Traffic white glove detection method and device based on intelligent feature analysis

Abstract

The invention discloses a traffic white glove detection method and device based on intelligent feature analysis, and the method comprises the steps: collecting traffic data in a network, carrying out the preprocessing, and generating a structured data flow; basic features are extracted from the preprocessed flow data, and preliminary analysis is carried out; time sequence features and behavior pattern features are extracted from the preliminarily analyzed traffic data, and changes and periodic changes of the traffic in a fixed time window are analyzed; performing weighted fusion on the basic features, the time sequence features and the behavior pattern features to form a comprehensive feature vector; inputting the feature vectors after weight fusion into a trained random forest model for classification, and identifying traffic white glove behaviors; and once the traffic white glove behavior is identified, generating an abnormal alarm, and automatically triggering abnormal alarm disposal. According to the method and the device, the hidden features in the traffic can be extracted, and the traffic white glove technology is analyzed and detected in real time in combination with a machine learning model.

Description

Technical Field

[0001] The present invention relates to the field of flow detection, and in particular to a flow white-glove detection method and device based on intelligent feature analysis. Background Art

[0002] Traffic white gloves is a technology that confuses normal traffic with malicious traffic, making it difficult for traditional traffic analysis tools to detect. With the development of network attack technology, attackers are increasingly using advanced obfuscation techniques to evade detection by security devices. Limitations of traditional detection methods: Traditional traffic detection methods are based on rules or simple statistical model methods, which usually rely on predefined rule sets or feature templates to detect abnormal traffic. The original fixed rule detection algorithm and the detection algorithm that rely on static rules are easily bypassed by traffic white gloves technology, because attackers can evade these rules through obfuscation and disguise. Although they perform well against ordinary attacks, they are often powerless when facing advanced concealment technology such as "traffic white gloves", and are prone to missed reports or false reports. Summary of the invention

[0003] In order to solve the above-mentioned problems existing in traditional traffic detection means, the present invention provides a traffic white glove detection method and device based on intelligent feature analysis, which can extract hidden features in the traffic and combine with machine learning models to perform real-time analysis and detection of traffic white glove technology.

[0004] To achieve the above object, the present invention adopts the following technical solutions:

[0005] In one embodiment of the present invention, a traffic white glove detection method based on intelligent feature analysis is proposed, and the method includes:

[0006] Collect raw traffic data in the network, perform preprocessing, and generate structured data streams;

[0007] Extract basic features from the preprocessed traffic data, including traffic metadata features and traffic statistics features, and perform preliminary analysis;

[0008] Extract time series features and behavior pattern features from the traffic data after preliminary analysis, and analyze the changes and periodic changes of traffic within a fixed time window;

[0009] The basic features, time series features and behavior pattern features are weighted and integrated to form a comprehensive feature vector;

[0010] The weighted fused feature vector is input into the trained random forest model for classification to identify traffic white glove behavior;

[0011] Once traffic white-glove behavior is identified, an abnormal alarm is generated and abnormal alarm handling is automatically triggered.

[0012] Furthermore, traffic metadata features include IP address information, port number distribution, and protocol type; traffic statistics features include packet size, traffic rate, and session duration.

[0013] Furthermore, the changes in traffic within a fixed time window and periodic changes are analyzed, including:

[0014] Use a fixed time window to count traffic changes within the time window; perform time series analysis on traffic based on the LSTM time series model to detect hidden traffic obfuscation attacks;

[0015] Use Fourier transform analysis to capture periodic changes in traffic and help identify traffic white glove behavior.

[0016] Furthermore, if multiple flows of the same IP show consistent behavior patterns, the characteristics of disguised flows can be identified through correlation analysis.

[0017] In one embodiment of the present invention, a flow white glove detection device based on intelligent feature analysis is also proposed, and the device includes:

[0018] Data collection module, used to collect original traffic data in the network;

[0019] The data preprocessing module is used to preprocess the collected traffic data and generate a structured data stream;

[0020] The basic feature extraction module is used to extract basic features from the preprocessed traffic data, including traffic metadata features and traffic statistical features, and perform preliminary analysis;

[0021] The middle-level feature extraction module is used to extract time series features and behavior pattern features from the traffic data after preliminary analysis, and analyze the changes and periodic changes of traffic within a fixed time window;

[0022] The deep feature extraction module is used to perform weighted fusion of basic features, time series features, and behavior pattern features to form a comprehensive feature vector;

[0023] The anomaly detection module is used to input the weighted fused feature vector into the trained random forest model for classification and identify traffic white glove behavior; once the traffic white glove behavior is identified, an anomaly alarm is generated and the anomaly alarm handling is automatically triggered.

