Sparse label traffic classification method based on transfer learning

Abstract

The invention belongs to the technical field of network security, and particularly provides a sparse label network traffic classification method based on transfer learning, which comprises the following steps: S1, acquiring a network traffic sample data set; the method comprises the following steps: S1, performing preprocessing of four steps on a data set to obtain an optimized data set, S3, dividing target domain data in the optimized data set into a training set and a test set according to a proportion of 8: 2, and setting that only 5% of sample data of the training set has labels, then merging the optimized target domain training set and the optimized source domain data, and inputting the merged data into an improved weight weighting model Tradaboost to obtain a weighted data set; s4, inputting the source domain data in the weighted data set and the target domain training set data in the optimized data set into the improved DANN model for adversarial training; and S5, outputting a classification result. The problem that a current mainstream traffic classification method cannot effectively cope with traffic label scarcity is effectively solved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a sparse label network traffic classification method based on transfer learning. Background Art

[0002] Network traffic classification is a task to accurately classify the traffic data generated in daily network activities. Most of the current malicious attacks are usually hidden in network traffic, which is highly concealed, destructive, and rapidly evolving. Therefore, it is particularly important to develop efficient and accurate network traffic detection technology. The current mainstream technology is to use deep learning methods and neural networks to perform traffic classification tasks. However, the actual problem is that the scale of network traffic data is huge, and there is a general problem of scarcity of labels in the field of network traffic. Such methods cannot effectively classify traffic for such problems. Summary of the invention

[0003] In view of the deficiencies of the prior art, the purpose of an embodiment of the present invention is to provide a sparse label traffic classification method based on transfer learning, which uses historical rich standard traffic data as auxiliary data and migrates it to the current target traffic data domain to perform traffic classification tasks. The present invention improves the Tradaboost algorithm, and uses only a small number of labels to assign weights to auxiliary historical data to form new auxiliary data, and align the edge distributions of the two traffic data domains. The present invention further improves the original DANN for adversarial learning and introduces a new dynamic weight control mechanism, so that the model can automatically adjust the weights of different loss items during adversarial training, thereby achieving fast and stable training convergence to align the high-dimensional feature distributions of the two domains, while achieving accurate and fast classification of traffic that lacks a large number of annotations in the field of network traffic classification. For the sake of accurate description, hereinafter, the present invention refers to the auxiliary data used to assist scarce data in training as source domain data, and the scarce label data that needs to be classified as target domain data.

[0004] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0005] A sparse label traffic classification method based on transfer learning, characterized by comprising the following steps:

[0006] Step S1: Obtain a network traffic sample data set;

[0007] Step S2: preprocessing the data set in four steps to obtain an optimized data set, wherein the data set includes source domain data and target domain data; the four steps are flow cleaning, feature selection, standardization, and label digitization;

[0008] Step S3: Divide the target domain data in the optimized data set into a training set and a test set in a ratio of 8:2, and set only 5% of the sample data in the training set to be labeled. Then merge the optimized target domain training set and the optimized source domain data and input them into the improved weighted model Tradaboost to obtain a weighted data set.

[0009] Step S4: input the source domain data in the weighted data set and the target domain training set data in the optimized data set into the improved DANN model for adversarial training;

[0010] Step S5: Output the classification result.

[0011] Furthermore, the datasets in step S1 are CIC-IDS-2017 and CIC-IDS-2018 datasets, the CIC-IDS-2017 dataset is a source domain dataset, and the CIC-IDS-2018 dataset is a target domain dataset, which includes various attacks such as brute force cracking, Dos, and DDoS, and is sourced from the Canadian Institute for Security Studies.

[0012] Furthermore, the step S2 is specifically as follows:

[0013] Traffic cleaning: Special processing is done on the null values ​​and infinite values ​​in the data set, and they are uniformly assigned a value of 0 to weaken the impact of noise points;

[0014] Feature selection: remove redundant features in the data set and retain only the features that are critical to the classification task;

[0015] Standardization: Standardize the sample data in the data set and map the values ​​to the range of 0 to 1, reducing the data size without affecting the relationship between the data;

[0016] Label digitization: Assign label values ​​​​increasing from 0 to different attack types according to the dataset label.

