A traffic white glove detection method and device based on intelligent feature analysis

Abstract

The application discloses a traffic white glove detection method and device based on intelligent feature analysis, wherein the method comprises the following steps: collecting traffic data in a network and preprocessing the traffic data to generate a structured data stream; extracting basic features from the preprocessed traffic data and performing preliminary analysis; extracting time sequence features and behavior pattern features from the preliminarily analyzed traffic data and analyzing the changes and periodic changes of the traffic in a fixed time window; weighting and fusing the basic features, the time sequence features and the behavior pattern features to form a comprehensive feature vector; inputting the weighted and fused feature vector into a trained random forest model for classification to identify traffic white glove behaviors; and once the traffic white glove behaviors are identified, generating an abnormal alarm and automatically triggering abnormal alarm disposal. The method and device can extract hidden features in traffic and combine a machine learning model to perform real-time analysis and detection on traffic white glove technologies.

Description

Technical Field

[0001] This invention relates to the field of flow detection, and in particular to a flow detection method and apparatus based on intelligent feature analysis. Background Technology

[0002] Traffic white-glove is a technique that obfuscates normal traffic from malicious traffic, making it difficult for traditional traffic analysis tools to detect. With the development of network attack techniques, attackers are increasingly using advanced obfuscation techniques to evade security equipment detection. The limitations of traditional detection methods: Traditional traffic detection methods are based on rules or simple statistical models, which typically rely on predefined rule sets or feature templates to detect abnormal traffic. Existing fixed-rule detection algorithms, which rely on static rules, are easily bypassed by traffic white-glove techniques because attackers can evade these rules through obfuscation and disguise. While performing well against ordinary attacks, these methods are often powerless against advanced stealth techniques like "traffic white-gloves," easily resulting in missed or false positives. Summary of the Invention

[0003] To address the aforementioned problems with traditional traffic detection methods, this invention provides a traffic white-glove detection method and device based on intelligent feature analysis. This method can extract hidden features from traffic and, combined with a machine learning model, perform real-time analysis and detection of traffic white-glove technology.

[0004] To achieve the above objectives, the present invention adopts the following technical solution:

[0005] In one embodiment of the present invention, a method for detecting white gloves in traffic flow based on intelligent feature analysis is proposed, the method comprising:

[0006] Collect raw network traffic data, preprocess it, and generate a structured data stream;

[0007] Basic features, including traffic metadata features and traffic statistical features, are extracted from the preprocessed traffic data and a preliminary analysis is performed.

[0008] Time series features and behavioral pattern features were extracted from the traffic data after preliminary analysis, and the changes and periodic changes in traffic within a fixed time window were analyzed.

[0009] The basic features, time series features, and behavioral pattern features are weighted and fused to form a comprehensive feature vector.

[0010] The weighted and fused feature vectors are input into a trained random forest model for classification to identify traffic white-glove behavior.

[0011] Once white-glove traffic behavior is identified, an anomaly alert is generated and the anomaly alert handling is automatically triggered.

[0012] Furthermore, traffic metadata features include IP address information, port number distribution, and protocol type; traffic statistics features include packet size, traffic rate, and session duration.

[0013] Furthermore, the analysis examines the changes in flow rate within a fixed time window and its periodic variations, including:

[0014] Using a fixed time window, traffic changes within that time window are statistically analyzed; based on the LSTM time series model, time series analysis of the traffic is performed to detect hidden traffic obfuscation attacks.

[0015] Fourier transform analysis is used to capture periodic changes in flow, helping to identify white-glove behavior in flow.

[0016] Furthermore, if multiple traffic streams from the same IP exhibit consistent behavioral patterns, then the characteristics of spoofed traffic can be identified through correlation analysis.

[0017] In one embodiment of the present invention, a flow rate white glove detection device based on intelligent feature analysis is also proposed, the device comprising:

[0018] The data acquisition module is used to collect raw traffic data from the network.

[0019] The data preprocessing module is used to preprocess the collected traffic data and generate a structured data stream;

[0020] The basic feature extraction module is used to extract basic features from the preprocessed traffic data, including traffic metadata features and traffic statistical features, and to perform preliminary analysis.

