Binary private protocol data identification method and system under open set condition

Abstract

The invention provides a binary private protocol data identification method and system under an open set condition, and relates to the technical field of network security. The method comprises the following steps: extracting load and frame structure features in a collected data frame, and preprocessing the load into a binary grayscale image; inputting the binary grayscale image into an auto-encoder to obtain a load feature and a reconstruction loss, and comparing the reconstruction loss with a preset loss threshold to divide the corresponding data frame into a preliminary known class and an unknown class; wherein the preliminary known class represents whether the class of the data frame is not determined to be a known class; inputting the load feature and the frame structure feature of the data frame into a classifier, and correcting the score of the classifier based on the center distance survival probability of the load feature; wherein the center-to-survival probability of the load feature refers to the value of a survival function corresponding to the distance from the load feature to the center of the known sample; the data frames in the preliminary known class are re-divided into a known class and an unknown class based on the corrected score.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a binary private protocol data recognition method and system under open set conditions. Background Art

[0002] In the process of digital transformation, protocols are the cornerstone of information interaction, and their security is crucial to protecting user privacy and network assets. With the rapid development of 5G, big data, and the Internet of Things, network traffic has exploded, which has enriched information exchange and increased the complexity and risks of cyberspace. In order to enhance confidentiality, the application of custom private protocols is becoming increasingly common, aiming to strengthen the security of data transmission. However, this has also opened up new paths for network threats, and traditional security mechanisms face the difficulties of identification and defense. Therefore, it is particularly important to conduct in-depth research on reverse engineering of private protocols, which helps to reveal the inherent mechanisms of protocols, enhance control over the network environment, and improve network confrontation, software analysis, and vulnerability mining capabilities.

[0003] In the initial stage of protocol reverse engineering, the effective classification of massive network traffic is a crucial first step, which directly determines the efficiency and accuracy of subsequent reverse analysis. When processing unknown protocol messages, the active learning methods that were relied on in the past are inefficient, while the probability and comparison-based methods are too rigid. Nowadays, automated classification methods, especially the use of machine learning technology, have become the mainstream trend, significantly improving the efficiency of analysis and classification. In the face of completely unknown data, unsupervised learning clustering algorithms can provide preliminary insights into the data structure. However, when domain experts can identify some data, semi-supervised learning can combine this expertise with the advantages of automated processing to achieve more efficient data understanding and classification, which is more in line with the reality of most problems. Therefore, the OSR (Open Set Recognition) of the protocol is of profound significance for the timely detection of behaviors such as network intrusions.

[0004] For unknown protocols, traditional feature-based methods are difficult to apply directly. As part of protocol reverse engineering, researchers have borrowed the gene comparison technology in biology to perform sequence comparison. For example, in "Cong Peixin, Li Xiaohui, Wang Junfeng. Clustering method of unknown binary protocols based on biological information. Journal of Sichuan University (Natural Science Edition), 2022, 59(3): 69-76", the researchers converted binary messages into quaternary gene form and calculated the distance matrix between bases for clustering. This method has high computational complexity and low efficiency when processing large amounts of data. With the advancement of machine learning, unsupervised learning, especially clustering algorithms, has been applied to discover patterns in unlabeled data, providing a basis for subsequent format extraction. The literature "Gu Chunxiang, Wu Weisen, Shi Yanan, et al. Unknown protocol classification method based on autoencoder. Journal of Communications, 2020, 41(6): 88-97" combines autoencoders with K-means algorithms to classify and identify unknown protocols. Compared with traditional clustering methods such as K-means, DBSCAN and GMM, these improved algorithms have improved effects and efficiency. However, these methods usually require larger training data sets, and their accuracy may not be as good as supervised learning methods. Given that private protocols are not completely unknown, in order to effectively utilize existing prior knowledge, semi-supervised learning techniques (such as self-training and collaborative training algorithms) significantly improve the performance of unknown protocol classification tasks by combining a small amount of labeled data with a large amount of unlabeled data. Such techniques enhance the learning ability of the model by mining the potential information in unlabeled data and learning the intrinsic structure between data. Such methods need to be carefully designed to make full use of unlabeled data, otherwise noise may be introduced to affect model performance, and the data quality requirements are high, and the balance between labeled data and unlabeled data is difficult to grasp.

