Traffic detection model training method, traffic detection method, electronic device, storage medium and apparatus

Abstract

The application discloses a traffic detection model training method and a traffic detection method, an electronic device, a storage medium and a device, and belongs to the fields of machine learning and information security. Traffic data sets are acquired and session division is performed; a packet length sequence and an arrival time interval sequence are extracted from each session; the packet length sequence comprises packet length information of data packets in the session, and the arrival time interval sequence comprises a difference between arrival times of adjacent data packets in the session; discrete wavelet transform is performed on the packet length sequence and the arrival time interval sequence respectively to obtain an approximate coefficient sequence and a detail coefficient sequence of each sequence; frequency domain features are extracted according to each approximate coefficient sequence and each detail coefficient sequence; and the frequency domain features are input to a random forest model for training to obtain a trained traffic detection model. To-be-detected traffic is input to the traffic detection model obtained by the above method for detection. The application can accurately identify target classified traffic in real time from to-be-detected traffic.

Description

Technical Field

[0001] This invention provides a traffic detection model training method, as well as a traffic detection method, electronic device, storage medium, and device, belonging to the interdisciplinary technical field of machine learning and information security. Background Technology

[0002] While rapidly developing network technologies bring convenience to people's lives, they also present challenges due to the complexity and diversity of network traffic. With the continuous enrichment of network applications and services, the scale and characteristics of network traffic are becoming increasingly complex. In particular, the widespread use of encrypted traffic makes monitoring and analyzing network activity more difficult. Therefore, accurately detecting and identifying specific network traffic is of great significance for network management, security monitoring, and performance optimization. However, traditional traffic detection methods are no longer sufficient to cope with today's complex network environment.

[0003] Early traffic detection methods primarily relied on port identification and deep packet inspection (DPI). However, with the widespread adoption of dynamic port negotiation, encrypted communication, and tunneling technologies, the effectiveness of these methods has significantly decreased. To address this challenge, researchers have extracted statistical features such as packet size, payload size, number of packets, total traffic volume, arrival time, and duration, and combined these features with machine learning and deep learning techniques to detect and classify network traffic. Shafiq et al. used traffic statistical features combined with various machine learning algorithms such as decision trees and support vector machines to achieve real-time network traffic detection. Yang et al. proposed an adaptive traffic classification method based on spatiotemporal features, utilizing an attention mechanism to obtain a more comprehensive representation of network traffic and improve its identification capabilities. Lin et al. proposed a Transformer-based encrypted traffic bidirectional encoder representation, obtaining deeper contextual information at the packet level, thus improving the accuracy of network traffic detection. However, traditional network traffic feature information content is relatively low, making it prone to false positives and false negatives, resulting in poor detection accuracy. While deep learning-based traffic detection techniques achieve high detection accuracy, their complex model structures lead to long detection times, hindering efficient detection.

[0004] To address the shortcomings of traditional statistical features and deep learning methods, numerous studies have applied frequency domain analysis to network traffic detection. Yuchen Sun et al. proposed a Tor user website access detection method based on network traffic frequency domain fingerprinting (FDF). This method extracts the direction and length features of network traffic sequences, combines them, and transforms them into the frequency domain. Traffic classification is then achieved using a deep learning model incorporating CNN, fully connected layers (FC), and self-attention mechanisms. To address the issues of scarce labeled data and poor detection performance, Jiayi Ni et al. proposed a staged frequency domain feature detection method. This method uses a small-step sliding window during the training phase to fully capture the frequency domain features of the traffic and accurately distinguishes between malicious and normal traffic using the SOM-Kmeans technique. To address the problems of poor robustness and susceptibility to evasion in malicious traffic detection based on traditional statistical features, Chuanpu Fu et al. proposed a traffic frequency domain feature extraction method based on Fourier transform. This method uses discrete Fourier transform to extract the frequency domain features of traffic at the flow level and clusters traffic patterns using statistical machine learning algorithms, achieving real-time and robust malicious traffic detection. However, the application scope of the aforementioned existing technologies remains limited, effectively identifying only specific types of attacks, exhibiting weak generalization ability, and struggling to cope with unknown threats. Furthermore, existing methods do not demonstrate ideal robustness in certain scenarios, making it difficult to achieve fine-grained, accurate detection. Summary of the Invention

[0005] The purpose of this invention is to divide traffic into sessions, extract the packet length sequence and time interval sequence of each session, and use them as input for frequency domain feature extraction. Subsequently, frequency domain features of the traffic are extracted through discrete wavelet transform, and a random forest model is trained based on the extracted frequency domain features as a detection model, thereby achieving accurate detection of traffic of the target type.

