifier for processing, resulting in a second weight output by the second classifier. Combining the processing results of the two classifiers determines whether the traffic to be detected is abnormal, enabling a more comprehensive identification and analysis of the traffic to be detected, thereby improving the accuracy of detecting abnormal traffic.

[0012] Optionally, the first classifier is an extreme learning machine, which calculates the difference between the first weight and the preset standard weight, and determines the reliability of the first weight based on this difference, including:

[0013] The normalized distance between the first weight and the preset standard weight is calculated based on the following formula, and this normalized distance is used as the confidence level of the first weight:

[0014] y wd =exp(-││X0│-│w││);

[0015] Among them, y wd The confidence level is represented by X0, the first weight of the traffic to be detected, and w, the preset standard weight. exp(-||X0|-|w||) represents the exponent of the distance between the absolute value of the first weight of the traffic to be detected and the absolute value of the preset standard weight.

[0016] Optionally, if the confidence level is not less than a preset threshold, determine whether the traffic to be detected is abnormal traffic based on the first weight, including: in y wd If X0 is not less than 0 when the value is less than the preset threshold, the traffic to be detected is determined to be abnormal traffic. The closer X0 is to the absolute value of w, the greater the degree of abnormality of the traffic to be detected. If X0 is less than 0, the traffic to be detected is determined to be normal traffic.

[0017] Optionally, the second classifier includes multiple sub-classifiers; the second classifier processes multiple features and outputs a second weight for the traffic to be detected, including: identifying and predicting multiple features through each of the multiple sub-classifiers to obtain multiple prediction results for the traffic to be detected; the prediction results include the traffic type of the traffic to be detected, which includes normal traffic and abnormal traffic; based on the multiple prediction results, the number of occurrences of each traffic type is counted, and the second weight is determined based on the traffic type with the largest number of occurrences.

[0018] Determining whether the traffic to be detected is abnormal based on a first weight and a second weight includes: if the first weight is not less than 0 and the second weight is used to indicate that the traffic to be detected is abnormal, then the traffic to be detected is determined to be abnormal; otherwise, the traffic to be detected is determined to be normal.

[0019] Optionally, the second classifier is an extreme learning machine with different parameters than the first classifier; the second classifier processes multiple features and outputs a second weight for the traffic to be detected, including: identifying each feature among the multiple features through the second classifier and predicting the probability of each feature being an abnormal feature and a normal feature; and calculating the probability of each feature by weighting to obtain the second weight.

[0020] Determining whether the traffic to be detected is abnormal based on a first weight and a second weight includes: if the first weight is not less than 0 and the second weight is not less than 0, then the traffic to be detected is determined to be abnormal; otherwise, the traffic to be detected is determined to be normal.

[0021] Optionally, determining whether the traffic to be detected is abnormal traffic based on the first weight and the second weight further includes: if the confidence of the first weight is less than the first threshold, then determining whether the traffic to be detected is abnormal traffic based on the second weight; the first threshold is less than a preset threshold.

[0022] Secondly, embodiments of this application provide a classifier training method that can be applied to any electronic device with processing capabilities, including:

[0023] Multiple features of each sample flow in the first training set are input into the first classifier. The first classifier processes the multiple features of each sample flow and outputs the third weight of each sample flow.

[0024] Calculate the difference between the third weight of each sample flow and the preset standard weight, and determine the confidence level of the third weight based on the difference;

[0025] Obtain at least one sample traffic whose confidence level of the third weight is less than a preset threshold; input multiple features of each sample traffic and the true traffic type of each sample traffic into the second classifier, process the multiple features of each sample traffic through the second classifier and output the fourth weight of each sample traffic; determine the traffic type of each sample traffic based on the fourth weight of each sample traffic, and the traffic type includes normal traffic and abnormal traffic.

[0026] Calculate the first loss value of the traffic type and the true traffic type of each sample traffic. With the goal of the first loss value being less than the second threshold, adjust the parameters of the second classifier to obtain the trained second classifier.

[0027] The first and second classifiers are different classifiers, and the third and fourth weights are used to indicate whether the flow of each sample is abnormal.

[0028] In this scheme, at least one traffic sample whose confidence level is lower than a preset threshold is used as the training sample for the second classifier. This allows the trained second classifier to more accurately identify and predict the traffic to be detected that the first classifier cannot accurately identify, resulting in a more comprehensive identification of the traffic to be detected and thus improving the accuracy of detecting abnormal traffic.

[0029] Optionally, the first classifier is an extreme learning machine, which calculates the difference between the third weight of each sample flow and the preset standard weight, and determines the confidence of the third weight based on this difference, including: calculating the normalized distance between the third weight and the preset standard weight based on the following formula, and using the normalized distance as the confidence of the third weight:

[0030] y wd =exp(-││X) i │-│w││);

[0031] Among them, y wd Indicates credibility, X i Let w represent the third weight of the i-th sample flow, and w represent the preset standard weight; exp(-||X i │-│w││) represents the exponent for calculating the distance between the absolute value of the third weight of the i-th sample flow and the absolute value of the preset standard weight.

[0032] Optionally, before inputting multiple features of each sample traffic in the first training set into the first classifier, the method further includes: inputting multiple features of each sample traffic in the second training set into the first classifier, processing the multiple features of each sample traffic through the first classifier, and outputting a fifth weight for each sample traffic; determining the traffic type of each sample traffic based on the fifth weight of each sample traffic; calculating a second loss value based on the traffic type of each sample traffic and the true type of each sample traffic, and adjusting the parameters of the first classifier with the aim of the second loss value being less than a third threshold, to obtain a trained first classifier.

[0033] Optionally, before inputting multiple features of each sample flow in the first training set into the first classifier, the method further includes: for each sample flow in the first training set, performing the following operations: inputting several features of each sample flow into a preset tree model, scoring the feature importance of each feature among the several features through the tree model to obtain a score for each feature; sorting each feature in descending order of score, and obtaining the top n features from the sorting to obtain multiple features for each sample flow; n is a positive integer greater than 1.

[0034] Thirdly, embodiments of this application provide a data detection device, including:

[0035] The first detection module is used to: input multiple features of the traffic to be detected into the first classifier, process the multiple features through the first classifier, and output the first weight of the traffic to be detected;

[0036] The processing module is used to: calculate the difference between the first weight and the preset standard weight, and determine the credibility of the first weight based on the difference;

[0037] The first detection module is also used to: if the confidence level is not less than the threshold, determine whether the traffic to be detected is abnormal traffic based on the first weight;

[0038] The second detection module is used to: if the confidence level is less than the threshold, input multiple features into the second classifier, process the multiple features through the second classifier, and output the second weight of the traffic to be detected; and determine whether the traffic to be detected is abnormal traffic based on the first weight and the second weight.

[0039] The first classifier and the second classifier are different classifiers; the first weight and the second weight are used to indicate whether the traffic to be detected is abnormal.

