Traffic sample generation method matched with target domain style and related equipment

Abstract

The invention discloses a method for generating a traffic sample matched with a target domain style and related equipment. According to the method, different types of traffic sample groups in the source domain and the target domain are determined, and the features of each group are finely adjusted through the statistical information of each group, so that respective distribution is adapted, migration difficulty caused by relatively large difference between different groups is avoided, and the migration efficiency is improved. And the migration features are weighted in the feature migration process of the source domain traffic sample through statistical information, so that the accuracy and flexibility of feature adjustment are improved, and a generated traffic sample more similar to a target domain is obtained.

Description

Technical Field

[0001] The present application relates to the technical field of traffic identification, and in particular to a method, apparatus, device and computer-readable storage medium for generating traffic samples that match a target domain style. Background Art

[0002] Traffic data identification is a crucial technology in the field of network management and security. It analyzes network traffic data to identify different types of traffic. Its application areas include application identification, device identification, network service identification, and network quality identification. These functions are crucial for network optimization, bandwidth management, user behavior analysis, and the formulation of network security policies. By accurately identifying traffic characteristics, network administrators can more effectively allocate network resources, monitor compliance, and prevent potential security threats.

[0003] Traditional traffic identification methods usually rely on port number and protocol analysis, but with the increasing popularity of encryption technology and the use of dynamic ports, the effectiveness of these methods has gradually decreased. Therefore, more advanced technologies, such as traffic analysis methods based on feature extraction and machine learning, have been developed and applied to improve the accuracy and adaptability of identification.

[0004] Even machine learning-based traffic identification methods face huge challenges when dealing with data in different domains or network environments. For example, a traffic identification model trained in a laboratory may not work well in an actual production network because there are obvious distribution differences between laboratory data (source domain) and actual network data (target domain). This phenomenon is called domain shift and is the main reason for the degradation of model performance. The sources of distribution differences mainly include the following two aspects: (1) Network configuration differences: Different network configurations lead to different network indicators such as bandwidth, latency, jitter, and packet loss rate, which have a significant impact on traffic characteristics; (2) User behavior differences: User behavior in the laboratory is usually a predetermined script or pattern, while in the actual production network, user behavior is affected by many factors (such as time, location, culture, etc.), so it is more complex and diverse, which in turn affects the timing characteristics of traffic.

[0005] In order to solve the domain shift problem caused by data distribution differences, domain adaptation technology has been widely studied, aiming to improve the applicability of models in different live network environment data. These methods are generally divided into three categories: Domain-Adversarial Neural Networks (DANN), Cluster-Aware Domain Adaptation (CADA), and Generative Domain Adaptation (GDA). Adversarial learning (DANN) is an algorithm that uses adversarial training methods for domain adaptation. By introducing an adversarial network, the features extracted by the feature extractor cannot distinguish the data in the source domain and the target domain, so that the model can learn the domain-invariant features between the source domain and the target domain in adversarial training; Cluster-Aware Domain Adaptation (CADA) is a method to align the clustering structure between the source and target domains. By discovering and aligning the potential clustering structure of the data, CADA can effectively adapt to data in different domains; Generative adaptation uses a generative model (such as a generative adversarial network, GAN) to synthesize source domain data that is consistent with the style of the target domain, and adds the generated data to the training set, thereby narrowing the distribution difference between the source domain and the target domain of the training set.

[0006] However, for a wide range of traffic data recognition tasks, the difficulty of data annotation (small samples) and large domain differences in different existing network environments lead to large differences in category distribution in the target domain and unclear data clustering structure, which makes methods such as DANN and CADA not suitable for traffic data. For the GDA algorithm, it requires high-quality generation capabilities when generating samples in the target domain to ensure that these synthetic samples can effectively help train classifiers in the target domain. However, relying solely on generative methods may ignore significant differences between different data groups, resulting in insufficient diversity and deviation of generated samples. For example, in traffic data, the characteristics of certain attack types or user behavior patterns may not be fully represented in the generation process, so it is possible to introduce inaccurate samples and affect recognition accuracy. Summary of the invention

[0007] In order to solve the above technical problems, the present application provides a method, device, equipment and computer-readable storage medium for generating traffic samples matching the target domain style.

[0008] In a first aspect, an embodiment of the present application provides a method for generating a traffic sample matching a target domain style, the method for generating a traffic sample matching a target domain style comprising:

[0009] Classify labeled source domain traffic samples by label and determine statistical information for each category;

[0010] Cluster the unlabeled target domain traffic samples to obtain multiple target domain clusters, and determine the statistical information of each target domain cluster;

[0011] The feature migration weight is determined by integrating the statistical information of all categories and the clustering information of all target domain clusters, and the feature migration of each source domain traffic sample is performed based on the feature migration weight to obtain the migration feature set;

[0012] The comprehensive migration feature set, source domain traffic sample features, and target domain traffic sample features are used to train a generative adversarial network;

[0013] The generator based on the trained generative adversarial network generates generated traffic samples that match the style of the target domain.