[0006] The traffic detection model training method of the present invention includes the following steps:

[0007] Acquire traffic datasets and segment sessions;

[0008] Extract packet length sequences and arrival time interval sequences from each session; the packet length sequence includes packet length information of data packets in the session, and the arrival time interval sequence includes the difference in arrival time of adjacent data packets in the session;

[0009] Discrete wavelet transform is performed on the packet length sequence and the arrival time interval sequence to obtain the approximate coefficient sequence and detail coefficient sequence of each sequence;

[0010] Frequency domain features are extracted based on the approximation coefficient sequences and the detail coefficient sequences.

[0011] The frequency domain features are input into the random forest model for training to obtain a trained traffic detection model.

[0012] Furthermore, the traffic dataset includes a malicious traffic dataset.

[0013] Furthermore, the method for session segmentation involves parsing the source IP, destination IP, source port, destination port, and protocol fields of each data packet, and combining these fields to form a unique session identifier; data packets with the same source IP, destination IP, source port, destination port, and protocol are grouped into the same session.

[0014] Furthermore, one or more evaluation metrics are used to evaluate the performance of the model, including accuracy, precision, recall, and F1 score.

[0015] Furthermore, zero-padding is performed on sequences where the number of elements in the packet length sequence and the arrival time interval sequence is less than a set number.

[0016] Furthermore, statistical calculations are performed on the approximation coefficient sequence and detail coefficient sequence of each sequence, and the corresponding energy, skewness, entropy, mean absolute deviation, standard deviation, variance, mean and maximum value are extracted as frequency domain features of the flow.

[0017] Furthermore, the frequency domain features are normalized before input.

[0018] The flow detection method of the present invention involves inputting the flow to be detected into the flow detection model obtained by the above method for detection.

[0019] The present invention also provides an electronic device including a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing any of the methods described above.

[0020] The present invention also provides a storage medium for storing a computer program, which, when executed by a computer, implements the method described in any of the preceding claims.

[0021] The present invention also provides a flow detection model training device, comprising:

[0022] The data acquisition module is used to acquire traffic datasets and perform session segmentation;

[0023] Data processing module, including

[0024] A session processing module is used to divide the traffic dataset into sessions and extract packet length sequences and arrival time interval sequences from each session; the packet length sequence includes packet length information of data packets in the session, and the arrival time interval sequence includes the difference in arrival time of adjacent data packets in the session;

[0025] The discrete wavelet transform module is used to perform discrete wavelet transform on the packet length sequence and the arrival time interval sequence to obtain the approximate coefficient sequence and the detail coefficient sequence of each sequence;

[0026] The frequency domain feature extraction module is used to extract frequency domain features based on the approximation coefficient sequence and the detail coefficient sequence.

[0027] The training module is used to input the frequency domain features into the random forest model for training to obtain a trained traffic detection model.

[0028] The present invention also provides a flow detection device, comprising: an input module for receiving the flow to be detected and inputting a flow detection model obtained according to a training device; and an output module for receiving and outputting the detection result of the flow detection model.

[0029] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0030] This invention can accurately identify target-classified traffic from the traffic to be detected in real time. Session-level segmentation enables comprehensive analysis of communication behavior, covering key parameters such as traffic size, transmission rate, and duration, providing a more comprehensive perspective and helping to reveal behavioral patterns in encrypted communication, making it particularly suitable for the accurate detection of encrypted traffic. The use of a random forest model effectively prevents overfitting, and random forests have high training and detection efficiency, and support parallel processing of decision trees, further improving detection speed and performance in practical applications. Attached Figure Description

[0031] Figure 1 This is a flowchart illustrating an embodiment of the present invention.

[0032] Figure 2 This is a visual comparison chart of the traffic frequency domain features extracted in this embodiment of the invention and the traffic statistical features extracted by CICFlowMeter.

[0033] Figure 3 This is a diagram showing the experimental results of frequency domain feature ablation in an embodiment of the present invention.

