A C2 traffic detection method based on context-aware language model

Abstract

The present invention discloses a C2 traffic detection method based on a context-aware language model. The method converts C2 traffic into a text sequence through the language model BERT, uses an encoder model with a Transformer architecture to extract deep features associated with the training set context, and uses them to train a pre-built C2 traffic classifier. The encoder model is fine-tuned through a back-propagation mechanism; the trained encoder model is used to extract deep features of the test set, and the deep features are used to train a decoder model, and the loss is calculated and the model parameters are optimized based on the reconstruction error; the deep features of the traffic to be tested are extracted through the encoder model and input into the classifier for classification detection; the decoder model is used to reconstruct the original text and calculate the reconstruction error, and the encoder model is further optimized by taking the weighted sum of the classifier loss and the reconstruction error as the total loss; the method realizes accurate C2 traffic detection without relying on a large amount of training data, and improves the ability and generalization of the deep learning model to extract deep features of complex traffic.

Description

Technical Field

[0001] The present invention relates to the technical field of traffic detection, and in particular to a C2 traffic detection method based on a context-aware language model. Background Art

[0002] APT attacks (Advanced Persistent Threat) are an advanced form of modern cyberattack characterized by high stealth, persistence, and targeted attack vectors. Throughout the various stages of an APT attack, command and control (C2) communications are key to enabling attackers to remotely control infected systems and form the foundation for APT's stealth. C2 traffic, the hidden and complex communication link between attackers and controlled endpoints, poses a significant challenge to network security. Therefore, accurately identifying and blocking C2 traffic is crucial for defending against APT attacks and protecting network security.

[0003] Mainstream methods for C2 traffic detection include signature-based, machine learning-based, and deep learning-based approaches. C2 traffic detection technology has evolved through multiple stages, from pattern matching to feature engineering-based machine learning, and finally to the introduction of deep learning, gradually improving detection quality and efficiency.

[0004] In the early days of research, signature-based pattern matching technology dominated, using predefined signature rules like regular expression matching to identify known attack patterns. However, static matching cannot identify unknown threats and often lacks adaptability to rapidly evolving attack vectors. Signature-based detection methods rely on static rules based on known attack patterns, making them slow to respond to unknown or mutated APT attacks and difficult to effectively identify.

[0005] Traditional methods for detecting C2 traffic rely on feature engineering combined with machine learning, utilizing customized traffic attributes and statistical information to perform classification detection. For example, a feature engineering framework based on time-window statistical traffic behavior characteristics is combined with a random forest model. While these methods demonstrate high accuracy in specific scenarios, they rely heavily on expert experience, and the feature extraction process is complex and highly subjective. Furthermore, reliance on a single data source can lead to the loss of key features. Feature engineering often struggles to cope with evolving network attack methods, and performance degrades significantly when faced with new, unknown traffic. The effectiveness of machine learning models is highly dependent on the quality of feature engineering, and feature design relies on expert knowledge and subjective judgment. This can limit the effectiveness of these methods in handling new attack patterns, and their generalization capabilities need to be improved.

[0006] With the rise of deep learning technology, automated feature extraction methods have gradually been applied to abnormal traffic detection. However, traditional deep learning models are limited in their ability to capture traffic characteristics, each with its own technical limitations. For example, CNNs excel at capturing the spatial features of two-dimensional data such as images and are often used to process static traffic features. However, traffic is dynamic data with time series characteristics, and CNNs often struggle to capture long-term relationships and time series features when processing network traffic. RNNs can also suffer from the vanishing gradient problem when processing long sequences of data, which can weaken model performance. Improved variants such as LSTM and GRU, while addressing the gradient issue to some extent, remain insensitive to very long sequences and may not be ideal for complex C2 traffic patterns.

