A binary private protocol data identification method and system under open set conditions

Abstract

The present invention provides a method and system for identifying binary private protocol data under open set conditions, relating to the field of network security technology. The method comprises: extracting payload and frame structure features from a collected data frame and preprocessing the payload into a binary grayscale image; inputting the binary grayscale image into an autoencoder to obtain payload features and reconstruction loss, comparing the reconstruction loss with a preset loss threshold to classify the corresponding data frame into a preliminary known class and an unknown class; wherein the preliminary known class indicates that the class of the data frame has not yet been determined to be a known class; inputting the payload features and frame structure features of the data frame into a classifier, and correcting the classifier score based on the center-to-center survival probability of the payload features; wherein the center-to-center survival probability of the payload features refers to the value of the survival function corresponding to the distance from the payload features to the center of a known class sample; and based on the corrected score, reclassifying the data frame in the preliminary known class into a known class and an unknown class.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a binary private protocol data identification method and system under open set conditions. Background Art

[0002] In the digital transformation process, protocols, as the cornerstone of information exchange, ensure that their security is crucial for protecting user privacy and network assets. With the rapid development of 5G, big data, and the Internet of Things (IoT), network traffic has exploded. This has enriched information exchange while also exacerbating the complexity and risks of cyberspace. To enhance confidentiality, the use of custom private protocols is becoming increasingly common, aiming to strengthen the security of data transmission. However, this also opens up new avenues for cyber threats, making traditional security mechanisms challenging to identify and defend against. Therefore, in-depth research into reverse engineering of private protocols has become increasingly important. It helps reveal the underlying mechanisms of protocols, enhances control over network environments, and improves capabilities in network adversarial attacks, software analysis, and vulnerability discovery.

[0003] In the initial stages of protocol reverse engineering, effectively classifying massive amounts of network traffic is a crucial first step, directly determining the efficiency and accuracy of subsequent reverse analysis. When processing unknown protocol messages, active learning methods, which were previously relied upon, are inefficient, while methods based on probability and comparison are overly rigid. Today, automated classification methods, particularly those employing machine learning, have become a mainstream trend, significantly improving the effectiveness of analysis and classification. When faced with completely unknown data, unsupervised clustering algorithms can provide initial insights into data structure. However, when domain experts can identify partial data, semi-supervised learning can combine this expertise with the advantages of automated processing, achieving more efficient data understanding and classification that is more relevant to the majority of problems. Therefore, protocol Open Set Recognition (OSR) is of profound significance for the timely detection of behaviors such as network intrusions.

[0004] For unknown protocols, traditional feature-based methods are difficult to apply directly. As part of protocol reverse engineering, researchers have borrowed the gene comparison technology in biology to perform sequence alignment. For example, in "Cong Peixin, Li Xiaohui, Wang Junfeng. Clustering method of unknown binary protocols based on biological information. Journal of Sichuan University (Natural Science Edition), 2022, 59(3): 69-76", researchers converted binary messages into quaternary gene form, calculated the distance matrix between bases, and then clustered them. This method has high computational complexity and low efficiency when processing large amounts of data. With the advancement of machine learning, unsupervised learning, especially clustering algorithms, has been applied to discover patterns in unlabeled data, providing a basis for subsequent format extraction. The literature "Gu Chunxiang, Wu Weisen, Shi Yanan, et al. Unknown protocol classification method based on autoencoder. Journal of Communications, 2020, 41(6): 88-97" combines autoencoder with K-means algorithm to classify and identify unknown protocols. Compared with traditional clustering methods such as K-means, DBSCAN and GMM, these improved algorithms have improved in both effectiveness and efficiency. However, these methods usually require larger training data sets and their accuracy may be lower than that of supervised learning methods. Given that private protocols are not completely unknown, in order to effectively utilize existing prior knowledge, semi-supervised learning techniques (such as self-training and collaborative training algorithms) significantly improve the performance of unknown protocol classification tasks by combining a small amount of labeled data with a large amount of unlabeled data. Such technologies enhance the learning ability of the model by mining the potential information in unlabeled data and learning the inherent structure between data. Such methods need to be carefully designed to make full use of unlabeled data, otherwise noise may be introduced to affect model performance, and the data quality requirements are high, and the balance between labeled and unlabeled data is difficult to grasp.

