SDN abnormal traffic distributed detection method and system based on D-VAE-WGAN

Abstract

The invention discloses a distributed detection method and system for SDN abnormal traffic based on D-VAE-WGAN, and the method comprises the steps: carrying out the cooperative training of a D-VAE-WGAN model based on a collected original traffic sample data set, and obtaining an optimal D-VAE-WGAN model; the cloud server sends a copy of the trained discriminator Dd to each subnet controller, and the copy of the trained discriminator Dd, an original encoder Ge, an original decoder Gd and an original discriminator De in the controller form a detection agent; calculating a reconstruction error and a discrimination error of the reconstructed sample based on the detection agent, and obtaining an error value of the sample; and judging based on the obtained error value of the sample and a set threshold value, and if the error value is greater than the judged threshold value, judging that the sample is an abnormal sample. According to the method, the problem of slow convergence of the GAN is solved by taking the VAE as an encoder, and the risk of'mode collapse 'of the GAN is avoided by taking the Wasserstein distance as similarity measurement. Joint training is carried out by using a generator to exchange parameters, so that each sub-network can learn flow data distribution in other sub-networks, and the overall defense capability of the SDN network is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of deep learning and relates to a SDN abnormal traffic distributed detection method and system based on D-VAE-WGAN. Background Art

[0002] With the rapid development of information technology, Software-Defined Networking (SDN), as a new type of network architecture, has been successfully applied in many business fields. SDN brings unprecedented flexibility and convenience to network management through centralized control, programmability, and global topology view. However, with the expansion of network scale and the increase of traffic, the application of traditional abnormal traffic detection methods in SDN environment faces many challenges. For example, when performing large-scale software-defined network detection tasks, traditional abnormal traffic detection methods have high computational overhead, busy shared links, and are prone to single-point failures of network devices, resulting in reduced SDN network service quality or even network paralysis. Therefore, there is an urgent need for a method to quickly detect abnormal traffic. Summary of the invention

[0003] The purpose of the present invention is to solve the problems in the prior art that the traditional abnormal traffic detection method has high computational overhead and busy shared links when performing large-scale software defined network detection tasks, which easily causes single point failure of network equipment, resulting in reduced SDN network service quality or even network paralysis. A D-VAE-WGAN-based SDN abnormal traffic distributed detection method and system are provided.

[0004] In order to achieve the above object, the present invention adopts the following technical solutions:

[0005] The SDN abnormal traffic distributed detection method based on D-VAE-WGAN includes:

[0006] Collecting raw traffic sample data sets;

[0007] Build a D-VAE-WGAN model that includes a cloud server and several subnets;

[0008] Based on the collected original traffic sample data set, the D-VAE-WGAN model is co-trained to obtain the optimal D-VAE-WGAN model;

[0009] The cloud server will train the discriminator D d A copy of the encoder G is sent to each subnet controller and compared with the original encoder G in the controller. e , decoder G d and the discriminator D e Together they constitute the detection agent;

[0010] Based on the detection agent, the reconstruction error and discrimination error of the reconstructed sample are calculated to obtain the error value of the sample;

[0011] A judgment is made based on the error value of the obtained sample and the set threshold. If the error value is greater than the judgment threshold, the sample is determined to be an abnormal sample.

[0012] A further improvement of the present invention is:

[0013] Furthermore, a D-VAE-WGAN model including a cloud server and several subnets is constructed, specifically: the cloud server communicates data with the subnets respectively; the cloud server includes a discriminator D d ; The subnet includes encoder G e , decoder G d and the discriminator D e .

[0014] Furthermore, before the D-VAE-WGAN model is co-trained, the D-VAE-WGAN model is also jointly optimized based on the Wasserstein distance, specifically:

[0015] Inside the subnet, the learning sample is input to the encoder G e and decoder G d In the above example, the reconstructed sample G is obtained by encoding and decoding. d (G e (x)) ; Train the encoder G based on the cycle consistency loss function e and decoder G d , when the cycle consistency loss function is minimized, the optimal encoder G is obtained e and decoder G d ;

[0016] For input x~P X , encoder G e As the generator and discriminator D e Working together to produce the intermediate output G e (x)~Q Z ; Introduce Gaussian distribution P Z As a constraint, use the random variable z to find the conditional distribution Q(Z|X) so that the bounds of the random variable z are Q Z =∫Q(Z|X)dP X , by adjusting the encoder G e The parameters make G e (x) Obey Q Z The distribution of Z The distance between them keeps decreasing, and the training generator G is realized eThe goal is to use the Wasserstein distance as the encoder G e and the discriminator D e The objective function of WGAN-e composed of

[0017] Decoder G d Discriminator D with cloud server d As a generator, it forms a WGAN-d structure; based on the discriminator D d The difference between the constrained reconstructed data and the input data is optimized based on the Wasserstein distance as the objective function. When the Wasserstein distance is minimized, the optimized WGAN-d is obtained.