[0007] Deep learning avoids feature engineering by constructing complex neural networks. However, traditional deep learning methods still have shortcomings in capturing traffic characteristics, especially in learning the deep features and context-related features of complex traffic. Deep learning model training requires a large amount of well-labeled data to build a knowledge system and relies on multi-source, multi-feature data to avoid overfitting, while C2 traffic data is often scarce and unbalanced. Deep learning models have difficulty achieving good generalization capabilities when faced with new, unseen C2 traffic and have difficulty adapting quickly to ever-changing threat forms.

[0008] Therefore, a C2 traffic detection method based on context-aware language model is proposed to solve the above problems. Summary of the Invention

[0009] To address the above issues, the present invention aims to provide a C2 traffic detection method based on a context-aware language model, enhance the ability of deep learning to extract context-sensitive deep features from complex traffic, improve the generalization of the deep learning-based C2 traffic detection model, and achieve accurate C2 traffic detection without relying on large amounts of training data. The technical solution is as follows:

[0010] A C2 traffic detection method based on a context-aware language model includes the following steps:

[0011] Step S1: collect C2 traffic data and convert it into a text sequence;

[0012] Step S2: Use the BERT model's word segmenter to segment the text sequence in units of one byte. Input the segmented text sequence into the BERT model's embedding layer to obtain word embedding vectors, position embedding vectors, and paragraph embedding vectors. The embedding vectors are then summed up and divided into training and test sets. The encoder model performs deep feature extraction on the training set samples to obtain context-related high-dimensional feature vectors of the training set.

[0013] Step S3: Use the high-dimensional feature vectors of the training set to train the pre-built classifier to classify C2 traffic, and fine-tune the encoder model through the back-propagation mechanism;

[0014] Step S4: Perform deep feature extraction on the test set samples through the trained encoder model to obtain a high-dimensional feature vector of the test set; use the high-dimensional feature vector of the test set to train the decoder model, calculate the loss based on the reconstruction error, and optimize the parameters of the decoder model based on the optimizer;

[0015] Step S5: Collect the flow data to be measured, obtain the high-dimensional feature vector to be measured according to the method of step S1 and step S2, input the high-dimensional feature vector to be measured into the classifier, detect the flow data to be measured, and obtain the classification result of the flow data to be measured; at the same time, the high-dimensional feature vector to be measured is input into the trained decoder model for reconstruction and calculation of the reconstruction error, and the loss of the classifier and the reconstruction error are weighted and summed as the total loss to further fine-tune the encoder model.

[0016] Furthermore, the step S1 includes:

[0017] S11, collect C2 traffic and store it as PCAP packets;

[0018] S12, grouping the PCAP packets according to the source and destination IP addresses;

[0019] S13. Convert each set of PCAP data packets into UTF-8 encoded hexadecimal string data.

[0020] Furthermore, the pre-built classifier in step S3 includes a pooling layer and two fully connected layers:

[0021] The high-dimensional feature vector generated by the encoder model is converted to a fixed size through the pooling layer, then input into the hidden layer for linear transformation, and then the feature vector is mapped to the category space through the second fully connected layer. The two fully connected layers are connected by the nonlinear activation function tanh;

[0022] The cross entropy loss function is used to measure the difference between the model prediction label and the true label, and the gradient descent method is used to adjust the weight to minimize the loss. CE The calculation formula is:

[0023]

[0024] Where N is the total number of samples, is the probability that the model predicts that the jth sample is C2 traffic, y j is the true label of the jth sample.

[0025] Furthermore, the decoder model is internally composed of 6 layers of identical Transformer decoders in cascade.

[0026] Furthermore, the evaluation indicators of the reconstruction error include mean square error, mean absolute error and cosine similarity:

[0027] The mean square error (MSE) measures the overall error by calculating the square mean of the difference between the corresponding elements of the reconstructed text and the original text. The calculation formula is:

[0028]

[0029] Where n is the number of samples, ε k is the kth element of the original text, is the kth element of the reconstructed text;

[0030] The mean absolute error (MAE) is the mean absolute value of the difference between the corresponding elements of the reconstructed text and the original text. The calculation formula is:

[0031]

[0032] Cosine similarity cos sim is used to measure the directional similarity between the two. The calculation formula is:

[0033]

[0034] Among them, and are the vector representations of the original text and the reconstructed text respectively.

