Feature extraction method and system for multi-source heterogeneous traffic fusion

Abstract

The invention provides a feature extraction method for multi-source heterogeneous traffic fusion, and the method comprises the steps: obtaining multi-source heterogeneous traffic, and carrying out the dimension reduction processing; mapping the multi-source heterogeneous traffic and the dimensionality-reduced features into nodes of a heterogeneous graph, and constructing connecting edges between the nodes and the corresponding traffic; respectively aggregating nodes in the heterogeneous graph by utilizing a multi-layer attention mechanism to realize representation of a flow-level feature vector, and completing flow identity association by utilizing a multi-layer perceptron; a multi-source heterogeneous traffic personalized feature extraction model is constructed based on a depth map auto-encoder, and personalized feature extraction of traffic is completed by using a heterogeneous map based on the model. According to the invention, efficient extraction of multi-level and multi-dimensional personalized features in a multi-source heterogeneous network environment is realized, and the accuracy of service identification detection is improved.

Description

Technical Field

[0001] The present invention relates to the field of traffic data processing, and in particular to a feature extraction method and system for multi-source heterogeneous traffic fusion. Background Art

[0002] As the scale and complexity of the Internet continue to increase, Internet traffic has different standards for collection, processing, storage, and exchange due to the different services, protocols, and system technology architectures involved. The traffic is multi-source and heterogeneous. These multi-source heterogeneous traffic generally has the characteristics of high-dimensional, dispersed, and unclear features, resulting in low traffic value density, which hinders traffic characterization, aggregation association, and personalized feature extraction, and brings difficulties to the identification of Internet services and assets and business detection. Therefore, it is necessary to reduce the dimension of multi-source heterogeneous traffic, form low-dimensional traffic data that can be fused, extract personalized features, and obtain high-value information in the traffic.

[0003] Multi-source heterogeneous traffic fusion refers to the process of reducing the dimension, characterizing, aggregating, and correlating traffic collected from multiple sources. Multi-source heterogeneous traffic fusion is of great significance for reducing the dimension of traffic features and improving the accuracy of traffic category identification. Compared with the single source traffic, the feature characterization obtained by multi-source heterogeneous traffic fusion is more accurate and reliable. The key issues to be solved in the process of traffic fusion are the diversity, uncertainty, noise of traffic and the correlation analysis between traffic. There are related studies at home and abroad: the research includes traffic fusion models based on JDL, calculation, and DS evidence theory. The JDL model includes perception traffic preprocessing, entity state perception prediction, relationship inference and prediction, action impact assessment, and improved perception process. Due to the low value density of multi-source heterogeneous high-dimensional traffic, it is difficult to characterize, aggregate, and associate traffic processing, and the current processing solution has a low recognition and detection accuracy. Summary of the invention

[0004] In view of the problems existing in the prior art, a feature extraction method and system for multi-source heterogeneous traffic fusion are provided. A multi-source heterogeneous personalized feature extraction model is constructed based on a feature characterization method based on heterogeneous graphs, a feature aggregation method based on a multi-layer attention mechanism, and a traffic identity association method based on a multi-layer perceptron. The difficulties in multi-source heterogeneous traffic characterization, aggregation, association and personalized feature extraction are solved, which is beneficial to the establishment of key fingerprint libraries of industry information networks, key business identification and multi-source heterogeneous network threat traffic detection.

[0005] The first aspect of the present invention proposes a feature extraction method for multi-source heterogeneous traffic fusion, comprising:

[0006] Obtain multi-source heterogeneous traffic and perform dimensionality reduction processing;

[0007] Map multi-source heterogeneous traffic and reduced-dimensional features into nodes of a heterogeneous graph, and construct edges between nodes and corresponding traffic;

[0008] A multi-layer attention mechanism is used to aggregate nodes in heterogeneous graphs to represent flow-level feature vectors, and a multi-layer perceptron is used to complete flow identity association.

[0009] A personalized feature extraction model for multi-source heterogeneous traffic is constructed based on the deep graph autoencoder, and the personalized feature extraction of traffic is completed based on the heterogeneous graph.

[0010] As a preferred solution, the dimensionality reduction process is implemented by kernel principal component analysis, supervised multi-dimensional scaling, isometric mapping or local linear embedding.