[0034] Figure 4 This is a framework diagram of the flow detection device in an embodiment of the present invention. Detailed Implementation

[0035] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, and to make the objectives, features, and advantages of the present invention more apparent and understandable, the core technology of the present invention will be further described in detail below with reference to the accompanying drawings. The present invention can detect traffic of a set type from traffic to be detected; in this specific embodiment, malicious traffic is used as an example only. It should be understood that the specific embodiments described herein are only for explaining the present invention and are not intended to limit the present invention.

[0036] The overall approach of this invention is to first divide traffic into sessions, extracting the packet length sequence and time interval sequence for each session as input for frequency domain feature extraction. Then, frequency domain features of the traffic are extracted using discrete wavelet transform, and a random forest model is trained based on these extracted features to serve as a malicious traffic detection model, thereby achieving accurate detection of malicious traffic.

[0037] A flowchart illustrating an embodiment of the present invention is shown below. Figure 1 As shown, the specific steps of the method are described in detail as follows:

[0038] (1) Data preprocessing

[0039] To verify the applicability of this method under different attack scenarios, this invention selected several typical network attack scenarios for testing, including simulated real network environments, various IoT attack scenarios, DoH-based covert attack traffic, and botnet attacks. Specifically, the validation datasets used include the CICIDS2017 dataset, the CICIoT2023 dataset, the CIRA-CIC-DoHBrw-2020 dataset, the CTU-13 dataset, and the USTC-TFC2016 dataset. The CICIDS2017 dataset simulates a real network environment, covering various network attack types, including brute-force attacks, botnets, DoS, DDoS, and web attacks, while also including normal network traffic. The CICIoT2023 dataset simulates IoT network environments, covering various attack types such as botnet attacks, DoS and DDoS attacks, and includes normal device activity traffic. The CIRA-CIC-DoHBrw-2020 dataset is specifically designed to detect DoH-based malicious network traffic, involving various malicious activities, including encrypted malware communication and covert command and control channels, and also includes normal browser traffic. The CTU-13 dataset primarily contains various botnet traffic, including worms, DoS attacks, and command and control communications, as well as normal network traffic.

[0040] To effectively detect common real-world cyberattacks, this invention classifies and reorganizes existing experimental datasets to obtain a training dataset. Based on common cyberattack types, the traffic data is divided into eight categories: botnet traffic, brute-force traffic, denial-of-service / distributed denial-of-service traffic, DoH covert channel traffic, malware traffic, scanning traffic, flooding traffic, and malicious injection traffic. Table 1 shows detailed information about the training dataset.

[0041] Table 1

[0042]

[0043]

[0044] This invention segments traffic data in a dataset at the session level. A session is a communication unit uniquely identified by the source IP address, destination IP address, source port, destination port, and transport protocol of a data packet. Each session represents a logical connection, encompassing all data interactions between the communicating parties within a specific timeframe; traffic exists in the form of multiple data packets. In this step, the source IP, destination IP, source port, destination port, and protocol fields of each data packet are parsed, and these fields are combined to form a unique session identifier. Then, all data packets with the same source IP, destination IP, source port, destination port, and protocol are grouped into the same session. A session contains bidirectional data transmission between the communicating parties, including request packets from the source IP to the destination IP and response packets from the destination IP back to the source IP.

[0045] For each session, the packet length information of each data packet in the session is extracted as a packet length sequence, and the packet length of data packets sent from the host to the server is defined as positive, while the packet length of data packets sent from the server to the host is defined as negative. Defining the positive and negative values ​​of the packet length according to the sending direction is to better fit the wavelet shape, making the subsequent frequency domain features extracted using discrete wavelet transform more effective.

[0046] The arrival time of each data packet in the session is extracted as an arrival time sequence. Then, the arrival time interval sequence is obtained by calculating the arrival time difference between two adjacent data packets, that is, subtracting the arrival time of the previous data packet from the arrival time of the next data packet. The time interval of the first data packet is set to 0.

[0047] It is worth noting that only the packet length sequence and arrival time interval sequence of data packets are extracted as inputs for frequency domain features because encrypted traffic cannot directly access its payload. Its communication behavior can only be analyzed through the packet header information, and the packet length sequence and arrival time interval best reflect the transmission characteristics and communication mode.