[0014] In combination with the first aspect, in one implementation, after determining the clustering information of each target domain cluster, the method further includes:

[0015] For each target domain cluster, only the target domain traffic samples M that meet the requirements are retained S ,in:

[0016]

[0017] M C is the mean of the C sample masks closest to the cluster center, N is the sample dimension, and A is the preset threshold.

[0018] In combination with the first aspect, in one implementation, the step of determining the feature migration weight by integrating the statistical information of all categories and the clustering information of all target domain clusters includes:

[0019] Performing linear transformation on statistical information of all categories to obtain a first linear transformation result;

[0020] Perform a linear transformation on the clustering information of all target domain clusters to obtain a second linear transformation result;

[0021] Splicing the first linear transformation result and the second linear transformation result to obtain a splicing result;

[0022] The concatenation result is mapped through the Sigmoid function to obtain the feature migration weight.

[0023] In combination with the first aspect, in one implementation, feature migration is performed on the features of each source domain traffic sample based on the feature migration weight to obtain a migration feature set, including:

[0024] For any source domain traffic sample S i , perform feature migration according to the feature migration formula, where the feature migration formula is:

[0025]

[0026] x is any source domain traffic sample S i The feature of y is any target domain traffic sample T i The characteristics of δ(x) and δ(y) are S i and T i The variance of μ(x) and μ(y) are S i and T i The mean value of (w δ , w μ ) is the feature migration weight, dAdaIN(x, y) is S i Corresponding migration characteristics;

[0027] By analogy, the migration features corresponding to all source domain traffic samples are obtained and constitute a migration feature set.

[0028] In combination with the first aspect, in one implementation, during the training process, the loss of the generative adversarial network includes:

[0029] Generator Loss and the discriminator loss in:

[0030]

[0031] I real is the target domain traffic sample, I fake To generate traffic samples, G is the generator and D is the discriminator.

[0032] In combination with the first aspect, in one implementation, the generator loss It also includes non-sparse loss L1 and sparse loss L sparse ,in:

[0033]

[0034] z(k) is the zero mask of the target domain, which is used to represent the part close to zero in the target domain; f(k) is the generated traffic sample, k is the sample attribute, and y is the target domain data.

[0035] In combination with the first aspect, in one implementation, after the generator based on the trained generative adversarial network generates a generated traffic sample matching the target domain style, it also includes:

[0036] Train the classifier based on the generated traffic samples.

[0037] In a second aspect, an embodiment of the present application provides a traffic sample generating device matching a target domain style, characterized in that the traffic sample generating device matching a target domain style comprises:

[0038] The clustering migration module is used to classify the labeled source domain traffic samples according to the labels and determine the statistical information of each category; cluster the unlabeled target domain traffic samples to obtain multiple target domain clusters and determine the statistical information of each target domain cluster; determine the feature migration weight by combining the statistical information of all categories and the clustering information of all target domain clusters, and perform feature migration on the features of each source domain traffic sample based on the feature migration weight to obtain a migration feature set;

[0039] The domain discrimination module is used to train the generative adversarial network based on the comprehensive migration feature set, source domain traffic sample features and target domain traffic sample features; the generator based on the trained generative adversarial network generates generated traffic samples that match the target domain style.

[0040] In a third aspect, an embodiment of the present application provides a traffic sample generating device that matches the target domain style, wherein the traffic sample generating device that matches the target domain style comprises a processor, a memory, and a traffic sample generating program that matches the target domain style stored on the memory and can be executed by the processor, wherein when the traffic sample generating program that matches the target domain style is executed by the processor, the steps of the traffic sample generating method that matches the target domain style as described in the first aspect are implemented.

[0041] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which is stored a traffic sample generation program that matches the target domain style. When the traffic sample generation program that matches the target domain style is executed by a processor, the steps of the traffic sample generation method that matches the target domain style as described in the first aspect are implemented.

[0042] The beneficial effects brought by the technical solution provided by the embodiments of the present application include:

[0043] In the embodiment of the present application, the labeled source domain traffic samples are classified according to the labels, and the statistical information of each category is determined; the unlabeled target domain traffic samples are clustered to obtain multiple target domain clusters, and the statistical information of each target domain cluster is determined; the feature migration weight is determined by combining the statistical information of all categories and the clustering information of all target domain clusters, and the feature migration of each source domain traffic sample is performed based on the feature migration weight to obtain a migration feature set; the migration feature set, the source domain traffic sample features and the target domain traffic sample features are comprehensively trained to generate an adversarial network; the generator based on the trained generative adversarial network generates a generated traffic sample that matches the target domain style. Through the embodiment of the present application, different categories of traffic sample groups in the source domain and the target domain are determined, and the features of each group are finely adjusted through the specific statistical information of each group to adapt to their respective distributions, avoid migration difficulties caused by large differences between different groups, and weight the migration features of the source domain traffic samples during the feature migration process through statistical information, so as to improve the accuracy and flexibility of feature adjustment, thereby obtaining a generated traffic sample that is more similar to the target domain. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 This is a flow chart of an embodiment of a method for generating a traffic sample matching a target domain style according to the present application;

[0045] Figure 2 A schematic diagram of processing source domain traffic samples and target domain traffic samples;

[0046] Figure 3 This is a functional module diagram of an embodiment of a traffic sample generation device matching a target domain style according to the present application;

[0047] Figure 4 This is a schematic diagram of the hardware structure of a traffic sample generation device that matches the target domain style involved in the embodiment of the present application. DETAILED DESCRIPTION

[0048] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0049] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below in conjunction with the accompanying drawings.