[0018] The cycle consistency loss function, the Wasserstein distance of WGAN-e, and the Wasserstein distance objective function of WGAN-d are weighted to obtain the final Wasserstein distance objective function.

[0019] Furthermore, the cycle consistency loss function is:

[0020]

[0021] The Wasserstein distance is used as the encoder G e and the discriminator D e The objective function of WGAN-e is:

[0022]

[0023] The Wasserstein distance objective function of the WGAN-d is:

[0024]

[0025] The final Wasserstein distance objective function is

[0026]

[0027] Among them, λ, γ, μ are the weights of each objective function, and the sum of λ, γ, μ is 1.

[0028] Furthermore, before the D-VAE-WGAN model is collaboratively trained, the following steps are also included: considering the weight relationship between samples and constructing a weight matrix based on a multi-layer neural network, specifically:

[0029]

[0030] Where n is the number of layers in the multi-layer neural network, m is the maximum number of neurons in all neural network layers, ω ij is the weight value of the jth neuron in the i-th layer; if there is no neuron at the corresponding position, the weight value is 0; according to the standard deviation calculation method, the constraint operator based on the standard deviation SD is obtained, which is:

[0031]

[0032] Based on the standard deviation constraint operator as a regularization term, a loss function is constructed, specifically:

[0033] Loss = f w (x)+α·σ(ω) (6)

[0034] Among them, f w (x) is the error function, and α is used to control the relative importance of the constraint operator.

[0035] Furthermore, the D-VAE-WGAN model is collaboratively trained based on the collected original traffic sample data set. Specifically, the D-VAE-WGAN model of the cloud server and each SDN controller is interactively and collaboratively trained based on the collected traffic samples, including:

[0036] Split the original traffic sample data set into a training set and a test set;

[0037] a. The i-th SDN controller uses the input sample x in the training set i and Gaussian noise z i , complete D e Own parameter ω De Update; VAE generates sample data G d (G e (x i ) and sent to the discriminator D located on the cloud server. d ;

[0038] b. Discriminator D d According to the input sample data x sent by the controller i , complete its own parameters ω Dd Updates;

[0039] c. Discriminator D d According to the generated data G sent by the controller d (G e (x i ), calculate the generated error and feed the result back to the i-th controller;

[0040] d. The controller updates G according to the error information fed back e , G dThe parameter ω Ge and ω Gd ;

[0041] e. After completing a k-round periodic iteration, exchange parameters ω with the j-th controller by random selection. Ge and ω Gd ;

[0042] f. Repeat ae until the total number of iterations required is completed.

[0043] Furthermore, based on the reconstruction error and discrimination error generated by the detection agent in reconstructing the sample, the error value of the sample is obtained, specifically:

[0044]

[0045] Among them, Z Re (x) is the reconstruction error, which is the difference between the input sample x in the test set and the reconstructed sample The sum of the differences in eigenvalues ​​in the corresponding dimensions is calculated as

[0046]

[0047] in, To discriminate the error, the discriminator considers the difference between the real input sample and the reconstructed sample, which is represented by the Wasserstein distance, that is,

[0048]

[0049] Among them, α∈(0,1).

[0050] Furthermore, the threshold is set as follows: the mean of all sample error values ​​in the training set is calculated plus 3 standard deviations, that is,

[0051]

[0052] The judgment is made based on the error value of the obtained sample and the set threshold, specifically:

[0053]

[0054] The SDN abnormal traffic distributed detection system based on D-VAE-WGAN includes:

[0055] A collection module, wherein the collection module collects raw traffic sample data sets;

[0056] A construction module, wherein the construction module constructs a D-VAE-WGAN model including a cloud server and a plurality of subnets;

[0057] A training module, wherein the training module performs collaborative training on the D-VAE-WGAN model based on the collected original traffic sample data set to obtain an optimal D-VAE-WGAN model;

[0058] The cloud server of the component module will train the discriminator D d A copy of the encoder G is sent to each subnet controller and compared with the original encoder G in the controller. e , decoder G d and the discriminator D e Together they constitute the detection agent;

[0059] An acquisition module, wherein the acquisition module calculates a reconstruction error and a discrimination error of the reconstructed sample based on the detection agent, and acquires an error value of the sample;

[0060] The judgment module performs judgment based on the error value of the obtained sample and a set threshold value. If the error value is greater than the judgment threshold value, the sample is determined to be an abnormal sample.

