Adaptive encryption threat detection method and device based on incremental learning
Through the adaptive encryption threat detection method based on incremental learning, traffic data characteristics are extracted, sample data is obtained, and data augmentation is carried out, which solves the problem of high false alarm rate in the existing technology, and achieves higher detection accuracy and adaptability.
Patent Information
- Application Number
- CN202411612429.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-12
- Publication Date
- 2025-02-28
AI Technical Summary
The existing encrypted traffic AI detection technology has a high false alarm rate due to model solidification and inability to adaptively update, and it is impossible to effectively identify the current network white traffic and changing traffic patterns.
Adaptive encryption threat detection method based on incremental learning is adopted, and white traffic and black traffic sample data are obtained by extracting multiple angle features of traffic data, and active learning and data augmentation technology are used to train and adjust the model to ensure that the model can be updated adaptively.
It improves the accuracy of model detection, effectively reduces the false alarm rate, and can better adapt to changes and differences in existing network traffic.
Smart Images
Figure CN119544281A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of traffic detection, and in particular to an adaptive encryption threat detection method based on incremental learning. Background Art
[0002] In the field of traffic detection, encryption technology is widely used and traditional plaintext detection methods are limited. By extracting relevant behavioral field information from encrypted traffic and building machine learning models, malicious threats can be effectively identified. However, most of the current encrypted traffic AI detection technologies are based on solidified models, that is, they use a relatively fixed set of laboratory black and white encrypted traffic and are formed after fitting using various AI algorithms.
[0003] This type of AI detection model has the following two main problems. First, there may be a big difference between the white traffic in the laboratory and the white traffic on the live network. Therefore, the model may identify the white traffic on the live network as malicious traffic, resulting in false alarms. Second, the traffic on the live network will also change over time, and new white traffic will appear. If the model cannot be updated adaptively, the false alarm situation may become more serious. Summary of the invention
[0004] The main purpose of the present invention is to disclose an adaptive encryption threat detection method based on incremental learning, which is used to solve the problems existing in the prior art such as false alarms caused by identifying the existing network white traffic as malicious traffic due to large differences in white traffic, and aggravated false alarms caused by the inability to adaptively update the model.
[0005] To achieve the above object, according to one aspect of the present invention, a method for adaptive encryption threat detection based on incremental learning is provided, and the following technical solutions are adopted:
[0006] Extract multi-angle features of traffic data; obtain white traffic sample data according to the feature-based rule-based extraction method and the active learning-based extraction method; obtain black traffic sample data according to the feature-based data perturbation data augmentation technology; perform active learning based on the white traffic sample data and the black traffic sample data to obtain the existing network black and white samples; adjust the encryption threat detection system model based on black and white samples, and confirm the use of the latest encryption threat detection system for detection.
[0007] Furthermore, the adaptive encryption threat detection method, the feature-based rule-based extraction method includes: obtaining white samples that do not cause device detection alarms in different time periods according to time distribution, and obtaining representative data in each time period using a random undersampling method; according to different scenarios, using random undersampling extraction in proportion to the IP segment traffic ratio; merging all the data sampled from each part as the first sample.
[0008] Furthermore, the adaptive encryption threat detection method, the extraction method based on active learning includes using the model before adaptive updating as the baseline model, selecting the samples with the smallest absolute value of the difference between the probability values predicted as normal traffic and malicious traffic in the real-time samples, performing secondary labeling on these samples to confirm the true labels, and taking the samples with the true label of white as the second sample; merging the first sample and the second sample into white traffic sample data.
[0009] Furthermore, the adaptive encryption threat detection method obtains black traffic sample data according to the feature-based data perturbation data augmentation technology, including: using the collected historical black samples and the black sample data provided externally to simulate the generation of new black sample data as the black sample data of the existing network; randomly dropping and retransmitting historical black traffic to simulate the mutated black samples that may exist in the existing network.
[0010] Furthermore, the adaptive encryption threat detection method uses black and white samples to adjust the encryption threat detection system model training and confirms that the latest encryption threat detection system is used for detection, including: Model parameter adjustment:
[0011] W Class_i =W*(NUM ALL / NUM Class_i )
[0012] Where W represents the original feature weight parameter vector corresponding to all samples, NUM ALL is the total number of samples, NUM Class_i is the number of samples in the i-th category, and the sample weight corresponding to the i-th category sample becomes W after adjustment. Class_i ;
[0013] Model structure adjustment: First, set the maximum number of random forest subtrees threshold to control the scale of the model; when the model is updated, if the number of subtrees does not reach the maximum threshold, add a certain number of subtrees for learning and fitting the data obtained by the data preprocessing module; and when the number of subtrees reaches the maximum threshold, before updating, sort the subtrees according to their error rate performance on the real-time data to be updated, and eliminate the TopN trees at the end. At the same time, add the same number of N trees to train and fit the new real-time data, so that the number of subtrees of the subsequently updated model is always equal to the maximum threshold.