[0040] Optionally, the first classifier is an extreme learning machine. When the processing module calculates the difference between the first weight and the preset standard weight, and determines the reliability of the first weight based on this difference, it is specifically used for:

[0041] The normalized distance between the first weight and the preset standard weight is calculated based on the following formula, and this normalized distance is used as the confidence level of the first weight:

[0042] y wd =exp(-││X0│-│w││);

[0043] Among them, y wd The confidence level is represented by X0, the first weight of the traffic to be detected, and w, the preset standard weight. exp(-||X0|-|w||) represents the exponent of the distance between the absolute value of the first weight of the traffic to be detected and the absolute value of the preset standard weight.

[0044] Optionally, when the first detection module determines whether the traffic to be detected is abnormal traffic based on a first weight if the confidence level is not less than a preset threshold, it is specifically used to: [The text abruptly ends here, likely due to an incomplete sentence or missing information.] wd If X0 is not less than 0 when the value is less than the preset threshold, the traffic to be detected is determined to be abnormal traffic. The closer X0 is to the absolute value of w, the greater the degree of abnormality of the traffic to be detected. If X0 is less than 0, the traffic to be detected is determined to be normal traffic.

[0045] Optionally, the second classifier includes multiple sub-classifiers; when the second detection module processes multiple features through the second classifier and outputs the second weight of the traffic to be detected, it is specifically used to: identify and predict multiple features through each of the multiple sub-classifiers to obtain multiple prediction results of the traffic to be detected by the multiple sub-classifiers; the prediction results include the traffic type of the traffic to be detected, and the traffic type includes normal traffic and abnormal traffic; count the number of occurrences of each traffic type based on the multiple prediction results, and determine the second weight based on the traffic type with the largest number of occurrences;

[0046] When determining whether the traffic to be detected is abnormal traffic based on the first weight and the second weight, the second detection module is specifically used as follows: if the first weight is not less than 0 and the second weight is used to indicate that the traffic to be detected is abnormal traffic, then the traffic to be detected is determined to be abnormal traffic; otherwise, the traffic to be detected is determined to be normal traffic.

[0047] Optionally, the second classifier is an extreme learning machine with different parameters than the first classifier; when the second detection module processes multiple features through the second classifier and outputs the second weight of the traffic to be detected, it is specifically used to: identify each feature among the multiple features through the second classifier and predict the probability of each feature being an abnormal feature and a normal feature; and calculate the probability of each feature by weighting to obtain the second weight.

[0048] When determining whether the traffic to be detected is abnormal traffic based on the first weight and the second weight, the second detection module is specifically used as follows: if the first weight is not less than 0 and the second weight is not less than 0, then the traffic to be detected is determined to be abnormal traffic; otherwise, the traffic to be detected is determined to be normal traffic.

[0049] Optionally, when determining whether the traffic to be detected is abnormal traffic based on the first weight and the second weight, the second detection module is further configured to: if the confidence of the first weight is less than the first threshold, then determine whether the traffic to be detected is abnormal traffic based on the second weight; the first threshold is less than a preset threshold.

[0050] Fourthly, embodiments of this application provide a classifier training apparatus, comprising:

[0051] The first detection module is used to: input multiple features of each sample flow in the first training set into the first classifier, process the multiple features of each sample flow through the first classifier, and output the third weight of each sample flow.

[0052] The processing module is used to: calculate the difference between the third weight of each sample flow and the preset standard weight, and determine the confidence level of the third weight based on the difference;

[0053] The second detection module is used to: obtain at least one sample traffic whose confidence level of the third weight is less than a preset threshold; input multiple features of each sample traffic and the true traffic type of each sample traffic into the second classifier; process the multiple features of each sample traffic through the second classifier and output the fourth weight of each sample traffic; determine the traffic type of each sample traffic based on the fourth weight of each sample traffic, and the traffic type includes normal traffic and abnormal traffic.

[0054] The optimization module is used to: calculate the first loss value for the traffic type and the true traffic type of each sample traffic flow; adjust the parameters of the second classifier with the goal of the first loss value being less than a second threshold, and obtain a trained second classifier.

[0055] The first and second classifiers are different classifiers, and the third and fourth weights are used to indicate whether the flow of each sample is abnormal.

[0056] Optionally, the first classifier is an extreme learning machine. When the processing module calculates the difference between the third weight and the preset standard weight for each sample flow and determines the confidence of the third weight based on this difference, it specifically calculates the normalized distance between the third weight and the preset standard weight based on the following formula, and uses this normalized distance as the confidence of the third weight:

[0057] y wd =exp(-││X) i │-│w││);

[0058] Among them, y wd Indicates credibility, X i Let w represent the third weight of the i-th sample flow, and w represent the preset standard weight; exp(-||X i │-│w││) represents the exponent for calculating the distance between the absolute value of the third weight of the i-th sample flow and the absolute value of the preset standard weight.

[0059] Optionally, before inputting multiple features of each sample traffic in the first training set into the first classifier, the first detection module is further configured to: input multiple features of each sample traffic in the second training set into the first classifier, process the multiple features of each sample traffic through the first classifier, and output a fifth weight for each sample traffic; determine the traffic type of each sample traffic based on the fifth weight of each sample traffic; calculate a second loss value based on the traffic type of each sample traffic and the true type of each sample traffic, and adjust the parameters of the first classifier with the aim of the second loss value being less than a third threshold, to obtain a trained first classifier.

[0060] Optionally, before inputting multiple features of each sample flow in the first training set into the first classifier, the first detection module is further configured to: for each sample flow in the first training set, perform the following operations: input several features of each sample flow into a preset tree model, score the feature importance of each feature among the several features through the tree model, and obtain a score for each feature; sort each feature in descending order of score, and obtain the top n features from the sorting to obtain multiple features for each sample flow; n is a positive integer greater than 1.

[0061] Fifthly, embodiments of this application provide an electronic device including at least one processor, which, when executing a computer program stored in a memory, causes a method as described in the first aspect or any optional embodiment of the first aspect, or a method as described in the second aspect or any optional embodiment of the second aspect, to be implemented.

[0062] In a sixth aspect, embodiments of this application provide a computer-readable storage medium for storing instructions that, when executed, cause a method as described in the first aspect or any optional implementation of the first aspect, or a method as described in the second aspect or any optional implementation of the second aspect, to be implemented.

[0063] In a seventh aspect, embodiments of this application provide a computer program product, including computer program code, which, when executed on a computer, causes the method as described in the first aspect or any optional implementation of the first aspect, or the method as described in the second aspect or any optional implementation of the second aspect, to be implemented.