[0061] Compared with the prior art, the present invention has the following beneficial effects:

[0062] The present invention uses the collected original traffic sample data set to collaboratively train the D-VAE-WGAN model to obtain the optimal D-VAE-WGAN model; the cloud server sends the trained discriminator D d A copy of the encoder G is sent to each subnet controller and compared with the original encoder G in the controller. e , decoder G d and the discriminator D e Together they constitute a detection agent; based on the detection agent, the reconstruction error and discrimination error of the reconstructed sample are calculated to obtain the error value of the sample; based on the error value of the obtained sample and the set threshold, a judgment is made, and if the error value is greater than the judgment threshold, the sample is determined to be an abnormal sample. The present invention uses VAE as an encoder to solve the problem of slow convergence of GAN, and uses Wasserstein distance as a similarity metric to avoid the risk of "mode collapse" of GAN. Joint training is performed by exchanging parameters of the generator, so that each subnet can learn the distribution of traffic data in other subnets, thereby improving the overall defense capability of the SDN network. Constructing a detection agent in the subnet realizes distributed detection of abnormal traffic within the subnet; avoiding large-scale data interaction between each controller and the cloud server, reducing the bandwidth consumption of the shared link and the computing pressure of the server. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0064] Figure 1 It is a flow chart of the distributed detection method of abnormal SDN traffic based on D-VAE-WGAN of the present invention;

[0065] Figure 2 It is a structural schematic diagram of the SDN abnormal traffic distributed detection system based on D-VAE-WGAN of the present invention;

[0066] Figure 3 This is a schematic diagram of the network topology of the abnormal traffic detection system based on D-VAE-WGAN;

[0067] Figure 4 Schematic diagram of GAN structure;

[0068] Figure 5 Schematic diagram of the D-VAE-WGAN network architecture;

[0069] Figure 6 Schematic diagram of the detection results of the detection agent in each data set. DETAILED DESCRIPTION

[0070] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0071] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0072] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0073] In the description of the embodiments of the present invention, it should be noted that if the terms "upper", "lower", "horizontal", "inner", etc. indicate an orientation or positional relationship based on the orientation or positional relationship shown in the drawings, or the orientation or positional relationship in which the product of the invention is usually placed when in use, it is only for the convenience of describing the present invention and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention. In addition, the terms "first", "second", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.

[0074] In addition, if the term "horizontal" appears, it does not mean that the component must be absolutely horizontal, but can be slightly tilted. For example, "horizontal" only means that its direction is more horizontal than "vertical", which does not mean that the structure must be completely horizontal, but can be slightly tilted.

[0075] In the description of the embodiments of the present invention, it is also necessary to explain that, unless otherwise clearly specified and limited, the terms "set", "install", "connect", and "connect" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal connection of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0076] The present invention is further described in detail below in conjunction with the accompanying drawings:

[0077] See also Figure 1 The present invention discloses a distributed detection method for abnormal SDN traffic based on D-VAE-WGAN, comprising:

[0078] S101, collecting original traffic sample data set;

[0079] S102, constructing a D-VAE-WGAN model including a cloud server and several subnets;

[0080] The cloud server communicates data with the subnets respectively; the cloud server includes a discriminator D d ; The subnet includes encoder G e , decoder G d and the discriminator D e .

[0081] S103, co-training the D-VAE-WGAN model based on the collected original traffic sample data set to obtain an optimal D-VAE-WGAN model;

[0082] Before the D-VAE-WGAN model is co-trained, it also includes: joint optimization of the D-VAE-WGAN model based on the Wasserstein distance, specifically:

[0083] Inside the subnet, the learning sample is input to the encoder G e and decoder G d In the above example, the reconstructed sample G is obtained by encoding and decoding. d (G e (x)) ; Train the encoder G based on the cycle consistency loss function e and decoder G d , when the cycle consistency loss function is minimized, the optimal encoder G is obtained e and decoder G d ;

[0084] For input x~P X , encoder G e As the generator and discriminator D e Working together to produce the intermediate output G e (x)~Q Z ; Introduce Gaussian distribution P Z As a constraint, use the random variable z to find the conditional distribution Q(Z|X) so that the bounds of the random variable z are Q Z =∫Q(Z|X)dP X , by adjusting the encoder G e The parameters make G e (x) Obey Q Z The distribution of Z The distance between them is constantly decreasing, realizing the training encoder G e The goal is to use the Wasserstein distance as the encoder G e and the discriminator D e The objective function of WGAN-e composed of

[0085] Decoder G d Discriminator D with cloud server d As a generator, it forms a WGAN-d structure; based on the discriminator D d The difference between the constrained reconstructed data and the input data is optimized based on the Wasserstein distance as the objective function. When the Wasserstein distance is minimized, the optimized WGAN-d is obtained.