[0024] Furthermore, traffic metadata features include IP address information, port number distribution, and protocol type; traffic statistics features include packet size, traffic rate, and session duration.

[0025] Furthermore, the changes in traffic within a fixed time window and periodic changes are analyzed, including:

[0026] Use a fixed time window to count traffic changes within the time window; perform time series analysis on traffic based on the LSTM time series model to detect hidden traffic obfuscation attacks;

[0027] Use Fourier transform analysis to capture periodic changes in traffic and help identify traffic white glove behavior.

[0028] Furthermore, if multiple flows of the same IP show consistent behavior patterns, the characteristics of disguised flows can be identified through correlation analysis.

[0029] In one embodiment of the present invention, a computer device is also proposed, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the aforementioned white glove detection of traffic based on intelligent feature analysis is implemented.

[0030] In one embodiment of the present invention, a computer-readable storage medium is also proposed, which stores a computer program for executing traffic white-glove detection based on intelligent feature analysis.

[0031] Beneficial effects:

[0032] 1. The present invention uses machine learning and deep learning technologies to extract multi-dimensional features from massive network traffic, including basic features, time series features, and behavioral pattern features.

[0033] 2. The present invention gradually filters and mines potential abnormal behaviors in traffic through a hierarchical analysis method. Each level targets different feature sets and analysis algorithms to ensure the depth and breadth of detection.

[0034] 3. The present invention can dynamically adjust the analysis strategy according to the changes in the network environment and historical data to ensure that efficient detection capabilities are maintained when facing new attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is a flow chart of the flow white glove detection method based on intelligent feature analysis of the present invention;

[0036] Figure 2 It is a structural schematic diagram of a flow white glove detection device based on intelligent feature analysis of the present invention;

[0037] Figure 3 It is a schematic diagram of the computer device structure of the present invention. DETAILED DESCRIPTION

[0038] The principles and spirit of the present invention will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and implement the present invention, and are not intended to limit the scope of the present invention in any way. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0039] Those skilled in the art will appreciate that the embodiments of the present invention may be implemented as a device, apparatus, equipment, method or computer program product. Therefore, the present disclosure may be implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0040] According to the implementation of the present invention, a traffic white-glove detection method and device based on intelligent feature analysis is proposed, aiming to achieve effective detection of complex obfuscated traffic and improve the level of network security protection by combining advanced machine learning and big data analysis technology. The original intention of this solution is to solve the shortcomings of current traffic detection technology in dealing with complex obfuscation attacks and meet the industry's demand for efficient, accurate and adaptive security solutions.

[0041] The principle and spirit of the present invention are explained in detail below with reference to several representative embodiments of the present invention.

[0042] Figure 1 Schematic diagram of the flow chart of the flow white glove detection method based on intelligent feature analysis of the present invention. Figure 1 As shown, the method includes:

[0043] 1. Collection and preprocessing of traffic data: obtaining original traffic data from the network, including packet header information, data packet content, and timing information of data generation, and preprocessing to remove noise and normalize the data.

[0044] The data collection module can collect network traffic information in real time through traffic collection tools such as NetFlow and sFlow, and convert it into a structured data stream, including key fields such as IP address, source / destination port, protocol type, packet size and timestamp.

[0045] 2. Data feature extraction and modeling

[0046] (1) Basic feature extraction module. Basic features are mainly basic information that is obvious and easy to extract from network traffic. These features can often quickly reflect certain obvious attacks or abnormal behaviors. Basic features include: traffic metadata features and traffic statistics features.

[0047] (2) Traffic metadata characteristics

[0048] IP address information: including source IP and destination IP. These features can reflect whether there are abnormal phenomena such as IP spoofing and IP address concentrated attacks.

[0049] Port number distribution: Certain ports such as HTTP (80) and HTTPS (443) may be the focus of attacks. Monitoring the use of port numbers can help detect abnormal port traffic.