[0011] As a preferred solution, the multi-source heterogeneous traffic and the reduced-dimensional features are mapped into nodes of a heterogeneous graph, and edges between the nodes and the corresponding traffic are constructed, specifically including:

[0012] Feature extraction is performed on multi-source heterogeneous traffic attribute information, traffic generation content, and traffic relationship information, and they are represented in the form of nodes and vectors in a heterogeneous graph and potential feature space; among which, the node types in the heterogeneous graph include traffic nodes, traffic attribute information nodes, traffic generation content nodes, traffic relationship information nodes, behavior category nodes, feature nodes, and relationship embedding nodes.

[0013] As a preferred solution, the representation in the form of nodes and vectors in a heterogeneous graph and a potential feature space specifically includes:

[0014] Feature extraction for traffic attribute information and traffic generation content: directly construct traffic attribute information of simple dimensions as feature nodes in the heterogeneous graph; extract traffic generation content features and construct feature nodes in the heterogeneous graph in the form of nodes; at the same time, record the sequence information of features that exist in a certain order;

[0015] Feature extraction for traffic relationship information: Extract the features of each traffic relationship information, build relationship embedding nodes in the heterogeneous graph, and represent the features as vectors in the latent space;

[0016] Node vectorization representation: In a heterogeneous graph, given any node except the relation embedding node, the node in the latent feature space is represented using the Glorot normal distribution and randomly initialized.

[0017] As a preferred solution, the multi-layer attention mechanism is used to aggregate the nodes in the heterogeneous graph respectively, specifically including:

[0018] Using a multi-layer attention mechanism consisting of a behavior category-level attention layer, a behavior expression-level attention layer, and a flow-level attention layer, feature nodes, behavior category nodes, relationship embedding nodes, flow attribute information nodes, flow generation content nodes, and flow relationship information nodes are aggregated in the latent space to perform a fusion representation of flow nodes; the embedding vectors of feature nodes and relationship embedding nodes are used as the input of the attention layer; behavior category nodes, flow attribute information nodes, flow generation content nodes, and flow relationship information nodes are used to calculate attention weights.

[0019] As a preferred solution, when performing fusion representation, feature aggregation is performed in the order of behavior category level attention layer, behavior expression level attention layer, and flow level attention layer from micro to macro.

[0020] As a preferred solution, the method of extracting personalized features of traffic based on a lightweight loss-compensated depth map autoencoder specifically includes:

[0021] Collect multi-source heterogeneous raw data, perform data preprocessing on the collected raw data, and generate heterogeneous graphs;

[0022] The processed heterogeneous graph is input into the deep autoencoder for dimensionality reduction and feature extraction, and the coding loss is compensated at each coding layer;

[0023] The encoded situation assessment factor feature information is passed to the decoder for decoding and restoration, and then the difference between the restored graph data and the original graph data is evaluated by minimizing the MSE loss function to train the feature extraction model;

[0024] The trained feature extraction model is used to extract features from heterogeneous graphs.

[0025] As a preferred solution, the processed heterogeneous graph is input into a deep autoencoder for dimensionality reduction and feature extraction, and the coding loss is compensated at each coding layer, specifically including:

[0026] After the i-th encoding layer of the deep autoencoder encodes the input data of this layer, preliminary output data is obtained;

[0027] Using the decoding layer to restore the preliminary output data to obtain restored data;

[0028] Calculate the loss value of restored data and input data;

[0029] The loss value is compensated back to the preliminary output data to obtain the final output data of the i-th encoding layer.

[0030] As a preferred solution, when the preliminary output data is restored by using the decoding layer, the decoding layer corresponding to the encoding layer is selected for restoration.

[0031] A second aspect of the present invention proposes a system, including a memory and a processor, wherein the memory stores a computer program corresponding to the feature extraction method for multi-source heterogeneous traffic fusion as described in the first aspect and can be loaded by the processor to execute.

[0032] Compared with the prior art, the beneficial effects of adopting the above technical scheme are as follows: the present invention reduces the dimensionality of high-dimensional data features, represents, fuses and associates high-dimensional feature data based on heterogeneous graphs, multi-layer attention mechanisms, multi-layer perceptrons, loss-compensated deep graph autoencoders and other technologies, and finally constructs a multi-source heterogeneous traffic personalized feature extraction model, thereby realizing efficient extraction of multi-level and multi-dimensional personalized features in a multi-source heterogeneous network environment, and improving the accuracy of business identification and detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 Schematic diagram of feature extraction in multi-source heterogeneous traffic fusion in one embodiment of the present invention.