[0086] The cycle consistency loss function, the Wasserstein distance of WGAN-e, and the Wasserstein distance objective function of WGAN-d are weighted to obtain the final Wasserstein distance objective function.

[0087] The cycle consistency loss function is:

[0088]

[0089] The Wasserstein distance is used as the encoder G e and the discriminator D e The objective function of WGAN-e is:

[0090]

[0091] The Wasserstein distance objective function of the WGAN-d is:

[0092]

[0093] The final Wasserstein distance objective function is

[0094]

[0095] Among them, λ, γ, μ are the weights of each objective function, and the sum of λ, γ, μ is 1.

[0096] Before the D-VAE-WGAN model is collaboratively trained, it also includes: considering the weight relationship between samples and building a weight matrix based on a multi-layer neural network, specifically:

[0097]

[0098] Where n is the number of layers in the multi-layer neural network, m is the maximum number of neurons in all neural network layers, ω ij is the weight value of the jth neuron in the i-th layer; if there is no neuron at the corresponding position, the weight value is 0; according to the standard deviation calculation method, the constraint operator based on the standard deviation SD is obtained, which is:

[0099]

[0100] Based on the standard deviation constraint operator as a regularization term, a loss function is constructed, specifically:

[0101] Loss = f w (x)+α·σ(ω) (6)

[0102] Among them, f w(x) is the error function, and α is used to control the relative importance of the constraint operator.

[0103] The D-VAE-WGAN model is collaboratively trained based on the collected original traffic sample data set. Specifically, the D-VAE-WGAN model of the cloud server and each SDN controller is interactively and collaboratively trained based on the collected traffic samples, including:

[0104] Split the original traffic sample data set into a training set and a test set;

[0105] a. The i-th SDN controller uses the input sample x in the training set i and Gaussian noise z i , complete D e Own parameter ω De Update; VAE generates sample data G d (G e (x i ) and sent to the discriminator D located on the cloud server. d ;

[0106] b. Discriminator D d According to the input sample data x sent by the controller i , complete its own parameters ω Dd Updates;

[0107] c. Discriminator D d According to the generated data G sent by the controller d (G e (x i ), calculate the generated error and feed the result back to the i-th controller;

[0108] d. The controller updates G according to the error information fed back e , G d The parameter ω Ge and ω Gd ;

[0109] e. After completing a k-round periodic iteration, exchange parameters ω with the j-th controller by random selection. Ge and ω Gd ;

[0110] f. Repeat ae until the total number of iterations required is completed.

[0111] The content in a is completed by formula (3), the content in b is completed by formula (4), and the content in c is completed by formula (5).

[0112] S104, the cloud server will train the discriminator D dA copy of the encoder G is sent to each subnet controller and compared with the original encoder G in the controller. e , decoder G d and the discriminator D e Together they constitute the detection agent;

[0113] S105, calculating the reconstruction error and discrimination error of the reconstructed sample based on the detection agent, and obtaining the error value of the sample;

[0114] Based on the reconstruction error and discrimination error generated by the detection agent to reconstruct the sample, the error value of the sample is obtained, specifically:

[0115]

[0116] Among them, Z Re (x) is the reconstruction error, which is the difference between the input sample x in the test set and the reconstructed sample The sum of the differences in eigenvalues ​​in the corresponding dimensions is calculated as

[0117]

[0118] in, To discriminate the error, the discriminator considers the difference between the real input sample and the reconstructed sample, which is represented by the Wasserstein distance, that is,

[0119]

[0120] Among them, α∈(0,1).

[0121] The threshold is set as follows: the mean of all sample error values ​​in the training set is calculated plus 3 standard deviations, that is,

[0122]

[0123] S106, making a judgment based on the obtained error value of the sample and the set threshold value, if the error value is greater than the judgment threshold value, the sample is determined to be an abnormal sample.

[0124]

[0125] See also Figure 2 The present invention discloses a SDN abnormal traffic distributed detection system based on D-VAE-WGAN, comprising:

[0126] A collection module, wherein the collection module collects raw traffic sample data sets;

[0127] A construction module, wherein the construction module constructs a D-VAE-WGAN model including a cloud server and a plurality of subnets;

[0128] A training module, wherein the training module performs collaborative training on the D-VAE-WGAN model based on the collected original traffic sample data set to obtain an optimal D-VAE-WGAN model;

[0129] The cloud server of the component module will train the discriminator D d A copy of the encoder G is sent to each subnet controller and compared with the original encoder G in the controller. e , decoder G d and the discriminator D e Together they constitute the detection agent;

[0130] An acquisition module, wherein the acquisition module calculates a reconstruction error and a discrimination error of the reconstructed sample based on the detection agent, and acquires an error value of the sample;

[0131] The judgment module performs judgment based on the error value of the obtained sample and a set threshold value. If the error value is greater than the judgment threshold value, the sample is determined to be an abnormal sample.