[0050] Protocol type: TCP, UDP, ICMP, etc. Attackers may use specific protocols to confuse traffic, such as using UDP instead of TCP to circumvent conventional defense mechanisms.

[0051] (3) Traffic statistics characteristics

[0052] Packet size: Certain attacks may use larger or smaller packets to disguise normal traffic, especially some DDoS attacks.

[0053] Traffic rate: By monitoring the number of bytes transmitted per second, you can detect sudden traffic surges or suspicious traffic with a very low rate.

[0054] Session duration: Some traffic white glove attacks may avoid detection by maintaining low-frequency connections for a long time.

[0055] Through simple statistical rules or threshold analysis, the basic characteristics of the traffic are preliminarily analyzed. This process can filter out obvious normal traffic and reduce the computing pressure of subsequent advanced analysis.

[0056] (4) Middle-level feature extraction module: The middle-level features focus on analyzing the behavioral pattern characteristics and time series characteristics of traffic, especially capturing the changing trends and periodic changes of traffic at different time points.

[0057] Time series features, sliding window analysis: Use a fixed time window (such as every 5 seconds or 10 seconds) to count traffic changes within the time window, including the number of packets, traffic size, number of connections, etc. This can help identify sudden traffic patterns.

[0058] Time series modeling: Based on time series models such as LSTM (Long Short-Term Memory Network), time series analysis of traffic is performed. LSTM models can capture historical patterns of traffic and predict future behavior to detect hidden traffic obfuscation attacks.

[0059] Behavior pattern characteristics, periodicity analysis: Use frequency domain analysis methods such as Fourier transform to capture periodic changes in traffic. Attackers may send disguised traffic in a certain periodicity, so periodicity analysis can help identify traffic white glove behavior.

[0060] Traffic correlation analysis: Analyze the correlation of multiple flows, such as whether multiple flows of the same IP show consistent behavior patterns (such as the same protocol, port, packet size, etc.). Through these correlation analyses, the characteristics of disguised traffic can be identified.

[0061] (5) Deep feature extraction module. Deep features use random forests to perform feature selection and classification by integrating multiple decision tree models. It can effectively handle high-dimensional and complex features and mainly focuses on potential patterns and abnormal behaviors in traffic.

[0062] Feature vectorization: Through the feature embedding technology in deep learning, different high-dimensional and complex traffic features (such as basic features, time series features, and behavioral pattern features) are embedded into low-dimensional vector space, making complex feature relationships more intuitive in low dimensions. The purpose of this mapping is to retain the key information of the data while reducing the dimension of the data so that the model can process and understand the data more efficiently. For example, the original network traffic features may contain hundreds or thousands of dimensions (such as multiple attributes of each data packet), and these features can be compressed into vectors of dozens or even fewer dimensions through embedding technology.

[0063] Weighted fusion is a technique used to combine different features to form a comprehensive feature vector in the multi-level feature extraction process. Different features have different importance in network traffic analysis, so by assigning weights to features, key features can be more effectively highlighted, thereby improving the accuracy of the model. Weighted fusion is mainly used in the combination stage of different types of features, such as basic features, time series features, and behavioral pattern features. It can dynamically adjust the weights of different features to obtain the optimal feature combination effect.

[0064] Before performing weighted fusion, you first need to assign weights to different features:

[0065] Time series features play an important role in detecting disguised traffic, so they can be given a higher weight.

[0066] Basic features (such as IP addresses and port numbers) may provide useful initial clues in some cases, but their accuracy is relatively low, so their weight can be appropriately reduced.

[0067] Feature standardization,Since the numerical ranges of different features may vary greatly, the features need to be standardized before weighted fusion.

[0068] By scaling the features to the interval [0, 1], we can ensure that the values ​​of each feature are in the same range, thereby preventing the absolute values ​​of some features from being too large and affecting the fusion results.

[0069] Feature weighting: When the influence of features in a data set is uneven, weighting can highlight important features. Feature data needs to be weighted to improve the accuracy of subsequent models.

[0070] Once the weights and normalized feature values ​​are determined, the next step is the weighted fusion process. The features can be weighted using the following formula:

[0071] F=w1*F1+w2*F2+....+wn*Fn

[0072] Where F is the feature vector after weighted fusion, F1, F2, ..., Fn represent the feature values ​​of different feature levels, and w1, w2, ..., wn are the corresponding weights.