[0005] Traditional machine learning algorithms use the same set of categories for their training and test sets. This means that to correctly classify every sample in the real world, a training set covering all real-world categories is required. However, such training sets often do not exist. In reality, samples not covered by the training set are often directly classified as known categories, and the model cannot recognize these errors. To address this problem, open set recognition has been developed. Considerations have been made in the classifier to reject samples with low confidence as unknown classes, or to perform single-class anomaly detection, distinguishing the unknown class in a separate step. Current research on open set recognition algorithms focuses on generative and discriminative approaches. Generative open set recognition algorithms primarily train the model by generating deceptive samples that differ from known classes, thereby delineating the open space. However, these algorithms suffer from the problem of not accurately and completely covering all unknown class samples, and the space of generated deceptive samples may be smaller than the open space. OpenMax improves on the closed softmax function in the last layer of the classifier network, incorporating the concept of meta-recognition to reject inputs that are far from known classes. However, this approach is highly dependent on the model structure. Another model that combines the two approaches well is one based on the AE (AutoEncoder) and VAE (Variational AutoEncoder) architecture, such as C2AE, which rejects unknown classes by combining reconstruction loss with EVT (Extreme Value Theory). However, these open-set recognition algorithms using EVT suffer from noise sensitivity, complex parameter estimation, and invalid data distribution assumptions. Summary of the Invention

[0006] Aiming at the problems of noise sensitivity and complex parameter estimation in the current open set recognition algorithm for protocols, the present invention provides a binary private protocol data recognition method and system under open set conditions.

[0007] In a first aspect, the present invention provides a method for identifying binary private protocol data under open set conditions, comprising:

[0008] Step 1: Extracting payload and frame structure features from the collected data frame and preprocessing the payload into a binary grayscale image; wherein the frame structure features refer to other features of the data frame except the payload;

[0009] Step 2: Input the binary grayscale image into the autoencoder to obtain load features and reconstruction loss, and compare the reconstruction loss with a preset loss threshold to classify the corresponding data frame into a preliminary known class and an unknown class; wherein the preliminary known class indicates that the class of the data frame has not yet been determined to be a known class;

[0010] Step 3: Input the load feature and the frame structure feature of the data frame into the classifier, and correct the classifier score based on the center distance survival probability of the load feature; wherein the center distance survival probability of the load feature refers to the value of the survival function corresponding to the distance from the load feature to the center of the known class sample;

[0011] Step 4: Based on the corrected scores, the data frames in the preliminary known classes are divided into known classes and unknown classes again.

[0012] Furthermore, it also includes: during the training process, adopting a joint training method of autoencoder and classifier.

[0013] Furthermore, the autoencoder adopts a two-dimensional convolutional neural network.

[0014] Furthermore, the encoder and decoder of the autoencoder are asymmetric structures; wherein the encoder includes multiple convolution blocks, flattening layers, Dropout layers and fully connected layers connected in sequence; wherein each of the convolution blocks includes a convolution layer, a batch normalization layer and a ReLU activation function layer connected in sequence; the decoder includes a fully connected layer, a batch normalization layer, a reshaping layer, multiple transposed convolution blocks and a transposed convolution layer with a Tanh activation function connected in sequence; wherein each of the transposed convolution blocks includes a transposed convolution layer, a batch normalization layer and a ReLU activation function layer connected in sequence.

[0015] Furthermore, in step 2, the preset loss threshold is determined according to the following process:

[0016] The known class dataset is divided into a training set and a validation set. When the reconstruction loss of the validation set is similar to that of the training set and the autoencoder does not overfit, the maximum reconstruction loss in the validation set is selected as the preset loss threshold.

[0017] Furthermore, step 3 also includes: using the density estimation function of the Gaussian kernel to calculate the density estimation function corresponding to the distance from the load feature to the center of the N types of known class samples, and then calculating the center distance survival probability of the corresponding load feature based on the corresponding density estimation function.

[0018] Furthermore, in step 3, the classifier score is corrected based on the center distance survival probability of the load feature, specifically including:

[0019] The corrected scores for classifying the data frame into known classes are:

[0020]

[0021] The corrected scores for classifying the data frame into the unknown class are:

[0022]

[0023] Among them, z j Indicates that the data frame x i The probability of being classified into the jth known class, z j is the jth element of vector z, C is the length of vector z, softmax(z j ) represents the data frame x i is the classifier score of the j-th known class, Represents the data frame x i The value of the survival function corresponding to the distance from the load feature to the center of the j-th known class sample, j = 1, 2, ..., N, N is the total number of categories of the classifier, N = C.