[0050] In a first aspect, an embodiment of the present application provides a method for generating a traffic sample that matches a target domain style.

[0051] In one embodiment, referring to Figure 1 , Figure 1 This is a flow chart of an embodiment of a method for generating a traffic sample matching a target domain style in this application. Figure 1 As shown, the method for generating traffic samples matching the target domain style includes:

[0052] Step S10, classifying the labeled source domain traffic samples according to the labels, and determining the statistical information of each category;

[0053] In this embodiment, assuming that there are 500 source domain traffic samples, each of which has a corresponding label, the source domain traffic samples with the same label are classified into one category, thereby obtaining multiple categories, and the statistical information of each category can be determined based on the source domain traffic samples contained in each category. The traffic samples referred to in this article refer to the statistical characteristics of each flow.

[0054] For a category, the statistical information includes the number, variance, standard deviation, average distance from the center point, etc. of source domain traffic samples included in the category. This is only a schematic description of the statistical information, which can be increased or decreased according to actual needs.

[0055] Step S20, clustering the unlabeled target domain traffic samples to obtain multiple target domain clusters, and determining statistical information of each target domain cluster;

[0056] In this embodiment, the distribution inconsistency problem between the source domain and the target domain is solved by sample clustering selection and feature alignment, so as to improve the effectiveness and accuracy of cross-domain transfer learning when the source domain lacks sufficient labels or the features are greatly different from the target domain. It is divided into two main stages: clustering and adaptive feature transfer.

[0057] First, the K-Means clustering algorithm is used to perform unsupervised clustering on the target domain traffic samples. K-Means is a classic clustering method that can divide the target domain traffic samples into several target domain clusters according to feature similarity. In the absence of labels, K-Means can automatically identify potential patterns and structures in the data by finding the cluster center, and determine the statistical information of the target domain cluster, including Cen (center point), Size (cluster size), Radius (cluster radius), SD (standard deviation), AD (average distance), etc. This process can clarify the distribution of different types of traffic features in the target domain.

[0058] Furthermore, in one embodiment, after step S20, the method further includes:

[0059] For each target domain cluster, only the target domain traffic samples M that meet the requirements are retained S ,in:

[0060]

[0061] M C is the mean of the C sample masks closest to the cluster center, N is the sample dimension, and A is the preset threshold.

[0062] In this embodiment, after clustering is completed, the sparse pattern selection algorithm can be further combined to filter out traffic samples that are greatly different from the source domain from the target domain. The purpose of sparse pattern selection is to eliminate those traffic samples that may be noisy or irrelevant to the source domain characteristics, so as to reduce the interference caused by irregular traffic samples. This filtering process can ensure that only those traffic samples that have a certain similarity with the mask sparse pattern of each cluster center are selected, so as to avoid the migration of source domain characteristics in the target domain deviating too much from the actual situation.

[0063] Step S30, determining a feature migration weight by integrating statistical information of all categories and clustering information of all target domain clusters, and performing feature migration on the features of each source domain traffic sample based on the feature migration weight to obtain a migration feature set;

[0064] In this embodiment, a feature migration algorithm based on dynamic adaptive instance normalization (dAdaIN) is proposed. Figure 2 , Figure 2 A schematic diagram of processing source domain traffic samples and target domain traffic samples.

[0065] like Figure 2 As shown, the target domain after clustering (i.e. Figure 2 The source domain (quality difference domain) traffic samples and labeled source domain traffic samples are input to the encoder, and the encoder extracts the intermediate layer features of the traffic samples from the input. The function of dAdaIN is to transform the intermediate layer features of the source domain traffic samples to the distribution of the target domain traffic samples. The core idea of ​​this part of the algorithm is to dynamically adjust the mean and variance of the source domain features migrated to the target domain in the AdaIN algorithm through the clustering information of the source domain and the target domain. The algorithm will perform corresponding normalization operations on the source domain features according to the statistical characteristics of each target domain cluster (such as mean and variance).

[0066] Furthermore, in one embodiment, the step of determining the feature migration weight by integrating the statistical information of all categories and the clustering information of all target domain clusters includes:

[0067] Performing linear transformation on statistical information of all categories to obtain a first linear transformation result;

[0068] Perform a linear transformation on the clustering information of all target domain clusters to obtain a second linear transformation result;

[0069] Splicing the first linear transformation result and the second linear transformation result to obtain a splicing result;

[0070] The concatenation result is mapped through the Sigmoid function to obtain the feature migration weight.