[0005] The training set and test set of traditional machine learning algorithms have the same set of categories, which means that if you want to correctly classify each sample in reality, you need a training set that covers all categories in reality. However, such a training set often does not exist. In reality, there are always samples that are not covered by the training set and are directly classified into known categories, and the model cannot recognize this error. To solve this problem, open set recognition has been developed. People consider rejecting samples with low confidence as unknown classes on the classifier, or performing single-class anomaly detection to distinguish unknown classes in a separate step. Current research on open set recognition algorithms mainly focuses on generative and discriminative directions. The main idea of ​​the generative open set recognition algorithm is to generate deceptive samples that are different from known categories to train the model, thereby demarcating the open space. However, this type of algorithm has the problem of not being able to accurately and completely cover all unknown class samples, and the generated deceptive sample space may be smaller than the open space. OpenMax improves the closed softmax function of the last layer of the classifier network, incorporates the concept of meta-recognition to reject inputs that are far from known classes, and has the problem of being highly dependent on the model structure. Another good combination of the two is the model based on AE (AutoEncoder) and VAE (Variational AutoEncoder), such as C2AE, which rejects unknown classes by combining reconstruction loss with EVT (Extreme Value Theory). This type of open set recognition algorithm using extreme value theory has the problems of being sensitive to noise, complex parameter estimation, and invalid data distribution assumptions. Summary of the invention

[0006] Aiming at the problems of noise sensitivity and complex parameter estimation in the current open set recognition algorithm for protocols, the present invention provides a binary private protocol data recognition method and system under open set conditions.

[0007] In a first aspect, the present invention provides a method for identifying binary private protocol data under an open set condition, comprising:

[0008] Step 1: extracting the payload and frame structure features from the collected data frame and preprocessing the payload into a binary grayscale image; wherein the frame structure features refer to other features of the data frame except the payload;

[0009] Step 2: Input the binary grayscale image into the autoencoder to obtain load features and reconstruction loss, compare the reconstruction loss with a preset loss threshold to classify the corresponding data frame into a preliminary known class and an unknown class; wherein the preliminary known class indicates that the class of the data frame has not yet been determined to be a known class;

[0010] Step 3: Input the load feature and the frame structure feature of the data frame into the classifier, and correct the classifier score based on the center distance survival probability of the load feature; wherein the center distance survival probability of the load feature refers to the value of the survival function corresponding to the distance from the load feature to the center of the known class sample;

[0011] Step 4: Based on the corrected scores, the data frames in the preliminary known classes are divided into known classes and unknown classes again.

[0012] Furthermore, it also includes: in the training process, a joint training method of an autoencoder and a classifier is adopted.

[0013] Furthermore, the autoencoder adopts a two-dimensional convolutional neural network.

[0014] Furthermore, the encoder and decoder of the autoencoder are asymmetric structures; wherein the encoder includes multiple convolution blocks, flattening layers, Dropout layers and fully connected layers connected in sequence; wherein each of the convolution blocks includes a convolution layer, a batch normalization layer and a ReLU activation function layer connected in sequence; the decoder includes a fully connected layer, a batch normalization layer, a reshaping layer, multiple transposed convolution blocks and a transposed convolution layer with a Tanh activation function connected in sequence; wherein each of the transposed convolution blocks includes a transposed convolution layer, a batch normalization layer and a ReLU activation function layer connected in sequence.

[0015] Furthermore, in step 2, the preset loss threshold is determined according to the following process:

[0016] The known class data set is divided into a training set and a validation set. When the reconstruction loss of the validation set is similar to that of the training set and the autoencoder is not overfitted, the maximum reconstruction loss in the validation set is selected as the preset loss threshold.

[0017] Furthermore, step 3 also includes: using the density estimation function of the Gaussian kernel to calculate the density estimation function corresponding to the distance from the load feature to the center of the N types of known class samples, and then calculating the center distance survival probability of the corresponding load feature based on the corresponding density estimation function.