[0021] The mid-level feature extraction module is used to extract time series features and behavioral pattern features from the traffic data after preliminary analysis, and to analyze the changes and periodic changes in traffic within a fixed time window.

[0022] The deep feature extraction module is used to weightedly fuse basic features, time series features, and behavioral pattern features to form a comprehensive feature vector;

[0023] The anomaly detection module is used to input the weighted and fused feature vectors into the trained random forest model for classification and to identify traffic white-glove behavior. Once traffic white-glove behavior is identified, an anomaly alarm is generated and anomaly alarm handling is automatically triggered.

[0024] Furthermore, traffic metadata features include IP address information, port number distribution, and protocol type; traffic statistics features include packet size, traffic rate, and session duration.

[0025] Furthermore, the analysis examines the changes in flow rate within a fixed time window and its periodic variations, including:

[0026] Using a fixed time window, traffic changes within that time window are statistically analyzed; based on the LSTM time series model, time series analysis of the traffic is performed to detect hidden traffic obfuscation attacks.

[0027] Fourier transform analysis is used to capture periodic changes in flow, helping to identify white-glove behavior in flow.

[0028] Furthermore, if multiple traffic streams from the same IP exhibit consistent behavioral patterns, then the characteristics of spoofed traffic can be identified through correlation analysis.

[0029] In one embodiment of the present invention, a computer device is also proposed, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the aforementioned traffic white glove detection based on intelligent feature analysis.

[0030] In one embodiment of the present invention, a computer-readable storage medium is also provided, which stores a computer program that performs traffic white-glove detection based on intelligent feature analysis.

[0031] Beneficial effects:

[0032] 1. This invention utilizes machine learning and deep learning technologies to extract multi-dimensional features from massive network traffic, including basic features, time series features, and behavioral pattern features.

[0033] 2. This invention uses a hierarchical analysis method to gradually filter and mine potential abnormal behaviors in traffic. Each level targets different feature sets and analysis algorithms to ensure the depth and breadth of detection.

[0034] 3. This invention can dynamically adjust the analysis strategy based on changes in the network environment and historical data, ensuring that it maintains a high level of detection capability when facing new types of attacks. Attached Figure Description

[0035] Figure 1 This is a schematic diagram of the flow white glove detection method based on intelligent feature analysis of the present invention;

[0036] Figure 2 This is a schematic diagram of the flow rate white glove detection device based on intelligent feature analysis according to the present invention;

[0037] Figure 3 This is a schematic diagram of the computer device structure of the present invention. Detailed Implementation

[0038] The principles and spirit of the present invention will now be described with reference to several exemplary embodiments. It should be understood that these embodiments are provided merely to enable those skilled in the art to better understand and implement the present invention, and are not intended to limit the scope of the present invention in any way. Rather, these embodiments are provided to make this disclosure more thorough and complete, and to fully convey the scope of this disclosure to those skilled in the art.

[0039] Those skilled in the art will recognize that embodiments of the present invention can be implemented as an apparatus, device, device, method, or computer program product. Therefore, this disclosure can be specifically implemented in the following forms: entirely hardware, entirely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0040] According to embodiments of the present invention, a traffic white-glove detection method and apparatus based on intelligent feature analysis is proposed. This method aims to effectively detect complex and obfuscated traffic by combining advanced machine learning and big data analytics technologies, thereby improving network security protection levels. The initial intention of this solution is to address the shortcomings of current traffic detection technologies in dealing with complex obfuscated attacks, and to meet the industry's demand for efficient, accurate, and adaptive security solutions.

[0041] The principles and spirit of the present invention will be explained in detail below with reference to several representative embodiments.

[0042] Figure 1 This is a schematic diagram of the flow chart for the white-glove detection method based on intelligent feature analysis of this invention. Figure 1 As shown, the method includes:

[0043] 1. Traffic data collection and preprocessing: Obtain raw traffic data from the network, including packet header information, data packet content and data generation time information, and perform preprocessing to remove noise and normalize the data.

[0044] The data acquisition module can collect network traffic information in real time using traffic acquisition tools such as NetFlow and sFlow, and convert it into a structured data stream containing key fields such as IP address, source / destination port, protocol type, packet size, and timestamp.