[0048] In subsequent discrete wavelet transform processing, insufficient data volume may lead to inaccurate feature extraction or even prevent effective discrete wavelet calculation. To ensure the feasibility and accuracy of extracting traffic frequency domain features through discrete wavelet transform, zero-padding is used to augment data for sequences with fewer than 16 data points in either the packet length sequence or the arrival time interval sequence. This ensures that each session has sufficient data for subsequent frequency domain analysis, which is beneficial to the effectiveness and stability of the subsequent discrete wavelet transform.

[0049] (2) Frequency domain feature extraction

[0050] Discrete wavelet transforms are performed on the packet length sequence and arrival time interval sequence for each session. Compared to discrete Fourier transform, discrete wavelet transform has the capabilities of time-frequency localization and multi-resolution analysis, which can effectively capture the non-stationary characteristics of traffic and accurately locate the time and corresponding frequency features of abnormal behavior. The multi-scale analysis of discrete wavelet transform is suitable for traffic segmentation at the session level, can distinguish traffic patterns at different time scales, and can capture both global features and identify local anomalies in long-term traffic detection. At the same time, discrete wavelet transform is less affected by noise and can output stable frequency domain features.

[0051] Discrete wavelet transform decomposes the input data into an approximation coefficient sequence and a detail coefficient sequence. The approximation coefficients reflect the overall trend and main energy distribution of the original flow, helping to reveal the periodic characteristics and macroscopic structure of the flow. The detail coefficients, on the other hand, capture high-frequency details in the flow, such as sudden events or abnormal activities, effectively detecting minute flow changes and unusual behaviors. In this step, discrete wavelet transform is performed on the packet length sequence and arrival time interval sequence for each session, respectively, to obtain the approximation coefficient sequence and detail coefficient sequence of the packet length sequence after frequency domain analysis, and the approximation coefficient sequence and detail coefficient sequence of the arrival time interval sequence after frequency domain analysis. The approximation coefficient sequence and the detail coefficient sequence are each a series of continuous real numbers, reflecting the characteristics of the input signal at different frequency levels, representing the signal's intensity and variation at that frequency level.

[0052] The formula for the discrete wavelet transform is shown below:

[0053]

[0054] Where a j [k] and d j [k] represents the approximation coefficient sequence and detail coefficient sequence for level j and position k, respectively. j and k are parameters of the discrete wavelet transform. The scaling function φ(t) and the wavelet function ψ(t) are used to calculate the approximation coefficients and detail coefficients, respectively. n This represents the value of the nth element in the sequence. N represents the total number of elements in the sequence. n represents the nth element in the sequence.

[0055] Both the approximation coefficient sequence and the detail coefficient sequence are real number sequences of unequal length and cannot be directly used as frequency domain features of flow. Therefore, to obtain more representative and consistent-length frequency domain features, statistical analysis of the aforementioned approximation coefficient sequence and detail coefficient sequence is required. The lengths of the results after discrete wavelet transform vary depending on the length of the sessions; therefore, the approximation coefficient sequence and detail coefficient sequence cannot be directly used as frequency domain features of flow. To obtain consistent and more representative features, this invention performs statistical analysis on the approximation coefficient sequence and detail coefficient sequence, extracting the corresponding energy, skewness, entropy, mean absolute deviation, standard deviation, variance, mean, and maximum value as frequency domain features to improve the accuracy and robustness of feature representation.

[0056] Energy (E): Energy reflects the overall intensity and information content of traffic, revealing the activity level of the traffic. If the energy is too high or too low, there may be a potential security threat. In addition, energy is not sensitive to noise interference, which helps to more accurately detect malicious traffic.

[0057]

[0058] Skewness: Skewness (S) reflects the symmetry of traffic transmission and the extension of the tail. High positive or negative skewness values ​​may indicate abnormal data flow in the network.

[0059]

[0060] Entropy (H) reflects the complexity and uniformity of traffic flow. A high entropy value indicates that the traffic flow is highly random and may be related to abnormal traffic patterns.

[0061]

[0062] Mean Absolute Deviation (MAD): MAD reflects the dispersion of flow distribution; abnormal flow can cause a sharp increase in MAD value. Furthermore, MAD is unaffected by noise interference, which helps improve the stability of detection.

[0063]

[0064] Standard deviation (SD) reflects the fluctuation and stability of flow rate. A high standard deviation indicates flow rate fluctuations, which may be related to anomalies.

