A method and device for detecting anomaly of encrypted traffic based on multi-resolution model

Abstract

The present invention provides an encrypted traffic anomaly detection method and device based on a multi-resolution model, and relates to the technical field of encrypted traffic anomaly detection. The method comprises: capturing traffic through the Internet to obtain a variety of mixed flows; processing traffic data on the multiple mixed flows to obtain a sub-flow set and a hexadecimal data packet set; capturing multi-level semantic information through a multi-resolution model based on the multiple mixed flows, sub-flow sets and hexadecimal data packet sets to obtain a mixed flow CLS tag; performing encrypted traffic anomaly detection through a multi-layer perceptron based on the mixed flow CLS tag to obtain an encrypted traffic anomaly detection result. The present invention is an efficient and accurate encrypted traffic anomaly detection method based on a multi-level data structure.

Description

Technical Field

[0001] The present invention relates to the technical field of encrypted traffic anomaly detection, and in particular to an encrypted traffic anomaly detection method and device based on a multi-resolution model. Background Art

[0002] A multi-resolution model is a model that learns and extracts features at different levels of data to better capture the hierarchical structure and semantic associations in the data. By effectively modeling features at different levels, the performance of the model in complex tasks can be significantly improved.

[0003] In the field of computer vision, multi-level feature perception is usually achieved by constructing multi-scale feature representations. For example, Feature Pyramid Network (FPN) is a multi-level architecture for object detection tasks. It fuses features of different scales in a top-down manner, and is particularly suitable for processing objects of different sizes in images. By combining high-level semantic information with low-level detail information, FPN can better handle the detection problem of multi-scale objects. In the field of natural language processing, task learning methods can learn multi-level information by training multiple related tasks simultaneously. For example, a model can learn word-level part-of-speech tagging tasks on one task, sentence-level syntactic analysis tasks on another task, and paragraph-level sentiment analysis tasks on a third task. In this way, the model can share knowledge among tasks at different levels and enhance its hierarchical understanding ability. However, in the field of encrypted traffic detection, most existing models focus on a single feature level, such as byte sequences at the packet level or statistical features at the flow level. These methods are insufficient in capturing inter-packet associations, intra-flow contexts, and inter-flow interactions. In existing methods, traffic data is usually expanded sequentially into homogeneous vectors and input into the model, which loses the hierarchical structure of the data and cannot effectively capture cross-level semantic relationships.

[0004] In existing encrypted traffic classification methods, key features are selected through component analysis algorithms to improve classification accuracy and reduce computational overhead, such as the average impurity reduction algorithm. Or statistical features such as minimum, maximum, mean, standard deviation, etc. are extracted using the MIRAGE tool. Although these machine learning methods based on statistical features have achieved certain results in traffic classification, they usually rely on features designed by experts. These methods require prior knowledge to select appropriate features, so when faced with new and unknown traffic types, machine learning methods have poor adaptability. In addition, features designed by experts often cannot capture the complex relationships in traffic data, which limits the accuracy and robustness of the model.

[0005] Deep learning-based methods usually use deep neural network architectures such as convolutional neural networks and recurrent neural networks to analyze traffic data. Convolutional neural networks are used to process encrypted traffic, automatically extract features from data, and gradually abstract higher-level feature information through multi-layer convolution operations. In the analysis of encrypted traffic, convolutional neural networks can effectively identify and classify traffic features by learning the spatial structure of traffic data. End-to-end deep learning does not require artificial design of complex features and directly uses raw traffic data for training. Based on convolutional neural networks combined with long short-term memory neural networks, spatial features and temporal features of traffic are learned respectively. The model's detection ability for encrypted traffic is enhanced, especially when facing new malicious traffic, showing good adaptability. Deep learning methods have made significant progress in traffic analysis, but encrypted traffic classification methods based on deep learning only study from the flow level or packet level, and do not use features at different granularities. The original input does not include flow-level features, that is, it does not include the length distribution of all packets in the data flow and arrival time information.

[0006] Pre-training methods can learn effective feature representations from a large amount of unlabeled data in encrypted traffic classification. Unlike traditional traffic classification methods, pre-training methods use unlabeled traffic data for pre-training through self-supervised learning, which significantly improves the generalization ability and classification performance of the model. The BERT pre-training model is used to model the context data stream level using large-scale unlabeled encrypted traffic data. In the data preprocessing stage, the network traffic data packets are divided into header and payload segments, and the context features of the traffic are extracted to improve the classification and anomaly detection capabilities of encrypted traffic. The pre-training method significantly reduces the dependence on labeled data through self-supervised learning and learns effective representations from a large amount of unlabeled traffic data. However, the current mainstream pre-training models are almost all based on the Transformer architecture, which uses a quadratic self-attention mechanism to calculate the correlation within the sequence. This has very high computational and memory costs for long sequences and has shortcomings.