[0064] The technical effects or advantages of one or more technical solutions provided in the third, fourth, fifth, sixth and seventh aspects of this application can all be explained by the corresponding technical effects or advantages of one or more technical solutions provided in the first or second aspect. Attached Figure Description

[0065] Figure 1A flowchart of a data detection method provided in an embodiment of this application;

[0066] Figure 2 Example diagram of test results with different preset thresholds provided for embodiments of this application;

[0067] Figure 3 An example diagram illustrating experimental results of a combination of RF classifier and ELM classifier provided in this application embodiment;

[0068] Figure 4 An example diagram illustrating experimental results with different numbers of classifiers, provided for embodiments of this application;

[0069] Figure 5 A structural diagram of a data detection device provided in an embodiment of this application;

[0070] Figure 6 A structural diagram of a classifier training device provided in an embodiment of this application;

[0071] Figure 7 This is a structural diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0072] The data collection, dissemination, and use in this application all comply with relevant national laws and regulations.

[0073] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0074] The technical solution of this application will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments of this application and the specific features in the embodiments are detailed descriptions of the technical solution of this application, rather than limitations on the technical solution of this application. In the absence of conflict, the embodiments of this application and the technical features in the embodiments can be combined with each other.

[0075] It should be understood that "multiple" in the description of the embodiments of this application refers to two or more. "First," "second," etc., in the embodiments of this application are used to distinguish different objects, not to describe a specific order. The term "and / or" in the embodiments of this application is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Furthermore, the term "comprising" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices. In the embodiments of this application, a module refers to a part of a software system that has independent functionality.

[0076] For ease of understanding, the following is an introduction to some of the technical terms used in the embodiments of this application:

[0077] 1. An Intrusion Detection System (IDS) is a security technology used to monitor unauthorized activities or abnormal behaviors in a network or system. It monitors and analyzes network traffic, system logs, audit data, etc., to detect and respond to various attack attempts, attack behaviors, or attack results.

[0078] 2. Extreme Learning Machine (ELM) is a fast, single-layer feedforward neural network used to solve classification and regression problems. It is suitable for both supervised and unsupervised learning. It typically consists of three layers: an input layer, hidden layers, and an output layer. The connections between each layer are established through a feature mapping function. During training, the weights and biases of the hidden layers are usually randomly generated or manually assigned and do not need to be updated. Training is completed simply by calculating the weights of the output layer. The learning process is relatively simple, the learning speed is fast, and the generalization ability is strong.

[0079] 3. Random Forest (RF) is a commonly used machine learning algorithm, belonging to the ensemble learning method. It constructs multiple decision trees for classification or regression prediction, with each decision tree trained on randomly selected datasets and features. Random Forest uses a technique called "bagging," employing random bootstrapping (sampling with replacement) to build each decision tree. This randomness ensures low correlation between trees, thus reducing the risk of overfitting. Ultimately, the output of Random Forest is the average of the predictions from all decision trees or the majority vote result.

[0080] In today's highly digitalized and hyper-connected era, the impact of cyberattacks has permeated every aspect of our daily lives, posing security risks to everything from financial networks and critical infrastructure to healthcare systems and government agencies. Furthermore, cybersecurity vulnerabilities and threats have shown a significant upward trend over time, with attacks becoming increasingly faster and more impactful. Faced with the rapid and comprehensive development of the information technology industry, the widespread adoption of the internet, and the extensive use of enterprise networks, cyberattacks are frequent, and traditional perimeter protection measures such as firewalls are no longer sufficient to cope with complex internal and external threats. Therefore, Intrusion Detection Systems (IDS) have emerged as a proactive security protection mechanism.

[0081] The primary function of IDS (Intrusion Detection System) is to monitor and analyze network traffic and system activity to identify potential malicious behavior or policy violations. The development and application of IDS rely on several key technologies, including but not limited to network protocol analysis, feature matching, anomaly detection, statistical analysis, machine learning, behavioral analysis, real-time response, log analysis, protocol fuzzing, and honeypot technology. With the development and improvement of these technologies, IDS can effectively detect and respond to various types of network attacks, protecting network and system security. Machine learning-based IDS methods mainly focus on two directions: feature optimization and model improvement. Specifically, methods such as feature grouping and feature generation amplify the differences between normal and abnormal traffic to discover features that are difficult to detect between them. However, in scenarios requiring rapid detection, complex technical features can lead to excessively long feature computation times, thus affecting detection speed. Increasing the number of model layers and classifiers can improve model performance, but it ignores the importance of features as the basis for classification, and excessive use of deep learning models results in poor model interpretability and difficulty in in-depth analysis.

[0082] In view of this, this application proposes an embodiment in which multiple features of the traffic to be detected are input into a first classifier to obtain a first weight of the traffic to be detected. The difference between the first weight and a preset standard weight is calculated, and the credibility of the first weight is determined based on the difference. If the credibility is not less than a preset threshold, it means that the prediction result of the first classifier of the traffic to be detected is credible. Then, the traffic to be detected is directly determined as abnormal based on the first weight, which can improve the efficiency of detecting abnormal traffic. If the credibility is less than the preset threshold, it means that the prediction result of the first classifier of the traffic to be detected is unreliable. Then, multiple features are input into a second classifier to obtain a second weight. The first weight and the second weight are combined to determine whether the traffic to be detected is abnormal, so as to more comprehensively identify and analyze the traffic to be detected, thereby improving the accuracy of detecting abnormal traffic.

[0083] The data detection method provided in this application can be applied to any scenario for detecting abnormal traffic, including but not limited to the detection of traffic for malicious behavior.

[0084] See Figure 1 This is a flowchart of a data detection method provided in an embodiment of this application. This method can be applied to any electronic device with processing capabilities, such as a virtual machine, tablet, or computer. The method includes steps S101 to S103:

[0085] S101. Input multiple features of the traffic to be detected into the first classifier, process the multiple features through the first classifier, and output the first weight of the traffic to be detected.

[0086] The first weight is used to indicate whether the traffic to be detected is abnormal.

[0087] For example, the multiple features mainly include multiple statistical features of the traffic to be detected, such as packet size, number of packets, maximum value of packets, time interval of packets, average transmission rate of messages, etc.; the multiple features may also include behavioral features and content features of the traffic to be detected, etc., which can be selected according to actual needs, and this application embodiment does not limit this.

[0088] In one possible example, the first classifier is a pre-trained Extreme Learning Machine (ELM). The specific implementation of processing multiple features using the first classifier to output the first weight of the traffic to be detected is as follows:

[0089] The ELM classifier identifies each feature among multiple features of the traffic to be detected and predicts the probability that each feature is an anomalous feature or a normal feature.

[0090] The first weight is obtained by weighting the probability of each feature.

[0091] For example, the output of the ELM classifier can be in the form of [-m, m], where m is a positive number; where -m represents the probability that the traffic to be detected is normal traffic, and m represents the probability that the traffic to be detected is abnormal traffic. m can be used as the first weight of the traffic to be detected to indicate the probability that the traffic to be detected is abnormal traffic and the degree of abnormality of the traffic to be detected; or m represents the probability that the traffic to be detected is normal traffic, and -m represents the probability that the traffic to be detected is abnormal traffic, and -m is used as the first weight of the traffic to be detected.