[0024] In a second aspect, the present invention provides a binary private protocol data identification system under open set conditions, comprising:

[0025] A data preprocessing unit, configured to extract payload and frame structure features from the collected data frame and preprocess the payload into a binary grayscale image; wherein the frame structure features refer to other features of the data frame in addition to the payload;

[0026] a preliminary classification unit, configured to input the binary grayscale image into an autoencoder to obtain a load feature and a reconstruction loss, and compare the reconstruction loss with a preset loss threshold to classify the corresponding data frame into a preliminary known class and an unknown class; wherein the preliminary known class indicates that the class of the data frame has not yet been determined to be a known class;

[0027] a score updating unit, configured to input the load feature and the frame structure feature of the data frame into a classifier, and correct the classifier score based on the center-to-center survival probability of the load feature; wherein the center-to-center survival probability of the load feature refers to the value of the survival function corresponding to the distance from the load feature to the center of a known class sample;

[0028] The reclassification unit is used to reclassify the data frames in the preliminary known classes into known classes and unknown classes based on the corrected scores.

[0029] In a third aspect, the present invention provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first aspect when executing the program.

[0030] In a fourth aspect, the present invention provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the method described in the first aspect when executed by a processor.

[0031] Beneficial effects of the present invention:

[0032] Traditional processing of unknown protocols mostly focuses on preliminary clustering of protocols, which requires a high sample size, inaccurate feature extraction, and lacks integration with empirical knowledge during long-term use. The present invention provides a binary private protocol data recognition method and system under open set conditions, which focuses on open set recognition of unknown protocols. It jointly trains an autoencoder and a classifier, so that the autoencoder learns the original load and label and completes feature extraction at the same time, and the classifier learns the load features and frame features at the same time, which can more accurately extract known category features and effectively reject unknown categories. In addition, the present invention has strong robustness compared to the traditional unknown protocol clustering invention model, fully utilizes prior information, and can extract features of unknown category data while dividing unknown categories for subsequent processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 One of the flow charts of a method for identifying binary private protocol data under open set conditions provided by an embodiment of the present invention;

[0034] Figure 2 A second flow chart of a method for identifying binary private protocol data under open set conditions provided by an embodiment of the present invention;

[0035] Figure 3 A schematic diagram of preprocessing a payload into a binary grayscale image according to an embodiment of the present invention;

[0036] Figure 4 An autoencoder architecture provided by an embodiment of the present invention;

[0037] Figure 5 A schematic structural diagram of a binary private protocol data recognition system under open set conditions provided by an embodiment of the present invention;

[0038] Figure 6 This is a structural block diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0039] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0040] Combine Figure 1 and Figure 2 As shown, an embodiment of the present invention provides a method for identifying binary private protocol data under open set conditions, including:

[0041] S101: extracting payload and frame structure features from a collected data frame and preprocessing the payload into a binary grayscale image; wherein the frame structure features refer to other features of the data frame except the payload;

[0042] Specifically, traditional protocol analysis often relies on experts visually observing bitmaps or observing large numbers of aligned frames to identify similar formats for classification and format extraction. Referring to expert learning methods, compared to directly processing 01 sequence messages, the embodiments of the present invention demonstrate significant advantages in intuitiveness and visual distinction by converting payloads into messages in a two-dimensional image format, taking into account the length characteristics of data and its bit-based nature.

[0043] In addition, the frame structure features in this embodiment include packet size, payload length, and verification method.

[0044] It is understandable that the image size of the binary grayscale image can be selected according to the length of the payload. For example, take the first 256 bits of data and convert it into a 16×16 pixel binary grayscale image, such as Figure 3 It should be noted that the side length of the binary grayscale image should be selected based on the distribution of the lengths of each category and is usually set to a multiple of 8 to avoid the problem of the byte part being split.

[0045] S102: Inputting the binary grayscale image into an autoencoder to obtain a load feature and a reconstruction loss, and comparing the reconstruction loss with a preset loss threshold to classify the corresponding data frame into a preliminary known class and an unknown class; wherein the preliminary known class indicates that the class of the data frame has not yet been determined to be an unknown class;

[0046] Specifically, data frames whose reconstruction loss is greater than a preset loss threshold are classified into the unknown class, and data frames whose reconstruction loss is not greater than the threshold are classified into the preliminary known class.