[0035] Furthermore, the weighted sum of the classifier loss and the reconstruction error in step S5 is used as the total loss to further fine-tune the encoder model, including:

[0036] The total loss is calculated as:

[0037] Total Loss=α·Classification Loss+η·Reconstruction Loss

[0038] Among them, Total Loss is the total loss, Classification Loss is the classifier loss, Reconstruction Loss is the reconstruction error, α is the weight coefficient of the classifier loss, and η is the weight coefficient of the reconstruction error.

[0039] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0040] The present invention converts C2 traffic data into a text sequence containing contextual information through the language model BERT, uses the encoder model of the Transformer architecture in the BERT model to extract deep features associated with the context of the training set samples, uses the obtained training set feature vectors to train a pre-built classifier, and fine-tunes the encoder model through a back-propagation mechanism; uses the trained encoder model to extract deep features of the test set, uses the test set feature vectors to train a decoder model, calculates the loss based on the reconstruction error, and optimizes the decoder model parameters; uses the trained encoder to extract deep features of the test traffic data containing a new type of C2 traffic, and inputs the obtained test feature vectors into the classifier for classification detection to obtain the classification results of the test traffic data; at the same time, the test feature vectors are input into the trained decoder model for reconstruction and the reconstruction error is calculated, and the loss of the classifier and the reconstruction error are weighted and summed as the total loss to further optimize the encoder model. It achieves accurate detection of C2 traffic without relying on large amounts of training data, enhances the ability of deep learning models to extract deep contextual features of complex traffic, enables deep learning models to quickly adapt and accurately detect new and unseen C2 traffic, and improves the generalization of C2 traffic detection models. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 This is the system structure diagram of this method.

[0042] Figure 2 Flowchart for converting C2 traffic into text sequence and embedding layer processing.

[0043] Figure 3 Fine-tuning the training architecture for the encoder model

[0044] Figure 4 Flowchart for decoder training and usage.

[0045] Figure 5 Comparison chart of reconstruction errors of different models on the test set of the training dataset EarlyCrow.

[0046] Figure 6 Comparison chart of reconstruction errors of different models on the test set of the training dataset IcedID BackConnect.

[0047] Figure 7 Comparison chart of reconstruction errors of different models on the test set of the training dataset CobaltStrikeC2.

[0048] Figure 8 Comparison chart of reconstruction errors of different models on the test set of the training dataset VNAT. DETAILED DESCRIPTION

[0049] The following will clearly and completely describe the technical solution of the present invention in conjunction with the accompanying drawings in the present invention, so as to have a further understanding of the concept of the present invention, the technical problems solved, the technical features constituting the technical solution and the technical effects brought about.

[0050] The system structure of the method of the present invention is as follows Figure 1 As shown in the figure, it consists of three parts: data preprocessing, encoder model fine-tuning, and decoder model reconstruction. Specifically, it includes the following steps:

[0051] Step S1: collect C2 traffic data and convert it into a text sequence;

[0052] S11, collect C2 traffic and store it as PCAP packets;

[0053] S12, grouping the PCAP packets according to the source and destination IP addresses;

[0054] The traffic data that has been captured and stored as PCAP files is grouped and the packets are grouped in the same way as the source / destination IP.

[0055] S13, converting each set of PCAP data packets into UTF-8 encoded hexadecimal string data;

[0056] For each data packet, use the hexlify() method of the python binascii module to convert the data packet into hexadecimal encoding, and then use the decode() method to convert it into UTF-8 string form.

[0057] Step S2: Use the BERT model's word segmenter to segment the text sequence in units of one byte. Input the segmented text sequence into the BERT model's embedding layer to obtain word embedding vectors, position embedding vectors, and paragraph embedding vectors. The embedding vectors are then summed up and divided into training and test sets. The encoder model performs deep feature extraction on the training set samples to obtain context-related high-dimensional feature vectors of the training set.