[0092] In this embodiment, -m represents the probability that the traffic to be detected is normal traffic, and m represents the probability that the traffic to be detected is abnormal traffic.

[0093] S102. Calculate the difference between the first weight and the preset standard weight, and determine the credibility of the first weight based on the difference.

[0094] In one possible embodiment, step S102 is implemented as follows:

[0095] The normalized distance between the first weight and the preset standard weight is calculated based on the following formula, and this normalized distance is used as the confidence level of the first weight:

[0096] y wd =exp(-││X0│-│w││);

[0097] Among them, y wd The confidence level is represented by X0, the first weight of the traffic to be detected, and w, the preset standard weight. exp(-||X0|-|w||) represents the exponent of the distance between the absolute value of the first weight of the traffic to be detected and the absolute value of the preset standard weight.

[0098] For example, the preset standard weight can be [-1, 1], where -1 represents normal traffic and 1 represents abnormal traffic; or 1 represents normal traffic and -1 represents abnormal traffic. In practical applications, the specific value of the preset standard weight can also be selected according to actual needs. In this embodiment, the standard weight is only taken as -1 representing normal traffic and 1 representing abnormal traffic, and the value range of X0 is between -1 and 1.

[0099] It can be understood that the further the absolute value of X0 is from 1 (i.e., the absolute value of the standard weights), the better. wd The closer X0 is to 0, the less accurately ELM can classify the traffic to be detected. This means the reliability of the first weight obtained by ELM in identifying and predicting the traffic is low, and misclassification may occur. The closer the absolute value of X0 is to 1 (i.e., the absolute value of the standard weight), the better. wd As the value approaches 1, ELM can classify the traffic to be detected more accurately, meaning that the reliability of the first weight obtained by ELM in identifying and predicting the traffic to be detected is higher.

[0100] Therefore, based on the obtained confidence level, a method for determining whether the traffic to be detected is abnormal traffic can be further selected. Specifically, for the two cases where the confidence level is not less than a preset threshold and less than a preset threshold, the embodiments of this application will be described in detail below through steps S103-1 and S103-2 respectively.

[0101] S103-1. If the confidence level is not less than the preset threshold, then determine whether the traffic to be detected is abnormal traffic based on the first weight.

[0102] It is understandable that if the confidence level is not less than the preset threshold, it means that the first weight obtained by the first classifier in identifying and predicting the traffic to be detected is reliable and the classification accuracy is high. Therefore, it is possible to directly determine whether the traffic to be detected is abnormal traffic based on the first weight, so as to improve the efficiency of detecting abnormal traffic.

[0103] Specifically, the method for determining whether the traffic to be detected is abnormal traffic based on the first weight is as follows:

[0104] In y wd If X0 is not less than 0 when the value is less than the preset threshold, the traffic to be detected is determined to be abnormal traffic. The closer X0 is to the absolute value of w, the greater the degree of abnormality of the traffic to be detected. If X0 is less than 0, the traffic to be detected is determined to be normal traffic.

[0105] It is understandable that, according to the above step S102, a standard weight of -1 represents normal traffic and 1 represents abnormal traffic. Taking the value range of X0 between -1 and 1 as an example, in this case, if X0 is not less than 0, the traffic to be detected is determined to be abnormal traffic. The closer X0 is to 1, the closer the first classifier determines that the traffic to be detected is to the standard abnormal traffic, that is, the greater the degree of abnormality of the traffic to be detected. Similarly, if X0 is less than 0, the traffic to be detected is determined to be normal traffic. The closer X0 is to -1, the closer the first classifier determines that the traffic to be detected is to the standard normal traffic, and the smaller the degree of abnormality of the traffic to be detected.

[0106] The above example, where a standard weight of -1 represents normal traffic and 1 represents abnormal traffic, is just one possible example of determining whether the traffic to be detected is abnormal based on whether X0 is greater than 0. In practice, the corresponding judgment conditions of X0 can be set according to the selected standard weight value.

[0107] S103-2. If the confidence level is less than the preset threshold, multiple features are input into the second classifier. The second classifier processes the multiple features and outputs the second weight of the traffic to be detected. Based on the first weight and the second weight, it is determined whether the traffic to be detected is abnormal traffic.

[0108] It is understandable that if the credibility is less than the preset threshold, it means that the first weight obtained by the first classifier in identifying and predicting the traffic to be detected is unreliable, the classification accuracy is low, and further detection of the traffic to be detected is required. The second classifier is a pre-trained classifier.

[0109] The second weight is also used to indicate whether the traffic to be detected is abnormal. The first classifier and the second classifier are different classifiers. The first classifier and the second classifier can be integrated into one model or they can be in two different models. The model where the first classifier is located can call the model where the second classifier is located.

[0110] It is understood that the first classifier and the second classifier are different. They can be classifiers of different types, or they can be classifiers of the same type but with different parameters. For these two situations, this application's embodiments illustrate two implementation methods of step S103-2 through the following Embodiment 1 and Embodiment 2:

[0111] In Example 1, the first classifier and the second classifier are classifiers of different types.

[0112] Specifically, the second classifier includes multiple sub-classifiers; the specific implementation methods for processing multiple features through the second classifier and outputting the second weights of the traffic to be detected include:

[0113] Multiple features are identified and predicted by each of the multiple sub-classifiers, resulting in multiple prediction results for the traffic to be detected. The prediction results include the traffic type of the traffic to be detected, which includes normal traffic and abnormal traffic.

[0114] The number of occurrences of each traffic type is counted based on multiple prediction results, and the second weight is determined based on the traffic type with the highest number of occurrences.

[0115] Determining whether the traffic to be detected is abnormal based on a first weight and a second weight includes: if the first weight is not less than 0 and the second weight is used to indicate that the traffic to be detected is abnormal, then the traffic to be detected is determined to be abnormal; otherwise, the traffic to be detected is determined to be normal.

[0116] For example, the second classifier can be an RF classifier, which includes multiple decision trees (i.e. multiple sub-classifiers). Each decision tree processes each of the multiple features and obtains a prediction result for each feature. Through a voting decision method, the traffic types among the multiple prediction results are counted, and the traffic type with the largest number of occurrences is taken as the prediction result of the second classifier. The traffic type or the numerical identifier of the traffic type (i.e., the second weight) is output.

[0117] Other binary classifiers can also be used as the second classifier, and this application does not limit this.

[0118] It is understandable that, since the second classifier and the first classifier are different types of classifiers, before inputting multiple features of the traffic to be detected into the second classifier, it is necessary to re-extract the features of the traffic to be detected or perform data transformation on the multiple features so that the input features can be recognized and processed by the second classifier.

[0119] Example 2: The first classifier and the second classifier are classifiers of the same type but with different parameters. The first classifier is the Extreme Learning Machine exemplified in the above examples.

[0120] Specifically, the second classifier is an extreme learning machine with different parameters than the first classifier; the specific implementation method of processing multiple features through the second classifier and outputting the second weight of the traffic to be detected includes:

[0121] The second classifier identifies each feature among multiple features and predicts the probability that each feature is an anomalous feature or a normal feature; the probability of each feature is calculated by weighting to obtain the second weight.