[0071] In this embodiment, the statistical information of all categories and the clustering information of all target domain clusters are respectively input into two linear layers for full feature connection, and the feature transfer weight (w δ , w μ ), in order to dynamically adjust the degree of migration from the source domain to the target domain, as follows:

[0072] (w δ , w μ )=SigMoid(Linear(Cen,Size,Radius,AD,SD))

[0073] Among them, SigMoid is the SigMoid function, Linear is the linear layer, Cen, Size, Radius, AD, and SD are the center point, cluster size, cluster radius, standard deviation, and average distance respectively.

[0074] The essence of dynamic feature migration is that dAdaIN not only considers the global differences between the source and target domains, but also makes personalized adjustments based on the local information of each target domain cluster. This means that whether the target domain is a relatively single-distributed environment or a collection of complex scenes of multiple categories, the algorithm can maintain stable performance in the target domain by continuously adjusting the source domain features. This dynamic adaptive feature is unachievable with traditional feature normalization methods, which usually only process global statistical information and ignore the complex feature differences within the target domain categories.

[0075] Furthermore, in one embodiment, the features of each source domain traffic sample are migrated based on the feature migration weight to obtain a migration feature set, including:

[0076] For any source domain traffic sample S i , perform feature migration according to the feature migration formula, where the feature migration formula is:

[0077]

[0078] x is any source domain traffic sample S i The feature of y is any target domain traffic sample T i The characteristics of δ(x) and δ(y) are Si and T i The variance of μ(x) and μ(y) are S i and T i The mean value of (w δ , w μ ) is the feature migration weight, dAdaIN(x, y) is S i Corresponding migration characteristics;

[0079] By analogy, the migration features corresponding to all source domain traffic samples are obtained and constitute a migration feature set.

[0080] Through the above embodiments, not only is it ensured that the feature distribution between the source domain and the target domain is more consistent, but also the transfer learning effect of the model in the target domain can be improved.

[0081] Step S40, training a generative adversarial network by comprehensively combining the migration feature set, source domain traffic sample features, and target domain traffic sample features;

[0082] In this embodiment, the generative adversarial network includes a generator and a discriminator. The generative adversarial network is used to distinguish and align the data distribution features of the source domain and the target domain. The discriminator is used to identify whether the migration features have been aligned with the target domain features. The discriminator guides the adjustment of the generator by evaluating the matching degree of the features. At the same time, the migration feature set is input into the feature decoder to form a generator, and the generator can convert the input source domain traffic sample into a generated traffic sample that approximates the target domain.

[0083] The structure of the generator consists of 6 3D convolutional layers: the first layer uses 64 3×3×3 convolution kernels for feature extraction, with a step size of 1 and a padding of 1 to achieve flexible feature capture; the following convolutional layers gradually increase the number of convolution kernels, and the second layer uses 128 convolution kernels with a step size of 2, which can reduce the spatial dimension of the feature map while increasing the representation ability of the model; continuing to the third layer, the number of convolution kernels is further increased to 256, and the step size is maintained at 1 to extract deeper features; in order to gradually restore the dimension of the feature map, the fourth layer introduces deconvolution. The deconvolution structure has 128 3×3×3 convolution kernels that can upsample the data, with a step size of 2 and padding of 1. This deconvolution layer is responsible for expanding the low-dimensional convolution feature map layer by layer back to the size close to the input data; in the fifth convolution layer, the number of channels of the input feature map is 128, and the number of channels of the output becomes 64 after the convolution operation, and the size of the convolution kernel is 3x3x3; the number of input channels of the sixth layer is 64, and after the convolution operation with a convolution kernel size of 3x3x3, the number of output channels is further reduced to 1, so that the output adapts to the characteristics of the target domain traffic sample. The Dropout mechanism is introduced in each convolution layer to enhance the regularization ability of the model. This mechanism helps prevent the model from overfitting during training and improves generalization performance by randomly discarding a certain proportion of neuron connections. The final output of the generator undergoes a specific masking process, which ensures that the generated data conforms to the sparse characteristics of the target domain. In some areas that need to be sparse, the output of the generator is close to zero, so that the generated data is closer to the real target domain traffic sample in structure.

[0084] The discriminator also uses a deep 3D convolutional network design. Its initial layer is similar to the generator, using 64 3×3×3 convolution kernels with a step size of 2, which helps to initially extract information from the sample. The following layers increase the number of convolution kernels, with 128 convolution kernels in the second layer and 256 in the third layer. Through the superposition and pooling of these layers, the discriminator can gradually reduce the spatial dimension while maintaining efficient feature extraction. After extraction through multiple convolutional layers, the output feature map is flattened and input into the fully connected layer, and finally a category label activated by Sigmoid is output to indicate the authenticity of the input sample (that is, whether it comes from real data or generated data). In the design of the discriminator, the Dropout layer is also introduced for regularization to enhance the stability and reliability of the model.