[0017] Furthermore, the step S3 is specifically as follows:

[0018] S301: Separate all labeled data in the target domain training set, merge the homologous domain data set to form a merged data set, initialize the sample weights of the merged data set, and input them into the Tradaboost attention module;

[0019] S302: Improve the traditional Tradaboost algorithm, discard the weak classifiers finally trained by the algorithm, and only keep the weight matrix in the algorithm iteration process;

[0020] S303: A g function is used to control whether the sample is updated. The g function formula is as follows:

[0021]

[0022] where h t (x i ) represents the current predicted label, c(x i ) is the actual label of the sample;

[0023] When the sample is classified correctly, the g value is 0, indicating that the classification is correct; otherwise, the g value is 1, indicating that the classification is wrong;

[0024] S304: Select a decision tree with a weak classifier depth of 6 for iterative training. In each iteration, the weight of the source domain data set is updated according to the classification of the weak classifier. The weight parameters of each update are recorded in real time. After the iterative training is completed, the recorded weight matrix is ​​multiplied by the source domain data set to obtain a weighted data set.

[0025] Furthermore, the improved weighted model Tradaboost improved in step S3 is specifically:

[0026] The module assigns the same initial weight to each sample data in the source domain and the target domain in the optimized dataset, and the initial weight is set to 1 / total number of samples; initializes two weight parameters β and β t , which are used to update the weights of the source domain samples and the target domain samples in the optimized dataset respectively. The definition formula is as follows:

[0027]

[0028] Among them, n is the total number of samples of source domain data in the optimized dataset, and N is the total number of iterations of the algorithm;

[0029] β t =∈ t / (1-∈ t )

[0030] Where: ∈ t is the error rate of the model, calculated as follows:

[0031]

[0032] Among them, h t (x i ) represents the current predicted label, c(x i ) is the actual label of the sample, m is the total number of target domain samples in the optimized dataset, Indicates the current weight.

[0033] Furthermore, the weight update rule formula of the improved weighted model Tradaboost in step S3 is as follows:

[0034]

[0035] in, Represents the new weight after updating.

[0036] Furthermore, the step S4 is specifically as follows:

[0037] S401: The source domain data in the weighted data set and the target domain training set data in the optimized data set are converted into two-dimensional grayscale images, which are input into the feature extraction module of the DANN, and the high-dimensional features in the original two-dimensional grayscale images of the source domain and the target domain are extracted through the convolution layer as the output of the module;

[0038] The feature extractor model uses four layers of convolution f_conv1, f_conv2, f_conv3, f_conv4, where the size of the convolution kernel is 3 and the number of convolution kernels is 64, 128, 256 and 512. Generate high-dimensional feature representations of auxiliary data and training sets. Use four layers of batch normalization. Two layers of pooling and one layer of dropout to avoid overfitting of the model.

[0039] S402: The domain discriminator receives the output from the previous step as input. The domain discriminator consists of two fully connected layers. The first fully connected layer performs nonlinear transformation on the received features and outputs 100 neurons. The second fully connected layer transforms the 100 neurons into two output neurons (0, 1) to determine whether the input features are from the source domain or the target domain. Gradient reversal is used to implement adversarial training of the domain discriminator and the feature extractor.

[0040] S403: Accept the output from step S401 as input, first output the high-dimensional features of the input to 100 neurons through a fully connected layer, and add a Dropout layer after the first fully connected layer. Next, the second fully connected layer further transforms the features into another 100 neurons. Finally, the classification task is completed by outputting the categories through a fully connected layer.

[0041] Furthermore, the improved DANN model in step S4 is specifically:

[0042] In addition to the three loss functions of the original DANN, a target domain label loss function is added to improve the traditional DANN's failure to fully utilize the small number of labels in the target domain data. The loss function formula is as follows:

[0043] L total =L s-class +L t-class +L t-domain +L s-domain

[0044] Among them, Ltotal represents the total loss, L s-class represents the source domain label loss, L t-class represents the target domain label loss, L t-domain represents the target domain loss, L s-domain Represents the source domain loss.