[0018] Furthermore, in step 3, the classifier score is corrected based on the center distance survival probability of the load feature, specifically including:

[0019] The corrected scores for classifying the data frame into known classes are:

[0020]

[0021] The corrected scores for classifying the data frame into the unknown class are:

[0022]

[0023] Among them, z j Indicates that the data frame x i The probability of being classified into the jth known class, z j is the jth element of vector z, C is the length of vector z, softmax(z j ) represents the data frame x i is the classifier score of the jth known class, Represents the data frame x i The value of the survival function corresponding to the distance from the load feature to the center of the j-th known class sample, j = 1, 2, ..., N, N is the total number of classifier categories, N = C.

[0024] In a second aspect, the present invention provides a binary private protocol data identification system under an open set condition, comprising:

[0025] A data preprocessing unit, used to extract the load and frame structure features in the collected data frame and preprocess the load into a binary grayscale image; wherein the frame structure features refer to other features of the data frame except the load;

[0026] A preliminary classification unit, used for inputting the binary grayscale image into an autoencoder to obtain a load feature and a reconstruction loss, and comparing the reconstruction loss with a preset loss threshold to classify the corresponding data frame into a preliminary known class and an unknown class; wherein the preliminary known class indicates that the class of the data frame has not yet been determined to be a known class;

[0027] A score updating unit, used for inputting the load feature and the frame structure feature of the data frame into the classifier, and correcting the classifier score based on the center distance survival probability of the load feature; wherein the center distance survival probability of the load feature refers to the value of the survival function corresponding to the distance from the load feature to the center of the known class sample;

[0028] The reclassification unit is used to reclassify the data frames in the preliminary known classes into known classes and unknown classes based on the corrected scores.

[0029] In a third aspect, the present invention provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first aspect when executing the program.

[0030] In a fourth aspect, the present invention provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method described in the first aspect.

[0031] Beneficial effects of the present invention:

[0032] Traditional processing of unknown protocols is mostly focused on preliminary clustering of protocols, which requires a high sample size, inaccurate feature extraction, and lacks integration with empirical knowledge during long-term use. The binary private protocol data recognition method and system under open set conditions provided by the present invention focuses on open set recognition of unknown protocols, jointly trains the autoencoder and the classifier, so that the autoencoder simultaneously learns the original load and label and completes feature extraction, and the classifier simultaneously learns the load features and frame features, more accurately extracts known category features, and effectively rejects unknown categories; in addition, the present invention is more robust than the traditional unknown protocol clustering invention model, fully utilizes prior information, and can extract features of unknown class data while dividing unknown classes for subsequent processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 One of the flow charts of a method for identifying binary private protocol data under open set conditions provided by an embodiment of the present invention;

[0034] Figure 2 A second flow chart of a method for identifying binary private protocol data under an open set condition provided by an embodiment of the present invention;

[0035] Figure 3 A schematic diagram of preprocessing a load into a binary grayscale image provided by an embodiment of the present invention;

[0036] Figure 4 An architecture of an autoencoder provided by an embodiment of the present invention;

[0037] Figure 5 A schematic diagram of the structure of a binary private protocol data identification system under open set conditions provided by an embodiment of the present invention;

[0038] Figure 6 A structural block diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution in the embodiment of the present invention will be clearly described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is a part of the embodiment of the present invention, not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0040] Combination Figure 1 and Figure 2 As shown, an embodiment of the present invention provides a binary private protocol data identification method under an open set condition, comprising:

[0041] S101: extracting load and frame structure features from the collected data frame and preprocessing the load into a binary grayscale image; wherein the frame structure features refer to other features of the data frame except the load;

[0042] Specifically, traditional protocol analysis often uses experts to observe bitmaps or observe aligned frames in batches to find similar formats for classification and format extraction. Referring to the expert learning method, compared with directly processing 01 sequence messages, the embodiments of the present invention show significant advantages in intuitiveness and visual distinction by converting the payload into a message in a two-dimensional image format, targeting the length characteristics of the data and its bit-based nature.

[0043] In addition, the frame structure features in this embodiment include packet size, payload length, and verification method.

[0044] It is understandable that the image size of the binary grayscale image can be selected according to the length of the payload. For example, the first 256 bits of data are taken and converted into a binary grayscale image of 16×16 pixels, such as Figure 3 It should be noted that the side length of the binary grayscale image should be selected based on the distribution of the lengths of each category and is usually set to a multiple of 8 to avoid the problem of the byte part being split.