[0034] Figure 2 This is a flow chart of feature extraction in multi-source heterogeneous traffic fusion in one embodiment of the present invention.

[0035] Figure 3 Schematic diagram of the dimensionality reduction process in one embodiment of the present invention.

[0036] Figure 4 Schematic diagram of a heterogeneous graph in one embodiment of the present invention.

[0037] Figure 5 Schematic diagram of feature representation based on node vectorization in one embodiment of the present invention.

[0038] Figure 6 Schematic diagram of traffic feature aggregation based on a multi-layer attention mechanism in one embodiment of the present invention.

[0039] Figure 7 Schematic diagram of personalized feature extraction in one embodiment of the present invention.

[0040] Figure 8 FIG. 1 is a schematic diagram of a depth map autoencoder according to an embodiment of the present invention. DETAILED DESCRIPTION

[0041] Embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar modules or modules with the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be construed as limitations on the present application. On the contrary, the embodiments of the present application include all changes, modifications and equivalents that fall within the spirit and connotation of the appended claims.

[0042] like Figure 1 As shown in the figure, the feature extraction technology of multi-source heterogeneous traffic fusion is based on multiple optimization rules, including dimensionality reduction, characterization, aggregation, association and other processing. Based on feature fusion, personalized features are extracted for specific business applications. Feature fusion can effectively reduce the sample size and improve the processing speed of the system. The feature extraction technology of multi-source heterogeneous traffic fusion first mines low-dimensional feature representations of complex high-dimensional data based on multiple dimensionality reduction methods for subsequent feature characterization processing. Feature characterization is based on heterogeneous graph processing. Heterogeneous graph is a special graph structure containing multiple types of nodes and multiple types of edges. In view of the problems such as the weak single-modal characterization ability of traffic attribute information, traffic generation content, and traffic relationship information, it is proposed to represent the features of different traffic attribute information, traffic generation content, traffic relationship information and their dimensionality reduction in heterogeneous graphs respectively. Secondly, in view of the problem that the potential relationship between traffic attribute information, traffic generation content, and traffic relationship information is often ignored, a feature aggregation method based on a multi-layer attention mechanism is proposed. The self-attention mechanism is used to obtain the weights of different traffic type features, and the multi-layer attention mechanism is used to realize the multi-layer aggregation of traffic features such as behavior category level and behavior expression level. Based on the multi-layer aggregation of features, a traffic association model is constructed based on the multi-layer perception mechanism to achieve comprehensive association of information traffic.

[0043] In view of the low value density of multi-source heterogeneous high-dimensional traffic, which leads to difficulties in traffic processing characterization, aggregation, and association, and low accuracy of business identification and detection, the embodiment of the present invention proposes a feature extraction method for multi-source heterogeneous traffic fusion, which combines the feature characterization method based on heterogeneous graphs, the feature aggregation method based on multi-layer attention mechanism, and the traffic identity association method based on multi-layer perceptron to construct a multi-source heterogeneous personalized feature extraction model, which solves the difficulties in multi-source heterogeneous traffic characterization, aggregation, association, and personalized feature extraction, and is beneficial to the establishment of key fingerprint libraries for industry information networks, key business identification, and multi-source heterogeneous network threat traffic detection. The specific scheme is as follows:

[0044] Step 1: Obtain multi-source heterogeneous traffic and perform dimensionality reduction processing.

[0045] At present, multi-source heterogeneous traffic, such as network encrypted traffic, digital images, videos, logs, traffic libraries, etc., usually has high-dimensional information. Before fusing such high-dimensional traffic, it is usually necessary to reduce its dimensionality, that is, convert the high-dimensional traffic into meaningful low-dimensional traffic. Ideally, the low-dimensional representation of the mapped traffic should have a dimension called the intrinsic dimension of the traffic. The intrinsic dimension of the traffic is the minimum dimension used to consider the properties of the observed traffic. Dimensionality reduction is conducive to the classification, compression and visualization of high-dimensional traffic.

[0046] Please refer to Figure 3,In this embodiment, dimension reduction methods including kernel principal component analysis method, ,supervised multidimensional scaling method, isometric mapping method, and local linear embedding method are ,provided.