[0007] In the prior art, there is a lack of an efficient and accurate encrypted traffic anomaly detection method based on a multi-level data structure. Summary of the invention

[0008] In order to solve the technical problem that the hierarchical structure of data is lost in the prior art and the cross-level semantic relationship cannot be effectively captured, the embodiment of the present invention provides a method and device for detecting anomalies in encrypted traffic based on a multi-resolution model. The technical solution is as follows:

[0009] On the one hand, a method for detecting anomalies of encrypted traffic based on a multi-resolution model is provided, the method being implemented by an encrypted traffic anomaly detection device, the method comprising:

[0010] Capturing traffic through the Internet to obtain multiple mixed flows; processing traffic data on the multiple mixed flows to obtain a sub-flow set and a hexadecimal data packet set;

[0011] According to the multiple mixed flows, the sub-flow set and the hexadecimal data packet set, multi-level semantic information is captured by a multi-resolution model to obtain a mixed flow CLS tag;

[0012] According to the multiple mixed flows, the sub-flow set and the hexadecimal data packet set, multi-level semantic information is captured by a multi-resolution model to obtain a mixed flow CLS tag, including:

[0013] Based on the learnable projection matrix, data packet level semantic information is captured according to the hexadecimal data packet set to obtain a data packet CLS tag set;

[0014] Capturing stream-level semantic information according to the data packet CLS tag set and the sub-stream set to obtain a sub-stream CLS tag set;

[0015] Capturing session-level semantic information according to the substream CLS tag set and the multiple hybrid streams to obtain hybrid stream CLS tags;

[0016] According to the mixed flow CLS mark, encrypted traffic anomaly detection is performed through a multi-layer perceptron to obtain an encrypted traffic anomaly detection result.

[0017] On the other hand, a device for detecting anomalies of encrypted traffic based on a multi-resolution model is provided, and the device is applied to a method for detecting anomalies of encrypted traffic based on a multi-resolution model, and the device includes:

[0018] A traffic acquisition module is used to capture traffic through the Internet to obtain multiple mixed flows; process the traffic data of the multiple mixed flows to obtain a sub-flow set and a hexadecimal data packet set;

[0019] A multi-level semantic information capture module, used to capture multi-level semantic information through a multi-resolution model according to the multiple mixed flows, the sub-flow set and the hexadecimal data packet set, to obtain a mixed flow CLS tag;

[0020] According to the multiple mixed flows, the sub-flow set and the hexadecimal data packet set, multi-level semantic information is captured by a multi-resolution model to obtain a mixed flow CLS tag, including:

[0021] Based on the learnable projection matrix, data packet level semantic information is captured according to the hexadecimal data packet set to obtain a data packet CLS tag set;

[0022] Capturing stream-level semantic information according to the data packet CLS tag set and the sub-stream set to obtain a sub-stream CLS tag set;

[0023] Capturing session-level semantic information according to the substream CLS tag set and the multiple hybrid streams to obtain hybrid stream CLS tags;

[0024] The encrypted traffic anomaly detection module is used to perform encrypted traffic anomaly detection through a multi-layer perceptron according to the mixed flow CLS mark to obtain an encrypted traffic anomaly detection result.

[0025] On the other hand, an encrypted traffic anomaly detection device is provided, comprising: a processor; a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, any one of the above-mentioned encrypted traffic anomaly detection methods based on the multi-resolution model is implemented.

[0026] On the other hand, a computer-readable storage medium is provided, in which at least one instruction is stored. The at least one instruction is loaded and executed by a processor to implement any one of the above-mentioned encrypted traffic anomaly detection methods based on a multi-resolution model.

[0027] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0028] The present invention proposes an encrypted traffic anomaly detection method based on a multi-resolution model, which performs multi-level temporal semantic capture on encrypted traffic through a multi-resolution model, and performs semantic capture of different fine-grained levels at the packet level, stream level and session level of encrypted traffic; improves the adaptability of encrypted traffic detection to complex scenarios; based on the Mamba module, the multi-resolution model has higher detection efficiency and lower resource consumption, and effectively processes long sequences of encrypted traffic, etc. The present invention is an efficient and accurate encrypted traffic anomaly detection method based on a multi-level data structure. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0030] Figure 1 It is a flow chart of a method for detecting anomalies of encrypted traffic based on a multi-resolution model provided by an embodiment of the present invention;

[0031] Figure 2It is a schematic diagram of the relationship between a data packet and a data flow provided by an embodiment of the present invention;

[0032] Figure 3 It is a schematic diagram of a linear projection process of a data packet provided by an embodiment of the present invention;

[0033] Figure 4 It is a block diagram of an encrypted traffic anomaly detection device based on a multi-resolution model provided by an embodiment of the present invention;

[0034] Figure 5 It is a structural diagram of an encrypted traffic anomaly detection device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0035] The technical solution of the present invention is described below in conjunction with the accompanying drawings.