[0065]

[0066] Peak factor (PF): The peak factor reflects the peak intensity of the flow and its dynamic range relative to the overall energy level. A high peak factor may be associated with short-lived, sudden events, which may indicate abnormal activity.

[0067]

[0068] Maximum value: The maximum value (Max) reflects the amplitude of traffic. The maximum value can indicate the occurrence of extreme events, such as sudden traffic spikes, which may be associated with specific network events or malicious behavior.

[0069] Max = max(x[n])

[0070] Average value: The average value reflects the baseline level of traffic. In malicious traffic detection, the average value can be used to identify the normal behavior of data flows, and any activity that deviates significantly from this baseline may indicate abnormal or malicious behavior.

[0071]

[0072] In summary, this invention extracted a total of 32 frequency domain features from the dataset across 8 categories. These are 8 frequency domain features each for the approximate coefficient sequence and detail coefficient sequence generated after the packet length sequence undergoes discrete wavelet transform, and 8 frequency domain features each for the approximate coefficient sequence and detail coefficient sequence generated after the arrival time interval sequence undergoes discrete wavelet transform.

[0073] (3) Model training and testing:

[0074] This invention employs random forest, a machine learning algorithm, as the detection model. Random forests can efficiently process fixed-length structured numerical features, fully exploiting the nonlinear relationships between features and improving classification accuracy. Secondly, random forests possess excellent anti-overfitting ability and robustness, maintaining stable detection performance with limited data volumes and being insensitive to noise and outliers. Furthermore, considering the critical importance of detection speed in cybersecurity—due to the rapid generation of network traffic—if the detection speed cannot keep pace with the traffic capture speed, real-time or near-real-time detection of network threats will be impossible. Random forests offer fast training and inference speeds with lower computational resource requirements, making them suitable for real-time detection in practical cybersecurity environments. Their detection principle is simple, and the model decision-making process is easy to understand, helping researchers better analyze network traffic. The transparent detection process also lends high credibility to this method. In contrast, deep learning models typically require large amounts of data and high-performance computing resources, have complex training processes, and poor model interpretability, making them difficult to meet the real-time and transparency requirements of the cybersecurity field.

[0075] The extracted frequency domain features are subjected to min-max normalization to normalize them to the interval (-1, 1) to ensure that different features are within the same scale range and to avoid affecting the training effect of the model due to differences in feature magnitude. Normalization can make the value range of all features consistent, thereby improving the convergence speed and detection performance of the model. The random forest model is then trained.

[0076] In the malicious traffic detection phase, this invention uses a trained random forest model to analyze network traffic. By inputting normalized frequency domain features, the detection model can identify potential malicious traffic, classify and label it, thereby achieving accurate and robust detection of various attack behaviors.

[0077] (4) Experimental comparison

[0078] 1) Comparative analysis of frequency domain characteristics and traditional statistical characteristics

[0079] To thoroughly compare the superiority of the traditional statistical features extracted by CICFlowMeter with the frequency domain features extracted by this invention, a feature visualization experiment was conducted, and the results are as follows: Figure 2 As shown, frequency domain features achieve significant category separation across multiple network traffic data types, with different types of malicious traffic exhibiting clear regional divisions and boundaries. Although some category boundaries overlap, the overall sample clustering within each category is high, and the inter-class separation effect is good. In contrast, the visualization results of traditional statistical features show lower category separation. Although some categories (such as DDoS / DoS) exhibit some spatial clustering, the overall boundaries between categories are blurred, and the sample distribution of most categories is relatively scattered. This difference highlights the limitations of traditional statistical features in dealing with complex network traffic patterns.

[0080] Therefore, the frequency domain features extracted by this invention can more effectively capture the structure and pattern of network traffic, which not only significantly improves the accuracy and precision of malicious traffic detection, but also shows stronger adaptability and stability when dealing with complex dynamic traffic patterns.

[0081] 2) Frequency domain feature ablation experiment

[0082] To evaluate the importance of the flow frequency domain features extracted by the FREDet method of this invention and the robustness of the detection method, systematic ablation experiments were conducted for different feature types. FREDet extracted eight flow frequency domain features: energy, skewness, entropy, mean absolute deviation, standard deviation, peak factor, maximum value, and average value. First, the importance of different feature types was ranked, and then the most important features were removed sequentially for evaluation. Figure 3As can be seen, removing the energy feature significantly reduces FREDet's detection performance, indicating the crucial role of this feature in detection. Removing the maximum value, standard deviation, mean, and peak factor sequentially results in a slight decrease in FREDet's detection performance, suggesting that while these features contribute less, they still play a role in identifying complex threats. When the skewness and entropy features are removed, FREDet's detection capability is almost completely lost, further demonstrating that these features are essential for maintaining the efficiency and stability of detection.