[0047] Specifically, kernel principal component analysis uses kernel functions to extend traditional linear principal component analysis to different dimensional spaces. The calculation result is the kernel matrix instead of the principal eigenvectors of the covariance matrix. Since the kernel matrix is ​​similar to the data points constructed in high-dimensional space using kernel functions, the kernel space has the characteristics of nonlinear mapping. By using commonly used kernel functions (including linear kernels, polynomial kernels and Gaussian kernels), high-dimensional data can be successfully mapped to low-dimensional data.

[0048] The supervised multidimensional scaling algorithm maps high-dimensional data to low-dimensional space through a series of nonlinear mapping techniques, and tries to maintain the distance between data pairs. The quality of the mapping is usually expressed as a function, that is, the error function between two distance pairs in the low-dimensional space and the high-dimensional space. There are two important types of stress functions for supervised multidimensional scaling matrices: the original stress function and the Sammon cost function.

[0049] The isometric mapping algorithm calculates the data point x by constructing a neighborhood graph G i In the data set X, each data point x i The shortest path between two points in the graph G is a good estimate of the corresponding geodesic distance. Therefore, the geodesic distance between all data points in the data set can be calculated by the Dijkstra algorithm or the Floyd shortest algorithm to form a pair of geodesic distance matrices. The resulting matrix is ​​then used to calculate the representation y of the data points in the low-dimensional space. i . This enables high-dimensional data to be mapped into low-dimensional data.

[0050] The local linear embedding method is a local feature dimensionality reduction technique that requires the construction of a graph representing the data points. The local linear embedding method describes the data point x i The local features of the surrounding manifold, this process transforms the data point x i Write it as k adjacent points x ij The linear combination w i That is, the reconstruction weight. A hyperplane is fitted through the data point and the nearest adjacent point. Therefore, the local linear embedding method is applicable to data manifolds with local linear features. The local linear feature linear assumption means that the data point x i The reconstruction weight of is invariant to transformations such as translation, rotation, and rescaling. Therefore, after the data is linearly mapped to a low-dimensional space using the hyperplane, the corresponding reconstruction weight will also be preserved in the low-dimensional space. In other words, if the low-dimensional representation of the data can preserve the local geometric features of the corresponding manifold, then in the high-dimensional space, the data point x can be reconstructed using adjacent points.i The reconstruction weight w i , in low-dimensional space, the corresponding data point y can still be reconstructed using adjacent points i .

[0051] Step 2: Map the multi-source heterogeneous traffic and the reduced-dimensional features into nodes of the heterogeneous graph, and construct edges between the nodes and the corresponding traffic.

[0052] In order to solve the problem of weak single-modal characterization capabilities of traffic attribute information, traffic generation content, and traffic relationship information, in this embodiment, feature extraction is performed on the traffic attribute information, traffic generation content, and traffic relationship information in multi-source heterogeneous traffic. Since the traffic manifestation forms of the traffic attribute information, traffic generation content, and traffic relationship information are heterogeneous, a heterogeneous graph can be used to describe the relevant features.

[0053] A heterogeneous graph is a special graph structure. Compared with a traditional graph, a heterogeneous graph contains multiple types of nodes and multiple types of edges. Since the graph structure has a strong ability to express relationships, in this embodiment, the traffic attribute information, traffic generation content, traffic relationship information and extracted features from different network sources are represented in the heterogeneous graph, and the edges between these nodes and traffic are constructed.

[0054] In practical applications, please refer to Figure 4 , by mapping the features extracted from traffic attribute information, traffic generation content, and traffic relationship information into feature nodes in the heterogeneous graph, and mapping the feature nodes in the heterogeneous graph to the same feature space, the feature normalization representation is realized to support the subsequent feature fusion and traffic identity association operations. Combined with the subdivision structure of traffic attribute information, traffic generation content, and traffic relationship information, the node types in the heterogeneous graph can be divided into traffic nodes, traffic attribute information nodes, traffic generation content nodes, traffic relationship information nodes, behavior category nodes, feature nodes, and relationship embedding nodes. Among them, traffic attribute information nodes, traffic generation content nodes, and traffic relationship information nodes are abstract concept nodes, which are used to calculate the attention weight of features in the feature characterization process; specific feature nodes and behavior category nodes corresponding to traffic relationship information are dynamically constructed after feature extraction.