[0085] During the entire training process, the generator and the discriminator are updated alternately. The generator continuously generates traffic samples to confuse the discriminator, while the discriminator tries to continuously improve its ability to distinguish generated traffic samples from real traffic samples. During the training process, the generator and the discriminator use the loss function for back-propagation optimization.

[0086] Furthermore, in one embodiment, during the training process, the loss of the generative adversarial network includes:

[0087] Generator Loss and the discriminator loss in:

[0088]

[0089] I real is the target domain traffic sample, I fake To generate traffic samples, G is the generator and D is the discriminator.

[0090] Furthermore, in one embodiment, the loss of the generator not only takes into account the adversarial loss, but also combines the non-sparse loss L1 and the sparse loss L sparse , to encourage the generator to generate samples that are more consistent with the characteristics of the target domain.

[0091] In this embodiment, a sparse pattern similarity loss function is proposed, the purpose of which is to introduce a sparsity constraint between the generated data and the target domain data. Specifically, the loss function constrains the generated data through two parts:

[0092] Zero alignment loss: For regions close to zero in the target domain, the generated data is constrained to be as close to zero as possible at these locations. This constraint is implemented through L1 loss, that is, after weighting the data locations close to zero in the target domain, the absolute error of the generated data at these locations is calculated to form a loss term:

[0093]

[0094] Non-sparse area matching loss: For the non-sparse part of the target domain, that is, the area with larger values, the generated data is required to match the target domain data as much as possible. Similarly, this part of the constraint calculates the difference between the generated data and the non-sparse part of the target domain through the L1 loss, and introduces the sparsity weight to control the impact of this loss:

[0095]

[0096] z(k) is the zero mask of the target domain, which is used to represent the part close to zero in the target domain; f(k) is the generated traffic sample, k is the sample attribute, and y is the target domain data.

[0097] Step S50, generating a generated traffic sample matching the target domain style based on the generator of the trained generative adversarial network.

[0098] In this embodiment, after the training of the generative adversarial network is completed, a generated traffic sample matching the target domain style can be generated based on the generator of the trained generative adversarial network.

[0099] In the embodiment of the present application, the labeled source domain traffic samples are classified according to the labels, and the statistical information of each category is determined; the unlabeled target domain traffic samples are clustered to obtain multiple target domain clusters, and the statistical information of each target domain cluster is determined.

[0100] information; determine the feature migration weight by integrating the statistical information of all categories and the clustering information of all target domain clusters, and perform feature migration on the features of each source domain traffic sample based on the feature migration weight to obtain a migration feature set; train a generative adversarial network based on the migration feature set, source domain traffic sample features, and target domain traffic sample features; generate traffic samples that match the target domain style based on the generator of the trained generative adversarial network. Through the embodiments of the present application, different categories of traffic sample groups in the source domain and the target domain are determined, and the features of each group are finely adjusted through the statistical information specific to each group to adapt to their respective distributions and avoid migration difficulties caused by large differences between different groups. The migration features of the source domain traffic samples are weighted through statistical information during the feature migration process, so as to improve the accuracy and flexibility of feature adjustment, thereby obtaining a generated traffic sample that is closer to the target domain.

[0101] Furthermore, in one embodiment, after step S50, the method further includes:

[0102] Train the classifier based on the generated traffic samples.

[0103] In this embodiment, the classifier is a CNN network structure, and the classifier is trained by generating traffic samples to improve its adaptability to the target domain. The entire classifier consists of two 3D convolutional layers to extract useful features from the input data layer by layer. The design of the first convolutional layer uses 32 convolution kernels with a size of 3×3×3, a step size of 1, and an appropriate padding strategy to maintain the size of the feature map. This configuration enables the layer to effectively capture local spatial features and contextual information when processing input data; the next convolutional layer increases the number of convolution kernels to 64, also using a convolution kernel size of 3×3×3, and a step size of 1 to maintain padding. In this way, the convolutional network can extract more complex and rich data features at a deeper level.

[0104] After these two convolutional layers, the network uses a maximum pooling layer to further reduce the dimension of the data and the amount of computation. The pooling layer uses a 2×2×2 window and sets the step size to 2, which can effectively reduce the spatial dimension of the feature map, thereby speeding up subsequent calculations while retaining important feature information.

[0105] The fully connected layer is divided into two layers. The first layer maps the features of the previous layer output to 512 neurons and combines them with the activation function to further expand the nonlinear expression ability of the model. The final output layer is responsible for mapping the network's prediction results to a specific number of categories and outputting a vector result corresponding to the number of categories.