[0073] 3. Multi-level intelligent analysis: The integrated multi-level features are input into the intelligent analysis module and classified and identified through the trained machine learning model, namely the random forest model.

[0074] During the training process of the random forest model, each sample in the training set is represented by a set of feature vectors obtained in step 2. The feature vectors are the basis for inputting into the random forest model. Each input feature vector corresponds to a network traffic instance, including the multi-level features extracted previously (such as basic features, time series features, and behavior pattern features, etc.). Each sample in the data set should contain a feature vector after multi-level feature extraction and weighted fusion. Each feature vector also has a corresponding label "normal traffic" and "attack traffic". Labeled data set: Use pre-labeled data sets of normal traffic and abnormal traffic (including traffic white glove attacks) as training samples. The random forest model improves the stability of the model by building multiple decision trees and voting (classification tasks) or averaging (regression tasks) their prediction results. Pre-labeling refers to classifying and labeling the category of each traffic sample in advance when building the training data set, that is, classifying the traffic data as "normal traffic" or "abnormal traffic" (for example, attack traffic or traffic white glove attacks). The time for pre-labeling is usually after collecting or generating data, but before model training.

[0075] 4. Model multiple iterative learning

[0076] During the training process, the random forest model gradually learns the characteristic patterns of different categories of data through multiple iterations. The categories refer to the different types of samples that the model needs to distinguish, including normal and abnormal. Abnormal is mainly traffic disguised as normal traffic to bypass traditional detection systems. Each decision tree fits the model according to its training subset and feature subset, and classifies each input sample. As the iterations increase, the random forest model gradually improves the accuracy of the classification through more decision trees. Through multiple iterations, the model is constantly adjusted to learn the complex boundary between "normal traffic" and "abnormal traffic". The number of iterations can be adjusted through cross-validation to ensure that the model does not overfit or underfit.

[0077] 5. Evaluation after model training

[0078] After training is completed, the data in the test set is input into the model, and the trained random forest model is used to classify the test data. At this time, the model will vote for each input traffic instance, and multiple trees will jointly determine the classification result. The performance of the model can be evaluated by indicators such as accuracy, recall, and F1-score.

[0079] Through the extraction of shallow, medium and deep multi-dimensional features, combined with the analysis of intelligent algorithms, an effective traffic white glove detection system can be established. Shallow features help to quickly identify obvious traffic anomalies, medium features capture the dynamic and periodic changes of traffic, and deep features reveal potential complex patterns and disguised behaviors. Finally, through multi-level feature fusion and intelligent analysis, hidden attack behaviors are detected.

[0080] It should be noted that, although the operations of the method of the present invention are described in a specific order in the above embodiments and the accompanying drawings, this does not require or imply that the operations must be performed in the specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0081] In order to explain the above-mentioned traffic white-glove detection method based on intelligent feature analysis more clearly, a specific embodiment is used for illustration below. However, it should be noted that this embodiment is only for better illustrating the present invention and does not constitute an improper limitation to the present invention.

[0082] The process of implementing a traffic white glove detection method based on intelligent feature analysis is as follows:

[0083] Step 1: Data collection and preprocessing: Deploy traffic collection devices at the network inlet and outlet to collect Netflow / SFlow traffic data generated by network equipment routers and switches, preprocess the collected traffic data, remove noise, normalize the data, and generate a time series data set.

[0084] Step 2: Basic feature layer analysis

[0085] Extract basic features and analyze the basic information of each traffic packet, such as data packet size, IP address, port number, protocol type, etc.

[0086] Based on the source and purpose of the traffic, some apparently harmless normal traffic is initially filtered out, and the remaining traffic is further analyzed.

[0087] Step 3: Timing feature layer analysis

[0088] Analyze the trend of traffic changes over time and extract the traffic peak, frequency, packet sending interval, etc. within each time window.

[0089] Compare these time series features with the characteristics of historical traffic to identify abnormal peaks and behavior patterns that may exist in a specific time period.

[0090] Step 4: Spatial feature layer analysis

[0091] Analyze the geographical distribution of traffic and the correlation between communication nodes.

[0092] Identify traffic patterns that span different regions and frequently change source IP or destination IP, and preliminarily screen out possible disguised traffic white glove behaviors.