[0045] 2. Feature extraction and modeling of data

[0046] (1) Basic Feature Extraction Module: Basic features are mainly obvious and easily extracted basic information in network traffic. These features can often quickly reflect certain obvious attacks or abnormal behaviors. Basic features include: traffic metadata features and traffic statistical features.

[0047] (2) Traffic metadata characteristics

[0048] IP address information: including source IP and destination IP, these characteristics can reflect whether there are abnormal phenomena such as IP spoofing or concentrated IP address attacks.

[0049] Port number distribution: Some ports, such as HTTP (80) and HTTPS (443), may be the focus of attacks. Monitoring the use of port numbers can help detect abnormal port traffic.

[0050] Protocol type: such as TCP, UDP, ICMP, etc. Attackers may use specific protocols to obfuscate traffic, such as using UDP instead of TCP to circumvent conventional defense mechanisms.

[0051] (3) Flow statistics characteristics

[0052] Packet size: Certain attacks may use large or small packets to disguise normal traffic, especially some DDoS attacks.

[0053] Traffic rate: By monitoring the number of bytes transmitted per second, sudden surges in traffic or suspicious traffic with excessively low rates can be detected.

[0054] Session duration: Some white-glove attacks may avoid detection by maintaining low-frequency connections for extended periods.

[0055] A preliminary analysis of the basic characteristics of traffic is performed using simple statistical rules or threshold analysis. This process can filter out obviously normal traffic, reducing the computational burden of subsequent advanced analysis.

[0056] (4) Mid-level feature extraction module: Mid-level features focus on analyzing the behavioral pattern features and time series features of traffic, especially capturing the changing trends and periodic changes of traffic at different time points.

[0057] Time series characteristics, sliding window analysis: Using a fixed time window (e.g., every 5 or 10 seconds), traffic changes within that time window are statistically analyzed, including information such as the number of packets, traffic size, and number of connections. This can help identify sudden traffic patterns.

[0058] Temporal modeling: Based on time series models such as LSTM (Long Short-Term Memory), traffic is analyzed over time. LSTM models can capture historical patterns in traffic and predict future behavior to detect hidden traffic obfuscation attacks.

[0059] Behavioral pattern characteristics, periodic analysis: Using frequency domain analysis methods such as Fourier transform, periodic changes in traffic are captured. Attackers may send spoofed traffic in a periodic manner, so periodic analysis can help identify white-glove traffic behavior.

[0060] Traffic correlation analysis: Analyze the correlation between multiple traffic streams, such as whether multiple traffic streams from the same IP exhibit consistent behavior patterns (such as the same protocol, port, packet size, etc.). Through these correlation analyses, the characteristics of spoofed traffic can be identified.

[0061] (5) Deep feature extraction module: Deep features use random forest to select and classify features by integrating multiple decision tree models. It can effectively handle high-dimensional and complex features and mainly focuses on potential patterns and abnormal behaviors in traffic.

[0062] Feature vectorization: Through feature embedding techniques in deep learning, different high-dimensional and complex traffic features (such as basic features, time series features, and behavioral pattern features) are embedded into a low-dimensional vector space, making complex feature relationships more intuitive in a lower dimension. The purpose of this mapping is to retain the key information of the data while reducing the dimensionality of the data, enabling the model to process and understand the data more efficiently. For example, raw network traffic features may contain hundreds or thousands of dimensions (such as multiple attributes of each data packet), while embedding techniques can compress these features into vectors of tens or even fewer dimensions.

[0063] Weighted fusion is a technique used in multi-level feature extraction to combine different features to form a comprehensive feature vector. Different features have different importance in network traffic analysis; therefore, by assigning weights to features, key features can be highlighted more effectively, thereby improving the accuracy of the model. Weighted fusion is mainly used in the combination stage of different types of features, such as basic features, time series features, and behavioral pattern features. It can dynamically adjust the weights of different features to obtain the optimal feature combination effect.

[0064] Before performing weighted fusion, weights need to be assigned to the different features:

[0065] Time series features play an important role in detecting spoofed traffic, and therefore can be given high weight.

[0066] Basic characteristics (such as IP address and port number) may provide useful initial clues in some cases, but their accuracy is relatively low, so their weight can be appropriately reduced.