[0036] In the embodiments of the present invention, words such as "exemplarily" and "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "example" in the present invention should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "example" is intended to present the concept in a specific way. In addition, in the embodiments of the present invention, the meaning expressed by "and / or" can be both, or it can be either of the two.

[0037] In the embodiments of the present invention, "image" and "picture" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they intend to express are the same. "of", "corresponding, relevant" and "corresponding" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they intend to express are the same.

[0038] In the embodiments of the present invention, sometimes a subscript such as W1 may be written as a non-subscript such as W1. When the difference is not emphasized, the meanings to be expressed are the same.

[0039] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0040] The embodiment of the present invention provides an encrypted traffic anomaly detection method based on a multi-resolution model, which can be implemented by an encrypted traffic anomaly detection device, which can be a terminal or a server. Figure 1 The flowchart of the encrypted traffic anomaly detection method based on the multi-resolution model is shown. The processing flow of the method may include the following steps:

[0041] S1. Capture traffic through the Internet to obtain multiple mixed flows; process traffic data of the multiple mixed flows to obtain a sub-flow set and a hexadecimal data packet set.

[0042] Optionally, traffic data processing is performed on the multiple mixed flows to obtain a sub-flow set and a hexadecimal data packet set, including:

[0043] Perform sub-flow segmentation on multiple mixed flows to obtain a sub-flow set;

[0044] Perform quintuple segmentation on each subflow in the subflow set to obtain a data packet set;

[0045] The data packet set is converted into a hexadecimal data packet set.

[0046] In a feasible implementation manner, the traffic (multiple mixed streams) captured from the network in the present invention includes a request stream for accessing a website, a playback stream of video streaming media, and a transmission stream for downloading files.

[0047] Divide multiple mixed flows (session level) into different flows (flow level). In this step, the flows are divided into five-tuples, which include source IP, destination IP, protocol type, source port number, and destination port number. Data packets with the same five-tuple belong to the same flow within a unit time. Further, the flow is divided into different data packets. For the segmentation of data packets, the Transmission Control Protocol / User Datagram Protocol (TCP / UDP) based on the traffic defines the boundaries of the data packets to ensure that the time series characteristics between data packets are preserved. The relationship between data packets and flows is as follows: Figure 2 Similarly, the relationship between the flow and the multiple mixed flows is also divided as described above, and will not be repeated here.

[0048] S2, according to the multiple mixed flows, sub-flow sets and hexadecimal data packet sets, multi-level semantic information is captured through a multi-resolution model to obtain a mixed flow CLS tag;

[0049] Among them, according to multiple mixed flows, sub-flow sets and hexadecimal data packet sets, multi-level semantic information is captured through a multi-resolution model to obtain mixed flow CLS tags, including:

[0050] Based on the learnable projection matrix, the packet-level semantic information is captured according to the hexadecimal packet set to obtain the packet CLS tag set;

[0051] Capture flow-level semantic information according to the data packet CLS tag set and the sub-flow set to obtain the sub-flow CLS tag set;

[0052] The session-level semantic information is captured according to the sub-stream CLS tag set and multiple mixed streams to obtain the mixed stream CLS tags.

[0053] In a feasible implementation, in the present invention, traffic contains information of different resolutions, such as packet granularity, flow granularity, session granularity, etc. Each resolution can provide certain information about the behavior of traffic. Generally speaking, the more complex the attack behavior, the more resolution information is needed to detect malicious traffic.

[0054] The information at the packet level is mostly single-dimensional information (such as the packet length of the packet). The flow-level data contains the handshake information of the communicating parties (client and server) and the sequence information of the packet (the length distribution of all packets in the flow and the arrival time information). The session data contains the count and average duration of the flow, which can provide information about the complete user-host interaction. Therefore, information of different resolutions has different focuses in traffic analysis, and in the present invention, information of different resolutions is used to realize encrypted traffic detection.

[0055] Among them, the multi-resolution model is constructed according to the model structure of the Mamba module.

[0056] In a feasible implementation, in actual applications, network traffic is very huge. Mamba (Linear-Time Sequence Modeling with Selective StateSpaces) has strong long-context processing capabilities and can effectively process long sequences in the stream. Calculating huge network traffic is quite time-consuming and resource-intensive. Mamba is a model with linear time complexity, which has higher efficiency and lower resource consumption. Mamba excels in the field of representation learning.