[0055] Based on the definition of heterogeneous graph, feature extraction is performed on traffic attribute information, traffic generation content, and traffic relationship information, and represented in the heterogeneous graph and potential feature space in the form of nodes and vectors to support subsequent feature aggregation and traffic identity association operations. Figure 5 In this embodiment, the feature extraction is divided into three processes: feature extraction for traffic attribute information and traffic generation content, feature extraction for traffic relationship information, and node vectorization representation:

[0056] (1) Feature extraction of traffic attribute information and traffic generation content

[0057] For simple dimensional traffic attribute information, such as device name, IP address, etc., it can be directly constructed as a feature node in the heterogeneous graph. The traffic generation content can reflect the working field of the traffic, the service object, etc. The extracted features are constructed as nodes in the heterogeneous graph, and the sequence information is recorded for the features with a sequence.

[0058] (2) Feature extraction for traffic relationship information

[0059] Traffic relationship information usually contains multiple types, such as predecessor relationship, cooperation relationship, blacklist relationship, etc. Using the network embedding method, the features of each type of traffic relationship information are extracted respectively, the relationship embedding nodes are constructed in the heterogeneous graph, and the features are represented by vectors in the latent space.

[0060] (3) Node vectorization representation

[0061] In a heterogeneous graph, given any node except the relation embedding node, the node in the latent feature space is represented using Glorot normal distribution and randomly initialized.

[0062] By vectorizing the feature nodes and placing them in the same latent feature space as the relationship embedding nodes, subsequent feature aggregation and capturing internal correlations between features are facilitated. Abstract concept nodes such as traffic attribute information nodes, traffic generation content nodes, traffic relationship information nodes, and behavior category nodes corresponding to traffic attribute information and traffic generation content are vectorized for calculation of the attention weights of the abstractly represented behaviors in the subsequent fusion process. In each round of training for subsequent traffic identity association, the embedding vectors of the nodes in the latent space are dynamically updated.

[0063] Step 3: Use the multi-layer attention mechanism to aggregate the nodes in the heterogeneous graph to represent the flow-level feature vector, and use the multi-layer perceptron to complete the flow identity association.

[0064] In order to solve the problem that the potential relationship between volume attribute information, traffic generation content, and traffic relationship information is often overlooked, this embodiment is inspired by the self-attention mechanism to capture the internal correlation between features. This embodiment adopts a feature aggregation method based on a multi-layer attention mechanism, uses the self-attention mechanism to learn the internal correlation between traffic attribute information, traffic generation content, and traffic relationship information, and uses the multi-layer attention mechanism to aggregate multiple features step by step. Please refer to Figure 6 , the specific process is as follows:

[0065] First, the attention layer structure is introduced based on heterogeneous graphs;

[0066] Secondly, multiple attention layer structures such as behavior category level attention layer, behavior expression level attention layer, and flow level attention layer are used to aggregate feature nodes, behavior category nodes, relationship embedding nodes, flow attribute information nodes, flow generation content nodes, and flow relationship information nodes in the latent space respectively, to achieve the aggregation of flow nodes and complete the expression of flow-level feature vectors.

[0067] When performing feature aggregation, in this embodiment, feature aggregation is performed from micro to macro in the order of behavior category level attention layer, behavior expression level attention layer, and flow level attention layer.

[0068] It should be noted that in the heterogeneous graph, only the embedding vectors of feature nodes and relationship embedding nodes are used as the input of the attention layer, and the embedding vectors of other types of nodes are used to calculate the attention coefficient.

[0069] Based on completing the traffic feature representation based on the heterogeneous graph and completing the feature aggregation based on the multi-layer attention mechanism, in this embodiment, a multi-layer perceptron is also used to realize traffic identity association.

[0070] Specifically, given two networks g s and g t Two user nodes v i and v j , let h i and h j Respectively represent the node v i and v j First, in order to improve the training speed and avoid gradient disappearance, BatchNormalization is used to train h i and h j Perform normalization.

[0071] The input of the multilayer perceptron is x = [h i '||hj'], where || is the concatenation function, then the l-th layer neural network is defined as:

[0072] y l (x) = ReLU(W l ·y l-1 (x)+b l )

[0073] Use the neural network to output a one-dimensional vector y∈(0,1) as the probabilistic user identity association result:

[0074] y ij =σ(W·y l (x)+b),

[0075] The user identity association loss function is:

[0076]

[0077] In practical applications, the Keras framework can be used to integrate the traffic behavior feature extraction and representation based on heterogeneous graphs, feature aggregation based on multi-layer attention mechanism, and traffic identity association process based on multi-layer perceptron.