[0067] Feature standardization is necessary because the numerical ranges of different features may vary greatly. Therefore, features need to be standardized before weighted fusion.

[0068] By scaling the features to the range of [0, 1], we can ensure that the values ​​of each feature are within the same range, thereby preventing the absolute values ​​of some features from being too large and affecting the fusion result.

[0069] Feature weighting is used when the influence of features in a dataset is unbalanced. Weighting can highlight important features, so feature data needs to be weighted to improve the accuracy of subsequent models.

[0070] Once the weights and standardized feature values ​​are determined, the next step is the weighted fusion process. The features can be weighted using the following formula:

[0071] F = w1*F1 + w2*F2 + ... + wn*Fn

[0072] Where F is the weighted fused feature vector, F1, F2, ..., Fn represent the feature values ​​of different feature levels, and w1, w2, ..., wn are the corresponding weights.

[0073] 3. Multi-level intelligent analysis: The fused multi-level features are input into the intelligent analysis module, and classified and identified by a trained machine learning model, namely the random forest model.

[0074] During training, each sample in the training set of the Random Forest model is represented by a set of feature vectors obtained in step 2. These feature vectors form the basis of the input to the Random Forest model. Each input feature vector corresponds to a network traffic instance, including previously extracted multi-level features (such as basic features, time-series features, and behavioral pattern features). Each sample in the dataset should contain a feature vector after multi-level feature extraction and weighted fusion. Each feature vector also has a corresponding label: "normal traffic" and "attack traffic." The labeled dataset uses pre-labeled datasets of normal and abnormal traffic (including white-glove attacks) as training samples. The Random Forest model improves its stability by constructing multiple decision trees and voting (for classification tasks) or averaging their predictions (for regression tasks). Pre-labeling refers to classifying and labeling each traffic sample in advance when constructing the training dataset, classifying the traffic data as "normal traffic" or "abnormal traffic" (e.g., attack traffic or white-glove attacks). Pre-labeling typically occurs after data collection or generation, but before model training.

[0075] 4. Model learns through multiple iterations

[0076] During training, the random forest model learns feature patterns from different categories of data through multiple iterations. The category refers to the different types of samples the model needs to distinguish, including normal and abnormal traffic. Abnormal traffic mainly disguises itself as normal traffic to bypass traditional detection systems. Each decision tree fits the model based on its training subset and feature subset, classifying each input sample. With each iteration, the random forest model gradually improves its classification accuracy using more decision trees. Through multiple iterations, the model continuously adjusts, learning the complex boundaries between "normal traffic" and "abnormal traffic." The number of iterations can be adjusted using cross-validation to ensure the model avoids overfitting or underfitting.

[0077] 5. Evaluation after model training is completed

[0078] After training, the data from the test set is input into the model, and the pre-trained random forest model is used to classify the test data. At this point, the model votes on the classification of each input traffic instance, with multiple trees jointly determining the classification result. The model's performance can be evaluated using metrics such as accuracy, recall, and F1-score.

[0079] By extracting multi-dimensional features at shallow, medium, and deep levels, and combining this with intelligent algorithm analysis, an effective traffic white-glove detection system can be established. Shallow features help quickly identify obvious traffic anomalies, medium-level features capture dynamic and periodic changes in traffic, and deep features reveal potential complex patterns and camouflage behaviors. Finally, through multi-level feature fusion and intelligent analysis, hidden attack behaviors are detected.

[0080] It should be noted that although the operation of the method of the present invention has been described in a specific order in the above embodiments and figures, this does not require or imply that the operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0081] To provide a clearer explanation of the above-mentioned traffic flow white glove detection method based on intelligent feature analysis, a specific embodiment will be used for illustration below. However, it is worth noting that this embodiment is only for better illustrating the present invention and does not constitute an improper limitation of the present invention.

[0082] The process for implementing a traffic white-glove detection method based on intelligent feature analysis is as follows:

[0083] Step 1: Data Acquisition and Preprocessing. Deploy traffic acquisition devices at network ingress and egress points to collect Netflow / SFlow traffic data generated by network devices such as routers and switches. Preprocess the collected traffic data to remove noise, normalize the data, and generate a time-series dataset.