[0057] In the existing technology, the most advanced methods of traffic analysis mainly use the Transformer architecture, which uses a self-attention mechanism with quadratic complexity to calculate the correlation within the sequence. This has very high computational and memory costs for long sequences. The Mamba module has obvious advantages over the Transformer architecture in the network field.

[0058] Optionally, based on the learnable projection matrix, data packet level semantic information is captured according to the hexadecimal data packet set to obtain a data packet CLS tag set, including:

[0059] Based on the learnable projection matrix, a linear mapping is performed on the hexadecimal data packet set to obtain a data packet embedding vector set;

[0060] Based on the data packet embedding vector set, construct a data packet SEG field set according to the sixteen-mechanism data packet set;

[0061] Perform splicing according to the data packet embedding vector set and the data packet SEG field set to obtain a first extended embedding vector set;

[0062] Adding an initial CLS tag to the first extended embedding vector set to obtain a second extended embedding vector set;

[0063] According to the second extended embedding vector set, cross scanning is used to capture dynamic timing semantics at the data packet level to obtain a data packet Concatenate token vector set; according to the data packet Concatenate token vector set, a data packet CLS tag set is obtained.

[0064] Here, the initial CLS token is a zero matrix with the same dimension as the first expanded embedding vector.

[0065] In a feasible implementation, Figure 3 As shown, after obtaining the data packet in the present invention, each data packet is linearly projected to obtain the embedding vector of the data packet. The embedding vector of each data packet retains the original information and captures the features useful for classification. The mathematical expression of this process is as follows (1):

[0066] (1);

[0067] Among them, pi in the formula corresponds to the i-th data packet, and W is initially generated by random initialization. It is a learnable and optimized projection matrix.

[0068] In this way, the original information of each data packet is mapped into a high-dimensional vector space. This high-dimensional vector representation can not only maintain the original information of each data packet, but also capture implicit features, such as the indicative relationship between specific byte patterns and traffic malice. Another advantage of high-dimensional mapping is that it helps solve the problem of high noise in the original byte stream. Through projection, noise reduction and feature enhancement can be achieved, providing more stable input for subsequent models. In this way, the key information of the packet can be retained, more features can be learned, and subsequent processing is facilitated.

[0069] The segment field (SEG) is used to represent information specific to the packet stage (such as the length of the packet), and the projection matrix is ​​used to project the SEG field into a form that can be spliced ​​with the embedded vector of the data packet. The SEG field is generated as follows: the statistical information of the data packet (such as the length of the packet, the transmission time of the packet) is first formed into a one-dimensional vector such as (10, 2), and the projection matrix is ​​used to project the vector into a form that can be spliced ​​with the embedded vector of the data packet to obtain the SEG field.

[0070] The design of the SEG field is particularly important, as it provides supplementary contextual information in addition to the original data packet content, and the present invention uses the Common Language Specification (CLS) tag to aggregate the information of a single data packet. The CLS tag is generated as follows: The CLS tag is initialized as a matrix of all zeros and is concatenated to the end of the embedding vector of the data packet. After entering the Mamba module, the output data packet CLS tag is used to aggregate the global information of the embedding vector of each data packet, helping the model to better understand the internal relationship and feature information of the packet.

[0071] Another advantage of CLS tagging is that it shortens the input and improves model efficiency. In a multi-resolution model, a large number of data packets or flow inputs need to be processed. Introducing CLS tags into a traffic monitoring model that combines multiple levels can effectively improve model reasoning.

[0072] The Mamba 2D model in the Mamba module uses a cross-scanning method to effectively capture the connections between different packets or different flows. The embedding vector of the data packet containing the CLS tag will be input into the data packet Mamba module for further processing. The Mamba module uses cross-scanning to process the input. The Mamba module scans both inside the data packet and between data packets. This cross-scanning mechanism is a joint extraction technology of global and local features. In the local scope, the module can capture the patterns and relationships inside the data packet; in the global scope, it can identify the timing relationships and statistical laws between data packets. This design can effectively improve the robustness of the model to complex traffic patterns and better learn various features.

[0073] After obtaining the concatenate token vector of the data packet, the CLS tag of the data packet is taken out. This CLS tag contains information at the data packet level, such as the characteristic information of the data packet itself and the relationship between the data packets.

[0074] Optionally, capturing flow-level semantic information according to the data packet CLS tag set and the sub-flow set to obtain the sub-flow CLS tag set includes:

[0075] The sub-flow set and the data packet CLS tag set are concatenated to obtain a sub-flow embedding vector set;

[0076] Based on the substream embedding vector set, a substream SEG field set is constructed according to the substream set;

[0077] Perform concatenation according to the substream embedding vector set and the substream SEG field set to obtain a third extended embedding vector set;

[0078] adding an initial CLS tag to the third extended embedding vector set to obtain a fourth extended embedding vector set;

[0079] According to the fourth extended embedding vector set, cross scanning is used to capture dynamic temporal semantics at the stream level to obtain a substream Concatenate token vector set; based on the substream Concatenate token vector set, a substream CLS tag set is obtained.