[0058] BERT's built-in tokenizer is used to segment the string data into 1-byte tokens, obtaining a token sequence that is then input into the embedding layer.

[0059] like Figure 2As shown in the figure, the embedding layer first adds special tags (word vectors) to the token sequence, including [CLS] to indicate the beginning of the sequence, which is used for classification tasks to determine the category to which the text belongs; [SEP] is used to separate different sentences; [MASK] is used to mask some randomly replaced words to help the model learn the semantic relationship between word meta-tokens and the grammatical structure of the text; [PAD] is used to fill input sequences with inconsistent lengths; a corresponding position vector is assigned to each word meta-token, which has the same dimension as the word embedding vector; two token sequences from different PCAP data packets are added to different paragraph vectors, and finally the word embedding vector, position embedding vector, and paragraph embedding vector are summed to obtain the final embedding vector. For each input token x i , the embedding vector E(x i ) represents the word embedding vector W e (x i ), position embedding vector W p (x i ) and segment embedding vector W s (x i ), and the specific calculation formula is as follows:

[0060] E((x i )=W e (x i )+W p (x i )+W s (x i )

[0061] The embedding vectors are divided into training and test sets. The training set samples are input into the BERT model's encoder model, which consists of multiple cascaded Transformer encoders. The encoder model extracts deep features and obtains high-dimensional feature vectors of the context-dependent training set for classification and detection tasks. This improves the ability of deep learning-based C2 traffic detection models to capture deep context-dependent features.

[0062] The specific architecture is as follows Figure 3 As shown in the figure, the encoder of each Transformer architecture integrates a self-attention module and a feedforward network. First, it enters the self-attention layer. The model calculates the attention weight of each position and combines it with the input representation to generate an updated sequence representation. The self-attention calculation formula is as follows:

[0063]

[0064] Among them, Q is the query matrix, which is obtained by linear transformation of the input sequence; K is the key matrix, which is obtained by linear transformation of the input sequence; V is the value matrix, which represents the original information of the input sequence; d k is the dimension of the key, used to scale the dot product to stabilize the gradient;

[0065] To further enhance the model's expressiveness, the Transformer architecture introduces a multi-head attention mechanism. Its core idea is to divide the Q, K, and V matrices into multiple subspaces, perform self-attention operations in each subspace, and finally concatenate the outputs of different subspaces. The specific formula is:

[0066] MultiHead(Q,K,V)=[head1,...,head R ]W O

[0067] Among them, each attention head r The calculation formula is:

[0068]

[0069] R is the total number of subspaces, is the linear transformation weight matrix corresponding to the query, key, and value matrices in the rth subspace, W O is the linear transformation weight matrix of the multi-head attention output; by introducing multiple attention heads, the model can learn different representations and dependencies in different subspaces. This parallel computing method enables the Transformer architecture to better capture complex semantic relationships and improve its ability to capture sequential information;

[0070] A feedforward neural network is connected after the self-attention mechanism for further nonlinear transformation; the feedforward layer FFN usually includes two linear transformations and an activation function, and its calculation formula is as follows:

[0071] FFN(z)=ReLU(zW1+b1)W2+b2

[0072] Where z is the input data, ReLU is the activation function, W1 and W2 are weight matrices, and b1 and b2 are bias matrices;

[0073] To prevent the gradient vanishing problem caused by the network being too deep, the Transformer architecture adds residual connections after the multi-head attention layer and the feedforward neural network layer. By directly adding the input to the output, a skip connection is formed. After each residual connection, layer normalization is introduced to normalize the output. Its mathematical form is:

[0074] Output=LayerNorm(z+Sublayer(z))

[0075] Among them, Output is the encoder output, LayerNorm() is the layer normalization expression, and Sublayer(z) is the output data of a sublayer;

[0076] The purpose of layer normalization is to maintain numerical stability in different layers of the model, thereby speeding up training and improving the generalization ability of the model. The calculation formula of layer normalization is:

[0077]

[0078] Where μ is the mean of the input data, δ is the standard deviation of the input data, and γ and β are trainable scaling and offset parameters.