[0045] S102: Input the binary grayscale image into the autoencoder to obtain load features and reconstruction loss, compare the reconstruction loss with a preset loss threshold to classify the corresponding data frame into a preliminary known class and an unknown class; wherein the preliminary known class indicates that the class of the data frame has not yet been determined to be an unknown class;

[0046] Specifically, data frames whose reconstruction loss is greater than a preset loss threshold are classified into the unknown class, and data frames whose reconstruction loss is not greater than the threshold are classified into the preliminary known class.

[0047] S103: Input the load feature and the frame structure feature of the data frame into the classifier, and correct the classifier score based on the center distance survival probability of the load feature; wherein the center distance survival probability of the load feature refers to the value of the survival function corresponding to the distance from the load feature to the center of the known class sample;

[0048] S104: Based on the corrected scores, the data frames in the preliminary known classes are divided again into known classes and unknown classes, so as to reduce the neglect of unknown classes by a single reconstruction loss threshold.

[0049] It is understandable that the autoencoder and classifier have the above corresponding functions only after being trained with a known class data set. During training, the two are trained jointly, that is, the total loss is trained under the requirement that the weighted sum of the classifier loss and the reconstruction loss is minimized, and both feature extraction and classification are completed. This means that the load feature z = E (x) output by the encoder E in the autoencoder is used for both the decoder to reconstruct the input x and the classifier to predict the label y. Therefore, the feature vector z should contain both the main information of the original input and sufficient information for correct classification.

[0050] Traditional processing of unknown protocols is mostly focused on clustering protocols, which requires a high sample size, inaccurate feature extraction, and lacks integration with empirical knowledge during long-term use. The binary private protocol data recognition method under open set conditions provided by the embodiment of the present invention focuses on open set recognition of unknown protocols, fully utilizes existing empirical knowledge, extracts features more accurately, and quickly extracts key unknown class information; in addition, the present invention is more robust than the traditional unknown protocol clustering invention model, is not prone to overfitting, and can extract features of unknown class data while dividing unknown classes for subsequent processing.

[0051] In one embodiment, by preprocessing the load into images, the selection range of the autoencoder network is expanded. In this embodiment, a two-dimensional convolutional neural network (2D CNN) is particularly used.

[0052] Specifically, inputting the same data in the form of a one-dimensional sequence into a one-dimensional convolutional neural network (1D CNN) or a long short-term memory network (LSTM) can process sequence data and capture time dependencies, but it is prone to gradient vanishing or gradient exploding problems when processing long sequences. These structures have difficulty in effectively propagating error signals in back propagation, especially when the sequence length is long. However, due to its inherent local connection characteristics, 2D CNN can better manage the gradient flow in deep networks and effectively avoid the above problems. The specific explanation is as follows:

[0053] Assume that the first 32 bytes of the data frame B0, B1, ..., B 31 According to every two bytes, that is, 16 bits b 0,0 ,b 0,1 ,…,b 0,7 ,b 1,0 ,b 1,1 ,…,b 1,7 It is processed into a 16×16 binary grayscale image, that is, each pixel is 0 or 1, represented by I∈{0,1} 16×16 .

[0054] For the first convolutional layer, a 3×3 convolution kernel K∈R is used. 3×3 , the step size is 2, and the calculation formula of the output feature map F is as follows:

[0055]

[0056] Where i, j are the positions of the output feature map, I(2i+m,2j+n) is the pixel value at position (2i+m,2j+n) in the input image I, and K(m+1,n+1) is the weight of the corresponding position in the convolution kernel. Take F(1,1) as an example:

[0057] F(1,1)=I(1,1)K(0,0)+I(1,2)K(0,1)+I(1,3)K(0,2)

[0058] +I(2,1)K(1,0)+I(2,2)K(1,1)+I(2,3)K(1,2)

[0059] +I(3,1)K(2,0)+I(3,2)K(2,1)+I(3,3)K(2,2)

[0060] That is, F(1,1) consists of bits {b 1,1 ,b 1,2 ,b 1,3 ,b 3,1 ,b 3,2 ,b 3,3 ,b 5,1 ,b 5,2 ,b 5,3}It is calculated that it is related to the 9 bits of the three bytes {B1, B3, B5}.