[0080] In a feasible implementation manner, the present invention splices the data packet CLS tag set with the sub-stream set at the stream level to obtain the embedded vector of the stream. Based on the splicing of the SEG field after the embedded vector of the data packet in the above steps, the representation of the stream is actually the fusion result of the data packet characteristics and the global statistical information of the stream, so it has higher expression ability and can adapt to more complex traffic pattern analysis needs. In order to further enhance the ability of the embedded vector representation of the stream, an initial CLS tag is added after the embedded vector of each stream. The CLS tag is used to aggregate the global information of the embedded vector of the entire stream. Similarly, the fourth extended embedded vector set is input into the sub-stream Mamba module, and the input is processed using cross scanning. The Mamba module will scan the inside of the stream as well as the streams and between the streams to capture more information.

[0081] Optionally, capturing session-level semantic information according to the substream CLS tag set and the multiple hybrid streams to obtain the hybrid stream CLS tags includes:

[0082] Concatenate multiple mixed streams and sub-stream CLS tag sets to obtain a mixed stream embedding vector;

[0083] Based on the mixed stream embedding vector, a mixed stream SEG field is constructed according to multiple mixed streams;

[0084] Perform concatenation according to the mixed stream embedding vector and the mixed stream SEG field to obtain a fifth extended embedding vector set;

[0085] Adding an initial CLS tag to the fifth extended embedding vector to obtain a sixth extended embedding vector;

[0086] According to the sixth extended embedding vector set, cross scanning is used to capture dynamic temporal semantics at the session level to obtain a mixed stream Concatenate token vector set; according to the mixed stream Concatenate token vector set, a mixed stream CLS tag is obtained.

[0087] In a feasible implementation manner, the present invention also splices the CLS of the concatenate token vectors of multiple sub-streams in the output at the session level to form a complete embedding vector of multiple mixed streams. This vector includes both the global view across streams and the features within the stream, effectively capturing the potential interaction relationship between different streams. The SEG field is also used to effectively represent the network features of the entire multiple mixed streams (including the count and average duration of the stream). After the embedding vectors of the multiple mixed streams are spliced ​​with the SEG, an initial CLS tag is added to the embedding vector of the multiple mixed streams. The CLS tag is used to aggregate the global information of the embedding vector of the entire multiple mixed streams. It is then input into the mixed stream Mamba module to obtain the mixed stream concatenate token vector and the mixed stream CLS tag.

[0088] S3. According to the CLS mark of the mixed flow, encrypted traffic anomaly detection is performed through a multi-layer perceptron to obtain the encrypted traffic anomaly detection result.

[0089] In one feasible implementation, the mixed flow CLS tag is input into the multilayer perceptron (MLP) classification head for classification. The core of the design of the MLP classification head is to achieve the task of traffic classification. By introducing the multilayer perceptron structure, the model can learn nonlinear patterns in the traffic and use these patterns for fine-grained classification decisions.

[0090] After obtaining the output of the MLP classification head, the output can generate a probability distribution for each possible label, which is the normal or abnormal traffic (multiple mixed flows) in the captured network as our initial model input. Based on this detection result, real-time malicious traffic detection, traffic distribution optimization, and intrusion response strategy formulation can be achieved.

[0091] The present invention proposes an encrypted traffic anomaly detection method based on a multi-resolution model, which performs multi-level temporal semantic capture on encrypted traffic through a multi-resolution model, and performs semantic capture of different fine-grained levels at the packet level, stream level and session level of encrypted traffic; improves the adaptability of encrypted traffic detection to complex scenarios; based on the Mamba module, the multi-resolution model has higher detection efficiency and lower resource consumption, and effectively processes long sequences of encrypted traffic, etc. The present invention is an efficient and accurate encrypted traffic anomaly detection method based on a multi-level data structure.