[0132] Example:

[0133] See also Figure 3 The present invention discloses a distributed detection topology structure of SDN abnormal traffic based on D-VAE-WGAN. The D-VAE-WGAN model adopts a two-stage operation mode of "centralized training and distributed detection". In the training stage, the model is designed in a "one-to-many" mode, that is, a discriminator on a cloud server corresponds to generators in multiple controllers, and they use normal network traffic samples to complete training centrally. After the training is completed, the cloud server sends a mirror copy of the training results to each controller, and establishes a detection agent with the ability to independently complete anomaly detection on each controller. In the detection stage, the detection agent performs in-depth analysis of the traffic data in the subnet to discover and identify abnormal traffic therein.

[0134] The D-VAE-WGAN model is based on the VAE-WGAN architecture constructed by combining the GAN network and VAE, and proposes the D-VAE-WGAN structure model according to the topological characteristics of large-scale SDN networks. In the VAE-WGAN architecture, VAE is used as the encoder of GAN to assist GAN in completing training; and Wasserstein distance is introduced as a similarity metric to avoid the "mode collapse" problem.

[0135] See also Figure 4, GAN includes a discriminator and a generator. The discriminator and the generator can be CNN, RNN or other neural networks. The generator in GAN reconstructs the input random noise samples to generate new samples; the discriminator will judge the input samples to determine whether they come from the real sample set or the samples generated by the generator, and feed back the judgment results to the generator; the generator adjusts the parameters according to the feedback results and then generates new samples, and the discriminator re-judges and re-feeds back, and repeats this process many times. Therefore, the training process of GAN is actually a process of mutual game between the discriminator and the generator. Usually, the discriminator is trained with real samples first; the generator tries its best to generate approximate samples to deceive the discriminator, and continuously iterates and improves until the generator learns the data distribution of the real samples to generate realistic samples, so that the discriminator cannot distinguish the source of the data, and finally the two reach Nash equilibrium. The optimization goal of GAN can be described as a problem of finding minimum and maximum values.

[0136]

[0137] Among them, x is the real data sample, P r represents the real sample distribution; z is from the random distribution P g The noise data, G(z) is the generated data, and D(x) is the probability that sample x comes from the real sample space.

[0138] The D-VAE-WGAN model architecture is as follows Figure 5 As shown in the figure, each distributed controller contains a complete VAE (including encoder and decoder) and a GAN discriminator. There is only one GAN discriminator on the cloud server, which forms a "one-to-many" generative adversarial network structure with the generator on each controller.

[0139] Figure 5 , inside the SDN controller, the VAE consists of an encoder G e and decoder G d Composition (G e and G d In 2 GANs, it is used as a generator to learn the features of the input sample x and obtain the reconstructed sample G by encoding and decoding. d (G e (x)). The encoder G is trained using the cycle consistency loss function e and decoder G d , to prevent them from causing contradictions when used as GAN generators, the objective function is

[0140]

[0141] In addition, the VAE encoder G e As the generator and discriminator De Form a GAN, for input x~P X , VAE will produce an intermediate output G e (x)~Q Z ; Introduce Gaussian distribution P Z As a constraint, use the random variable z to find the conditional distribution Q(Z|X) so that the boundary of z Q Z =∫Q(Z|X)dP X , by adjusting G e The parameters make G e (x) Obedient Q Z distribution and the prior distribution P Z The distance between them is constantly decreasing to achieve the training generator G e The goal is to use Wasserstein distance as G e With D e The objective function of WGAN-e composed of

[0142]

[0143] In the cloud server, the discriminator D d With the VAE decoder G d As a generator, it forms another WGAN-d structure. In WGAN-d, only using the norm distance cannot accurately describe the similarity between the reconstructed data and the input data. In order to make the reconstructed output of the variational autoencoder closer to the true distribution of the input data, it is proposed to use the discriminator D d To further constrain the difference between the reconstructed data and the input data, WGAN-d also uses Wasserstein distance as the objective function

[0144]

[0145] Since the training of the GAN discriminator and generator is asynchronous, there are three asynchronous training processes for each VAE-WGAN model, each of which has its own loss function and optimizer. Since the GAN discriminator only involves itself during the training phase, it can be directly used with z~P Z The samples in are used as input to train D e ; Use x~P X The samples in are used as input to train D d . The generator G of the two GANs e and G d It also serves as the encoder and decoder of VAE, so when training G e , G dWhen using VAE, we need to take into account the above equations (2), (3), and (4) at the same time, and use the weighted sum of these three objective functions as the final objective function

[0146]

[0147] Among them, λ, γ, and μ are the weights of each objective function, and their sum is 1. In the present invention, the values ​​are 0.4, 0.3, and 0.3 respectively.