[0061] The second convolutional layer will expand to cover seven bytes, a total of 49 bits, and the third convolutional layer will cover 22 bytes, 121 bits. As the network depth increases, the range of associated learning expands to 32 bytes.

[0062] The autoencoder learns the efficient encoding representation of input data by building a neural network model, which includes two basic structures: encoder and decoder. Its goal is to minimize the difference between input data and reconstructed data, thereby achieving effective feature extraction and dimensionality reduction. Figure 4 The autoencoder model used in the embodiment of the present invention includes, from left to right: the input layer and three convolutional layers of the encoder, and the reshaping layer and four transposed convolutional layers of the decoder. The sizes of each layer of the model are shown in the figure.

[0063] Since the mapping difficulty of binary grayscale images from high dimension to low dimension is inconsistent with that from low dimension to high dimension, the model adopts an asymmetric autoencoder architecture. The model is flexible and can effectively prevent overfitting. Both the input dimension and the extracted feature dimension are adjustable parameters, which can be adjusted according to the length of the input data and the accuracy of the validation set.

[0064] The encoder first extracts the features of the input data through multiple convolutional layers, each followed by a batch normalization layer and a ReLU activation function layer. Then, the output of the convolutional layer is flattened into a one-dimensional vector through a flattening layer, and then a Dropout layer is used to prevent overfitting, and finally a low-dimensional feature representation is generated through a fully connected layer. The decoder maps this low-dimensional feature representation to an intermediate layer through a fully connected layer, and then passes through a batch normalization layer. Then, a reshape layer is used to reshape the output of the intermediate layer into a shape suitable for the convolution operation, and then the original shape of the data is gradually restored through multiple transposed convolutional layers, each of which is followed by a batch normalization layer and a ReLU activation function layer. Finally, a transposed convolutional layer with a Tanh activation function is used to generate the decoded data.

[0065] The classifier input is the variable dimensional load features extracted by the autoencoder and the frame structure features of the data frame. In one embodiment, the classifier is a layer of normalization layer and a layer of fully connected network, and softmax is used as the output layer activation function.

[0066] It can be seen from the entire data identification method process of the present invention that the preset reconstruction loss threshold plays a key role in the accuracy of the classification result. On the basis of the above embodiments, it is considered that if only the reconstruction loss of the autoencoder is used to define the reconstruction loss threshold to distinguish the unknown class, it is easy to overfit the known class data, be sensitive to noise, and ignore the diversity of data distribution, so that the determined reconstruction loss threshold is highly dependent on the selected data. Therefore, in one embodiment, in order to weaken the influence of the data set on the classification result, this embodiment adopts the following method to determine the preset reconstruction loss threshold: the known class data set is divided into a training set and a validation set. When the reconstruction loss of the validation set is similar to the reconstruction loss of the training set and the autoencoder does not overfit, the maximum reconstruction loss in the validation set is selected as the preset loss threshold. It can be understood that the user can customize the situation where the reconstruction loss of the validation set is similar to the reconstruction loss of the training set, such as setting a difference threshold. When the difference between the two is less than the difference threshold, the two are considered to be similar.

[0067] On the basis of the above embodiments, in order to study the extracted load features from a different angle, we further start from the load features extracted by the autoencoder, reduce the dimensionality of 8, 16 or higher dimensional features, verify the feature extraction effect, calculate the sample center and center distance after dimensionality reduction of the training set features, and fit the cumulative distribution function of each type of center distance. In this embodiment, kernel density estimation (KDE) is used to estimate the unknown probability density function.

[0068] Specifically, the basic idea of ​​KDE is to iA kernel function K is placed on it, and then the probability density function f is estimated by weighted averaging these kernel functions. The kernel function K is a non-negative function that satisfies the following conditions:

[0069]

[0070] Common kernel functions include Gaussian kernel, Epanechnikov kernel, rectangular kernel, triangular kernel, etc. This embodiment uses the Gaussian kernel function, and the formula is as follows:

[0071]

[0072] Bandwidth is an important parameter of KDE, which controls the width of the kernel function. A larger bandwidth will make the estimate smoother, and a smaller bandwidth will make the estimate more localized. In Python, the bandwidth can be automatically selected by heuristic methods. For a given bandwidth h, the KDE formula of the Gaussian kernel is:

[0073]

[0074] is the density estimate at the center distance d, d i is the distance from the ith point to the center point, and n represents the sample size.