[0092] Figure 4 The invention is a block diagram of an encrypted traffic anomaly detection device based on a multi-resolution model according to an exemplary embodiment. The device is used in an encrypted traffic anomaly detection method based on a multi-resolution model. Figure 4The device includes a traffic acquisition module 410, a multi-level semantic information capture module 420, and an encrypted traffic anomaly detection module 430. Among them:

[0093] The traffic acquisition module 410 is used to capture traffic through the Internet to obtain multiple mixed flows; process the traffic data of the multiple mixed flows to obtain a sub-flow set and a hexadecimal data packet set;

[0094] A multi-level semantic information capturing module 420, configured to capture multi-level semantic information through a multi-resolution model according to a plurality of mixed flows, sub-flow sets and hexadecimal data packet sets, and obtain a mixed flow CLS tag;

[0095] Among them, according to multiple mixed flows, sub-flow sets and hexadecimal data packet sets, multi-level semantic information is captured through a multi-resolution model to obtain mixed flow CLS tags, including:

[0096] Based on the learnable projection matrix, the packet-level semantic information is captured according to the hexadecimal packet set to obtain the packet CLS tag set;

[0097] Capture flow-level semantic information according to the data packet CLS tag set and the sub-flow set to obtain the sub-flow CLS tag set;

[0098] Capture session-level semantic information based on the substream CLS tag set and multiple mixed streams to obtain mixed stream CLS tags;

[0099] The encrypted traffic anomaly detection module 430 is used to perform encrypted traffic anomaly detection through a multi-layer perceptron according to the mixed flow CLS mark to obtain an encrypted traffic anomaly detection result.

[0100] Optionally, the traffic acquisition module 410 is further configured to:

[0101] Perform sub-flow segmentation on multiple mixed flows to obtain a sub-flow set;

[0102] Perform quintuple segmentation on each subflow in the subflow set to obtain a data packet set;

[0103] The data packet set is converted into a hexadecimal data packet set.

[0104] Among them, the multi-resolution model is constructed according to the model structure of the Mamba module.

[0105] Optionally, the multi-level semantic information capturing module 420 is further used to:

[0106] Based on the learnable projection matrix, a linear mapping is performed on the hexadecimal data packet set to obtain a data packet embedding vector set;

[0107] Based on the data packet embedding vector set, construct a data packet SEG field set according to the sixteen-mechanism data packet set;

[0108] Perform splicing according to the data packet embedding vector set and the data packet SEG field set to obtain a first extended embedding vector set;

[0109] Adding an initial CLS tag to the first extended embedding vector set to obtain a second extended embedding vector set;

[0110] According to the second extended embedding vector set, cross scanning is used to capture dynamic timing semantics at the data packet level to obtain a data packet Concatenate token vector set; according to the data packet Concatenate token vector set, a data packet CLS tag set is obtained.

[0111] Optionally, the multi-level semantic information capturing module 420 is further used to:

[0112] The sub-flow set and the data packet CLS tag set are concatenated to obtain a sub-flow embedding vector set;

[0113] Based on the substream embedding vector set, a substream SEG field set is constructed according to the substream set;

[0114] Perform concatenation according to the substream embedding vector set and the substream SEG field set to obtain a third extended embedding vector set;

[0115] adding an initial CLS tag to the third extended embedding vector set to obtain a fourth extended embedding vector set;

[0116] According to the fourth extended embedding vector set, cross scanning is used to capture dynamic temporal semantics at the stream level to obtain a substream Concatenate token vector set; based on the substream Concatenate token vector set, a substream CLS tag set is obtained.

[0117] Optionally, the multi-level semantic information capturing module 420 is further used to:

[0118] Concatenate multiple mixed streams and sub-stream CLS tag sets to obtain a mixed stream embedding vector;

[0119] Based on the mixed stream embedding vector, a mixed stream SEG field is constructed according to multiple mixed streams;

[0120] Perform concatenation according to the mixed stream embedding vector and the mixed stream SEG field to obtain a fifth extended embedding vector set;

[0121] Adding an initial CLS tag to the fifth extended embedding vector to obtain a sixth extended embedding vector;

[0122] According to the sixth extended embedding vector set, cross scanning is used to capture dynamic temporal semantics at the session level to obtain a mixed stream Concatenate token vector set; according to the mixed stream Concatenate token vector set, a mixed stream CLS tag is obtained.

[0123] Here, the initial CLS token is a zero matrix with the same dimension as the first expanded embedding vector.

[0124] The present invention proposes an encrypted traffic anomaly detection method based on a multi-resolution model, which performs multi-level temporal semantic capture on encrypted traffic through a multi-resolution model, and performs semantic capture of different fine-grained levels at the packet level, stream level and session level of encrypted traffic; improves the adaptability of encrypted traffic detection to complex scenarios; based on the Mamba module, the multi-resolution model has higher detection efficiency and lower resource consumption, and effectively processes long sequences of encrypted traffic, etc. The present invention is an efficient and accurate encrypted traffic anomaly detection method based on a multi-level data structure.

[0125] Figure 5 is a schematic diagram of the structure of an encrypted traffic anomaly detection device provided by an embodiment of the present invention, such as Figure 5 As shown, the encrypted traffic anomaly detection device may include the above Figure 4 The encrypted traffic anomaly detection device based on a multi-resolution model is shown. Optionally, the encrypted traffic anomaly detection device 510 may include a first processor 2001 .