[0079] Step S3: Use the high-dimensional feature vectors of the training set to train the pre-built classifier to classify C2 traffic, and fine-tune the encoder model through the back-propagation mechanism;

[0080] The high-dimensional feature vector of the training set generated by the encoder model is input to the downstream task C2 classifier; the C2 classifier consists of a pooling layer and two fully connected layers;

[0081] First, the high-dimensional feature vector of the training set is converted to a fixed size through the pooling layer, and then input into the hidden layer for linear transformation, mapping the encoded sequence to the hidden space, and using the nonlinear activation function Tanh to enhance the model's ability to capture complex features. Then, it is input into the second fully connected layer and further mapped to the category space. The cross entropy loss function is used to measure the difference between the model prediction and the true label, and the gradient descent method is used to adjust the weight to minimize the loss. The loss function Loss CE The calculation formula is:

[0082]

[0083] Where N is the total number of samples, is the probability that the model predicts that the jth sample is C2 traffic, y j is the true label of the jth sample;

[0084] During the training process, the back-propagation mechanism is used to refine the parameter weights according to the loss function until the loss converges to a stable state. The encoder model is then fine-tuned to enable it to achieve excellent performance in the C2 traffic detection task, thereby optimizing the model performance.

[0085] Step S4: Perform deep feature extraction on the test set samples through the trained encoder model to obtain a high-dimensional feature vector of the test set; use the high-dimensional feature vector of the test set to train the decoder model, calculate the loss based on the reconstruction error, and optimize the parameters of the decoder model based on the optimizer;

[0086] The decoder model uses a Transformer architecture similar to the BERT encoder model, consisting of six identical layers of Transformer decoders connected together. Both the encoder and decoder models use the Transformer architecture, which uses a multi-head self-attention mechanism to capture semantic associations at different locations, performs nonlinear transformations through a feedforward neural network, and addresses the vanishing gradient problem through layer normalization and residual connections.

[0087] The training process of the decoder model is as follows Figure 4 As shown in the figure, the decoder model is first trained based on the fine-tuned BERT encoder model. At this time, the encoder model is able to encode the C2 traffic data into a specific vector representation containing key features. The test set samples are subjected to deep feature extraction through the trained encoder model to obtain the high-dimensional feature vector of the test set. The high-dimensional feature vector of the test set is used to train the decoder model, and the training goal of the decoder model is to reconstruct the input of the encoder model as accurately as possible, that is, the embedding vector corresponding to the original input text. The loss is calculated based on the evaluation index of the reconstruction error, and the decoder's own parameters are continuously adjusted based on the optimizer to make the reconstructed output text as close as possible to the original input text of the encoder model.

[0088] To accurately evaluate the difference between the decoder model's reconstructed output and the original input text, we introduced three evaluation metrics: Mean Squared Error (MSE), Mean Absolute Error (MAE), and Cosine Similarity (Cos Sim).

[0089] The mean square error (MSE) measures the overall error by calculating the mean of the squares of the differences between the corresponding elements of the reconstructed text and the original text. Large errors are given higher weights. A lower MSE value means that the reconstructed text is closer to the original text. The calculation formula is:

[0090]

[0091] Where n is the number of samples, ε k is the kth element of the original text, is the kth element of the reconstructed text;

[0092] The mean absolute error (MAE) is the mean of the absolute values ​​of the differences between the corresponding elements of the reconstructed text and the original text. It gives equal weight to all errors of different sizes and is therefore relatively insensitive to outliers. It provides an intuitive error metric. The lower the MAE value, the closer the reconstructed text is to the original text. The calculation formula is:

[0093]

[0094] Cosine similarity (cos sim) is used to measure the directional similarity between the reconstructed text and the original text. Its value range is [-1, 1]. The closer the cosine similarity is to 1, the more similar the directions of the two vectors are, that is, the reconstructed text better retains the semantic features of the original text. The calculation formula is:

[0095]

[0096] Among them, and are the vector representations of the original text and the reconstructed text respectively.