[0106] To further verify the performance of the solution in this embodiment, the ISCXVPN2016 dataset

[18] was selected as the training set for traffic application identification. The training set was obtained from Dalhousie University in Canada. A network dataset released by a research team at the University of California Davis in 2016 for network traffic classification and VPN traffic identification research. It contains 24 categories of applications, including web browsing (Firefox and Chrome), email (SMPTS, POP3S, and IMAPS), chat software (ICQ, AIM, Skype, Facebook, and Hangouts), streaming software (Vimeo and YouTube), file transfer, VoIP applications, and P2P applications, with a total of 16.4G network traffic data. 17 of these categories are selected as training samples for identification (the other 7 categories have too few data packets and are not statistically significant). Their statistical features are extracted in the following way: the packet length, packet time interval, and packet number of the upstream and downstream traffic are extracted once every 0.01 seconds. The statistical features include mean, standard deviation, median, maximum, and minimum. One sample takes 10 tokens, and the sample dimension is 6×5×10. The number of source domain training samples is 195,832. In another part of the training data, a poor quality environment was introduced, and after adding random downlink packet delay (50-200ms) and random packet loss of 5%, the number of target domain training samples was 131210, and the number of target domain test samples was 137558.

[0107] Hyperparameter selection: The learning rate of the generator and the discriminator is set to 0.0002, and the batch size is set to 16. In terms of network structure, the generator and the discriminator use a layer-by-layer increasing number of convolution channels, which are 64, 128, 256, and 512 respectively, so that higher-level features can be gradually extracted. The size of the convolution kernel is 4×4×4, which is used to capture the local features of spatiotemporal data, and the stride is set to 2. After each layer of convolution, the size of the feature map is reduced to extract more abstract features. In order to avoid overfitting, the model uses a Dropout of 0.3, which means that 30% of the neurons will be randomly discarded during each training. Sparsity loss is introduced in GAN training, where the weight of the sparsity loss is 0.5, ensuring that the generated data is close to the sparse characteristics of the target domain in the sparse area. At the same time, the threshold for sparse selection is set to 20, which makes the sparse patterns of paired source domain samples and target domain samples closer. The optimizer selected Adam, where the momentum parameters β1 and β2 were set to 0.5 and 0.999 respectively, which is a common setting in GAN training. It can accelerate the convergence of the model while ensuring the stability of gradient updates. The entire training process was trained for 50 rounds until convergence. In addition, in the forward propagation of the generator, a mask based on the target domain data was used to ensure that the generated output can be more approximated in the sparse area of ​​the target domain.

[0108] The CPU model of the OLT computing power board is Intel(R)Xeon(R)D-2187NT, and the graphics card model of the GPU server is NVIDIA GeForce 3090 24G. The experimental results are shown in Tables 1 and 2. It can be seen from Table 1 that after adding random delay (50-200ms) of downlink packets and random packet loss of 5%, the performance of the model's cross-domain recognition decreased by an average of 15%. As can be seen from Table 2, the existing advanced domain adaptive algorithms have not significantly improved the cross-domain traffic data classification task, only increasing by 1%. It can be seen that the solution disclosed in this embodiment has achieved the best performance in the cross-domain classification experiment, enabling the model to adapt to the large data distribution differences between domains, and obtaining the best cross-domain classification results, with a performance improvement of 7% over the existing algorithm.

[0109] method Accuracy Recall f1 score MLP (same domain) 0.9301 0.9346 0.9311 CNN (same domain) 0.9526 0.9568 0.9553 Transformer (same domain) 0.9295 0.9365 0.9281 MLP (cross-domain) 0.7757 0.7843 0.7819 CNN (cross-domain) 0.8038 0.8091 0.8053 Transformer (cross-domain) 0.7898 0.7899 0.7813

[0110] Table 1

[0111] method Accuracy Recall f1 score DANN (cross-domain) 0.7971 0.8042 0.7963 CADA (cross-domain) 0.8001 0.8001 0.7814 GDA (cross-domain) 0.8132 0.8165 0.8122 This embodiment (cross-domain) 0.8833 0.8812 0.8767

[0112] Table 2

[0113] In a second aspect, an embodiment of the present application also provides a device for generating traffic samples that matches the target domain style.

[0114] In one embodiment, referring to Figure 3 , Figure 3This is a functional module diagram of an embodiment of a traffic sample generation device matching a target domain style in this application. Figure 3 As shown, the traffic sample generating device matching the target domain style includes:

[0115] The clustering migration module 10 is used to classify the labeled source domain traffic samples according to the labels and determine the statistical information of each category; cluster the unlabeled target domain traffic samples to obtain multiple target domain clusters and determine the statistical information of each target domain cluster; determine the feature migration weight based on the statistical information of all categories and the clustering information of all target domain clusters, and perform feature migration on the features of each source domain traffic sample based on the feature migration weight to obtain a migration feature set;

[0116] The domain discrimination module 20 is used to train a generative adversarial network based on a comprehensive migration feature set, source domain traffic sample features, and target domain traffic sample features; and to generate traffic samples that match the target domain style based on the generator of the trained generative adversarial network.