[0126] Optionally, the encrypted traffic anomaly detection device 510 may further include a memory 2002 and a transceiver 2003 .

[0127] The first processor 2001, the memory 2002 and the transceiver 2003 may be connected via a communication bus.

[0128] Combine the following Figure 5 The components of the encrypted traffic anomaly detection device 510 are described in detail:

[0129] The first processor 2001 is the control center of the encrypted traffic anomaly detection device 510, and may be a processor or a general term for multiple processing elements. For example, the first processor 2001 is one or more central processing units (CPUs), or may be application specific integrated circuits (ASICs), or may be one or more integrated circuits configured to implement the embodiments of the present invention, such as one or more microprocessors (digital signal processors, DSPs), or one or more field programmable gate arrays (field programmable gate arrays, FPGAs).

[0130] Optionally, the first processor 2001 can perform various functions of the encrypted traffic anomaly detection device 510 by running or executing a software program stored in the memory 2002 and calling data stored in the memory 2002.

[0131] In a specific implementation, as an embodiment, the first processor 2001 may include one or more CPUs, such as Figure 5 CPU0 and CPU1 are shown in FIG.

[0132] In a specific implementation, as an embodiment, the encrypted traffic anomaly detection device 510 may also include multiple processors, such as Figure 5 The first processor 2001 and the second processor 2004 are shown in FIG. Each of these processors may be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). The processor here may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0133] The memory 2002 is used to store the software program for executing the solution of the present invention, and is controlled to be executed by the first processor 2001. The specific implementation method can refer to the above method embodiment, which will not be repeated here.

[0134] Optionally, the memory 2002 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 2002 may be integrated with the first processor 2001, or may exist independently, and may be accessed through the interface circuit ( Figure 5 (not shown) is coupled to the first processor 2001, which is not specifically limited in this embodiment of the present invention.

[0135] The transceiver 2003 is used to communicate with a network device or a terminal device.

[0136] Optionally, the transceiver 2003 may include a receiver and a transmitter ( Figure 5 The receiver is used to implement a receiving function, and the transmitter is used to implement a sending function.

[0137] Optionally, the transceiver 2003 may be integrated with the first processor 2001, or may exist independently, and may be connected to the first processor 2001 through the interface circuit ( Figure 5 (not shown) is coupled to the first processor 2001, which is not specifically limited in this embodiment of the present invention.

[0138] It should be noted that Figure 5 The structure of the encrypted traffic anomaly detection device 510 shown in the figure does not constitute a limitation on the router, and the actual knowledge structure identification device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0139] In addition, the technical effects of the encrypted traffic anomaly detection device 510 can refer to the technical effects of the encrypted traffic anomaly detection method based on a multi-resolution model described in the above method embodiment, and will not be repeated here.

[0140] It should be understood that the first processor 2001 in the embodiment of the present invention may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0141] It should also be understood that the memory in the embodiments of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0142] The above embodiments can be implemented in whole or in part by software, hardware (such as circuits), firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0143] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0144] In the present invention, "at least one" means one or more, and "plurality" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0145] It should be understood that in various embodiments of the present invention, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0146] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0147] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described equipment, devices and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0148] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0149] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0150] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0151] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0152] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A method for detecting anomalies in encrypted traffic based on a multi-resolution model, characterized in that: The method comprises: Capturing traffic through the Internet to obtain multiple mixed flows; processing traffic data on the multiple mixed flows to obtain a sub-flow set and a hexadecimal data packet set; According to the multiple mixed flows, the sub-flow set and the hexadecimal data packet set, multi-level semantic information is captured by a multi-resolution model to obtain a mixed flow CLS tag; According to the multiple mixed flows, the sub-flow set and the hexadecimal data packet set, multi-level semantic information is captured by a multi-resolution model to obtain a mixed flow CLS tag, including: Based on the learnable projection matrix, data packet level semantic information is captured according to the hexadecimal data packet set to obtain a data packet CLS tag set; The method of capturing data packet level semantic information based on the hexadecimal data packet set based on the learnable projection matrix to obtain the data packet CLS tag set includes: Based on the learnable projection matrix, linearly mapping the hexadecimal data packet set to obtain a data packet embedding vector set; Based on the data packet embedding vector set, construct a data packet SEG field set according to the hexadecimal data packet set; Perform splicing according to the data packet embedding vector set and the data packet SEG field set to obtain a first extended embedding vector set; adding an initial CLS tag to the first extended embedding vector set to obtain a second extended embedding vector set; According to the second extended embedding vector set, cross scanning is used to perform dynamic timing semantic capture at the data packet level to obtain a data packet Concatenate token vector set; according to the data packet Concatenate token vector set, a data packet CLS tag set is obtained; Capturing stream-level semantic information according to the data packet CLS tag set and the sub-stream set to obtain a sub-stream CLS tag set; The step of capturing stream-level semantic information according to the data packet CLS tag set and the substream set to obtain the substream CLS tag set includes: Concatenate the sub-stream set and the data packet CLS tag set to obtain a sub-stream embedding vector set; Based on the substream embedding vector set, construct a substream SEG field set according to the substream set; Perform splicing according to the substream embedding vector set and the substream SEG field set to obtain a third extended embedding vector set; adding an initial CLS tag to the third extended embedding vector set to obtain a fourth extended embedding vector set; According to the fourth extended embedding vector set, cross scanning is used to perform dynamic temporal semantic capture at the stream level to obtain a substream Concatenate token vector set; according to the substream Concatenate token vector set, a substream CLS tag set is obtained; Capturing session-level semantic information according to the substream CLS tag set and the multiple hybrid streams to obtain hybrid stream CLS tags; According to the mixed flow CLS mark, encrypted traffic anomaly detection is performed through a multi-layer perceptron to obtain an encrypted traffic anomaly detection result.