[0075] Based on the above theory, in the process of model training, the above formula is used in the embodiment of the present invention to calculate the value of each sample x in the validation set. i To the centers of N known samples c1, c2, ..., c N Distance The corresponding density estimation functions are f1(d), f2(d),…, f N (d). From this, we can get the cumulative distribution function (CDF) and survival function:

[0076]

[0077] S j (d) = P j (X>d)=1-F j (d)

[0078] j=1,2,…,N

[0079] Among them, F j (d) represents the density estimation function f j (d) The resulting cumulative distribution function, S j (d) represents the corresponding survival function.

[0080] Correspondingly, during the test process, the test set sample x is introduced i Distance to each class center Corresponding to each type of survival function, get the test set sample x i is the probability of the known class

[0081]

[0082] The embodiment of the present invention combines the calculated center distance survival probability with the softmax score of the classifier to obtain a corrected score. The softmax score can be expressed as:

[0083]

[0084] Vector z is the original output of the model, with a length of C, that is, the total number of categories of the classifier is N = C, z j is the jth element of the vector z, which can be understood as the probability of the sample being classified into the jth class. The denominator is the exponential sum of all z elements, ensuring that the sum of the outputs of the softmax function is 1. For this reason, the softmax function is closed, and the classifier always tends to classify unknown classes into known classes, even if these data points are far from the known categories.

[0085] However, it is usually difficult for samples of unknown classes that are far apart to get a high score in a certain class in the softmax function, and the scores will appear relatively average in each class compared to samples of known classes. Therefore, this embodiment uses the center distance probability of the load feature to correct the softmax score.

[0086] The corrected scores for the known classes are:

[0087]

[0088] The corrected score for the unknown class is the total score reduction:

[0089]

[0090] The classification results are:

[0091]

[0092] According to the corrected scores, the data frames in the preliminary known class are reclassified into the class with the highest score, so as to achieve the effect of correcting similar unknown class samples.

[0093] like Figure 5 As shown, corresponding to the above method, an embodiment of the present invention further provides a binary private protocol data recognition system under open set conditions, including a data preprocessing unit, a preliminary classification unit, a score updating unit and a reclassification unit.

[0094] Among them, the data preprocessing unit is used to extract the load and frame structure features in the collected data frame and preprocess the load into a binary grayscale image; wherein the frame structure feature refers to other features of the data frame except the load; the initial classification unit is used to input the binary grayscale image into the autoencoder to obtain the load feature and reconstruction loss, compare the reconstruction loss and the preset loss threshold to divide the corresponding data frame into preliminary known classes and unknown classes; wherein the preliminary known class indicates that the category of the data frame has not yet been determined whether it is a known class; the score updating unit is used to input the load feature and the frame structure feature of the data frame into the classifier, and correct the classifier score based on the center-to-center survival probability of the load feature; wherein the center-to-center survival probability of the load feature refers to the value of the survival function corresponding to the distance from the load feature to the center of the known class sample; the reclassification unit is used to divide the data frame in the preliminary known class into known classes and unknown classes again based on the corrected score.

[0095] It should be noted that the data identification system provided in the embodiment of the present invention is for implementing the above method. Its specific functions can be referred to the above method embodiments, which will not be described in detail here.

[0096] In order to verify the effectiveness of the solution of the present invention, the present invention also provides the following experimental data.

[0097] (I) Dataset

[0098] The dataset used in the experiment consists of two parts, as shown in Table 1 and Table 2.

[0099] Table 1 Datasets of different protocols

[0100]

[0101] Among them, ICMP, NBNS, ARP, DNS, NTP, FTP, and SMTP are from the MACCDC 2012 dataset, of which ICMP, NBNS, ARP, DNS, and NTP are binary protocols. Modbus and DNP3.0 are industrial control protocols.

[0102] Table 2 Datasets of different message types

[0103]

[0104] The AIS dataset comes from data received in an actual communication network.