[0117] Furthermore, in one embodiment, the cluster migration module 10 is further used for:

[0118] For each target domain cluster, only the target domain traffic samples M that meet the requirements are retained S ,in:

[0119]

[0120] M C is the mean of the C sample masks closest to the cluster center, N is the sample dimension, and A is the preset threshold.

[0121] Furthermore, in one embodiment, the cluster migration module 10 is specifically used for:

[0122] Performing linear transformation on statistical information of all categories to obtain a first linear transformation result;

[0123] Perform a linear transformation on the clustering information of all target domain clusters to obtain a second linear transformation result;

[0124] Splicing the first linear transformation result and the second linear transformation result to obtain a splicing result;

[0125] The concatenation result is mapped through the Sigmoid function to obtain the feature migration weight.

[0126] Furthermore, in one embodiment, the cluster migration module 10 is specifically used for:

[0127] For any source domain traffic sample S i , perform feature migration according to the feature migration formula, where the feature migration formula is:

[0128]

[0129] x is any source domain traffic sample S i The feature of y is any target domain traffic sample T i The characteristics of δ(x) and δ(y) are S i and T i The variance of μ(x) and μ(y) are S i and T i The mean value of (w δ , w μ ) is the feature migration weight, dAdaIN(x,y) is S i Corresponding migration characteristics;

[0130] By analogy, the migration features corresponding to all source domain traffic samples are obtained and constitute a migration feature set.

[0131] Furthermore, in one embodiment, during the training process, the loss of the generative adversarial network includes:

[0132] Generator Loss and the discriminator loss in:

[0133]

[0134] I real is the target domain traffic sample, I fake To generate traffic samples, G is the generator and D is the discriminator.

[0135] Furthermore, in one embodiment, the generator loss It also includes non-sparse loss L1 and sparse loss L sparse ,in:

[0136]

[0137] z(k) is the zero mask of the target domain, which is used to represent the part close to zero in the target domain; f(k) is the generated traffic sample, k is the sample attribute, and y is the target domain data.

[0138] Furthermore, in one embodiment, the traffic sample generation device matching the target domain style further includes a classification module, which is used to:

[0139] Train the classifier based on the generated traffic samples.

[0140] Among them, the functional implementation of each module in the above-mentioned traffic sample generation device matching the target domain style corresponds to the steps in the above-mentioned traffic sample generation method matching the target domain style embodiment, and its functions and implementation processes will not be repeated here one by one.

[0141] In a third aspect, an embodiment of the present application provides a traffic sample generating device that matches the target domain style. The traffic sample generating device that matches the target domain style may be a personal computer (PC), a laptop computer, a server, or other device with data processing capabilities.

[0142] Reference Figure 4 , Figure 4 The hardware structure diagram of the traffic sample generation device matching the target domain style involved in the embodiment of the present application is shown in FIG. In the embodiment of the present application, the traffic sample generation device matching the target domain style may include a processor, a memory, a communication interface, and a communication bus.

[0143] The communication bus may be of any type and is used to interconnect the processor, the memory, and the communication interface.

[0144] The communication interface includes an input / output (I / O) interface, a physical interface, and a logical interface, which are used to interconnect devices within the traffic sample generation device matching the target domain style, and an interface for interconnecting the traffic sample generation device matching the target domain style with other devices (such as other computing devices or user devices). The physical interface can be an Ethernet interface, a fiber optic interface, an ATM interface, etc.; the user device can be a display, a keyboard, etc.

[0145] The memory can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.

[0146] The processor may be a general-purpose processor, which may call a traffic sample generation program matching the target domain style stored in a memory, and execute a traffic sample generation method matching the target domain style provided in an embodiment of the present application. For example, the general-purpose processor may be a central processing unit (CPU). The method executed when the traffic sample generation program matching the target domain style is called may refer to the various embodiments of the traffic sample generation method matching the target domain style of the present application, which will not be repeated here.

[0147] Those skilled in the art will understand that Figure 4 The hardware structure shown in the figure does not constitute a limitation on the present application, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0148] In a fourth aspect, an embodiment of the present application also provides a computer-readable storage medium.

[0149] The computer-readable storage medium of the present application stores a traffic sample generation program that matches the target domain style, wherein when the traffic sample generation program that matches the target domain style is executed by a processor, the steps of the traffic sample generation method that matches the target domain style as described above are implemented.

[0150] Among them, the method implemented when the traffic sample generation program matching the target domain style is executed can refer to the various embodiments of the traffic sample generation method matching the target domain style of the present application, and will not be repeated here.

[0151] It should be noted that the serial numbers of the above-mentioned embodiments of the present application are only for description and do not represent the advantages or disadvantages of the embodiments.

[0152] The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices. The terms "first", "second" and "third" are used to distinguish different objects, etc., and do not represent a sequence, nor do they limit "first", "second" and "third" to different types.

[0153] In the description of the embodiments of the present application, "exemplary", "for example" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary", "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary", "for example" or "for example" is intended to present related concepts in a specific way.