[0097] Step S5: Collect the flow data to be measured, obtain the high-dimensional feature vector to be measured according to the method of step S1 and step S2, input the high-dimensional feature vector to be measured into the classifier, detect the flow data to be measured, and obtain the classification result of the flow data to be measured; at the same time, the high-dimensional feature vector to be measured is input into the trained decoder model for reconstruction and the reconstruction error is calculated. The loss of the classifier and the reconstruction error are weighted and summed as the total loss to further fine-tune the encoder model;

[0098] During the usage phase, the traffic data to be tested, which contains new types of C2 traffic data, is input into the model. The trained encoder is used to extract deep features of the traffic data to be tested, obtaining a high-dimensional feature vector to be tested. The high-dimensional feature vector to be tested is then input into the trained classifier to detect the traffic data. At the same time, the high-dimensional feature vector to be tested is input into the trained decoder model for reconstruction and the reconstruction error is calculated. The loss of the classifier and the reconstruction error are weighted and summed to form the total loss to further optimize the encoder model. This enhances the encoder model's ability to extract deep features for new, unseen C2 traffic, improving the generalization of the deep learning-based C2 traffic detection model.

[0099] The total loss is calculated as follows:

[0100] Total Loss=α·Classification Loss+η·Reconstruction Loss

[0101] Among them, TotalLoss is the total loss, Classification Loss is the classifier loss, ReconstructionLoss is the reconstruction error, α is the weight coefficient of the classifier loss, and η is the weight coefficient of the reconstruction error. Adjust the two weight coefficients α and η according to actual needs to balance the classifier performance and the encoder's ability to extract deep features, and further optimize the model performance.

[0102] To verify the effectiveness and robustness of the BERT model fine-tuning method in the C2 traffic detection task, six other encoder models were built for comparison: RNN, LSTM, GRU, BiRNN, BiLSTM, and BiGRU. All were trained to optimal results using the training dataset. On the test set of the training dataset, the BERT-based model demonstrated the best performance, while the other encoder models also showed good performance. However, when using a new test dataset for verification, only the BERT-based model maintained good results. The other encoder models, lacking the robustness of pre-trained knowledge storage, showed a significant performance drop when processing new datasets without training. The specific experimental results are shown in Tables 1 to 4:

[0103] Table 1 Experimental results of EarlyCrow dataset

[0104]

[0105] Table 2 Experimental results of IcedID BackConnect dataset

[0106]

[0107] Table 3 Experimental results of CobaltStrike C2 dataset

[0108]

[0109] Table 4 Experimental results of VANT C2 dataset

[0110]

[0111] Results show that on the EarlyCrow training dataset, the fine-tuned BERT model achieved an accuracy of 98.47%, with the best precision, recall, and F1 score among baseline models. On the IcedID BackConnect, CobaltStrike C2, and VNAT C2 test datasets, BERT maintained stable performance, with an accuracy rate of around 90%, demonstrating good generalization capabilities.

[0112] In addition, to verify the quality and robustness of the encoder model output, each encoder is trained on the decoder in the training dataset to achieve the highest performance, and the reconstruction error is verified on the test dataset. The specific data are as follows: Figures 5 to 8 As shown;

[0113] At the same time, compared with other encoders, the Transformer-based BERT model shows obvious advantages in both classification detection indicators and reconstruction error indicators. It not only performs best on the training dataset, but also maintains high accuracy and low reconstruction error on the test dataset, indicating that the encoder is highly effective in capturing traffic semantic features. Compared with other models, the performance of new data that has not been trained has dropped significantly. The model proposed in this invention has stronger robustness and generalization ability. It not only performs well in C2 classification detection tasks, but also has stronger advantages in feature capture and information expression, which means that the model can generate more informative and representative feature vectors, verifying its superiority in complex C2 traffic detection and analysis.