[0148] (2) Regularization method based on standard deviation constraint operator

[0149] Considering that the network traffic attribute characteristics do not exist in isolation, there is a certain correlation between these neuron weight elements. In order to better utilize the correlation information between feature weights, a weight matrix is ​​constructed based on a multi-layer neural network, specifically:

[0150]

[0151] Where n is the number of layers in the multi-layer neural network, m is the maximum number of neurons in all neural network layers, ω ij is the weight value of the jth neuron in the ith layer; if there is no neuron at the corresponding position, the weight value is 0. According to the standard deviation calculation method, a constraint operator based on the standard deviation SD is designed, which is:

[0152]

[0153] Use the standard deviation constraint operator as a regularization term to construct the loss function

[0154] Loss = f w (x)+α·σ(ω) (7)

[0155] Among them, f w (x) is the error function, and α is used to control the relative importance of the constraint operator. This regularization method can avoid the risk of overfitting in model training, and is conducive to mining the potential correlation between traffic data, providing richer feature information for data sample classification.

[0156] D-VAE-WGAN model collaborative training method

[0157] In the VAE of the D-VAE-WGAN structure, the encoder and decoder use a multi-layer convolutional network without a pooling layer. The number of neurons in the encoder input layer and the decoder output layer is the same as the dimension of the data to be detected. e and D dIt is a one-dimensional convolutional neural network structure without a Sigmoid layer. The hyperparameters of the model are adjusted according to empirical rules and experimental results, as shown in Table 1. The smoothing constant is used by the RMSProp optimization algorithm, mainly to make the parameter space smoother, which is conducive to improving the convergence speed of the model.

[0158] Table 1. Hyperparameters of D-VAE-WGAN

[0159]

[0160]

[0161] Normal traffic samples are used to interactively and collaboratively train the D-VAE-WGAN models of the cloud server and each SDN controller, including multiple iterative steps. The specific process can be described as follows:

[0162] Split the original traffic sample data set into a training set and a test set;

[0163] a. The i-th SDN controller uses the input sample x in the training set i and Gaussian noise z i , complete D e Own parameter ω De Update; VAE generates sample data G d (G e (x i ) and sent to the discriminator D located on the cloud server d ;

[0164] b. Discriminator D d According to the input sample data x sent by the controller i , complete its own parameters ω Dd Updates;

[0165] c. Discriminator D d According to the generated data G sent by the controller d (G e (x i ), calculate the generated error and feed the result back to the i-th controller;

[0166] d. The controller updates G according to the error information fed back e , G d The parameter ω Ge and ω Gd ;

[0167] e. After completing a k-round periodic iteration, exchange parameters ω with the j-th controller by random selection. Ge and ω Gd ;

[0168] f. Repeat ae until the total number of iterations required is completed.

[0169] The training method using random exchange parameters can further avoid the overfitting problem of controller training. At the same time, it can also share the training results of other controllers, so that each controller can learn the distribution of traffic data in other controller subnets in SDN, thereby forming an overall defense capability for large-scale SDN networks.

[0170] Anomaly detection based on detection agent

[0171] After the model is trained, the cloud server will send the trained D d A copy of the G e , G d and D e Together they constitute the detection agent. The reconstruction of abnormal samples by the detection agent will produce large reconstruction errors and discrimination errors. Therefore, the error value of the sample is defined as a weighted combination of the reconstruction error and the discrimination error, that is,

[0172]

[0173] Among them, Z Re (x) is the reconstruction error, which is the difference between the input sample x in the test set and the reconstructed sample The sum of the differences in eigenvalues ​​in the corresponding dimensions is calculated as

[0174]

[0175] in, is the discrimination error, which is the difference between the real input sample and the reconstructed sample considered by the discriminator, and is still expressed using the Wasserstein distance, that is,

[0176]

[0177] In addition, α∈(0,1) is a parameter that controls the relative importance of the two items, and the value of α is 0.5.