[0078] Step 4: Build a personalized feature extraction model for multi-source heterogeneous traffic based on the deep graph autoencoder, and use the heterogeneous graph based on this model to complete the personalized feature extraction of traffic.

[0079] Please refer to Figure 7 , the personalized feature extraction of traffic based on lightweight loss-compensated deep map autoencoder includes:

[0080] (1) Collecting heterogeneous raw data from multiple sources, preprocessing the collected raw data, and generating a heterogeneous graph;

[0081] (2) The processed heterogeneous graph is input into the deep autoencoder for dimensionality reduction and feature extraction, and the coding loss is compensated at each coding layer;

[0082] (3) The encoded situation assessment factor feature information is passed to the decoder for decoding and restoration, and then the difference between the restored image data and the original image data is evaluated by minimizing the MSE loss function to train the feature extraction model;

[0083] (4) Use the trained feature extraction model to extract features from heterogeneous graphs.

[0084] In the process of personalized feature removal, the deep autoencoder can effectively process multi-feature, high-dimensional nonlinear data, extract effective information from the current multi-source heterogeneous and high-dimensional data, and has great advantages in the realization of personalized feature evaluation and extraction. The working process of the deep autoencoder is as follows:

[0085] Assume that the heterogeneous graph is represented as G = (V, E), where V represents the node set, E represents the edge set; A represents the adjacency matrix; D represents the degree matrix; N represents the number of nodes; d represents the feature dimension of the node; X represents the feature matrix of the node; f represents the embedding dimension; and Z represents the embedding of the node. The graph autoencoder (GAE) uses a graph convolutional neural network (GCN) as the encoder, and the formula of its process is as follows:

[0086] Z=GCN(X,A)

[0087] Consider GCN as a function, and then input X and A into this function to obtain the output Z, where Z represents the potential representation of all nodes. The specific representation of the GCN function is as follows:

[0088]

[0089] in, w0 and w1 are the parameters to be learned. GAE uses the inner product as the decoder to reconstruct the original graph, as shown in the formula:

[0090]

[0091] in, is the reconstructed adjacency matrix. During the training process, GAE uses cross entropy as the loss function:

[0092]

[0093] Where y represents the value of an element in the adjacency matrix A (0 or 1), Represents the reconstructed adjacency matrix The value of the corresponding element in (between 0 and 1). From the loss function, we can see that we hope that the reconstructed adjacency matrix is ​​as close and similar to the original adjacency matrix as possible.

[0094] Although the deep graph autoencoder DAE has a good effect in extracting personalized features, as the number of network layers of the deep graph autoencoder increases, the deep graph autoencoder also has the common problem of other deep neural network models, that is, the deeper the neural network model, the more feature information of the data is lost in the neural network. There are a lot of nonlinear changes in the deep neural network model, and each change will lose some original information of the feature, resulting in more serious information loss with deeper layers. This shows that in the process of feature extraction, the nonlinear changes between layers will lead to the loss of some personalized feature evaluation extraction information. In order to effectively extract personalized features, improve the performance of personalized feature evaluation, and reduce the loss of evaluation feature information between layers of the deep autoencoder, please refer to Figure 8 In this embodiment, a lightweight loss-compensated depth map autoencoder is proposed, which compensates for the coding loss by adding a loss compensation module to each coding layer of the depth map autoencoder. In the loss compensation module, the decoder is first used to restore the data after encoding the current layer, and then the feature information loss value obtained by comparing the restored data with the data before encoding is encoded again, and finally the obtained loss value is compensated to the corresponding coding layer output data. The loss compensation process is further described below:

[0095] Assume that the i-th encoding layer of the loss compensation module is represented as encoderi , the corresponding decoding layer is represented as encoder n-i+1 , M i Represents the dimension of the corresponding i layer, n represents the total number of encoder layers, dec represents the difference operation, and the specific process of the loss compensation mechanism is divided into the following four stages.