[0122] Determining whether the traffic to be detected is abnormal based on a first weight and a second weight includes: if the first weight is not less than 0 and the second weight is not less than 0, then the traffic to be detected is determined to be abnormal; otherwise, the traffic to be detected is determined to be normal.

[0123] The above embodiments one and two are merely possible examples, and are not actually limited to these.

[0124] It is understandable that when determining whether the traffic to be detected is abnormal, considering both the first and second weights, i.e. the prediction results of the first classifier and the prediction results of the second classifier, can more comprehensively detect abnormalities in the traffic to be detected and improve the accuracy of abnormality detection.

[0125] However, the reliability of the first weight calculated according to the above embodiments may be extremely low, making the first weight unreliable. To avoid misjudgment due to the first weight, the method for determining whether the traffic to be detected is abnormal traffic based on the first weight and the second weight may further include:

[0126] If the confidence level of the first weight is less than the first threshold, then the traffic to be detected is determined to be abnormal based on the second weight.

[0127] The first threshold is less than a preset threshold. The first threshold can be selected based on actual needs. This avoids further steps to improve the accuracy of anomaly detection.

[0128] In this scheme, a first classifier processes multiple features of the traffic to be detected to obtain a first weight. The reliability of the first weight is determined based on the difference between this first weight and a preset standard weight. This determines whether the first classifier's processing result for the traffic to be detected is reliable. If the reliability is not less than a preset threshold, the first weight is considered highly reliable, and the detection of abnormal traffic can be directly determined based on this weight, thus improving the efficiency of detecting abnormal traffic. If the reliability is less than the preset threshold, the first weight is considered less reliable. Therefore, to ensure accurate detection of the traffic to be detected, multiple features are input into a second classifier for processing, resulting in a second weight output by the second classifier. Combining the processing results of the two classifiers determines whether the traffic to be detected is abnormal, enabling a more comprehensive identification and analysis of the traffic to be detected, thereby improving the accuracy of detecting abnormal traffic.

[0129] In one possible design, this application embodiment also provides a classifier training method, which includes steps S201 to S204:

[0130] S201. Input multiple features of each sample flow in the first training set into the first classifier. The first classifier processes the multiple features of each sample flow and outputs the third weight of each sample flow.

[0131] In one possible embodiment, before inputting multiple features of each sample flow in the first training set into the first classifier, the method further includes:

[0132] For each sample traffic in the first training set, perform the following operation:

[0133] Several features of each sample flow are input into a pre-defined tree model. The tree model scores the feature importance of each feature to obtain a score for each feature.

[0134] Sort each feature in descending order of score, and extract the top n features from the sort to obtain multiple features for each sample flow; n is a positive integer greater than 1.

[0135] For example, the preset tree model can be a limit tree or a random forest. Based on the tree model, the feature importance of each feature is scored, that is, the contribution of each feature to the prediction result of abnormal traffic, the frequency of occurrence, and other factors are scored, and the top n features with the highest scores are obtained. This can achieve the filtering of several features for each sample traffic, reduce feature dimensionality, and be based on features that are easier to identify and classify.

[0136] The value of n can be chosen according to the actual situation. For example, starting from the first feature in the sorting, features are added one by one (i.e., the number of features is gradually increased) to train the first classifier. The accuracy of the first classifier under different n values ​​is analyzed, and the n value with the highest accuracy (or the actual requirement) is obtained.

[0137] S202. Calculate the difference between the third weight of each sample flow and the preset standard weight, and determine the credibility of the third weight based on the difference.

[0138] For example, the first classifier is an extreme learning machine. It calculates the difference between the third weight of each sample flow and a preset standard weight, and determines the confidence level of the third weight based on this difference. This includes: calculating the normalized distance between the third weight and the preset standard weight based on the following formula, and using this normalized distance as the confidence level of the third weight:

[0139] y wd =exp(-││X) i │-│w││);

[0140] Among them, y wd Indicates credibility, X i Let w represent the third weight of the i-th sample flow, and w represent the preset standard weight; exp(-||X i │-│w││) represents the exponent for calculating the distance between the absolute value of the third weight of the i-th sample flow and the absolute value of the preset standard weight.

[0141] S203. Obtain at least one sample traffic whose confidence level of the third weight is less than a preset threshold; input multiple features of each sample traffic and the true traffic type of each sample traffic into the second classifier, process the multiple features of each sample traffic through the second classifier and output the fourth weight of each sample traffic; determine the traffic type of each sample traffic based on the fourth weight of each sample traffic, and the traffic type includes normal traffic and abnormal traffic.

[0142] It is understandable that both the third and fourth weights are used to indicate whether each sample traffic is abnormal. If the confidence level of the third weight is less than the preset threshold, it means that the first classifier cannot accurately classify at least one sample traffic. Therefore, a second classifier is needed to learn about at least one sample traffic, so that the subsequent combination of the first and second classifiers can more comprehensively identify each traffic and improve the accuracy of detecting abnormal traffic.

[0143] Similarly, the first classifier and the second classifier are different classifiers. For the two cases where the first classifier and the second classifier are of different types, and where the first classifier and the second classifier are of the same type but with different parameters, the specific implementation of step S203 will be described in detail below through Examples 3 and 4:

[0144] Example 3: The first classifier and the second classifier are different types of classifiers.

[0145] Specifically, the second classifier includes multiple sub-classifiers. These second classifiers process multiple features of each sample flow and output a fourth weight for each sample flow, including:

[0146] Multiple features of each sample traffic are identified and predicted by each of the multiple sub-classifiers, resulting in multiple prediction results for each sample traffic. The prediction results include the traffic type of each sample traffic. The number of occurrences of each traffic type is counted based on the multiple prediction results of each sample traffic, and the fourth weight of each sample traffic is determined based on the traffic type with the largest number of occurrences.

[0147] The traffic type for each sample traffic is determined based on the fourth weight of each sample traffic. The traffic type includes normal traffic and abnormal traffic, including:

[0148] The traffic type that appears most frequently corresponding to the fourth weight of each sample traffic is the traffic type of each sample traffic.

[0149] It is understandable that, since the second classifier is a different type of classifier from the first classifier, before inputting multiple features of at least one sample flow into the second classifier, it is necessary to re-extract the features of at least one sample flow so that the features can be recognized and processed by the second classifier.

[0150] Optionally, after extracting features of at least one sample flow, the same method as in the embodiment of step S201 above can be used to sort and filter the features of at least one sample flow by importance.

[0151] Example 4: The first classifier and the second classifier are classifiers of the same type but with different parameters.

[0152] Specifically, the second classifier is an extreme learning machine with different parameters than the first classifier; the second classifier processes multiple features of each sample flow and outputs a fourth weight for each sample flow, including:

[0153] The second classifier identifies each feature among multiple features of each sample traffic and predicts the probability that each feature of each sample traffic is an abnormal feature or a normal feature; the probability of each feature of each sample traffic is weighted to obtain the fourth weight of each sample traffic.

