Classification model training method, traffic data classification method and device

Abstract

The present application discloses a classification model training method, a flow data classification method and equipment, and belongs to the field of network security technology. The method includes: filtering the sample flow data through a network model to obtain a first sample feature for characterizing the first sample data, the first sample data is the data remaining after removing redundant data from the sample flow data; encoding the first sample feature through a network model to obtain a second sample feature for characterizing the second sample data, the second sample data is the data in the first sample data related to the traffic category to which it belongs; classifying the second sample feature through a network model to obtain a predicted classification result; training the network model according to the predicted classification result and the labeled classification result to obtain a classification model. By filtering the sample flow data through features, the characterization capability of the first sample feature is improved, thereby improving the accuracy of the classification model.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network security technology, and in particular to a classification model training method, a flow data classification method and a device. Background Art

[0002] In the field of network security technology, detecting abnormal traffic is an important means of identifying network attacks. For example, a classification model for traffic data is pre-trained, and the traffic data is classified by the classification model to obtain a classification result that characterizes whether the traffic data is abnormal, so that abnormal traffic can be detected based on the classification result. Based on this, how to train the classification model has become an urgent problem to be solved. Summary of the invention

[0003] The present application provides a classification model training method, a traffic data classification method and a device, which can be used to solve the problems in the related technology. The technical solution includes the following contents.

[0004] In a first aspect, a method for training a classification model is provided, the method comprising:

[0005] Acquire sample traffic data and a labeled classification result, wherein the labeled classification result represents the traffic category to which the sample traffic data belongs;

[0006] Performing feature filtering on the sample traffic data through a network model to obtain a first sample feature for characterizing first sample data, where the first sample data is data remaining after redundant data is removed from the sample traffic data;

[0007] Encoding the first sample feature through the network model to obtain a second sample feature for characterizing second sample data, where the second sample data is data in the first sample data related to the traffic category to which it belongs;

[0008] Classifying the second sample feature by using the network model to obtain a prediction classification result, wherein the prediction classification result represents the possibility that the sample traffic data belongs to a traffic category;

[0009] The network model is trained according to the predicted classification result and the labeled classification result to obtain a classification model, and the classification model is used to classify the target traffic data.

[0010] In a second aspect, a method for classifying flow data is provided, wherein the method comprises:

[0011] Obtain target traffic data and a classification model, wherein the classification model is trained according to the method of the first aspect;

[0012] Performing feature filtering on the target flow data by using the classification model to obtain a first target feature for characterizing first target data, where the first target data is data remaining after removing redundant data from the target flow data;

[0013] Encoding the first target feature by using the classification model to obtain a second target feature for characterizing second target data, where the second target data is data in the first target data that is related to the traffic category to which it belongs;

[0014] The second target feature is classified by the classification model to obtain a target classification result, wherein the target classification result represents the possibility that the target traffic data belongs to multiple traffic categories.

[0015] In a third aspect, a training device for a classification model is provided, the device comprising:

[0016] An acquisition module, used to acquire sample traffic data and annotate classification results, wherein the annotate classification results represent the traffic category to which the sample traffic data belongs;

[0017] A filtering module, used for performing feature filtering on the sample flow data through a network model to obtain a first sample feature for characterizing first sample data, where the first sample data is data remaining after redundant data is removed from the sample flow data;

[0018] an encoding module, used for encoding the first sample feature through the network model to obtain a second sample feature for characterizing second sample data, where the second sample data is data in the first sample data related to the traffic category to which it belongs;

[0019] A classification module, used to classify the second sample feature through the network model to obtain a prediction classification result, wherein the prediction classification result represents the possibility that the sample flow data belongs to a flow category;

[0020] A training module is used to train the network model according to the predicted classification result and the labeled classification result to obtain a classification model, and the classification model is used to classify the target traffic data.

[0021] In a fourth aspect, a flow data classification device is provided, the device comprising:

[0022] An acquisition module, used to acquire target traffic data and a classification model, wherein the classification model is trained according to the method of the first aspect;

[0023] A filtering module, used for performing feature filtering on the target flow data through the classification model to obtain a first target feature for characterizing first target data, where the first target data is data remaining after redundant data is removed from the target flow data;

[0024] an encoding module, configured to encode the first target feature by using the classification model to obtain a second target feature for characterizing second target data, where the second target data is data in the first target data that is related to the traffic category to which it belongs;

[0025] A classification module is used to classify the second target feature through the classification model to obtain a target classification result, wherein the target classification result represents the possibility that the target traffic data belongs to multiple traffic categories.