[0096] In the first stage, the encoding of the i-th layer of the deep autoencoder. When the i-1-th layer output data enters the i-th layer encoding layer, the dimension is M. i Output data Its expression is shown in the formula:

[0097]

[0098] The second stage is data decoding and restoration. In order to obtain the loss of the encoded data during the encoding process, the output data of the i-th encoding layer must first be Use the corresponding decoding layer to restore and obtain the output data with the same dimension as the i-1th encoding layer. i Represents the data restored by the i-th encoding layer, and the data dimension is the same as Equal, M i-1 Represents the data dimension of the i-1th coding layer. Its expression is shown in the formula:

[0099]

[0100] In the third stage, the loss value is obtained. In order to obtain the loss in the personalized feature extraction process of the coding layer, the present invention considers some existing loss function calculation methods. Since the loss obtained here needs to be compensated back to the corresponding coding layer, it needs to be as intuitive as possible. The L1 loss function is a method of solving the loss using absolute error, that is, performing difference operations on the data and calculating the absolute value. Compared with other loss functions, this method can directly reflect the loss of threat feature information between layers. Therefore, the L1 loss function calculates the loss of threat feature information. Since the loss difference between coding layers allows the existence of negative values, if the L1 loss function is used alone, the original negative data information will be lost. Therefore, the input data of the i-th coding layer is used. With decX i Difference is performed, and the i-th encoding layer is used to encode the data after the difference operation to obtain the corresponding loss value lossX i , whose expression is as follows:

[0101]

[0102] The fourth stage is loss compensation. At this time, the corresponding loss value lossX of the i-th coding layer in the encoding process is iCompensate back to the output data of the i-th encoding layer The compensation method here refers to the residual neural network, using the addition method, and its expression is shown in the formula:

[0103]

[0104] It should be noted that in order to ensure that the decoded data is as accurate as possible, the corresponding decoding layer in the encoding layer is used for decoding and restoration, that is, the decoder in the formula n-i+1 Corresponding to the n-i+1th decoding layer. If an initialized decoding layer is defined arbitrarily, there is no guarantee that the weights of the decoding layer can be effectively updated during training. In this case, random weight decoding may be used during the decoding process, resulting in the loss included in the compensation no longer being the feature information loss between the corresponding layers. Therefore, the selection and use of a specific decoding layer is particularly important here.

[0105] The present invention reduces the dimensionality of high-dimensional data features, and characterizes, fuses and associates the high-dimensional feature data based on technologies such as heterogeneous graphs, multi-layer attention mechanisms, multi-layer perceptrons, and loss-compensated deep graph autoencoders. Finally, a personalized feature extraction model for multi-source heterogeneous traffic is constructed to achieve feature extraction of multi-source heterogeneous traffic data, which can be used to form a feature gene library for encryption services.

[0106] An embodiment of the present invention further proposes a system, including a memory and a processor, wherein the memory stores a computer program corresponding to the feature extraction method for multi-source heterogeneous traffic fusion that can be loaded by the processor and executed.

[0107] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 1509, and / or installed from a removable medium 1511. When the computer program is executed by a central processing unit (CPU) 1501, various functions defined in the system of the present application are executed.

[0108] It should be noted that the computer-readable medium shown in the embodiment of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by an instruction execution system, device or device or used in combination with it. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0109] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0110] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0111] As another aspect, the present application also provides a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the feature extraction method for multi-source heterogeneous traffic fusion described in the above embodiment.

[0112] As another aspect, the present application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by an electronic device, the electronic device implements the feature extraction method of multi-source heterogeneous traffic fusion described in the above embodiment.

[0113] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0114] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the implementation methods of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation methods of the present application.

[0115] For those skilled in the art, the specific meanings of the above terms in the present invention can be understood in specific situations; the drawings in the embodiments are used to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings herein can be arranged and designed in various different configurations.

[0116] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in the field can change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A feature extraction method for multi-source heterogeneous traffic fusion, characterized in that: include: Obtain multi-source heterogeneous traffic and perform dimensionality reduction processing; Map multi-source heterogeneous traffic and reduced-dimensional features into nodes of a heterogeneous graph, and construct edges between nodes and corresponding traffic; A multi-layer attention mechanism is used to aggregate nodes in heterogeneous graphs to represent flow-level feature vectors, and a multi-layer perceptron is used to complete flow identity association. A personalized feature extraction model for multi-source heterogeneous traffic is constructed based on the deep graph autoencoder, and the personalized feature extraction of traffic is completed based on the heterogeneous graph.