[0178] The error value of the sample is calculated, and the threshold method is used to determine whether the sample is an abnormal sample. The threshold is set according to the "three sigma principle", and the mean of the error values ​​of all samples in the training set is calculated plus 3 standard deviations to obtain the value, that is,

[0179]

[0180] During anomaly detection, the detection agent on the controller detects all traffic samples in the subnet. When the error value of a sample is detected to be greater than the judgment threshold, the sample is judged as an abnormal sample.

[0181]

[0182] To verify the generalization ability of the proposed method, the detection agent performance is evaluated on popular public network traffic datasets such as CIC-IDS2017, CSE-CIC-IDS2018, CIC-DDoS2019, and UNSW-NB15. 48 feature data are selected from CIC-IDS2017, CSE-CIC-IDS2018, and CIC-DDoS2019 datasets; 48 features other than labels are selected from UNSW-NB15 as experimental data. A certain amount of normal samples are extracted from their respective original datasets and divided into a ratio of 7:3, and 70% of the normal samples are used as the training set; a certain amount of abnormal samples are extracted again and another 30% of normal samples are used to form a test set with different abnormal sample proportions. The specific information is shown in Table 2.

[0183] Table 2 Relevant information of each network traffic data set

[0184]

[0185] First, select one of the four datasets, use its training set to fully train the D-VAE-WGAN architecture model, and complete the construction of each subnet detection agent; then use the test set of this dataset to test the detection performance of each detection agent and record the detection results. Then, use other datasets to train the model, build detection agents, implement anomaly detection, and record detection results until several datasets have been tested. Figure 6 Demonstrates the detection performance of each detection agent on abnormal samples in 4 datasets

[0186] from Figure 6It can be seen that the highest accuracy of each detection agent for abnormal sample detection is 98.89% and the lowest is 95.13%; the highest recall rate is 98.51% and the lowest is 94.33%. This shows that the detection agent generated based on the D-VAE-WGAN architecture also has a strong ability to discriminate traffic data in heterogeneous networks. The detection effect of the detection agent on the four data sets is relatively good, indicating that the D-VAE-WGAN architecture model also has good adaptability to network data with different abnormal proportions. In addition, D-VAE-WGAN can complete training using only normal traffic samples. Even if the detection agent has not seen abnormal traffic samples during the training stage, it can still detect abnormal samples well during the detection stage. This shows that the detection agent has a good recognition ability for unknown abnormal samples.

[0187] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A distributed detection method for abnormal SDN traffic based on D-VAE-WGAN, characterized in that: include: Collecting raw traffic sample data sets; Build a D-VAE-WGAN model that includes a cloud server and several subnets; Based on the collected original traffic sample data set, the D-VAE-WGAN model is co-trained to obtain the optimal D-VAE-WGAN model; The cloud server will train the discriminator D d A copy of the encoder G is sent to each subnet controller and compared with the original encoder G in the controller. e , decoder G d and the discriminator D e Together they constitute the detection agent; Based on the detection agent, the reconstruction error and discrimination error of the reconstructed sample are calculated to obtain the error value of the sample; A judgment is made based on the error value of the obtained sample and the set threshold. If the error value is greater than the judgment threshold, the sample is determined to be an abnormal sample.

2. According to claim 1, the SDN abnormal traffic distributed detection method based on D-VAE-WGAN is characterized in that: The D-VAE-WGAN model comprising a cloud server and several subnets is constructed as follows: the cloud server communicates data with the subnets respectively; the cloud server comprises a discriminator D d ; The subnet includes encoder G e , decoder G d and the discriminator D e .

3. The SDN abnormal traffic distributed detection method based on D-VAE-WGAN according to claim 2 is characterized in that: Before the D-VAE-WGAN model is collaboratively trained, the D-VAE-WGAN model is also jointly optimized based on the Wasserstein distance, specifically: Inside the subnet, the learning sample is input to the encoder G e and decoder G d In the above example, the reconstructed sample G is obtained by encoding and decoding. d (G e (x)) ; Train the encoder G based on the cycle consistency loss function e and decoder G d , when the cycle consistency loss function is minimized, the optimal encoder G is obtained e and decoder G d ; For input x~P X , encoder G e As the generator and discriminator D e Working together to produce the intermediate output G e (x)~Q Z ; Introduce Gaussian distribution P Z As a constraint, use the random variable z to find the conditional distribution Q(Z|X) so that the bounds of the random variable z are Q Z =∫Q(Z|X)dP X , by adjusting the encoder G e The parameters make G e (x) Obey Q Z The distribution of Z The distance between them keeps decreasing, and the training generator G is realized e The goal is to use the Wasserstein distance as the encoder G e and the discriminator D e The objective function of WGAN-e composed of Decoder G d Discriminator D with cloud server d As a generator, it forms a WGAN-d structure; based on the discriminator D d The difference between the constrained reconstructed data and the input data is optimized based on the Wasserstein distance as the objective function. When the Wasserstein distance is minimized, the optimized WGAN-d is obtained. The cycle consistency loss function, the Wasserstein distance of WGAN-e, and the Wasserstein distance objective function of WGAN-d are weighted to obtain the final Wasserstein distance objective function.