[0047] S103: Inputting the load feature and the frame structure feature of the data frame into a classifier, and correcting the classifier score based on the center-to-center survival probability of the load feature; wherein the center-to-center survival probability of the load feature refers to the value of the survival function corresponding to the distance from the load feature to the center of a known class sample;

[0048] S104: Based on the corrected scores, the data frames in the preliminary known class are divided into known classes and unknown classes again, so as to reduce the neglect of unknown classes by a single reconstruction loss threshold.

[0049] It's understandable that the autoencoder and classifier only achieve the aforementioned corresponding functions after being trained on a dataset with known classes. During training, the two are trained jointly, requiring the total loss to be the minimum weighted sum of the classifier loss and the reconstruction loss, simultaneously fulfilling the requirements of feature extraction and classification. This means that the payload feature z = E(x) output by the encoder E in the autoencoder is used both by the decoder to reconstruct the input x and by the classifier to predict the label y. Therefore, the feature vector z should contain both the main information of the original input and sufficient information for correct classification.

[0050] Traditional processing of unknown protocols focuses on clustering protocols, which requires a high sample size, results in inaccurate feature extraction, and lacks integration with empirical knowledge over long periods of use. The binary private protocol data recognition method under open set conditions provided by the embodiments of the present invention focuses on open set recognition of unknown protocols, fully utilizing existing empirical knowledge to more accurately extract features and quickly extract key unknown class information. Furthermore, the present invention is more robust than the traditional unknown protocol clustering model and is less prone to overfitting. While dividing unknown classes, it can also extract features from unknown class data for subsequent processing.

[0051] In one embodiment, by pre-processing the payload into images, the selection range of the autoencoder network is expanded. In this embodiment, a two-dimensional convolutional neural network (2D CNN) is specifically selected.

[0052] Specifically, inputting the same data in the form of a one-dimensional sequence into a one-dimensional convolutional neural network (1D CNN) or a long short-term memory network (LSTM) can process sequential data and capture temporal dependencies, but is prone to gradient vanishing or gradient exploding problems when processing long sequences. These structures have difficulty effectively propagating error signals during backpropagation, especially when the sequence length is long. However, due to its inherent local connection characteristics, 2D CNN can better manage the flow of gradients in deep networks, effectively circumventing the above problems. The specific explanation is as follows:

[0053] Assume that the first 32 bytes of the data frame B0, B1, ..., B 31 According to every two bytes, that is, 16 bits b 0,0 ,b 0,1 ,…,b 0,7 ,b 1,0 ,b 1,1 ,…,b 1,7 It is processed into a 16×16 binary grayscale image, that is, each pixel is 0 or 1, represented as I∈{0,1} 16×16 .

[0054] For the first convolutional layer, a 3×3 convolution kernel K∈R is used. 3×3 , the step size is 2, and the calculation formula of the output feature map F is as follows:

[0055]

[0056] Where i, j are the positions of the output feature map, I(2i+m,2j+n) is the pixel value at position (2i+m,2j+n) in the input image I, and K(m+1,n+1) is the weight of the corresponding position in the convolution kernel. Take F(1,1) as an example:

[0057] F(1,1)=I(1,1)K(0,0)+I(1,2)K(0,1)+I(1,3)K(0,2)

[0058] +I(2,1)K(1,0)+I(2,2)K(1,1)+I(2,3)K(1,2)

[0059] +I(3,1)K(2,0)+I(3,2)K(2,1)+I(3,3)K(2,2)

[0060] That is, F(1,1) consists of bits {b 1,1 ,b 1,2 ,b 1,3 ,b 3,1 ,b 3,2 ,b 3,3 ,b 5,1 ,b 5,2 ,b 5,3}Calculated, it is related to the 9 bits of the three bytes {B1, B3, B5}.

[0061] The second convolutional layer will expand to cover seven bytes, a total of 49 bits, and the third convolutional layer will cover 22 bytes, a total of 121 bits. As the network depth increases, the range of associated learning expands to 32 bytes.