[0084] Step 2: Basic Feature Layer Analysis

[0085] Extract basic features and analyze the basic information of each traffic packet, such as packet size, IP address, port number, and protocol type.

[0086] Based on the source and purpose of the traffic, some obviously harmless normal traffic is initially filtered out. The remaining traffic is then analyzed in more depth.

[0087] Step 3: Temporal Feature Layer Analysis

[0088] Analyze the trend of traffic changes over time and extract the traffic peak, frequency, packet sending interval, etc. within each time window.

[0089] By comparing these time-series characteristics with historical traffic characteristics, abnormal peaks and behavioral patterns that may exist within a specific time period can be identified.

[0090] Step 4: Spatial Feature Layer Analysis

[0091] Analyze the geographical distribution of traffic and the relationships between communication nodes.

[0092] Identify traffic patterns that span different regions and frequently change source or destination IPs, and preliminarily screen out possible spoofing traffic white-glove behavior.

[0093] Step 5: Protocol Behavior Layer Analysis

[0094] Parse the protocol structure of data packets and conduct in-depth analysis of protocol header information and transmission behavior.

[0095] By analyzing protocol characteristics (such as HTTP headers, TCP handshake process, etc.), abnormal patterns in protocol behavior can be detected, especially those patterns associated with known white-glove traffic spoofing methods.

[0096] Step 6: In-depth Feature Analysis

[0097] Basic features, temporal features, spatial features, and protocol behavior features are fused to form a comprehensive feature vector. Feature extraction is the core of anomaly detection, and the random forest model can make predictions based on the extracted features.

[0098] The model automatically learns and identifies spoofing behavior in multi-level features, recognizing white-glove traffic hidden in normal traffic.

[0099] Step 7: Further Alerts and Responses

[0100] Once white-glove traffic behavior is identified, the system generates an alarm, notifies the administrator, and automatically triggers traffic restriction or blocking operations.

[0101] The system will store the detected traffic behavior and related characteristics in the database for subsequent analysis and model optimization.

[0102] Step 8: Further, after confirming the attack is complete, adjust and optimize the detection model based on feedback information to reduce the false alarm rate, continuously collect new traffic data, and constantly improve and update the detection algorithm to maintain the accuracy and effectiveness of the model.

[0103] Based on the same inventive concept, this invention also proposes a flow rate white glove detection device based on intelligent feature analysis. The implementation of this device can refer to the implementation of the method described above, and repeated details will not be repeated. The term "module" used below can refer to a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0104] Figure 2 This is a schematic diagram of the flow rate white glove detection device based on intelligent feature analysis according to the present invention. Figure 2 As shown, the device includes:

[0105] Data acquisition module 101 is used to collect raw traffic data in the network;

[0106] The data preprocessing module 102 is used to preprocess the collected traffic data and generate a structured data stream;

[0107] The basic feature extraction module 103 is used to extract basic features from the preprocessed traffic data, including traffic metadata features and traffic statistics features. The traffic metadata features include IP address information, port number distribution and protocol type. The traffic statistics features include packet size, traffic rate and session duration, and perform preliminary analysis.

[0108] The mid-layer feature extraction module 104 is used to extract time series features and behavioral pattern features from the traffic data after preliminary analysis, and to analyze the changes and periodic changes of traffic within a fixed time window, including: using a fixed time window to statistically analyze the traffic changes within that time window; performing time series analysis on the traffic based on the LSTM time series model to detect hidden traffic obfuscation attacks; using Fourier transform analysis to capture periodic changes in the traffic to help identify white-glove traffic behavior; if multiple traffic streams from the same IP exhibit consistent behavioral patterns, the characteristics of the disguised traffic can be identified through correlation analysis.

[0109] The deep feature extraction module 105 is used to weightedly fuse basic features, time series features and behavioral pattern features to form a comprehensive feature vector;

[0110] The anomaly detection module 106 is used to input the weighted and fused feature vector into the trained random forest model for classification and to identify traffic white-glove behavior; once traffic white-glove behavior is identified, an anomaly alarm is generated and anomaly alarm handling is automatically triggered.

[0111] It should be noted that although several modules of the flow white-glove detection device based on intelligent feature analysis have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of the present invention, the features and functions of two or more modules described above can be embodied in one module. Conversely, the features and functions of one module described above can be further divided and embodied by multiple modules.