[0045] Furthermore, the improved DANN model in step S4 also includes designing a new weight mechanism to control the loss function, and the formula is as follows:

[0046] L total =[1-n / (N+1)]L t-class +n / (N+1)L s-class +L t-domain +L s-domain

[0047] Among them, N is the total number of iterations of the preset current model, n is the current iteration number, n / (N+1) is the weight of the source domain loss function, and 1-n / (N+1) is the target domain loss weight.

[0048] Traditional DANN only uses the labels of source domain data, ignoring the key role of a small number of labels of target domain data. Therefore, the present invention adds an additional target domain label loss to the three loss functions of the original DANN. In addition, the original DANN does not pay attention to the constant changes in the data distribution of the two domains in adversarial training during training, which will cause instability and training crashes in adversarial training. Therefore, the present invention improves the loss function weight of DANN and designs a unique dynamic weight control mechanism to ensure the stable and excellent performance of the model in actual network traffic classification tasks.

[0049] The beneficial effects of the present invention are:

[0050] A sparse label traffic classification method based on transfer learning is adopted. Through the transfer learning strategy, a large amount of labeled historical data is combined with a small amount of current labeled data, the original Tradaboost and DANN are improved, and the edge distribution and high-dimensional feature distribution of different traffic data domains are aligned respectively, which enhances the adaptability and generalization ability of the model to the current data distribution, and the model converges quickly and has high stability. It effectively solves the problem that the current mainstream traffic classification method cannot effectively deal with the scarcity of traffic labels. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0052] Figure 1 This is a flow chart of a sparse label traffic classification method based on transfer learning in this application;

[0053] Figure 2 It is the Tradaboost attention model diagram;

[0054] Figure 3 It is the DANN model diagram;

[0055] Figure 4 Graphs of the loss functions of the present invention under four different learning rates;

[0056] Figure 5 It is a two-dimensional distribution diagram of the original features and the features after being processed by this model. DETAILED DESCRIPTION

[0057] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0058] The network traffic classification method of the present invention starts from the actual problem of lack of rich annotations in the current actual network classification field, and proposes a sparse label traffic classification method based on transfer learning. The historical rich label traffic is merged with the current lack of label traffic, and Tradaboost and DANN are used to pull the edge distribution and feature distribution of the two data domains closer from the perspectives of low dimension and high dimension respectively. The rich label information of historical data is used to assist the current classification task. At the same time, in view of the particularity of the field of network traffic classification, innovative improvements are made to Tradaboost and DANN in order to be able to be accurately and efficiently applied in the field of network traffic classification. Compared with the current mainstream classification methods, this method can effectively overcome the challenge of insufficient labels, and the speed and accuracy are greatly improved, and it has high practical value. In the following, the present invention refers to auxiliary data as source domain data, and scarce label data as target domain data.

[0059] like Figure 1 As shown, the present application provides a sparse label traffic classification method based on transfer learning, comprising the following steps:

[0060] Step S1: Obtain a network traffic sample data set;

[0061] Step S2: The messy data set is preprocessed in four steps to obtain an optimized data set. Here, the data set includes source domain data and target domain data. The four steps are traffic cleaning, feature selection, standardization, and label digitization.

[0062] It should be noted that the preprocessing operation is specifically as follows:

[0063] Traffic cleaning: Special processing is performed on the null values ​​and infinite values ​​in the data set, and they are uniformly assigned a value of 0 to weaken the impact of noise points.

[0064] Feature selection: Remove some redundant features in the data set and retain only the features that are critical to the classification task.

[0065] Standardization: Standardize the sample data in the data set and map the values ​​to the range of 0 to 1, reducing the data size without affecting the relationship between the data.

[0066] Label digitization: Different attack types in the dataset labels are assigned label values ​​with integers increasing from 0. The specific data is determined by the actual attack category.

[0067] Step S3: Divide the target domain data in the optimized dataset into a training set and a test set in a ratio of 8:2, and set only 5% of the sample data in the training set to have labels. Then merge the optimized target domain training set and the source domain data and input them into the improved weighted model Tradaboost, as shown in Figure 2 As shown, a weighted data set is obtained to bring the marginal distribution between the two data domains closer.