2. The encrypted traffic anomaly detection method based on a multi-resolution model according to claim 1 is characterized in that: The step of processing the traffic data of the multiple mixed flows to obtain a sub-flow set and a hexadecimal data packet set includes: Performing sub-flow segmentation on the multiple mixed flows to obtain a sub-flow set; Performing quintuple segmentation on each substream in the substream set to obtain a data packet set; The data packet set is format-converted to obtain a hexadecimal data packet set.

3. The encrypted traffic anomaly detection method based on a multi-resolution model according to claim 1 is characterized in that: The multi-resolution model is constructed according to the model structure of the Mamba module.

4. The encrypted traffic anomaly detection method based on a multi-resolution model according to claim 1 is characterized in that: The capturing of session-level semantic information according to the substream CLS tag set and the multiple hybrid streams to obtain the hybrid stream CLS tags includes: splicing the multiple mixed streams and the sub-stream CLS tag set to obtain a mixed stream embedding vector; Based on the mixed stream embedding vector, construct a mixed stream SEG field according to the multiple mixed streams; Perform splicing according to the mixed stream embedding vector and the mixed stream SEG field to obtain a fifth extended embedding vector set; adding an initial CLS tag to the fifth extended embedding vector set to obtain a sixth extended embedding vector set; According to the sixth extended embedding vector set, cross scanning is used to perform dynamic temporal semantic capture at the session level to obtain a mixed stream Concatenate token vector set; according to the mixed stream Concatenate token vector set, a mixed stream CLS tag is obtained.

5. The encrypted traffic anomaly detection method based on a multi-resolution model according to claim 4 is characterized in that: The initial CLS signature is a zero matrix of the same dimension as the first set of extended embedding vectors.

6. An encrypted traffic anomaly detection device based on a multi-resolution model, the encrypted traffic anomaly detection device based on a multi-resolution model is used to implement the encrypted traffic anomaly detection method based on a multi-resolution model as claimed in any one of claims 1 to 5, characterized in that: The device comprises: A traffic acquisition module is used to capture traffic through the Internet to obtain multiple mixed flows; process the traffic data of the multiple mixed flows to obtain a sub-flow set and a hexadecimal data packet set; A multi-level semantic information capture module, used to capture multi-level semantic information through a multi-resolution model according to the multiple mixed flows, the sub-flow set and the hexadecimal data packet set, to obtain a mixed flow CLS tag; According to the multiple mixed flows, the sub-flow set and the hexadecimal data packet set, multi-level semantic information is captured by a multi-resolution model to obtain a mixed flow CLS tag, including: Based on the learnable projection matrix, data packet level semantic information is captured according to the hexadecimal data packet set to obtain a data packet CLS tag set; Capturing stream-level semantic information according to the data packet CLS tag set and the sub-stream set to obtain a sub-stream CLS tag set; Capturing session-level semantic information according to the substream CLS tag set and the multiple hybrid streams to obtain hybrid stream CLS tags; The encrypted traffic anomaly detection module is used to perform encrypted traffic anomaly detection through a multi-layer perceptron according to the mixed flow CLS mark to obtain an encrypted traffic anomaly detection result.

7. An encrypted traffic anomaly detection device, characterized in that: The encrypted traffic anomaly detection device comprises: processor; A memory having computer-readable instructions stored thereon, wherein when the computer-readable instructions are executed by the processor, the method according to any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program codes, which can be called by a processor to execute the method according to any one of claims 1 to 5.

Images