[0105] Known classes and unknown classes are selected according to the desired degree of openness, and the number of items of each protocol or message type is randomly selected and applied to directly perform K-means clustering on the original data, perform K-means clustering on the features extracted by the autoencoder, directly calculate the correction score by the classifier, only use the reconstruction loss threshold and the present invention. The evaluation indicators are accuracy and F1-score.

[0106] Table 3 Comparison of algorithms at the same openness

[0107]

[0108] At the same level of openness, it can be seen from the experimental results in Table 3 that the autoencoder and classifier of the present invention cooperate to train the model with better feature extraction effect. Similarly, the original data and features are clustered by K-menas, and the effect is significantly improved. In addition, the direct use of the correction score and reconstruction loss to divide the unknown class is not as good as the present invention, which combines the two and significantly improves the overall effect. At the same time, the unknown class features extracted can be directly used for subsequent research.

[0109] In addition, the open set algorithm pursues timeliness. If the previous clustering method wants to classify unknown classes, it may need to accumulate data for a period of time to update the model, which does not meet the actual requirements of discovery and identification at any time. However, the present invention can save the trained model, classify each new data at any time, and discover unknown class data in time.

[0110] Figure 6 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 6As shown, the electronic device may include: a processor (processor) 601, a communication interface (Communications Interface) 602, a memory (memory) 603 and a communication bus 604, wherein the processor 601, the communication interface 602, and the memory 603 communicate with each other through the communication bus 604. The processor 601 can call the logic instructions in the memory 603 to execute the binary private protocol data recognition method, which includes: step 1: extracting the load and frame structure features in the collected data frame and preprocessing the load into a binary grayscale image; wherein the frame structure feature refers to other features of the data frame except the load; step 2: inputting the binary grayscale image into the autoencoder to obtain the load feature and reconstruction loss, comparing the reconstruction loss and the preset loss threshold to divide the corresponding data frame into a preliminary known class and an unknown class; wherein the preliminary known class indicates that the category of the data frame has not yet been determined whether it is a known class; step 3: inputting the load feature and the frame structure feature of the data frame into the classifier, and correcting the classifier score based on the center distance survival probability of the load feature; wherein the center distance survival probability of the load feature refers to the value of the survival function corresponding to the distance from the load feature to the center of the known class sample; step 4: based on the corrected score, the data frame in the preliminary known class is divided into a known class and an unknown class again.

[0111] In addition, when the logic instructions in the above-mentioned memory 603 are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0112] An embodiment of the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the methods provided by the above-mentioned method embodiments, for example, including: Step 1: Extract the load and frame structure features in the collected data frame and preprocess the load into a binary grayscale image; wherein the frame structure feature refers to other features of the data frame except the load; Step 2: Input the binary grayscale image into an autoencoder to obtain the load feature and reconstruction loss, compare the reconstruction loss and a preset loss threshold to divide the corresponding data frame into a preliminary known class and an unknown class; wherein the preliminary known class indicates that the category of the data frame has not yet been determined to be a known class; Step 3: Input the load feature and the frame structure feature of the data frame into a classifier, and correct the classifier score based on the center distance survival probability of the load feature; wherein the center distance survival probability of the load feature refers to the value of the survival function corresponding to the distance from the load feature to the center of the known class sample; Step 4: Based on the corrected score, the data frame in the preliminary known class is divided into a known class and an unknown class again.

[0113] An embodiment of the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the methods provided by the above-mentioned method embodiments are implemented, for example, including: Step 1: extracting the load and frame structure features in the collected data frame and preprocessing the load into a binary grayscale image; wherein the frame structure feature refers to other features of the data frame except the load; Step 2: inputting the binary grayscale image into an autoencoder to obtain the load feature and reconstruction loss, and comparing the reconstruction loss with a preset loss threshold to divide the corresponding data frame into a preliminary known class and an unknown class; wherein the preliminary known class indicates that the category of the data frame has not yet been determined to be a known class; Step 3: inputting the load feature and the frame structure feature of the data frame into a classifier, and correcting the classifier score based on the center distance survival probability of the load feature; wherein the center distance survival probability of the load feature refers to the value of the survival function corresponding to the distance from the load feature to the center of the known class sample; Step 4: based on the corrected score, the data frame in the preliminary known class is again divided into a known class and an unknown class.