[0068] It should be noted that the step S3 is specifically as follows:

[0069] S301: Separate all labeled data in the target domain training set, merge the homologous domain data set to form a merged data set, initialize the sample weights of the merged data set, and input it into the Tradaboost attention module;

[0070] S302: Improve the traditional Tradaboost algorithm. First, discard the weak classifiers finally trained by the algorithm and only keep the weight matrix in the algorithm iteration process. Meanwhile, the traditional algorithm does not process the correctly classified samples in the source domain data set and does not make full use of the hidden information of the source domain data set. For this, the present invention designs a unique weight update method. Regardless of whether the source domain data set samples are classified correctly or not, the strategy is used for updating.

[0071] S303: Secondly, Tradaboost only considers the case of binary classification, but in the actual network traffic classification task, the categories of traffic are diverse, so the present invention sets a g function to control whether the sample is updated, and expands the traditional Tradaboost to the case of multi-classification;

[0072] The formula of the g function is as follows:

[0073]

[0074] where h t (x i ) represents the current predicted label, c(x i ) is the actual label of the sample;

[0075] When the sample is classified correctly, the g value is 0, indicating that the classification is correct; otherwise, the g value is 1, indicating that the classification is wrong;

[0076] S304: After the improvement of the Tradaboost algorithm is completed, a decision tree with a weak classifier depth of 6 is selected for iterative training. The weight of the source domain data set is updated according to the classification of the weak classifier in each iteration, and the weight parameters of each update are recorded in real time. After the iterative training is completed, the recorded weight matrix is ​​multiplied with the source domain data set to obtain a weighted data set. The marginal distribution of the source domain data set and the target domain data set is brought closer.

[0077] It should be noted that the improvements made by this application to the weighted model Tradaboost are as follows:

[0078] First, the module assigns the same initial weight to each sample data in the source domain and the target domain, and the initial weight is set to 1 / total number of samples. Two weight parameters β and β are initialized. t , which are used to optimize the weights of source domain samples and target domain samples in the dataset, respectively. The definition formula is as follows:

[0079]

[0080] Among them, n is the total number of samples of source domain data in the optimized dataset, and N is the total number of iterations of the algorithm;

[0081] β t =∈ t / (1-∈ t )

[0082] Where: ∈ t is the error rate of the model, calculated as follows:

[0083]

[0084] Among them, ht (x i ) represents the current predicted label, c(x i ) is the actual label of the sample, m is the total number of target domain samples in the optimized dataset, Indicates the current weight.

[0085] Different from the traditional Tradaboost, the present invention improves the weight update rule as follows: In each iteration, if a sample in the source domain is misclassified, the weight of the sample is multiplied by β (less than 1) to reduce the weight of the sample. When the source domain sample is correctly classified, the weight of the sample is multiplied by a parameter slightly larger than 1. This parameter will slowly increase the weight value as the number of iterations increases, but it will not be too exaggerated to ensure the stability of convergence. If a sample in the target domain is mispredicted, it is multiplied by β t The reciprocal of expands the weight of the sample.

[0086] Step S4: Input the source domain data in the weighted data set and the target domain training set data in the optimized data set into the improved DANN model for adversarial training to narrow its high-dimensional feature distribution and achieve classification tasks. Figure 3 As shown in Figure 1, DANN consists of a feature extractor, a domain discriminator, and a label classifier. The feature extractor is responsible for extracting high-dimensional features, and the domain discriminator receives the output from the feature extractor to determine whether the feature comes from the source domain or the target domain. The label classifier receives the output of the feature extractor to implement the classification task.

[0087] It should be noted that the step S4 is specifically as follows:

[0088] S401: The source domain data in the weighted data set and the target domain training set data in the optimized data set are converted into two-dimensional grayscale images, which are input into the feature extraction module of DANN, and the high-dimensional features of the original two-dimensional grayscale images of the source domain and the target domain are extracted through the convolution layer as the output of the module.