[0093] Step 5: Protocol Behavior Layer Analysis

[0094] Parse the protocol structure of the data packet and deeply analyze the protocol header information and transmission behavior.

[0095] By analyzing protocol features (such as HTTP header information, TCP handshake process, etc.), abnormal patterns in protocol behavior are detected, especially those related to known white glove traffic disguise methods.

[0096] Step 6: Deep Feature Analysis

[0097] The basic features, time series features, spatial features and protocol behavior features are integrated to form a comprehensive feature vector. Feature extraction is the core of anomaly detection, and the random forest model can make predictions based on the extracted features.

[0098] The model automatically learns and identifies disguised behaviors in multi-level features and identifies white glove traffic hidden in normal traffic.

[0099] Step 7: Further warning and handling

[0100] Once traffic white-glove behavior is identified, the system generates an alarm, notifies the administrator and automatically triggers traffic restriction or blocking operations.

[0101] The system will store the detected traffic behavior and related features in the database for subsequent analysis and model optimization.

[0102] Step 8: Further, after confirming that the attack is complete, adjust and optimize the detection model based on the feedback information, reduce the false alarm rate, continue to collect new traffic data, continuously improve and update the detection algorithm, and maintain the accuracy and effectiveness of the model.

[0103] Based on the same inventive concept, the present invention also proposes a flow white glove detection device based on intelligent feature analysis. The implementation of the device can refer to the implementation of the above method, and the repeated parts will not be repeated. The term "module" used below can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0104] Figure 2 Schematic diagram of the structure of the flow white glove detection device based on intelligent feature analysis of the present invention. Figure 2 As shown, the device comprises:

[0105] The data collection module 101 is used to collect the original traffic data in the network;

[0106] The data preprocessing module 102 is used to preprocess the collected traffic data and generate a structured data stream;

[0107] The basic feature extraction module 103 is used to extract basic features from the preprocessed traffic data, including traffic metadata features and traffic statistical features, the traffic metadata features including IP address information, port number distribution and protocol type, and the traffic statistical features including data packet size, traffic rate and session duration, and perform preliminary analysis;

[0108] The middle-level feature extraction module 104 is used to extract time series features and behavior pattern features from the traffic data after preliminary analysis, and analyze the changes and periodic changes of the traffic within a fixed time window, including: using a fixed time window to count the traffic changes within the time window; based on the LSTM time series model, time series analysis of the traffic is performed to detect hidden traffic obfuscation attacks; using Fourier transform analysis to capture periodic changes in the traffic and help identify traffic white glove behavior; if multiple traffics of the same IP show consistent behavior patterns, the characteristics of the disguised traffic can be identified through correlation analysis;

[0109] The deep feature extraction module 105 is used to perform weighted fusion of basic features, time series features and behavior pattern features to form a comprehensive feature vector;

[0110] The anomaly detection module 106 is used to input the weighted fused feature vector into the trained random forest model for classification and identify the traffic white glove behavior; once the traffic white glove behavior is identified, an anomaly alarm is generated and the anomaly alarm handling is automatically triggered.

[0111] It should be noted that although several modules of the flow white glove detection device based on intelligent feature analysis are mentioned in the above detailed description, this division is only exemplary and not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more modules described above can be concretized in one module. Conversely, the features and functions of one module described above can be further divided into multiple modules for concretization.

[0112] Based on the above invention concept, Figure 3 As shown, the present invention also proposes a computer device 200, including a memory 210, a processor 220, and a computer program 230 stored in the memory 210 and executable on the processor 220. When the processor 220 executes the computer program 230, the aforementioned white glove detection of traffic based on intelligent feature analysis is implemented.

[0113] Based on the aforementioned inventive concept, the present invention also proposes a computer-readable storage medium, which stores a computer program for executing the aforementioned white-glove detection of traffic based on intelligent feature analysis.

[0114] The traffic white-glove detection method and device based on intelligent feature analysis proposed in the present invention have the following highlights:

[0115] 1. Intelligent feature extraction: using machine learning and deep learning technologies to extract multi-dimensional features from massive network traffic, including basic statistical features, time series features, protocol behavior features, etc.