[0062] The autoencoder learns the efficient encoding representation of input data by building a neural network model, which includes two basic structures: encoder and decoder. Its goal is to minimize the difference between input data and reconstructed data, thereby achieving effective feature extraction and dimensionality reduction. Figure 4 The autoencoder model used in this embodiment of the present invention includes, from left to right: the input layer and three convolutional layers of the encoder, and the reshaping layer and four transposed convolutional layers of the decoder. The sizes of each layer of the model are shown in the figure.

[0063] Because binary grayscale images have different mapping difficulties from high-dimensional to low-dimensional and from low-dimensional to high-dimensional, this model uses an asymmetric autoencoder architecture. This model is flexible and effectively prevents overfitting. Both the input dimension and the extracted feature dimension are adjustable parameters that can be adjusted based on the length of the input data and the accuracy of the validation set.

[0064] The encoder first extracts features from the input data through multiple convolutional layers, each followed by a batch normalization layer and a ReLU activation function layer. Next, a flattening layer flattens the output of the convolutional layer into a one-dimensional vector, followed by a dropout layer to prevent overfitting, and finally a fully connected layer generates a low-dimensional feature representation. The decoder maps this low-dimensional feature representation to an intermediate layer through a fully connected layer, followed by a batch normalization layer. A reshape layer then reshapes the output of the intermediate layer into a shape suitable for the convolution operation, and then gradually restores the original shape of the data through multiple transposed convolutional layers, each followed by a batch normalization layer and a ReLU activation function layer. Finally, a transposed convolutional layer with a Tanh activation function generates the decoded data.

[0065] The classifier input is the variable-dimensional load features extracted by the autoencoder and the frame structure features of the data frame. In one embodiment, the classifier is a layer of normalization layer and a layer of fully connected network, and softmax is used as the output layer activation function.

[0066] From the entire data recognition method process of the present invention, it can be seen that the preset reconstruction loss threshold plays a key role in the accuracy of the classification results. Based on the above embodiments, it is considered that if the method of using only the reconstruction loss of the autoencoder to define the reconstruction loss threshold to distinguish unknown classes is prone to overfitting the known class data, being sensitive to noise, and ignoring the diversity of data distribution, the determined reconstruction loss threshold is highly dependent on the selected data. Therefore, in one embodiment, in order to reduce the impact of the data set on the classification results, this embodiment adopts the following method to determine the preset reconstruction loss threshold: the known class data set is divided into a training set and a validation set. When the reconstruction loss of the validation set is similar to the reconstruction loss of the training set and the autoencoder does not overfit, the maximum reconstruction loss in the validation set is selected as the preset loss threshold. It is understandable that the user can customize the situation where the reconstruction loss of the validation set is similar to the reconstruction loss of the training set, such as setting a difference threshold. When the difference between the two is less than the difference threshold, the two are considered to be similar.

[0067] On the basis of the above embodiments, in order to study the extracted load features from a different perspective, we further start from the load features extracted by the autoencoder, reduce the dimensionality of 8, 16 or higher dimensional features, verify the feature extraction effect, calculate the sample center and center distance after dimensionality reduction of the training set features, and fit the cumulative distribution function of each type of center distance. In this embodiment, kernel density estimation (KDE) is used to estimate the unknown probability density function.

[0068] Specifically, the basic idea of ​​KDE is to iPlace a kernel function K on it, and then estimate the probability density function f by weighted averaging these kernel functions. The kernel function K is a non-negative function that satisfies the following conditions:

[0069]

[0070] Common kernel functions include Gaussian kernel, Epanechnikov kernel, rectangular kernel, triangular kernel, etc. This embodiment uses the Gaussian kernel function, and the formula is as follows:

[0071]

[0072] Bandwidth is an important parameter of KDE, which controls the width of the kernel function. A larger bandwidth will make the estimate smoother, while a smaller bandwidth will make the estimate more localized. In Python, the bandwidth can be automatically selected using heuristic methods. For a given bandwidth h, the KDE formula for the Gaussian kernel is:

[0073]

[0074] is the density estimate at the center distance d, d i is the distance from the i-th point to the center point, and n represents the sample size.