[0083] In summary, although the impact of various features on detection capabilities differs to varying degrees, each feature plays a positive role in improving detection performance. Furthermore, FREDet maintains high detection performance even when certain key features are missing, demonstrating the robustness of this invention.

[0084] (5) Results Comparison

[0085] This invention conducted experiments on a reclassified dataset, comprehensively evaluating its detection performance using metrics such as accuracy, precision, recall, and F1 score. To fully validate the effectiveness of the proposed method (FREDet), this invention selected five baseline methods for comparative analysis, including one packet-level detection method (DeepPacket) and four stream-level detection methods (Flowprint, FS-NET, ET-BERT, and CICML).

[0086] 1) Fine-grained attack category detection

[0087] First, this invention conducted fine-grained attack category detection experiments on the reclassified and reorganized dataset, aiming to accurately identify different types of malicious and normal traffic from the original traffic. Table 2 shows the performance comparison of FREDet and baseline methods in fine-grained detection. FREDet demonstrates superior performance in fine-grained attack category detection, achieving an accuracy of 98.63% and an F1 score of 97.04%, significantly outperforming all other baseline methods. This indicates that the frequency domain features extracted by this invention are highly representative. In particular, in the comparison with CICML, using the same random forest classifier and consistent experimental settings, the results show that FREDet's detection performance is more outstanding. This further demonstrates that the frequency domain features extracted by FREDet can more effectively capture the essential characteristics of network traffic, and compared with traditional statistical features, frequency domain features have a significant advantage in improving detection accuracy.

[0088] Table 2

[0089]

[0090] 2) Detection of known attack subcategories

[0091] Based on the detection of the main attack categories, this invention further conducted sub-category detection experiments for known attack types, aiming to identify specific attack methods or techniques. Table 3 shows the performance comparison between FREDet and baseline methods in sub-category detection. FREDet demonstrated excellent performance in detecting all types of attacks, especially achieving 100% accuracy in BruteForce and Recon attacks. Furthermore, FREDet achieved accuracy rates exceeding 99.93% and F1 scores exceeding 98.86% across all attack categories, significantly outperforming other baseline methods. This further demonstrates the significant advantages of frequency domain features in malicious traffic detection.

[0092]

[0093] This invention also provides a flow detection device, the structure of which is as follows: Figure 4 As shown, it is used to implement the above method.

[0094] The above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them. Those skilled in the art can modify or make equivalent substitutions to the technical solutions of the present invention without departing from the spirit and scope of the present invention. The scope of protection of the present invention should be determined by the claims.

Claims

1. A method for training a traffic detection model, comprising the following steps: Acquire traffic datasets and segment sessions; Extract packet length sequences and arrival time interval sequences from each session; the packet length sequence includes packet length information of data packets in the session, and the arrival time interval sequence includes the difference in arrival time of adjacent data packets in the session; Discrete wavelet transform is performed on the packet length sequence and the arrival time interval sequence respectively to obtain the approximate coefficient sequence and detail coefficient sequence of each sequence; the formula for discrete wavelet transform is as follows: Among them, a j [k] and d j [k] represents the approximate coefficient sequence and detail coefficient sequence for level j and position k, respectively, where j and k are parameters of the discrete wavelet transform, φ(·) is the scaling function, ψ(·) is the wavelet function, and l n Let N be the nth data point in the input sequence, and N be the total number of data points in the input sequence. Statistical calculations were performed on the approximation coefficient sequences and detail coefficient sequences of each sequence, and the corresponding energy, skewness, entropy, mean absolute deviation, standard deviation, peak factor, average value, and maximum value were extracted as eight types of frequency domain features of the flow rate. Specifically, these include eight frequency domain features of the approximation coefficient sequence generated by the packet length sequence after discrete wavelet transform, eight frequency domain features of the detail coefficient sequence generated by the packet length sequence after discrete wavelet transform, eight frequency domain features of the approximation coefficient sequence generated by the arrival time interval sequence after discrete wavelet transform, and eight frequency domain features of the detail coefficient sequence generated by the arrival time interval sequence after discrete wavelet transform, for a total of 32 frequency domain features. The frequency domain features are input into the random forest model for training to obtain a trained traffic detection model.