[0116] 2. Multi-level analysis architecture, through hierarchical analysis methods, gradually filters and mines potential abnormal behaviors in traffic. Each level targets different feature sets and analysis algorithms to ensure the depth and breadth of detection.

[0117] 3. Dynamic adaptive adjustment: the detection system can dynamically adjust the analysis strategy according to changes in the network environment and historical data to ensure that it maintains efficient detection capabilities when facing new types of attacks.

[0118] Although the spirit and principle of the present invention have been described with reference to several specific embodiments, it should be understood that the present invention is not limited to the disclosed specific embodiments, and the division of various aspects does not mean that the features in these aspects cannot be combined to benefit, and such division is only for the convenience of expression. The present invention is intended to cover various modifications and equivalent arrangements contained in the spirit and scope of the attached claims.

[0119] Regarding the limitation of the protection scope of the present invention, those skilled in the art should understand that, based on the technical solution of the present invention, various modifications or variations that can be made by those skilled in the art without creative work are still within the protection scope of the present invention.

Claims

1. A traffic white glove detection method based on intelligent feature analysis, characterized in that: The method includes: Collect raw traffic data in the network, perform preprocessing, and generate structured data streams; Extract basic features from the preprocessed traffic data, including traffic metadata features and traffic statistics features, and perform preliminary analysis; Extract time series features and behavior pattern features from the traffic data after preliminary analysis, and analyze the changes and periodic changes of traffic within a fixed time window; The basic features, time series features and behavior pattern features are weighted and integrated to form a comprehensive feature vector; The weighted fused feature vector is input into the trained random forest model for classification to identify traffic white glove behavior; Once traffic white-glove behavior is identified, an abnormal alarm is generated and abnormal alarm handling is automatically triggered.

2. The flow white glove detection method based on intelligent feature analysis according to claim 1 is characterized in that: The traffic metadata features include IP address information, port number distribution and protocol type; the traffic statistics features include data packet size, traffic rate and session duration.

3. The flow white glove detection method based on intelligent feature analysis according to claim 1 is characterized in that: Analyze traffic changes within a fixed time window and periodic changes, including: Use a fixed time window to count traffic changes within the time window; perform time series analysis on traffic based on the LSTM time series model to detect hidden traffic obfuscation attacks; Use Fourier transform analysis to capture periodic changes in traffic and help identify traffic white glove behavior.

4. The flow white glove detection method based on intelligent feature analysis according to claim 3 is characterized in that: If multiple flows from the same IP address show consistent behavior patterns, the characteristics of disguised flows can be identified through correlation analysis.

5. A flow white glove detection device based on intelligent feature analysis, characterized in that: The device includes: Data collection module, used to collect original traffic data in the network; The data preprocessing module is used to preprocess the collected traffic data and generate a structured data stream; The basic feature extraction module is used to extract basic features from the preprocessed traffic data, including traffic metadata features and traffic statistical features, and perform preliminary analysis; The middle-level feature extraction module is used to extract time series features and behavior pattern features from the traffic data after preliminary analysis, and analyze the changes and periodic changes of traffic within a fixed time window; The deep feature extraction module is used to perform weighted fusion of basic features, time series features, and behavior pattern features to form a comprehensive feature vector; The anomaly detection module is used to input the weighted fused feature vector into the trained random forest model for classification and identify traffic white glove behavior; once the traffic white glove behavior is identified, an anomaly alarm is generated and the anomaly alarm handling is automatically triggered.

6. The flow white glove detection device based on intelligent feature analysis according to claim 5 is characterized in that: The traffic metadata features include IP address information, port number distribution and protocol type; the traffic statistics features include data packet size, traffic rate and session duration.

7. The flow white glove detection device based on intelligent feature analysis according to claim 5 is characterized in that: Analyze traffic changes within a fixed time window and periodic changes, including: Use a fixed time window to count traffic changes within the time window; perform time series analysis on traffic based on the LSTM time series model to detect hidden traffic obfuscation attacks; Use Fourier transform analysis to capture periodic changes in traffic and help identify traffic white glove behavior.

8. The flow white glove detection device based on intelligent feature analysis according to claim 7 is characterized in that: If multiple flows from the same IP address show consistent behavior patterns, the characteristics of disguised flows can be identified through correlation analysis.

9. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 4 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program for executing the method according to any one of claims 1 to 4.

Images