[0075] Based on the above theory, in the process of model training, the embodiment of the present invention uses the above formula to calculate the value of each sample x in the validation set. i To the centers of N known class samples c1, c2, ..., c N distance The corresponding density estimation functions f1(d), f2(d),…, f N (d). From this, we can obtain the cumulative distribution function (CDF) and survival function:

[0076]

[0077] S j (d) = P j (X>d)=1-F j (d)

[0078] j=1,2,…,N

[0079] Among them, F j (d) represents the density estimation function f j (d) The resulting cumulative distribution function, S j (d) represents the corresponding survival function.

[0080] Correspondingly, during the test process, the test set sample x is brought in i Distance to the center of each class Corresponding to each type of survival function, get the test set sample x i is the probability of the known class

[0081]

[0082] The embodiment of the present invention combines the calculated center distance survival probability with the softmax score of the classifier to obtain a corrected score. The softmax score can be expressed as:

[0083]

[0084] Vector z is the original output of the model, with a length of C, that is, the total number of categories of the classifier is N = C, z j is the jth element of vector z, which can be understood as the probability of a sample being classified into the jth class. The denominator is the exponential sum of all z elements, ensuring that the sum of the outputs of the softmax function is 1. Because of this, the softmax function is closed, and the classifier always tends to classify unknown classes as known classes, even if the data points are far from the known class.

[0085] However, samples from unknown classes that are far apart generally struggle to achieve high scores in a particular class in the softmax function, and their scores tend to be relatively averaged across each class compared to samples from known classes. Therefore, this embodiment uses the center distance probability of the load feature to correct the softmax score.

[0086] The corrected scores for the known classes are:

[0087]

[0088] The corrected score for the unknown class is the total score reduction:

[0089]

[0090] The classification results are:

[0091]

[0092] According to the corrected scores, the data frames in the preliminary known class are reclassified into the class with the highest score, so as to achieve the effect of correcting similar unknown class samples.

[0093] like Figure 5 As shown, corresponding to the above method, an embodiment of the present invention further provides a binary private protocol data recognition system under open set conditions, including a data preprocessing unit, an initial classification unit, a score updating unit and a reclassification unit.

[0094] Among them, the data preprocessing unit is used to extract the load and frame structure features in the collected data frame and preprocess the load into a binary grayscale image; wherein, the frame structure feature refers to other features of the data frame except the load; the initial classification unit is used to input the binary grayscale image into the autoencoder to obtain the load feature and reconstruction loss, compare the reconstruction loss and the preset loss threshold to divide the corresponding data frame into a preliminary known class and an unknown class; wherein, the preliminary known class indicates that the category of the data frame has not yet been determined whether it is a known class; the score updating unit is used to input the load feature and the frame structure feature of the data frame into the classifier, and correct the classifier score based on the center-to-center survival probability of the load feature; wherein, the center-to-center survival probability of the load feature refers to the value of the survival function corresponding to the distance from the load feature to the center of the known class sample; the reclassification unit is used to divide the data frame in the preliminary known class into known classes and unknown classes again based on the corrected score.

[0095] It should be noted that the data identification system provided in the embodiment of the present invention is for implementing the above method. Its specific functions can be referred to the above method embodiments and will not be described again here.

[0096] In order to verify the effectiveness of the solution of the present invention, the present invention also provides the following experimental data.

[0097] (1) Dataset

[0098] The dataset used in the experiment consists of two parts, as shown in Table 1 and Table 2.

[0099] Table 1 Datasets of different protocols

[0100]

[0101] ICMP, NBNS, ARP, DNS, NTP, FTP, and SMTP are from the MACCDC 2012 dataset. ICMP, NBNS, ARP, DNS, and NTP are binary protocols. Modbus and DNP3.0 are industrial control protocols.

[0102] Table 2 Datasets of different message types

[0103]

[0104] The AIS dataset comes from data received in an actual communication network.

[0105] Known and unknown classes are selected according to the desired degree of openness, and the number of items for each protocol or message type is randomly selected. These are applied to directly perform K-means clustering on the original data, perform K-means clustering on the features extracted by the autoencoder, directly calculate the correction score by the classifier, use only the reconstruction loss threshold, and the present invention. The evaluation indicators are accuracy and F1-score.

[0106] Table 3 Comparison of algorithms at the same openness level

[0107]

[0108] At the same level of openness, experimental results in Table 3 show that the proposed model, trained collaboratively using the autoencoder and classifier, achieves superior feature extraction. Similarly, K-menas clustering of the original data and features significantly improves performance. Furthermore, directly using the correction score and reconstruction loss to classify unknown classes is not as effective as the proposed method, which combines the two, resulting in significantly improved overall performance. The extracted unknown class features can be directly used in subsequent research.