[0014] According to another aspect of the present invention, an adaptive encryption threat detection device based on incremental learning is provided, and the following technical solutions are adopted:
[0015] An extraction module is used to extract multi-angle features of traffic data; a first acquisition module is used to obtain white traffic sample data according to a feature-based rule-based extraction method and an active learning-based extraction method; a second acquisition module is used to obtain black traffic sample data according to a feature-based data perturbation data augmentation technology; an active learning module is used to perform active learning based on white traffic sample data and black traffic sample data to obtain black and white samples from the existing network; a training module is used to perform model training and adjustment on the encryption threat detection system based on black and white samples, and confirm the use of the latest encryption threat detection system for detection.
[0016] Furthermore, the first acquisition module of the adaptive encrypted threat detection device includes: an acquisition submodule, which is used to obtain white samples that do not cause device detection alarms in different time periods according to time distribution, and obtain representative data in each time period using a random undersampling method; an undersampling extraction module, which is used to perform random undersampling extraction according to the proportion of IP segment traffic according to different scenarios; a merging module, which is used to merge all the data sampled from each part as the first sample. A confirmation module is used to use the model before adaptive update as the benchmark model, select the sample with the smallest absolute value of the difference between the probability values predicted as normal traffic and malicious traffic in the real-time sample, perform secondary labeling on this part of the samples to confirm the true label, and use the sample with the true label of white as the second sample; a merging submodule is used to merge the first sample and the second sample into white traffic sample data.
[0017] Furthermore, the adaptive encryption threat detection device is characterized in that the second acquisition module includes: utilizing the collected historical black samples and the black sample data provided externally to simulate and generate new black sample data as the black sample data of the existing network; and simulating the mutated black samples that may exist in the existing network by randomly dropping and retransmitting historical black traffic.
[0018] Furthermore, the adaptive encryption threat detection device is characterized in that the training module includes: a first adjustment module for adjusting model parameters:
[0019] W Class_i =W*(NUM ALL / NUM Class_i )
[0020] Where W represents the original feature weight parameter vector corresponding to all samples, NUM ALL is the total number of samples, NUM Class_i is the number of samples in the i-th category, and the sample weight corresponding to the i-th category sample becomes W after adjustment. Class_i; The second adjustment module is used for model structure adjustment: first, the maximum number of subtrees in the random forest is set to control the scale of the model; when the model is updated, if the number of subtrees does not reach the maximum threshold, a certain number of subtrees are added to learn and fit the data obtained by the data preprocessing module; and when the number of subtrees reaches the maximum threshold, before updating, the subtrees are sorted according to their error rate performance on the real-time data to be updated, and the TopN trees are eliminated from the bottom. At the same time, the same number of N trees are added to train and fit the new real-time data, so that the number of subtrees of the subsequently updated model is always equal to the maximum threshold.
[0021] According to another aspect of the present invention, a storage medium is provided, and the following technical solution is adopted:
[0022] A storage medium includes the above-mentioned adaptive encryption threat detection device.
[0023] The present invention adaptively learns the characteristics of the problem and the data distribution, automatically adjusts the strategy and model parameters, and introduces the idea of incremental learning into encryption threat detection, thereby adaptively adjusting the model, improving the accuracy of model detection, and effectively reducing the false alarm rate. BRIEF DESCRIPTION OF THE DRAWINGS
[0024] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.
[0025] Figure 1 This is a flow chart of an adaptive encryption threat detection method based on incremental learning according to an embodiment of the present invention;
[0026] Figure 2 A specific flow chart of an adaptive encryption threat detection method based on incremental learning according to an embodiment of the present invention;
[0027] Figure 3 This is a structural diagram of an adaptive encryption threat detection device based on incremental learning described in an embodiment of the present invention. DETAILED DESCRIPTION
[0028] The embodiments of the present invention are described in detail below with reference to the accompanying drawings, but the present invention can be implemented in many different ways as defined and covered by the claims.
[0029] Figure 1 The present invention is a flowchart of a binocular camera-based intelligent chassis control method according to an embodiment of the present invention.
[0030] See also Figure 1As shown, a binocular camera-based intelligent chassis control method includes:
[0031] S101: Extract multiple angle features of traffic data.
[0032] S102: Obtain white traffic sample data according to a feature rule-based extraction method and an active learning-based extraction method.