[0114] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A C2 traffic detection method based on a context-aware language model, characterized in that: The following steps are involved: Step S1: collect C2 traffic data and convert it into a text sequence; Step S2: Use the BERT model's word segmenter to segment the text sequence in units of one byte. Input the segmented text sequence into the BERT model's embedding layer to obtain word embedding vectors, position embedding vectors, and paragraph embedding vectors. The embedding vectors are then summed up and divided into training and test sets. The encoder model performs deep feature extraction on the training set samples to obtain context-related high-dimensional feature vectors of the training set. Step S3: Use the high-dimensional feature vectors of the training set to train the pre-built classifier to classify C2 traffic, and fine-tune the encoder model through the back-propagation mechanism; Step S4: Perform deep feature extraction on the test set samples through the trained encoder model to obtain a high-dimensional feature vector of the test set; use the high-dimensional feature vector of the test set to train the decoder model, calculate the loss based on the reconstruction error, and optimize the parameters of the decoder model based on the optimizer; Step S5: Collect the flow data to be measured, obtain the high-dimensional feature vector to be measured according to the method of step S1 and step S2, input the high-dimensional feature vector to be measured into the classifier, detect the flow data to be measured, and obtain the classification result of the flow data to be measured; at the same time, the high-dimensional feature vector to be measured is input into the trained decoder model for reconstruction and calculation of the reconstruction error, and the loss of the classifier and the reconstruction error are weighted and summed as the total loss to further fine-tune the encoder model.

2. A C2 traffic detection method based on a context-aware language model as claimed in claim 1, characterized in that: The step S1 includes: S11. Collect C2 traffic and store it as a PCAP file. S12, grouping the PCAP packets according to the source and destination IP addresses; S13. Convert each set of PCAP data packets into UTF-8 encoded hexadecimal string data.

3. The C2 traffic detection method based on a context-aware language model according to claim 1, characterized in that: The pre-built classifier in step S3 includes a pooling layer and two fully connected layers: The high-dimensional feature vector generated by the encoder model is converted to a fixed size through the pooling layer, then input into the hidden layer for linear transformation, and then the feature vector is mapped to the category space through the second fully connected layer. The two fully connected layers are connected by the nonlinear activation function tanh; The cross entropy loss function is used to measure the difference between the model's predicted label and the true label, and the gradient descent method is used to adjust the weights to minimize the loss. The loss function calculation formula is: Where N is the total number of samples, is the probability that the model predicts that the jth sample is C2 traffic, y j is the true label of the jth sample.

4. The C2 traffic detection method based on a context-aware language model according to claim 1, characterized in that: The decoder model is internally composed of 6 identical layers of Transformer decoders cascaded together.

5. The C2 traffic detection method based on a context-aware language model according to claim 1, characterized in that: The evaluation indicators of the reconstruction error include mean square error, mean absolute error and cosine similarity: The mean square error (MSE) measures the overall error by calculating the square mean of the difference between the corresponding elements of the reconstructed text and the original text. The calculation formula is: Where n is the number of samples, ε k is the kth element of the original text, is the kth element of the reconstructed text; The mean absolute error (MAE) is the mean absolute value of the difference between the corresponding elements of the reconstructed text and the original text. The calculation formula is: Cosine similarity cos sim is used to measure the directional similarity between the two. The calculation formula is: Among them, and are the vector representations of the original text and the reconstructed text respectively.

6. The C2 traffic detection method based on a context-aware language model according to claim 1, characterized in that: The weighted sum of the classifier loss and the reconstruction error in step S5 is used as the total loss to further fine-tune the encoder model, including: The total loss is calculated as: Total Loss=α·Classification Loss+η·Reconstruction Loss Among them, Total Loss is the total loss, Classification Loss is the classifier loss, ReconstructionLoss is the reconstruction error, α is the weight coefficient of the classifier loss, and η is the weight coefficient of the reconstruction error.

Images