[0109] In addition, open set algorithms prioritize timeliness. Previous clustering methods, in order to identify unknown classes, may require accumulating data for a period of time before updating the model, which doesn't meet the real-world requirements of instant discovery and identification. This invention, however, can save the trained model and classify each new piece of data at any time, enabling timely discovery of unknown data.

[0110] Figure 6 An example of a physical structure diagram of an electronic device is shown below. Figure 6As shown, the electronic device may include: a processor (processor) 601, a communication interface (Communications Interface) 602, a memory (memory) 603 and a communication bus 604, wherein the processor 601, the communication interface 602, and the memory 603 communicate with each other through the communication bus 604. The processor 601 can call the logic instructions in the memory 603 to execute the binary private protocol data recognition method, which includes: step 1: extracting the load and frame structure features in the collected data frame and preprocessing the load into a binary grayscale image; wherein the frame structure feature refers to other features of the data frame other than the load; step 2: inputting the binary grayscale image into the autoencoder to obtain the load feature and reconstruction loss, comparing the reconstruction loss with the preset loss threshold to divide the corresponding data frame into a preliminary known class and an unknown class; wherein the preliminary known class indicates that the category of the data frame has not yet been determined to be a known class; step 3: inputting the load feature and the frame structure feature of the data frame into the classifier, and correcting the classifier score based on the center-to-center survival probability of the load feature; wherein the center-to-center survival probability of the load feature refers to the value of the survival function corresponding to the distance from the load feature to the center of the known class sample; step 4: based on the corrected score, the data frame in the preliminary known class is again divided into a known class and an unknown class.

[0111] In addition, when the logic instructions in the above-mentioned memory 603 are implemented in the form of a software functional unit and sold or used as an independent product, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0112] An embodiment of the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions. When the program instructions are executed by a computer, the computer can execute the methods provided by the above-mentioned method embodiments, for example, including: Step 1: Extracting the load and frame structure features in the collected data frame and preprocessing the load into a binary grayscale image; wherein the frame structure feature refers to other features of the data frame other than the load; Step 2: Inputting the binary grayscale image into an autoencoder to obtain the load feature and reconstruction loss, comparing the reconstruction loss with a preset loss threshold to divide the corresponding data frame into a preliminary known class and an unknown class; wherein the preliminary known class indicates that the class of the data frame has not yet been determined to be a known class; Step 3: Inputting the load feature and the frame structure feature of the data frame into a classifier, and correcting the classifier score based on the center-to-center survival probability of the load feature; wherein the center-to-center survival probability of the load feature refers to the value of the survival function corresponding to the distance from the load feature to the center of the known class sample; Step 4: Based on the corrected score, the data frame in the preliminary known class is again divided into a known class and an unknown class.

[0113] An embodiment of the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the methods provided by the above-mentioned method embodiments, for example, including: Step 1: Extracting the load and frame structure features in the collected data frame and preprocessing the load into a binary grayscale image; wherein the frame structure feature refers to other features of the data frame other than the load; Step 2: Inputting the binary grayscale image into an autoencoder to obtain the load feature and reconstruction loss, comparing the reconstruction loss with a preset loss threshold to divide the corresponding data frame into a preliminary known class and an unknown class; wherein the preliminary known class indicates that the category of the data frame has not yet been determined to be a known class; Step 3: Inputting the load feature and the frame structure feature of the data frame into a classifier, and correcting the classifier score based on the center-to-center survival probability of the load feature; wherein the center-to-center survival probability of the load feature refers to the value of the survival function corresponding to the distance from the load feature to the center of the known class sample; Step 4: Based on the corrected score, the data frame in the preliminary known class is again divided into a known class and an unknown class.