[0033] S103: Obtain black traffic sample data according to the data augmentation technology based on feature data disturbance.
[0034] S104: Active learning is performed according to the white traffic sample data and the black traffic sample data to obtain black and white samples of the existing network;
[0035] S105: Perform model training and adjustment on the encryption threat detection system based on black and white samples, and confirm that the latest encryption threat detection system is used for detection.
[0036] Specifically, step S101 obtains characteristic information for encrypted traffic data through time and space, handshake protocol, digital certificate and background characteristics. In step S102, first obtain alarm white samples according to time distribution through time and space characteristic information, and filter out representative data; in the problem of malicious threat detection, use the original model to select samples with the smallest predicted probability of normal and malicious traffic in actual samples, and finally merge the white samples obtained by the two extraction methods as updated sample data. In step S103, a certain amount of existing network black sample data is simulated and generated using the collected historical black samples and the characteristic black sample data collected in the special environment. In step S104, the weight parameters of normal business traffic and malicious threat traffic are adjusted by the random forest algorithm to obtain the existing network black and white samples. In step S105, the model parameters and model structure are adjusted by the obtained black and white sample data, and updated when the resources are idle through the scheduled task.
[0037] In the above technical solution of this embodiment, it is more stable than methods such as solidified models, and the detection capability in the existing network is more accurate. Compared with the previous solidified model, this adaptive traffic threat detection system based on incremental learning can automatically and continuously update the model without human intervention, and the adaptive model based on incremental training avoids the problem of catastrophic forgetting, thereby ensuring the stability of the model detection effect. It can also dynamically adjust the model structure to avoid endless expansion of the model. In addition, the imbalance of the data is taken into account during the update process, and the category weights are redistributed to avoid model bias. And the script running time is set in the resource idle period so as not to hinder the detection performance of the device.
[0038] Going a step further, first for encrypted traffic data, the patent of this invention extracts features from multiple angles as much as possible, including time and space, handshake, certificate and background features. Time and space features cover two dimensions of time and space. Time features include traffic duration and packet interval; while space features include the transfer matrix and entropy index of packet size. The handshake features mainly describe the properties of the client and server in the handshake phase, such as protocol version, cipher suite, and supported extensions. Certificate features focus on various properties of the digital certificates used, such as certificate chain length and user normality. Finally, background features are extracted and selected from background traffic, including DNS and HTTP.
[0039] In the current network environment, the amount of data is huge and complex. The ability to obtain representative new white samples from the huge white traffic data has a significant impact on the performance of the model. Therefore, the patent of the present invention uses a combination of rule-based extraction methods and active learning-based extraction methods to obtain white samples from the current network.
[0040] Rule-based extraction method: According to the time distribution, white samples that do not cause device detection alarms are obtained in different time periods, and representative data is obtained by random undersampling in each time period. And according to different scenarios, random undersampling is used in proportion to the proportion of IP segment traffic. Finally, all the data extracted from each part are merged into a representative sample.
[0041] Extraction method based on active learning: For the binary classification problem of malicious threat detection, the uncertainty sampling method based on edge sampling in active learning is used, that is, the model before adaptive update is used as the baseline model, and the sample with the smallest absolute value of the difference between the probability values predicted as normal traffic and malicious traffic in the real-time sample is selected. The security operation and maintenance personnel will perform secondary labeling on these samples to confirm the true label, and the samples with the formal label of white will be used as part of the representative samples. Finally, the white samples obtained by the two extraction methods are merged as the white traffic sample data for the final model update.
[0042] At the same time, through the data augmentation technology based on digital perturbation, a certain amount of black sample data is simulated and generated as the black sample data of the current network by using the collected historical black samples and the black sample data collected in a specific environment. By adding Gaussian noise, random noise, and masking the characteristic value processing method to the original feature data, it is used as new black sample data. In addition, by randomly dropping and retransmitting historical black traffic to simulate the variant black samples that may exist in the current network, and at the same time obtaining real-time black samples with expert experience in the active learning method, the model can increase its recognition of black sample data.
[0043] After obtaining the black and white sample data of the specified period, the model is subsequently trained and adjusted. The present invention adopts the random forest algorithm in machine learning, and the specific processing details are as follows:
[0044] Model parameter adjustment: Due to the different environments in the existing network data, the normal business traffic and malicious threat traffic obtained by the above data preprocessing module are very likely to cause imbalance problems. Therefore, based on cost-sensitive learning, the weight parameters are adjusted for the two types of data respectively. The adjustment method is as follows:
[0045] W Class_i =W*(NUM ALL / NUM Class_i )
[0046] Where W represents the original feature weight parameter vector corresponding to all samples, NUM ALL is the total number of samples, NUM Class_i is the number of samples in the i-th class, and the sample weight corresponding to the i-th class sample is adjusted to WClass_i. That is, the class weight is adjusted by dividing the total number of training data by the number of each class, thereby eliminating the bias caused by data imbalance.