[0112] Based on the aforementioned inventive concept, such as Figure 3 As shown, the present invention also proposes a computer device 200, including a memory 210, a processor 220, and a computer program 230 stored in the memory 210 and executable on the processor 220. When the processor 220 executes the computer program 230, it realizes the aforementioned flow white glove detection based on intelligent feature analysis.

[0113] Based on the aforementioned inventive concept, the present invention also proposes a computer-readable storage medium storing a computer program that performs the aforementioned traffic flow white glove detection based on intelligent feature analysis.

[0114] The flow rate white glove detection method and device based on intelligent feature analysis proposed in this invention have the following highlights:

[0115] 1. Intelligent feature extraction: Utilizing machine learning and deep learning technologies, it extracts multi-dimensional features from massive network traffic, including basic statistical features, time series features, protocol behavior features, etc.

[0116] 2. Multi-layered analysis architecture: Through a hierarchical analysis method, potential abnormal behaviors in traffic are filtered and mined step by step. Each layer targets different feature sets and analysis algorithms to ensure the depth and breadth of detection.

[0117] 3. Dynamic adaptive adjustment: The detection system can dynamically adjust its analysis strategy based on changes in the network environment and historical data, ensuring that it maintains high-efficiency detection capabilities when facing new types of attacks.

[0118] While the spirit and principles of the invention have been described with reference to several specific embodiments, it should be understood that the invention is not limited to the disclosed specific embodiments, and the division of aspects does not imply that features in these aspects cannot be combined for benefit; such division is merely for ease of description. The invention is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

[0119] Regarding the limitation of the scope of protection of this invention, those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solution of this invention are still within the scope of protection of this invention.