[0089] S402: The domain discriminator receives the output from the previous step as input. The domain discriminator consists of two fully connected layers. The first fully connected layer performs nonlinear transformation on the received features and outputs 100 neurons. The second fully connected layer converts 100 neurons into two output neurons (0,1) to determine whether the input features are from the source domain or the target domain. Gradient reversal is used to implement adversarial training of the domain discriminator and feature extractor. The domain loss gradient is multiplied by a negative constant during back propagation to deceive the feature extractor. The optimization goal at this time is that the domain discriminator cannot distinguish the source of the feature, which also reflects that the features extracted by the feature extractor make it impossible for the discriminator to make a correct judgment. This means that the features extracted at this time are a fully mixed feature of the source domain and the target domain, which achieves the closeness of the high-dimensional feature distribution of the data.

[0090] S403: Accept the output from step S401 as input, first output the high-dimensional features of the input to 100 neurons through a fully connected layer, and add a Dropout layer after the first fully connected layer. Next, the second fully connected layer further transforms the features into another 100 neurons. Finally, output the categories (the number of categories depends on the specific traffic category) through a fully connected layer to complete the classification task.

[0091] It should be noted that the improved DANN model is specifically:

[0092] The present invention adds an additional target domain label loss to the three loss functions of the original DANN to improve the traditional DANN which does not fully utilize the small number of labels in the target domain data. The loss function formula is as follows:

[0093] L total =L s-class +L t-class +L t-domain +L s-domain

[0094] Among them, L total represents the total loss, L s-class represents the source domain label loss, L t-class represents the target domain label loss, L t-domain represents the target domain loss, L s-domain represents the source domain loss.

[0095] In addition, due to the difference in the initial distribution of source domain data and target domain data, there are problems of slow convergence or unstable convergence in the iteration process. The original DANN model did not make targeted adjustments to this situation. This paper designs a unique weight mechanism to control the loss function. The formula is as follows: L total =[1-n / (N+1)]L t-class +n / (N+1)L s-class +L t-domain +L s-domain

[0096] Assuming that the total number of iterations of the current model is N, and the number of iterations currently completed is n, n / (N+1) is designed to be the weight of the source domain loss function, and 1-n / (N+1) is designed to be the weight of the target domain loss function. As the iteration proceeds, the weight of the source domain loss function continues to increase, and the weight of the target domain loss function continues to decrease. The present invention can ensure that training can be carried out stably in a network traffic environment through such a design.

[0097] In practical applications, the optimal parameters can be verified by making different parameter combinations on the training set, or the parameters can be set based on expert experience.

[0098] The invention points of this invention are as follows:

[0099] In order to solve the problem of label scarcity in the field of target network traffic classification, this paper innovatively combines the TrAdaBoost algorithm with the attention mechanism, improves the traditional Tradaboost algorithm, and proposes a method that can use a small amount of target domain label data to perform weighted enhancement on the source domain data. This mechanism initially narrows the marginal distribution gap between the source domain and the target domain in the low-dimensional feature space, effectively solving the performance degradation problem of the current method when the labeled data is scarce.

[0100] In order to improve the stability and convergence speed of the model in adversarial training, the present invention improves the traditional DANN model and designs a dynamic weight loss control mechanism for the traditional DANN. The mechanism adjusts the loss weight in real time according to the specific working conditions of the domain adversarial neural network (DANN), so that the model shows stronger robustness and efficiency in the actual network traffic environment. In addition, the present invention adds an additional target domain label loss to the three loss functions of the original DANN to improve the defect that the traditional DANN does not fully utilize the small number of labels in the target domain data.

[0101] A specific example of this method is as follows:

[0102] Two widely used public datasets, CIC-IDS-2017 and CIC-IDS-2018 datasets, are used. Four preprocessing operations, including traffic cleaning, feature selection, normalization, and label digitization, are performed on the two datasets respectively.

[0103] Use CIC-IDS-2017 as the auxiliary dataset and CIC-IDS-2018 as the target domain dataset. Divide the training set and test set in a ratio of 8:2, and design the training batch size batch_size to 256. Perform comparative experiments on four different learning rates (0.1, 0.01, 0.001, 0.0001) to obtain the best parameter settings, such as Figure 4 As shown. It can be seen that the model training speed of the present invention is very fast, and in practical applications, it can reduce the model training time. Using dimensionality reduction technology, the characteristics of the data set after model training and the initial characteristics can be visualized, and the changes in data distribution can be observed, such as Figure 5 As shown in Figure 1, part a shows the distribution of the initial source domain features and the target domain features, and part b shows the feature distribution of the two different domain models after model training. From the experimental results, the present invention can effectively bring the data distribution of the two data domains closer.