[0047] Model structure adjustment: Adaptive learning of new data multiple times will cause the model size to grow continuously, reducing detection efficiency. The model size is controlled by the random forest algorithm. Through the random forest, a tree model based on the bagging idea, the final prediction model of the model is based on the voting decision of each subtree. And each subtree is a decision tree with independent decision-making ability. First, set the maximum number of subtrees in the random forest to control the scale of the model. When the model is updated, if the number of subtrees does not reach the maximum threshold, a certain number of subtrees are added to learn and fit the number obtained by the data preprocessing module. When the number of indexes reaches the maximum threshold, before updating, sort the subtrees according to the error rate performance of the real-time data to be updated, and eliminate the top N trees at the end. At the same time, add a considerable number of N trees to train and fit the real-time data. The number of indexes of the model updated later is always equal to the maximum threshold. In addition, although the incremental learning method avoids the large amount of resource consumption of one-time retraining, the computing resources are still insufficient to support the model update during the peak period of system resources. Therefore, this method sets a scheduled task to update during the idle period of resources. .
[0048] The implementation process of the above incremental learning adaptive encryption threat detection method is as follows: Figure 2 As shown, the specific process of an adaptive encryption threat detection method based on incremental learning includes the following steps:
[0049] Step 201: malicious encrypted traffic set;
[0050] Step 203: extracting features;
[0051] Step 205: Data augmentation (oversampling)
[0052] Step 207: Current network white traffic;
[0053] Step 209: extracting feature values;
[0054] Step 211: flow extraction (undersampling);
[0055] Step 230: Active learning, uncertainty sampling, obtaining black and white samples from the existing network;
[0056] Step 240: adjusting the black and white category weight parameters;
[0057] Step 250: model fitting training;
[0058] Step 260: Adapting the model;
[0059] Step 261: input the existing network traffic;
[0060] Step 262: Model structure adjustment;
[0061] Figure 3 This is a structural diagram of an adaptive encryption threat detection device based on incremental learning described in an embodiment of the present invention.
[0062] Among them, reference Figure 3 As shown, an adaptive encryption threat detection device based on incremental learning includes: 310 a first acquisition module, used to obtain white traffic sample data according to a feature-based rule-based extraction method, that is, an extraction method based on active learning; 320 a second acquisition module, used to obtain black traffic sample data according to a feature-based data perturbation data augmentation technology; 330 an active learning module, used to perform active learning based on white traffic sample data and traffic sample data to obtain network-present black and white samples.
[0063] A storage medium provided by the present invention includes the above-mentioned adaptive encryption threat detection method based on incremental learning.
[0064] The present invention can automatically adjust its learning strategy or model parameters according to the characteristics of the current problem and data distribution through adaptive learning. Among them, the adaptive learning method driven by incremental learning can make the model have a certain degree of adaptability by further training and fitting new data on the basis of the original model. Therefore, this patent introduces the idea of incremental learning into encryption threat detection, continuously learns the characteristics of real-time live network encrypted traffic, and thus adaptively adjusts the model, improves the accuracy of model detection, and effectively reduces the false alarm rate.
[0065] The above only describes some exemplary embodiments of the present embodiment by way of illustration. It is undoubted that, for those skilled in the art, the described embodiments can be modified in various ways without departing from the spirit and scope of the present invention. Therefore, the above drawings and descriptions are illustrative in nature and should not be construed as limiting the scope of protection of the claims of the present invention.
Claims
1. An adaptive encryption threat detection method based on incremental learning, characterized in that: include: Extract multiple angle features of traffic data; Obtain white traffic sample data according to the feature rule-based extraction method and the active learning-based extraction method; Obtain black traffic sample data using feature-based data perturbation data augmentation technology; Active learning is performed based on white traffic sample data and black traffic sample data to obtain black and white samples from the current network; The encryption threat detection system model is trained and adjusted based on black and white samples, and the latest encryption threat detection system is used for detection.
2. The adaptive encryption threat detection method according to claim 1, characterized in that: The feature-based rule-based extraction method includes: According to the time distribution, white samples that do not cause equipment detection alarms are obtained in different time periods, and representative data is obtained by random undersampling method in each time period; Depending on the scenario, random undersampling is performed according to the proportion of IP segment traffic. Combine all the data sampled from each part as the first sample.