[0114] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0115] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for identifying binary private protocol data under open set conditions, characterized in that: include: Step 1: Extracting payload and frame structure features from the collected data frame and preprocessing the payload into a binary grayscale image; wherein the frame structure features refer to other features of the data frame except the payload; Step 2: Input the binary grayscale image into the autoencoder to obtain load features and reconstruction loss, and compare the reconstruction loss with a preset loss threshold to classify the corresponding data frame into a preliminary known class and an unknown class; wherein the preliminary known class indicates that the class of the data frame has not yet been determined to be a known class; the preset loss threshold is determined according to the following process: divide the known class data set into a training set and a validation set, and when the reconstruction loss of the validation set is similar to the reconstruction loss of the training set and the autoencoder does not overfit, select the maximum reconstruction loss in the validation set as the preset loss threshold; Step 3: Input the load feature and the frame structure feature of the data frame into the classifier, and correct the classifier score based on the center distance survival probability of the load feature; wherein the center distance survival probability of the load feature refers to the value of the survival function corresponding to the distance from the load feature to the center of the known class sample; correcting the classifier score based on the center distance survival probability of the load feature specifically includes: The corrected scores for classifying the data frame into known classes are: The corrected scores for classifying the data frame into the unknown class are: in, Indicates that the data frame Divided into j The probability of a class being known, is a vector z No. j elements, C is a vector z length, Represents a data frame For the j The classifier score for known classes, Represents a data frame Load characteristics to j The value of the survival function corresponding to the distance from the center of the class sample known to the class, , is the total number of categories of the classifier, ; Step 4: Based on the corrected scores, the data frames in the preliminary known classes are divided into known classes and unknown classes again.

2. The method for identifying binary private protocol data under open set conditions according to claim 1, characterized in that: Also includes: During the training process, the autoencoder and classifier are jointly trained.

3. The method for identifying binary private protocol data under open set conditions according to claim 1 or 2, characterized in that: The autoencoder adopts a two-dimensional convolutional neural network.

4. The method for identifying binary private protocol data under open set conditions according to claim 3, characterized in that: The encoder and decoder of the autoencoder are asymmetric structures; wherein the encoder includes multiple convolution blocks, flattening layers, Dropout layers and fully connected layers connected in sequence; wherein each of the convolution blocks includes a convolution layer, a batch normalization layer and a ReLU activation function layer connected in sequence; the decoder includes a fully connected layer, a batch normalization layer, a reshape layer, multiple transposed convolution blocks and a transposed convolution layer with a Tanh activation function connected in sequence; wherein each of the transposed convolution blocks includes a transposed convolution layer, a batch normalization layer and a ReLU activation function layer connected in sequence.

5. The method for identifying binary private protocol data under open set conditions according to claim 1, characterized in that: Step 3 also includes: using the density estimation function of the Gaussian kernel to calculate the density estimation function corresponding to the distance from the load feature to the center of the N types of known class samples, and then calculating the center distance survival probability of the corresponding load feature based on the corresponding density estimation function.

6. A binary private protocol data recognition system under open set conditions, characterized in that: include: A data preprocessing unit, configured to extract payload and frame structure features from the collected data frame and preprocess the payload into a binary grayscale image; wherein the frame structure features refer to other features of the data frame in addition to the payload; a preliminary classification unit, configured to input the binary grayscale image into an autoencoder to obtain a load feature and a reconstruction loss, and compare the reconstruction loss with a preset loss threshold to classify the corresponding data frame into a preliminary known class and an unknown class; wherein the preliminary known class indicates that the class of the data frame has not yet been determined to be an unknown class; and the preset loss threshold is determined according to the following process: dividing the known class data set into a training set and a validation set, and when the reconstruction loss of the validation set is similar to the reconstruction loss of the training set and the autoencoder does not overfit, selecting the maximum reconstruction loss in the validation set as the preset loss threshold; A score updating unit is configured to input the load feature and the frame structure feature of the data frame into a classifier, and correct the classifier score based on the center distance survival probability of the load feature; wherein the center distance survival probability of the load feature refers to the value of the survival function corresponding to the distance from the load feature to the center of a known class sample; correcting the classifier score based on the center distance survival probability of the load feature specifically includes: The corrected scores for classifying the data frame into known classes are: The corrected scores for classifying the data frame into the unknown class are: in, Indicates that the data frame Divided into j The probability of a class being known, is a vector z No. j elements, C is a vector z length, Represents a data frame For the j The classifier score for known classes, Represents a data frame Load characteristics to j The value of the survival function corresponding to the distance from the center of the class sample known to the class, , is the total number of categories of the classifier, ; The reclassification unit is used to reclassify the data frames in the preliminary known classes into known classes and unknown classes based on the corrected scores.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method according to any one of claims 1 to 5 is implemented.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images