4. The SDN abnormal traffic distributed detection method based on D-VAE-WGAN according to claim 3 is characterized in that: The cycle consistency loss function is: The Wasserstein distance is used as the encoder G e and the discriminator D e The objective function of WGAN-e is: The Wasserstein distance objective function of the WGAN-d is: The final Wasserstein distance objective function is Among them, λ, γ, μ are the weights of each objective function, and the sum of λ, γ, μ is 1.

5. The SDN abnormal traffic distributed detection method based on D-VAE-WGAN according to claim 4 is characterized in that: Before the D-VAE-WGAN model is collaboratively trained, the method further includes: considering the weight relationship between samples and constructing a weight matrix based on a multi-layer neural network, specifically: Where n is the number of layers in the multi-layer neural network, m is the maximum number of neurons in all neural network layers, ω ij is the weight value of the jth neuron in the i-th layer; if there is no neuron at the corresponding position, the weight value is 0; according to the standard deviation calculation method, the constraint operator based on the standard deviation SD is obtained, which is: Based on the standard deviation constraint operator as a regularization term, a loss function is constructed, specifically: Loss=f w (x)+a·s(ω) (6) Among them, f w (x) is the error function, and α is used to control the relative importance of the constraint operator.

6. The SDN abnormal traffic distributed detection method based on D-VAE-WGAN according to claim 5 is characterized in that: The D-VAE-WGAN model is collaboratively trained based on the collected original traffic sample data set, specifically: the D-VAE-WGAN model of the cloud server and each SDN controller is interactively and collaboratively trained based on the collected traffic samples, including: Split the original traffic sample data set into a training set and a test set; a. The i-th SDN controller uses the input sample x in the training set i and Gaussian noise z i , complete D e Own parameter ω De Update; VAE generates sample data G d (G e (x i ) and sent to the discriminator D located on the cloud server d ; b. Discriminator D d According to the input sample data x sent by the controller i , complete its own parameters ω Dd Updates; c. Discriminator D d According to the generated data G sent by the controller d (G e (x i ), calculate the generated error and feed the result back to the i-th controller; d. The controller updates G according to the error information fed back e , G d The parameter ω Ge and ω Gd ; e. After completing a k-round periodic iteration, exchange parameters ω with the j-th controller by random selection. Ge and ω Gd ; f. Repeat ae until the total number of iterations required is completed.

7. The SDN abnormal traffic distributed detection method based on D-VAE-WGAN according to claim 6 is characterized in that: The error value of the sample is obtained by reconstructing the sample based on the reconstruction error and the discrimination error generated by the detection agent, specifically: Among them, Z Re (x) is the reconstruction error, which is the difference between the input sample x in the test set and the reconstructed sample The sum of the differences in eigenvalues ​​in the corresponding dimensions is calculated as in, To discriminate the error, the discriminator considers the difference between the real input sample and the reconstructed sample, which is represented by the Wasserstein distance, that is, Among them, α∈(0,1).

8. The SDN abnormal traffic distributed detection method based on D-VAE-WGAN according to claim 7 is characterized in that: The threshold value is calculated by adding 3 standard deviations to the mean of all sample error values ​​in the training set, that is, The judgment is made based on the error value of the obtained sample and the set threshold, specifically:

9. The SDN abnormal traffic distributed detection system based on D-VAE-WGAN is characterized by: include: A collection module, wherein the collection module collects raw traffic sample data sets; A construction module, wherein the construction module constructs a D-VAE-WGAN model including a cloud server and a plurality of subnets; A training module, wherein the training module performs collaborative training on the D-VAE-WGAN model based on the collected original traffic sample data set to obtain an optimal D-VAE-WGAN model; The cloud server of the component module will train the discriminator D d A copy of the encoder G is sent to each subnet controller and compared with the original encoder G in the controller. e , decoder G d and the discriminator D e Together they constitute the detection agent; An acquisition module, wherein the acquisition module calculates a reconstruction error and a discrimination error of the reconstructed sample based on the detection agent, and acquires an error value of the sample; The judgment module performs judgment based on the error value of the obtained sample and a set threshold value. If the error value is greater than the judgment threshold value, the sample is determined to be an abnormal sample.

Images