[0154] The traffic type for each sample traffic is determined based on the fourth weight of each sample traffic. The traffic type includes normal traffic and abnormal traffic, including:

[0155] For each sample flow, if the fourth weight is not less than 0, the sample flow is determined to be abnormal flow; if the fourth weight is less than 0, the sample flow is determined to be normal flow.

[0156] It is understood that the specific implementation of determining the traffic type of each sample traffic based on the fourth weight is the same as the method of determining whether the traffic to be detected is abnormal traffic based on the first weight in step S102 above, and will not be repeated here in the embodiments of this application.

[0157] The above embodiments three and four are merely possible examples, and are not actually limited to these.

[0158] In one possible design, the preset threshold can be selected according to actual needs. An example of selecting a preset threshold is provided in this application embodiment:

[0159] It is understandable that the number of samples that need to be input into the second classifier is affected by a preset threshold. Theoretically, the larger the preset threshold, the more samples that need to be input into the second classifier, and the higher the accuracy of anomaly detection. To verify the relationship between the preset threshold and the accuracy of anomaly detection and to determine the preset threshold value that yields the highest anomaly detection accuracy, this application embodiment sets two different experimental combinations based on the corresponding datasets CSE-CIC-IDS2018 (IDS2018) and NF-UQ-NIDS-v2 (NIDS) for testing. The F1 scores of the classification models (including the first and second classifiers) under nine thresholds were compared, and this score is used to indicate the accuracy of the classification model (i.e., the accuracy of anomaly detection). The test results for the preset threshold α are as follows: Figure 2 As shown in Table 1 below.

[0160] Table 1 Test results for different preset thresholds

[0161]

[0162] Here, Ave indicates the average score of the classification model for the two datasets at the same threshold α. The intermediate values ​​(e.g., 0.91, 0.93, etc.) represent the scores of the classification model for each dataset at different thresholds α. Based on the results, the classification model score increases with increasing α, reaching its maximum when α = 0.9. This is because a larger threshold α includes more samples with low confidence in the first classifier's classification, thus enabling better feature selection. Therefore, based on the test results, a threshold α of 0.9 can be chosen.

[0163] Similarly, as the threshold α increases, the computational cost also increases. In practical applications, the specific value of the preset threshold can be selected according to requirements such as cost and accuracy.

[0164] S204. Calculate the first loss value of the traffic type and the true traffic type of each sample traffic. With the goal of the first loss value being less than the second threshold, adjust the parameters of the second classifier to obtain the trained second classifier.

[0165] It is understood that the method for calculating the loss value can be selected according to actual needs, and the second threshold can also be set according to actual needs. This application embodiment does not limit this.

[0166] In one possible example, the first classifier needs to be trained before the second classifier can be trained. The specific method for training the first classifier is as follows:

[0167] Multiple features of each sample traffic in the second training set are input into the first classifier. The first classifier processes the multiple features of each sample traffic and outputs the fifth weight of each sample traffic. The traffic type of each sample traffic is determined based on the fifth weight of each sample traffic.

[0168] The second loss value is calculated based on the traffic type and the true type of each sample traffic. The parameters of the first classifier are adjusted so that the second loss value is less than the third threshold, and the trained first classifier is obtained.

[0169] Therefore, training the first classifier first, and then training the second classifier based on the trained first classifier, can improve the training effect of the second classifier.

[0170] It is understood that the method for calculating the second loss value and the third threshold can be selected according to actual needs, and the embodiments of this application do not impose any restrictions on this.

[0171] Optionally, before inputting multiple features of each sample flow in the second training set into the first classifier, the same method as in the embodiment of step S201 can be used to sort and filter the features of each sample flow by importance to improve the training efficiency and accuracy of the first classifier.

[0172] In all the above embodiments, the first classifier selected is the ELM classifier. In practical applications, other classifiers can also be selected as the first classifier.

[0173] In one optional embodiment, the first classifier may also be an RF classifier or other classifiers, and the confidence level of the first classifier and the preset threshold are set according to the specific classifier.

[0174] For example, if the first classifier is an RF classifier, then the multiple features are identified and predicted according to each of the multiple decision trees in the RF classifier, resulting in multiple prediction results. The information entropy is calculated based on the multiple prediction results, and this information entropy is used as the credibility of the first classifier. The preset threshold corresponding to the information entropy is tested using the method described above for testing the preset threshold corresponding to the normalized distance.

[0175] Optionally, a combination of the first and second classifiers can be selected based on the specific application scenario and dataset. See [link to relevant documentation]. Figure 3 Table 2 below provides experimental examples of abnormal traffic detection based on different combinations of RF classifier and ELM classifier provided in this application.

[0176] Table 2. Examples of experimental results for the combination of RF classifier and ELM classifier.

[0177]

[0178] In the table, the numbers in the middle (e.g., 0.96, 0.93, etc.) represent the scores (i.e., anomaly detection accuracy) of each combination trained on different datasets; ER indicates that the first classifier is an ELM classifier and the second classifier is an RF classifier; RE indicates that the first classifier is an RF classifier and the second classifier is an ELM classifier; EE indicates that both the first and second classifiers are ELM classifiers, but with different parameters; RR indicates that both the first and second classifiers are RF classifiers, but with different parameters.

[0179] Based on the experimental results above, it can be concluded that when training on the IDS2018 and NIDS datasets, the ER combination yields the best results. The ELM classifier combined with normalized weighted distance is more suitable for filtering samples with low classification confidence; the RF classifier is more suitable for binary traffic classification (i.e., identifying normal and abnormal traffic). Therefore, using different types of classifiers improves the accuracy and robustness of abnormal traffic detection in IDS scenarios. This application only provides some possible combination examples; in practical applications, the combination and type of classifiers can be selected according to actual needs.

[0180] Optionally, this embodiment employs two classifiers. In practical applications, other numbers of classifiers can be combined as needed, such as a single classifier or three classifiers. Theoretically, more classifiers result in more detailed feature recognition, but this can also be affected by the concentration of features. See also Figure 4 Table 3 and the accompanying table provide experimental examples of the relationship between the number of different classifiers and the accuracy of detecting abnormal traffic in the embodiments of this application.

[0181] Table 3. Examples of experimental results with different numbers of classifiers.

[0182]

[0183] The results above show that using two classifiers significantly improves the score (i.e., the accuracy of detecting abnormal traffic) compared to using one classifier. However, the score does not continue to improve as the number of classifiers increases. This is understandable, as the number of traffic items requiring multiple detections decreases with the increase in the number of classifiers, without further improving classification performance. In fact, it may lead to overfitting due to over-screening. Therefore, when training on the IDS2018 and NIDS datasets, using two classifiers yields better anomaly detection results. In practical applications, the number of classifiers can be selected based on actual needs.