[0154] In the description of the embodiments of the present application, unless otherwise specified, “ / ” means or, for example, A / B can mean A or B; the “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.

[0155] In some processes described in the embodiments of the present application, multiple operations or steps that appear in a specific order are included, but it should be understood that these operations or steps may not be executed in the order in which they appear in the embodiments of the present application or in parallel, and the sequence number of the operation is only used to distinguish the different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed in sequence or in parallel, and these operations or steps may be combined.

[0156] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD) as described above, and includes a number of instructions for a terminal device to execute the methods described in each embodiment of the present application.

[0157] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for generating traffic samples matching the style of a target domain, characterized in that: The method for generating a traffic sample matching the target domain style includes: Classify labeled source domain traffic samples by label and determine statistical information for each category; Cluster the unlabeled target domain traffic samples to obtain multiple target domain clusters, and determine the statistical information of each target domain cluster; The feature migration weight is determined by integrating the statistical information of all categories and the clustering information of all target domain clusters, and the feature migration of each source domain traffic sample is performed based on the feature migration weight to obtain the migration feature set; The comprehensive migration feature set, source domain traffic sample features, and target domain traffic sample features are used to train a generative adversarial network; The generator based on the trained generative adversarial network generates generated traffic samples that match the style of the target domain.

2. The method for generating traffic samples matching the target domain style according to claim 1, characterized in that: After determining the clustering information of each target domain cluster, the method further includes: For each target domain cluster, only the target domain traffic samples M that meet the requirements are retained S ,in: M C is the mean of the C sample masks closest to the cluster center, N is the sample dimension, and A is the preset threshold.

3. The method for generating traffic samples matching the target domain style according to claim 1, characterized in that: The step of determining the feature migration weight by integrating the statistical information of all categories and the clustering information of all target domain clusters includes: Performing linear transformation on statistical information of all categories to obtain a first linear transformation result; Perform a linear transformation on the clustering information of all target domain clusters to obtain a second linear transformation result; Splicing the first linear transformation result and the second linear transformation result to obtain a splicing result; The concatenation result is mapped through the Sigmoid function to obtain the feature migration weight.

4. The method for generating traffic samples matching the target domain style according to claim 3, characterized in that: Based on the feature migration weight, the features of each source domain traffic sample are migrated to obtain a migration feature set, including: For any source domain traffic sample S i , perform feature migration according to the feature migration formula, where the feature migration formula is: x is any source domain traffic sample S i The feature of y is any target domain traffic sample T i The characteristics of δ(x) and δ(y) are S i and T i The variance of μ(x) and μ(y) are S i and T i The mean value of (w δ , w μ ) is the feature migration weight, dAdaIN(x,y) is S i The corresponding migration characteristics; By analogy, the migration features corresponding to all source domain traffic samples are obtained and constitute a migration feature set.

5. The method for generating traffic samples matching the target domain style according to claim 1, characterized in that: During training, the losses of the generative adversarial network include: Generator Loss and the discriminator loss in: I real is the target domain traffic sample, I fake To generate traffic samples, G is the generator and D is the discriminator.

6. The method for generating traffic samples matching the target domain style according to claim 5, characterized in that: Generator Loss It also includes non-sparse loss L1 and sparse loss L sparse ,in: z(k) is the zero mask of the target domain, which is used to represent the part close to zero in the target domain; f(k) is the generated traffic sample, k is the sample attribute, and y is the target domain data.

7. The method for generating traffic samples matching the target domain style according to claim 1, characterized in that: After the generator based on the trained generative adversarial network generates a generated traffic sample matching the target domain style, the method further includes: Train the classifier based on the generated traffic samples.

8. A flow sample generation device matching a target domain style, characterized in that: The traffic sample generating device matching the target domain style comprises: The clustering migration module is used to classify the labeled source domain traffic samples according to the labels and determine the statistical information of each category; cluster the unlabeled target domain traffic samples to obtain multiple target domain clusters and determine the statistical information of each target domain cluster; determine the feature migration weight by combining the statistical information of all categories and the clustering information of all target domain clusters, and perform feature migration on the features of each source domain traffic sample based on the feature migration weight to obtain a migration feature set; The domain discrimination module is used to train the generative adversarial network based on the comprehensive migration feature set, source domain traffic sample features and target domain traffic sample features; the generator based on the trained generative adversarial network generates generated traffic samples that match the target domain style.

9. A traffic sample generation device matching a target domain style, characterized in that: The traffic sample generating device matching the target domain style comprises a processor, a memory, and a traffic sample generating program matching the target domain style stored in the memory and executable by the processor, wherein when the traffic sample generating program matching the target domain style is executed by the processor, the steps of the traffic sample generating method matching the target domain style as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a traffic sample generation program that matches the target domain style, wherein when the traffic sample generation program that matches the target domain style is executed by a processor, the steps of the traffic sample generation method that matches the target domain style as described in any one of claims 1 to 7 are implemented.

Images