[0104] After obtaining the optimal parameter configuration, a binary classification and multi-classification comparison experiment was conducted with the current mainstream traffic classification methods. The mainstream methods include coral, Tradaboost, XG-boost, RNN, LSTM, GRU, GAN_RF, and ACGAN, which are the mainstream methods currently used in the field of traffic classification. The binary classification results are shown in Table 1, the accuracy results of the multi-classification experiment are shown in Table 2, and the precision results are shown in Table 3. It can be observed that the model in this paper has achieved a relatively balanced effect in all indicators of binary classification, especially in terms of accuracy, precision and F1 score, which has achieved the best performance among all models. Among them, the model in this paper achieved an accuracy of 99.79%, a precision of 99.50%, and an F1 score of 99.47%, and was only 0.24% lower than XGBoost in terms of recall. In the multi-classification task, the outstanding performance of the present invention for various attacks (numerically 0 to 8 in the table) is its balance. The model of this paper achieved the highest accuracy in category 1 and category 2, which are 99.84% and 99.67% respectively. In terms of precision, the model of this paper also achieved the best results in category 0 and category 2. This is because although the labels of the target domain are scarce, the model of this paper can be learned with the help of auxiliary data sets, which effectively overcomes the challenge of few samples and shows stronger classification ability and stability. In the actual traffic classification task, it also has high practicality.

[0105] Table 1

[0106] Model Accuracy (%) Accuracy (%) Recall rate (%) f1 score (%) coral 80.30 64.52 80.30 71.55 Tradaboost 96.31 93.73 87.16 90.19 XG-boost 95.84 82.72 99.68 90.41 RNN 97.92 92.23 98.01 94.93 Lstm 89.54 89.82 89.54 89.64 GRU 92.54 92.58 92.54 92.51 GAN-RF 95.74 95.70 95.74 95.68 ACGAN 96.34 90.99 96.21 93.35 Our 99.79 99.50 99.44 99.47

[0107] Table 2

[0108]

[0109]

[0110] Table 3

[0111]

[0112] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0113] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A sparse label traffic classification method based on transfer learning, characterized in that: The steps include: Step S1: Obtain a network traffic sample data set; Step S2: preprocessing the data set in four steps to obtain an optimized data set, wherein the data set includes source domain data and target domain data; the four steps are flow cleaning, feature selection, standardization, and label digitization; Step S3: Divide the target domain data in the optimized data set into a training set and a test set in a ratio of 8:2, and set only 5% of the sample data in the training set to be labeled. Then merge the optimized target domain training set and the optimized source domain data and input them into the improved weighted model Tradaboost to obtain a weighted data set. Step S4: input the source domain data in the weighted data set and the target domain training set data in the optimized data set into the improved DANN model for adversarial training; Step S5: Output the classification result.

2. A sparse label traffic classification method based on transfer learning as claimed in claim 1, characterized in that: The datasets in step S1 are CIC-IDS-2017 and CIC-IDS-2018 datasets, the CIC-IDS-2017 dataset is a source domain dataset, and the CIC-IDS-2018 dataset is a target domain dataset.

3. A sparse label traffic classification method based on transfer learning as claimed in claim 1, characterized in that: The step S2 is specifically as follows: Traffic cleaning: Special processing is done on the null values ​​and infinite values ​​in the data set, and they are uniformly assigned a value of 0 to weaken the impact of noise points; Feature selection: remove redundant features in the data set and retain only the features that are critical to the classification task; Standardization: Standardize the sample data in the data set and map the values ​​to the range of 0 to 1, reducing the data size without affecting the relationship between the data; Label digitization: Assign label values ​​​​increasing from 0 to different attack types according to the dataset label.