[0184] It is understood that the methods in the above embodiments can be used individually or in combination, and the embodiments of this application do not limit this. Furthermore, the above embodiments are merely some best examples provided in this application, and are not actually limited thereto.

[0185] The methods provided in the embodiments of this application have been described above. The apparatus provided in the embodiments of this application will be described below.

[0186] Based on the same technical concept, embodiments of this application provide a data detection device, which includes a module / unit / means for performing the method executed by the electronic device in the above-described method embodiments. This module / unit / means can be implemented in software, or in hardware, or implemented by hardware executing corresponding software.

[0187] For example, see Figure 5 The device 500 includes:

[0188] The first detection module 501 is used to: input multiple features of the traffic to be detected into the first classifier, process the multiple features through the first classifier, and output the first weight of the traffic to be detected;

[0189] Processing module 502 is used to: calculate the difference between the first weight and the preset standard weight, and determine the credibility of the first weight based on the difference;

[0190] The first detection module 501 is also used to: if the confidence level is not less than the threshold, determine whether the traffic to be detected is abnormal traffic based on the first weight;

[0191] The second detection module 503 is used to: if the confidence level is less than the threshold, input multiple features into the second classifier, process the multiple features through the second classifier, and output the second weight of the traffic to be detected; and determine whether the traffic to be detected is abnormal traffic based on the first weight and the second weight.

[0192] The first classifier and the second classifier are different classifiers; the first weight and the second weight are used to indicate whether the traffic to be detected is abnormal.

[0193] It should be understood that all relevant content of each step involved in the above data detection method embodiment can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0194] Based on the same technical concept, embodiments of this application provide a classifier training apparatus, which includes a module / unit / means for executing the method performed by the electronic device in the above-described method embodiments. This module / unit / means can be implemented in software, or in hardware, or implemented by hardware executing corresponding software.

[0195] For example, see Figure 6 The device 600 includes:

[0196] The first detection module 601 is used to: input multiple features of each sample flow in the first training set into the first classifier, process the multiple features of each sample flow through the first classifier, and output the third weight of each sample flow.

[0197] The processing module 602 is used to: calculate the difference between the third weight of each sample flow and the preset standard weight, and determine the confidence of the third weight based on the difference;

[0198] The second detection module 603 is used to: obtain at least one sample flow whose third weight is less than a preset threshold; input multiple features of each sample flow and the real flow type of each sample flow into the second classifier; and process the multiple features of each sample flow through the second classifier to output the fourth weight of each sample flow.

[0199] The optimization module 604 is used to: determine the traffic type of each sample traffic based on the fourth weight of each sample traffic, the traffic type includes normal traffic and abnormal traffic; calculate the first loss value of the traffic type and the true traffic type of each sample traffic, and adjust the parameters of the second classifier with the goal of the first loss value being less than the second threshold, so as to obtain the trained second classifier.

[0200] It should be understood that all relevant content of each step involved in the above-described classifier training method embodiment can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0201] Based on the same technical concept, see [link / reference] Figure 7 This application also provides an electronic device 700, comprising:

[0202] At least one processor 701; and a communication interface 703 communicatively connected to the at least one processor 701; the at least one processor 701 causes the electronic device 700 to execute the method steps performed by the Kanban in the above method embodiment through the communication interface 703 by executing instructions stored in the memory 702.

[0203] Optionally, the memory 702 is located outside the electronic device 700.

[0204] Optionally, the electronic device 700 includes a memory 702 connected to the at least one processor 701, and the memory 702 has instructions executable by the at least one processor 701. (See attached image) Figure 7 The dashed line indicates that the memory 702 is optional for the electronic device 700.

[0205] The at least one processor 701 and the memory 702 can be coupled through an interface circuit or integrated together, which is not limited here.

[0206] This application embodiment does not limit the specific connection medium between at least one processor 701, memory 702, and communication interface 703. This application embodiment... Figure 7At least one processor 701, memory 702, and communication interface 703 are connected via a bus 704, and the bus is in Figure 7 The connections between other components are shown in bold and are for illustrative purposes only, not as limiting information. This bus section can be an address bus, data bus, control bus, etc. For ease of illustration, Figure 7 It is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0207] It should be understood that the processor mentioned in the embodiments of this application can be implemented in hardware or software. When implemented in hardware, the processor can be a logic circuit, integrated circuit, etc. When implemented in software, the processor can be a general-purpose processor, implemented by reading software code stored in memory.

[0208] For example, the processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc.

[0209] It should be understood that the memory mentioned in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), which acts as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate Synchronous DRAM (DDR SDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchlink DRAM (SLDRAM), and Direct RAM (DR RAM).

[0210] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA, or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, the memory (storage module) can be integrated into the processor.

[0211] It should be noted that the memories described herein are intended to include, but are not limited to, these and any other suitable types of memories.

[0212] Based on the same technical concept, embodiments of this application also provide a computer-readable storage medium for storing instructions that, when executed, cause a computer to perform the method steps performed by any of the devices in the above method embodiments.

[0213] Based on the same technical concept, this application also provides a computer program product, including computer program code, which, when the computer program code is run on a computer, causes the method steps executed by any device in the above method embodiments to be implemented.

[0214] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0215] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0216] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0217] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0218] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A data detection method, characterized in that, include: Multiple features of the traffic to be detected are input into the first classifier, and the first classifier processes the multiple features to output the first weight of the traffic to be detected. Calculate the difference between the first weight and the preset standard weight, and determine the credibility of the first weight based on the difference; If the confidence level is not less than a preset threshold, then it is determined whether the traffic to be detected is abnormal traffic based on the first weight; If the confidence level is less than the preset threshold, the multiple features are input into the second classifier, the multiple features are processed by the second classifier, and the second weight of the traffic to be detected is output; based on the first weight and the second weight, it is determined whether the traffic to be detected is abnormal traffic; The first classifier and the second classifier are different classifiers; the first weight and the second weight are used to indicate whether the traffic to be detected is abnormal.

2. The method as described in claim 1, characterized in that, The first classifier is an extreme learning machine. The step of calculating the difference between the first weight and a preset standard weight, and determining the reliability of the first weight based on the difference, includes: The normalized distance between the first weight and the preset standard weight is calculated based on the following formula, and the normalized distance is used as the confidence level of the first weight: and wd =exp(-││X0│-│w││); Wherein, y wd The confidence level is represented by X0, which represents the first weight of the traffic to be detected, and w represents the preset standard weight; exp(-||X0|-|w||) represents the exponent for calculating the distance between the absolute value of the first weight of the traffic to be detected and the absolute value of the preset standard weight.

3. The method as described in claim 2, characterized in that, If the confidence level is not less than a preset threshold, then determining whether the traffic to be detected is abnormal traffic based on the first weight includes: In the y wd If X0 is not less than 0 and is not less than the preset threshold, then the traffic to be detected is determined to be abnormal traffic, and the closer X0 is to the absolute value of w, the greater the degree of abnormality of the traffic to be detected; if X0 is less than 0, then the traffic to be detected is determined to be normal traffic.