3. The adaptive encryption threat detection method according to claim 2, characterized in that: The active learning-based extraction method includes: Using the model before adaptive update as the baseline model, select the samples with the smallest absolute value of the difference between the probability values predicted as normal traffic and malicious traffic in the real-time samples, perform secondary labeling on these samples to confirm the true labels, and take the samples with the true label of white as the second samples; The first sample and the second sample are combined into white flow sample data.
4. The adaptive encryption threat detection method according to claim 1, characterized in that: The method of obtaining black traffic sample data according to the feature-based data perturbation data augmentation technology includes: Using the collected historical black samples and the black sample data provided by the outside, simulate and generate new black sample data as the black sample data of the current network; The historical black traffic is randomly dropped and retransmitted to simulate the mutated black samples that may exist in the existing network.
5. The adaptive encryption threat detection method according to claim 1, characterized in that: The model training and adjustment of the encryption threat detection system based on black and white samples and confirmation of using the latest encryption threat detection system for detection include: Model parameter adjustment: W Class_i =W*(NUM ALL / NUM Class_i ) Where W represents the original feature weight parameter vector corresponding to all samples, NUM ALL is the total number of samples, NUM Class_i is the number of samples in the i-th category, and the sample weight corresponding to the i-th category sample becomes W after adjustment. Class_i ; Model structure adjustment: First, set the maximum number of subtrees in the random forest to control the scale of the model; When the model is updated, if the number of subtrees does not reach the maximum threshold, a certain number of subtrees are added to learn and fit the data obtained by the data preprocessing module; When the number of subtrees reaches the maximum threshold, before updating, each subtree is sorted according to its error rate performance on the real-time data to be updated, and the TopN trees are eliminated at the last place. At the same time, the same number of N trees are added to train and fit the new real-time data, so that the number of subtrees of the subsequently updated model is always equal to the maximum threshold.
6. An adaptive encryption threat detection device based on incremental learning, characterized in that: include: An extraction module, used to extract multiple angle features of traffic data; A first acquisition module, used for acquiring white traffic sample data according to a feature rule-based extraction method and an active learning-based extraction method; The second acquisition module is used to acquire black traffic sample data according to the data augmentation technology based on feature data disturbance; Active learning module, used to perform active learning based on white traffic sample data and black traffic sample data to obtain black and white samples of the existing network; The training module is used to adjust the model training of the encrypted threat detection system based on black and white samples, and confirm the use of the latest encrypted threat detection system for detection.
7. The adaptive encryption threat detection device according to claim 6, characterized in that: The first acquisition module includes: The acquisition submodule is used to acquire white samples that do not cause device detection alarms in different time periods according to time distribution, and to acquire representative data in each time period using a random undersampling method; The under-sampling extraction module is used to perform random under-sampling extraction in proportion to the IP segment traffic ratio according to different scenarios; The merging module is used to merge all the data sampled from each part as the first sample. A confirmation module is used to use the model before adaptive updating as the baseline model, select the sample with the smallest absolute value of the difference between the probability values predicted as normal traffic and malicious traffic in the real-time sample, perform secondary label confirmation on this part of the samples, and take the sample with the real label of white as the second sample; The merging submodule is used to merge the first sample and the second sample into white flow sample data.
8. The adaptive encryption threat detection device according to claim 6, characterized in that: The second acquisition module includes: Using the collected historical black samples and the black sample data provided by the outside, simulate and generate new black sample data as the black sample data of the current network; The historical black traffic is randomly dropped and retransmitted to simulate the mutated black samples that may exist in the existing network.
9. The adaptive encryption threat detection device according to claim 6, characterized in that: The training module includes: The first adjustment module is used to adjust model parameters: W Class_i =W*(NUM ALL / NUM Class_i ) Where W represents the original feature weight parameter vector corresponding to all samples, NUM ALL is the total number of samples, NUM Class_i is the number of samples in the i-th category, and the sample weight corresponding to the i-th category sample becomes W after adjustment. Class_i ; The second adjustment module is used for model structure adjustment: First, set the maximum number of subtrees in the random forest to control the scale of the model; When the model is updated, if the number of subtrees does not reach the maximum threshold, a certain number of subtrees are added to learn and fit the data obtained by the data preprocessing module; When the number of subtrees reaches the maximum threshold, before updating, each subtree is sorted according to its error rate performance on the real-time data to be updated, and the TopN trees are eliminated at the last place. At the same time, the same number of N trees are added to train and fit the new real-time data, so that the number of subtrees of the subsequently updated model is always equal to the maximum threshold.
10. A storage medium, characterized in that: Includes the adaptive encryption threat detection device as described in any one of claims 6-9.