[0114] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0115] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for identifying binary private protocol data under open set conditions, characterized in that: include: Step 1: extracting the payload and frame structure features from the collected data frame and preprocessing the payload into a binary grayscale image; wherein the frame structure features refer to other features of the data frame except the payload; Step 2: Input the binary grayscale image into the autoencoder to obtain load features and reconstruction loss, compare the reconstruction loss with a preset loss threshold to classify the corresponding data frame into a preliminary known class and an unknown class; wherein the preliminary known class indicates that the class of the data frame has not yet been determined to be a known class; Step 3: Input the load feature and the frame structure feature of the data frame into the classifier, and correct the classifier score based on the center distance survival probability of the load feature; wherein the center distance survival probability of the load feature refers to the value of the survival function corresponding to the distance from the load feature to the center of the known class sample; Step 4: Based on the corrected scores, the data frames in the preliminary known classes are divided into known classes and unknown classes again.

2. The method for identifying binary private protocol data under open set conditions according to claim 1, characterized in that: Also includes: During the training process, the autoencoder and classifier are jointly trained.

3. The method for identifying binary private protocol data under open set conditions according to claim 1 or 2, characterized in that: The autoencoder adopts a two-dimensional convolutional neural network.

4. The method for identifying binary private protocol data under open set conditions according to claim 3, characterized in that: The encoder and decoder of the autoencoder are asymmetric structures; wherein the encoder includes a plurality of convolution blocks, flattening layers, Dropout layers and fully connected layers connected in sequence; wherein each of the convolution blocks includes a convolution layer, a batch normalization layer and a ReLU activation function layer connected in sequence; the decoder includes a fully connected layer, a batch normalization layer, a reshaping layer, a plurality of transposed convolution blocks and a transposed convolution layer with a Tanh activation function connected in sequence; wherein each of the transposed convolution blocks includes a transposed convolution layer, a batch normalization layer and a ReLU activation function layer connected in sequence.

5. The method for identifying binary private protocol data under open set conditions according to claim 1, characterized in that: In step 2, the preset loss threshold is determined according to the following process: The known class data set is divided into a training set and a validation set. When the reconstruction loss of the validation set is similar to that of the training set and the autoencoder is not overfitted, the maximum reconstruction loss in the validation set is selected as the preset loss threshold.

6. The method for identifying binary private protocol data under open set conditions according to claim 1, characterized in that: Step 3 also includes: using the density estimation function of the Gaussian kernel to calculate the density estimation function corresponding to the distance from the load feature to the center of the N types of known class samples, and then calculating the center distance survival probability of the corresponding load feature based on the corresponding density estimation function.

7. The method for identifying binary private protocol data under open set conditions according to claim 6, characterized in that: In step 3, the classifier score is corrected based on the center distance survival probability of the load feature, specifically including: The corrected scores for classifying the data frame into known classes are: The corrected scores for classifying the data frame into the unknown class are: Among them, z j Indicates that the data frame x i The probability of being classified into the jth known class, z j is the jth element of vector z, C is the length of vector z, softmax(z j ) represents the data frame x i is the classifier score of the jth known class, Represents the data frame x i The value of the survival function corresponding to the distance from the load feature to the center of the j-th known class sample, j = 1, 2, ..., N, N is the total number of classifier categories, N = C.

8. A binary private protocol data recognition system under open set conditions, characterized in that: include: A data preprocessing unit, used to extract the load and frame structure features in the collected data frame and preprocess the load into a binary grayscale image; wherein the frame structure features refer to other features of the data frame except the load; A preliminary classification unit, used for inputting the binary grayscale image into an autoencoder to obtain a load feature and a reconstruction loss, and comparing the reconstruction loss with a preset loss threshold to classify the corresponding data frame into a preliminary known class and an unknown class; wherein the preliminary known class indicates that the class of the data frame has not yet been determined to be an unknown class; A score updating unit, used for inputting the load feature and the frame structure feature of the data frame into the classifier, and correcting the classifier score based on the center distance survival probability of the load feature; wherein the center distance survival probability of the load feature refers to the value of the survival function corresponding to the distance from the load feature to the center of the known class sample; The reclassification unit is used to reclassify the data frames in the preliminary known classes into known classes and unknown classes based on the corrected scores.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method according to any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images