4. The method as described in claim 2, characterized in that, The second classifier includes multiple sub-classifiers; the step of processing the multiple features through the second classifier to output the second weight of the traffic to be detected includes: The multiple features are identified and predicted by each of the multiple sub-classifiers to obtain multiple prediction results for the traffic to be detected; the prediction results include the traffic type of the traffic to be detected, and the traffic type includes normal traffic and abnormal traffic; Based on the multiple prediction results, the number of occurrences of each traffic type is counted, and the second weight is determined based on the traffic type with the largest number of occurrences. The step of determining whether the traffic to be detected is abnormal traffic based on the first weight and the second weight includes: If the first weight is not less than 0, and the second weight is used to indicate that the traffic to be detected is abnormal traffic, then the traffic to be detected is determined to be abnormal traffic; otherwise, the traffic to be detected is determined to be normal traffic.

5. The method as described in claim 2, characterized in that, The second classifier is an extreme learning machine with parameters different from those of the first classifier; the step of processing the multiple features through the second classifier and outputting the second weight of the traffic to be detected includes: The second classifier identifies each of the plurality of features and predicts the probability that each feature is an anomalous feature or a normal feature; the probability of each feature is weighted to obtain the second weight. The step of determining whether the traffic to be detected is abnormal traffic based on the first weight and the second weight includes: if the first weight is not less than 0 and the second weight is not less than 0, then the traffic to be detected is determined to be abnormal traffic; otherwise, the traffic to be detected is determined to be normal traffic.

6. The method as described in claim 1, characterized in that, The step of determining whether the traffic to be detected is abnormal traffic based on the first weight and the second weight includes: If the confidence level of the first weight is less than the first threshold, then the detection traffic is determined to be abnormal based on the second weight; the first threshold is less than the preset threshold.

7. A classifier training method, characterized in that, include: Multiple features of each sample traffic in the first training set are input into the first classifier. The first classifier processes the multiple features of each sample traffic and outputs the third weight of each sample traffic. Calculate the difference between the third weight of each sample flow and the preset standard weight, and determine the credibility of the third weight based on the difference; Obtain at least one sample flow whose confidence level of the third weight is less than a preset threshold; The multiple features of each sample traffic in the at least one sample traffic and the true traffic type of each sample traffic are input into the second classifier. The second classifier processes the multiple features of each sample traffic and outputs the fourth weight of each sample traffic. The traffic type of each sample traffic is determined based on the fourth weight of each sample traffic, and the traffic type includes normal traffic and abnormal traffic; Calculate the first loss value of the traffic type and the true traffic type of each sample traffic, and adjust the parameters of the second classifier with the goal of the first loss value being less than a second threshold to obtain the trained second classifier; The first classifier and the second classifier are different classifiers, and the third weight and the fourth weight are both used to indicate whether the flow of each sample is abnormal.

8. The method as described in claim 7, characterized in that, The first classifier is an extreme learning machine. The step of calculating the difference between the third weight of each sample flow and a preset standard weight, and determining the reliability of the third weight based on the difference, includes: The normalized distance between the third weight and the preset standard weight is calculated based on the following formula, and the normalized distance is used as the confidence level of the third weight: and wd =exp(-││X i │-│w││); Wherein, y wd Indicates the credibility, the X i The third weight represents the flow rate of the i-th sample, and w represents the preset standard weight; the exp(-||X) i │-│w││) represents the exponent for calculating the distance between the absolute value of the third weight of the i-th sample flow and the absolute value of the preset standard weight.

9. The method as described in claim 7, characterized in that, Before inputting multiple features of each sample flow in the first training set into the first classifier, the method further includes: Multiple features of each sample traffic in the second training set are input into the first classifier. The first classifier processes the multiple features of each sample traffic and outputs the fifth weight of each sample traffic. The traffic type of each sample traffic is determined based on the fifth weight of each sample traffic. A second loss value is calculated based on the traffic type and the actual traffic type of each sample traffic. The parameters of the first classifier are adjusted so that the second loss value is less than a third threshold, and a trained first classifier is obtained.

10. The method as described in claim 7, characterized in that, Before inputting multiple features of each sample flow in the first training set into the first classifier, the method further includes: For each sample traffic in the first training set, perform the following operation: Several features of each sample flow are input into a preset tree model. The tree model scores the feature importance of each feature to obtain a score for each feature. Each feature is sorted in descending order of score, and the top n features are obtained from the sorting to obtain multiple features for each sample flow; where n is a positive integer greater than 1.

11. A data detection device, characterized in that, include: The first detection module is used to: input multiple features of the traffic to be detected into a first classifier, process the multiple features through the first classifier, and output the first weight of the traffic to be detected; The processing module is used to: calculate the difference between the first weight and the preset standard weight, and determine the credibility of the first weight based on the difference; The first detection module is further configured to: if the confidence level is not less than a preset threshold, determine whether the traffic to be detected is abnormal traffic based on the first weight; The second detection module is used to: if the confidence level is less than the preset threshold, input the multiple features into the second classifier, process the multiple features through the second classifier, and output the second weight of the traffic to be detected; and determine whether the traffic to be detected is abnormal traffic based on the first weight and the second weight. The first classifier and the second classifier are different classifiers; the first weight and the second weight are used to indicate whether the traffic to be detected is abnormal.

12. A classifier training device, characterized in that, include: The first detection model is used to: input multiple features of each sample traffic in the first training set into the first classifier, process the multiple features of each sample traffic through the first classifier, and output the third weight of each sample traffic. The processing module is used to: calculate the difference between the third weight of each sample flow and the preset standard weight, and determine the credibility of the third weight based on the difference; The second detection module is used to: obtain at least one sample flow whose confidence level of the third weight is less than a preset threshold; The multiple features of the at least one sample traffic and the true traffic type of each sample traffic are input into the second classifier. The second classifier processes the multiple features and outputs the fourth weight of each sample traffic. The traffic type of each sample traffic is determined based on the fourth weight of each sample traffic, and the traffic type includes normal traffic and abnormal traffic; The optimization module is used to: calculate the loss value of the traffic type and the true traffic type of each sample traffic, and adjust the parameters of the second classifier with the goal of the loss value being less than a second threshold, so as to obtain a trained second classifier; The first classifier and the second classifier are different classifiers, and the third weight and the fourth weight are both used to indicate whether the flow of each sample is abnormal.

13. An electronic device, characterized in that, include: Memory, used to store program instructions; A processor is configured to invoke program instructions stored in the memory and execute the steps included in the method as described in any one of claims 1-6 or the method as described in any one of claims 7-10, according to the obtained program instructions.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium is configured to have a computer program, the computer program including program instructions that, when executed by a computer, cause the method as described in any one of claims 1-6 or the method as described in any one of claims 7-10 to be implemented.

Images