4. The sparse label traffic classification method based on transfer learning as claimed in claim 1, characterized in that: The step S3 is specifically as follows: S301: Separate all labeled data in the target domain training set, merge the homologous domain data set to form a merged data set, initialize the sample weights of the merged data set, and input it into the Tradaboost attention module; S302: Improve the traditional Tradaboost algorithm, discard the weak classifiers finally trained by the algorithm, and only keep the weight matrix in the algorithm iteration process; S303: Control whether the sample is updated by a g function, the g function formula is as follows: where h t (x i ) represents the current predicted label, c(x i ) is the actual label of the sample; When the sample is classified correctly, the g value is 0, indicating that the classification is correct; Otherwise, the g value is 1, indicating a misclassification; S304: Select a decision tree with a weak classifier depth of 6 for iterative training. In each iteration, the weight of the source domain data set is updated according to the classification of the weak classifier. The weight parameters of each update are recorded in real time. After the iterative training is completed, the recorded weight matrix is ​​multiplied by the source domain data set to obtain a weighted data set.

5. A sparse label traffic classification method based on transfer learning as described in claim 4, characterized in that: The improved weighted model Tradaboost is specifically: The module assigns the same initial weight to each sample data in the source domain and the target domain in the optimized dataset, and the initial weight is set to 1 / total number of samples; initializes two weight parameters β and β t , which are used to update the weights of the source domain samples and the target domain samples in the optimized dataset respectively. The definition formula is as follows: Among them, n is the total number of samples of source domain data in the optimized dataset, and N is the total number of iterations of the algorithm; β t ＝∈ t / (1-∈ t ) Where: ∈ t is the error rate of the model, calculated as follows: Among them, h t (x i ) represents the current predicted label, c(x i ) is the actual label of the sample, m is the total number of target domain samples in the optimized dataset, Indicates the current weight.

6. A sparse label traffic classification method based on transfer learning as claimed in claim 5, characterized in that: The weight update rule formula of the Tradaboost weighted model improved in step S3 is as follows: in, Represents the new weight after updating.

7. The sparse label traffic classification method based on transfer learning as claimed in claim 1, characterized in that: The step S4 is specifically as follows: S401: The source domain data in the weighted data set and the target domain training set data in the optimized data set are converted into two-dimensional grayscale images, which are input into the feature extraction module of the DANN, and the high-dimensional features in the original two-dimensional grayscale images of the source domain and the target domain are extracted through the convolution layer as the output of the module; S402: The domain discriminator receives the output from the previous step as input. The domain discriminator consists of two fully connected layers. The first fully connected layer performs nonlinear transformation on the received features and outputs 100 neurons. The second fully connected layer transforms the 100 neurons into two output neurons (0, 1) to determine whether the input features are from the source domain or the target domain. Gradient reversal is used to implement adversarial training of the domain discriminator and the feature extractor. S403: Accept the output from step S401 as input, first output the high-dimensional features of the input to 100 neurons through a fully connected layer, and add a Dropout layer after the first fully connected layer. Next, the second fully connected layer further transforms the features into another 100 neurons. Finally, the classification task is completed by outputting the categories through a fully connected layer.

8. A sparse label traffic classification method based on transfer learning as claimed in claim 6, characterized in that: The improved DANN model in step S4 is specifically: In addition to the three loss functions of the original DANN, a target domain label loss function is added to improve the traditional DANN's failure to fully utilize the small number of labels in the target domain data. The loss function formula is as follows: L total =L s-class +L t-class +L t-domain +L s-domain Among them, L total represents the total loss, L s-class represents the source domain label loss, L t-class represents the target domain label loss, L t-domain represents the target domain loss, L s-domain represents the source domain loss.

9. The sparse label traffic classification method based on transfer learning as claimed in claim 7, characterized in that: The improved DANN model in step S4 also includes designing a new weight mechanism to control the loss function, and the formula is as follows: L total =[1-n / (N+1)]L t-class +n / (N+1)L s-class +L t-domain +L s-domain Among them, N is the total number of iterations of the preset current model, n is the current iteration number, n / (N+1) is the weight of the source domain loss function, and 1-n / (N+1) is the target domain loss weight.

Images