Claims

1. A traffic white glove detection method based on intelligent feature analysis, characterized in that, The method comprises: Collection and preprocessing of traffic data, obtaining raw traffic data from the network, including packet header information, packet content and data generation timing information, and preprocessing to remove noise and normalize data; The data collection module collects traffic information in the network in real time through a traffic collection tool, converts it into a structured data stream, and contains IP address, source / destination port, protocol type, packet size and timestamp; Feature extraction and modeling of data: (1) Basic feature extraction module, basic features are the basic information in network traffic that is obvious and easy to extract; these features can quickly reflect some obvious attacks or abnormal behaviors; basic features include: traffic metadata features and traffic statistical features; (2) Traffic metadata features IP address information: including source IP, destination IP, these features reflect whether there is IP camouflage and IP address cluster attack; Port number distribution: some ports may be the focus of attacks, monitoring the use of port numbers can help detect abnormal port traffic; Protocol type: attackers may use specific protocols to confuse traffic; (3) Traffic statistical features Packet size: certain attacks may use larger or smaller packets to camouflage normal traffic; Traffic rate: by monitoring the number of bytes transmitted per second, detect sudden traffic surges or suspicious traffic with too low a rate; Session duration: some traffic white glove attacks avoid detection by maintaining low-frequency connections for a long time; Through simple statistical rules or threshold analysis, the basic features of the traffic are preliminarily analyzed, and the obvious normal traffic is filtered out; (4) Middle-level feature extraction module, middle-level features focus on analyzing the behavior pattern features and time series features of traffic, capturing the changing trend and periodic changes of traffic at different time points; Time series features, sliding window analysis: use a fixed time window to count the traffic changes in that time window, including packet count, traffic size, connection count, to help identify sudden traffic patterns; Time series modeling: based on the LSTM time series model, the traffic is analyzed for time series; the LSTM time series model can capture the historical patterns of traffic and predict future behavior to detect hidden traffic obfuscation attacks; Behavior pattern features, periodicity analysis: use Fourier transform frequency domain analysis method to capture the periodic changes in traffic, which can help identify traffic white glove behavior; Traffic correlation analysis: analyze the correlation of multiple traffic, if multiple traffic of the same IP show consistent behavior patterns, through these correlation analysis, identify the features of disguised traffic; (5) Deep feature extraction module, deep features are selected and classified using random forests by integrating multiple decision tree models, which can effectively handle high-dimensional and complex features, focusing on potential patterns and abnormal behaviors in traffic; Feature vectorization: through feature embedding technology in deep learning, different high-dimensional and complex traffic features are embedded into a low-dimensional vector space, making complex feature relationships more intuitive in low dimensions; Before weighted fusion, different features need to be assigned weights: Time series features, weight increases; basic features, weight decreases; Feature standardization, feature standardization is required before weighted fusion; By scaling the features to the 【0, 1】 interval, ensure that the values of each feature are in the same range; Feature weighting, when the influence of features in the data set is not balanced, the feature data needs to be weighted; Determine the weight and normalized feature value, weighted fusion; The following formula is used to weight the features: F= w1*F1+w2*F2+....+wn*Fn Where F is the weighted feature vector after fusion, F1, F2, …, Fn represent the feature values of different feature levels, w1, w2, …, wn are the corresponding weights; Multi-level intelligent analysis, the fused multi-level features are input into the anomaly detection module, and the trained machine learning model, i.e. random forest model, is used for classification and identification; In the training process of the random forest model, each sample in the training set is represented by a set of feature vectors obtained in step 2, and the feature vector is the basis for input to the random forest model; Each input feature vector corresponds to a network traffic instance, including the multi-level features extracted before, each sample in the data set should contain the feature vector after multi-level feature extraction and weighted fusion, and each feature vector also has a corresponding label "normal traffic" and "attack traffic"; Mark the data set: use the data set of pre-labeled normal traffic and abnormal traffic including traffic white glove attack as training samples; The random forest model builds multiple decision trees and votes or averages their prediction results; Pre-labeling means that the class of each traffic sample is classified and labeled in advance when building the training data set, that is, the traffic data is classified as "normal traffic" or "abnormal traffic"; The pre-labeling time is after collecting data or generating data, but before model training; Model multiple iterations learning: In the training process, the random forest model will gradually learn the feature patterns of different categories of data through multiple iterations; Where the category refers to the different types of samples that the model needs to distinguish, including normal and abnormal, abnormal is disguised as normal traffic; Each decision tree fits the model according to its training subset and feature subset, and classifies each input sample; With the increase of iterations, the random forest model will gradually improve the accuracy of classification through more decision trees; Through multiple iterations, the model continuously adjusts and learns the complex boundary between "normal traffic" and "abnormal traffic"; The number of iterations is adjusted through cross-validation to ensure that the model does not overfit or underfit; Model evaluation after training: After training, input the data in the test set into the model, and use the trained random forest model to classify the test data; At this time, the model will vote for each input traffic instance, and multiple trees will jointly determine the classification result; Evaluate the performance of the model through accuracy, recall rate and F1-score; Through multi-dimensional feature extraction of shallow, middle and deep layers, combined with intelligent algorithm analysis, an effective traffic white glove detection system is established; shallow features help to quickly identify obvious traffic anomalies, middle features capture dynamic and periodic changes in traffic, and deep features reveal potential complex patterns and disguised behaviors; ultimately, through multi-level feature fusion and intelligent analysis, hidden attack behaviors are detected; Once traffic white glove behavior is identified, an abnormal alarm is generated, and abnormal alarm handling is automatically triggered.

2. A traffic white glove detection apparatus based on intelligent feature analysis for implementing the method as claimed in claim 1, characterized by, The device comprises: a data acquisition module for acquiring original traffic data in a network; a data preprocessing module for preprocessing the acquired traffic data and generating structured data flow; a basic feature extraction module for extracting basic features, including traffic metadata features and traffic statistical features, from the preprocessed traffic data and performing preliminary analysis; a middle layer feature extraction module for extracting time series features and behavior pattern features from the preliminarily analyzed traffic data and analyzing changes and periodic changes of traffic within a fixed time window; a deep layer feature extraction module for weighting and fusing the basic features, time series features and behavior pattern features to form a comprehensive feature vector; an anomaly detection module for inputting the weighted and fused feature vector into a trained random forest model for classification to identify traffic white glove behavior; once traffic white glove behavior is identified, an abnormal alarm is generated, and abnormal alarm handling is automatically triggered.

3. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the method of claim 1 when executing the computer program.

4. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program for executing the method of claim 1.

Images