2. The feature extraction method for multi-source heterogeneous traffic fusion according to claim 1 is characterized in that: The dimensionality reduction process is implemented by using kernel principal component analysis, supervised multi-dimensional scaling, isometric mapping or local linear embedding.

3. The feature extraction method for multi-source heterogeneous traffic fusion according to claim 1 or 2 is characterized in that: The multi-source heterogeneous traffic and the reduced-dimensional features are mapped into nodes of a heterogeneous graph, and edges between the nodes and the corresponding traffic are constructed, specifically including: Feature extraction is performed on multi-source heterogeneous traffic attribute information, traffic generation content, and traffic relationship information, and they are represented in the form of nodes and vectors in a heterogeneous graph and potential feature space; among which, the node types in the heterogeneous graph include traffic nodes, traffic attribute information nodes, traffic generation content nodes, traffic relationship information nodes, behavior category nodes, feature nodes, and relationship embedding nodes.

4. The feature extraction method for multi-source heterogeneous traffic fusion according to claim 3 is characterized in that: The representation in the form of nodes and vectors in a heterogeneous graph and a potential feature space specifically includes: Feature extraction for traffic attribute information and traffic generation content: directly construct traffic attribute information of simple dimensions as feature nodes in the heterogeneous graph; extract traffic generation content features and construct feature nodes in the heterogeneous graph in the form of nodes; at the same time, record the sequence information of features that exist in a certain order; Feature extraction for traffic relationship information: Extract the features of each traffic relationship information, build relationship embedding nodes in the heterogeneous graph, and represent the features as vectors in the latent space; Node vectorization representation: In a heterogeneous graph, given any node except the relation embedding node, the node in the latent feature space is represented using the Glorot normal distribution and randomly initialized.

5. The feature extraction method for multi-source heterogeneous traffic fusion according to claim 3 is characterized in that: The multi-layer attention mechanism is used to aggregate nodes in the heterogeneous graph respectively, specifically including: Using a multi-layer attention mechanism consisting of a behavior category-level attention layer, a behavior expression-level attention layer, and a flow-level attention layer, feature nodes, behavior category nodes, relationship embedding nodes, flow attribute information nodes, flow generation content nodes, and flow relationship information nodes are aggregated in the latent space to perform a fusion representation of flow nodes; the embedding vectors of feature nodes and relationship embedding nodes are used as the input of the attention layer; behavior category nodes, flow attribute information nodes, flow generation content nodes, and flow relationship information nodes are used to calculate attention weights.

6. The feature extraction method for multi-source heterogeneous traffic fusion according to claim 5 is characterized in that: When performing fusion representation, features are aggregated from micro to macro in the order of behavior category level attention layer, behavior expression level attention layer, and flow level attention layer.

7. The feature extraction method for multi-source heterogeneous traffic fusion according to claim 1 is characterized in that: The personalized feature extraction of traffic based on the lightweight loss-compensated deep map autoencoder specifically includes: Collect multi-source heterogeneous raw data, perform data preprocessing on the collected raw data, and generate heterogeneous graphs; The processed heterogeneous graph is input into the deep autoencoder for dimensionality reduction and feature extraction, and the coding loss is compensated at each coding layer; The encoded situation assessment factor feature information is passed to the decoder for decoding and restoration, and then the difference between the restored graph data and the original graph data is evaluated by minimizing the MSE loss function to train the feature extraction model; The trained feature extraction model is used to extract features from heterogeneous graphs.

8. The feature extraction method for multi-source heterogeneous traffic fusion according to claim 7 is characterized in that: The processed heterogeneous graph is input into the deep autoencoder for dimensionality reduction and feature extraction, and the coding loss is compensated at each coding layer, specifically including: After the i-th encoding layer of the deep autoencoder encodes the input data of this layer, preliminary output data is obtained; Using the decoding layer to restore the preliminary output data to obtain restored data; Calculate the loss value of restored data and input data; The loss value is compensated back to the preliminary output data to obtain the final output data of the i-th encoding layer.

9. The feature extraction method for multi-source heterogeneous traffic fusion according to claim 8 is characterized in that: When the initial output data is restored by using the decoding layer, the decoding layer corresponding to the encoding layer is selected for restoration.

10. A system, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program corresponding to the feature extraction method for multi-source heterogeneous traffic fusion as described in any one of claims 1 to 9, which can be loaded by the processor and executed.

Images