2. The method according to claim 1, characterized in that, The traffic dataset includes a malicious traffic dataset.

3. The method according to claim 1 or 2, characterized in that, The method for session segmentation is to parse the source IP, destination IP, source port, destination port, and protocol fields of each data packet, and combine these fields to form a unique session identifier; data packets with the same source IP, destination IP, source port, destination port, and protocol are grouped into the same session.

4. The method according to claim 1 or 2, characterized in that, The performance of the model is evaluated using one or more evaluation metrics, including accuracy, precision, recall, and F1 score.

5. The method according to claim 1 or 2, characterized in that, Zero-padding is performed on sequences where the number of elements in the packet length sequence and the arrival time interval sequence is less than a set number.

6. The method according to claim 1 or 2, characterized in that, The frequency domain features are normalized before being input.

7. A flow rate detection method, characterized in that, The flow to be detected is input into the flow detection model obtained by any one of the methods described in claims 1-6 and then detected.

8. An electronic device comprising a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the method of any one of claims 1-7.

9. A storage medium storing a computer program, which, when executed by a computer, implements the method of any one of claims 1-7.

10. A flow detection model training device, comprising: The data acquisition module is used to acquire traffic datasets and segment sessions; Data processing module, including A session processing module is used to divide the traffic dataset into sessions and extract packet length sequences and arrival time interval sequences from each session; the packet length sequence includes packet length information of data packets in the session, and the arrival time interval sequence includes the difference in arrival time of adjacent data packets in the session; The discrete wavelet transform module is used to perform discrete wavelet transform on the packet length sequence and the arrival time interval sequence respectively, to obtain the approximate coefficient sequence and the detail coefficient sequence of each sequence; the formula for discrete wavelet transform is as follows: Among them, a j [k] and d j [k] represents the approximate coefficient sequence and detail coefficient sequence for level j and position k, respectively, where j and k are parameters of the discrete wavelet transform, φ(·) is the scaling function, ψ(·) is the wavelet function, and l n Let N be the nth data point in the input sequence, and N be the total number of data points in the input sequence. The frequency domain feature extraction module is used to perform statistical calculations on the approximation coefficient sequence and detail coefficient sequence of each sequence, and extract the corresponding energy, skewness, entropy, mean absolute deviation, standard deviation, peak factor, average value and maximum value as eight types of frequency domain features of the flow rate. Specifically, these include eight frequency domain features of the approximation coefficient sequence generated after the packet length sequence is transformed by discrete wavelet transform, eight frequency domain features of the detail coefficient sequence generated after the packet length sequence is transformed by discrete wavelet transform, eight frequency domain features of the approximation coefficient sequence generated after the arrival time interval sequence is transformed by discrete wavelet transform, and eight frequency domain features of the detail coefficient sequence generated after the arrival time interval sequence is transformed by discrete wavelet transform, for a total of 32 frequency domain features. The training module is used to input the frequency domain features into the random forest model for training to obtain a trained traffic detection model.

11. The apparatus according to claim 10, characterized in that, The traffic dataset includes a malicious traffic dataset.

12. The apparatus according to claim 10, characterized in that, The session processing module parses the source IP, destination IP, source port, destination port, and protocol fields of each data packet and combines these fields to form a unique session identifier; data packets with the same source IP, destination IP, source port, destination port, and protocol are grouped into the same session.

13. The apparatus according to claim 10, characterized in that, It also includes an evaluation module, which uses one or more evaluation metrics to evaluate the performance of the model, including accuracy, precision, recall, and F1 score.

14. The apparatus according to claim 10, characterized in that, The session processing module zero-padding is performed on sequences where the number of elements in the packet length sequence and the arrival time interval sequence is less than a set number.

15. The apparatus according to claim 10, characterized in that, The frequency domain feature extraction module performs normalization processing before inputting the frequency domain features into the training module.

16. A flow detection device, comprising an input module for receiving the flow to be detected and inputting it into a flow detection model obtained by the training device according to claim 10; and an output module for receiving and outputting the detection result of the flow detection model.

Images