[0026] In a fifth aspect, an electronic device is provided, comprising a processor and a memory, wherein the memory stores at least one computer program, and the at least one computer program is loaded and executed by the processor so that the electronic device implements the method described in the first aspect or the second aspect above.

[0027] In the sixth aspect, a computer-readable storage medium is also provided, wherein at least one computer program is stored in the computer-readable storage medium, and the at least one computer program is loaded and executed by a processor to enable the electronic device to implement the method described in the first aspect or the second aspect above.

[0028] In the seventh aspect, a computer program is also provided, wherein the computer program is at least one, and the at least one computer program is loaded and executed by a processor to enable the electronic device to implement the method described in the first aspect or the second aspect above.

[0029] In an eighth aspect, a computer program product is also provided, wherein at least one computer program is stored in the computer program product, and the at least one computer program is loaded and executed by a processor so that the electronic device implements the method described in the first aspect or the second aspect above.

[0030] The technical solution provided by this application brings at least the following beneficial effects:

[0031] In the technical solution provided by the present application, by filtering the sample flow data by features, redundant data is removed from the sample flow data, and valid first sample data is retained, thereby improving the accuracy and characterization capability of the first sample features. Subsequently, by encoding the first sample features and classifying the encoded second sample features, a prediction classification result with high accuracy can be obtained, so that a classification model with high accuracy can be trained based on the prediction classification result, so that the target flow data can be accurately classified through the classification model, thereby improving the accuracy of the classification result. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0033] Figure 1 is a schematic diagram of a computer system provided in an embodiment of the present application;

[0034] Figure 2 It is a flow chart of a classification model training method provided in an embodiment of the present application;

[0035] Figure 3 It is a training framework diagram of a generation model provided in an embodiment of the present application;

[0036] Figure 4 This is a schematic diagram of selecting a sub-data set provided in an embodiment of the present application;

[0037] Figure 5 is a schematic diagram of selecting another sub-data set provided in an embodiment of the present application;

[0038] Figure 6 is a schematic diagram of different evaluation indicators provided in an embodiment of the present application;

[0039] Figure 7 This is a schematic diagram of the relationship between the amount of sub-data and model performance provided in an embodiment of the present application;

[0040] Figure 8 is a schematic diagram of the structure of a first network provided in an embodiment of the present application;

[0041] Fig. 9 It is a schematic diagram for determining a predicted classification result provided in an embodiment of the present application;

[0042] Fig.10 is a flow chart of a method for classifying flow data provided by an embodiment of the present application;

[0043] Fig.11 It is a structural schematic diagram of a training device for a classification model provided in an embodiment of the present application;

[0044] Fig.12 It is a structural schematic diagram of a flow data classification device provided in an embodiment of the present application;

[0045] Fig.13 It is a structural diagram of a terminal device provided in an embodiment of the present application;

[0046] Fig.14 It is a structural diagram of a server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0048] It should be noted that the terms "first", "second", etc. in this application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. On the contrary, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0049] like Figure 1 As shown, Figure 1 1 is a schematic diagram of a computer system provided in an embodiment of the present application, and the computer system includes: a terminal device 101 and a server 102. Among them, a client is installed and running in the terminal device 101, and the server 102 is used to provide background services for the client. The target object 103 can use the terminal device 101 to achieve instant communication, transmission of traffic data, transmission of classification results, etc. through the interaction between the client and the server 102. The training method of the classification model provided in the embodiment of the present application can be executed by the terminal device 101, or by the server 102, or by the terminal device 101 and the server 102 together, and the embodiment of the present application does not limit this.

[0050] In a possible implementation, the server 102 undertakes the main computing work, and the terminal device 101 undertakes the secondary computing work. Alternatively, the server 102 undertakes the secondary computing work, and the terminal device 101 undertakes the main computing work. Alternatively, the terminal device 101 and the server 102 use a distributed computing architecture to perform collaborative computing.

[0051] Optionally, the terminal device 101 may be any electronic device product that can perform human-computer interaction with a user through one or more methods such as a keyboard, a touchpad, a remote controller, voice interaction, or a handwriting device. For example, the terminal device 101 may be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, a PC (Personal Computer), a mobile phone, a PDA (Personal Digital Assistant), a wearable device, a PPC (Pocket PC), a smart car machine, a smart TV, etc.

[0052] The terminal device 101 may generally refer to one of a plurality of terminal devices, and this embodiment is only illustrated by taking the terminal device 101 as an example. Those skilled in the art may know that the number of the terminal devices 101 may be more or less. For example, the terminal device 101 may be only one, or the terminal devices 101 may be dozens or hundreds, or more. The embodiment of the present application does not limit the number and device type of the terminal devices 101.

[0053] The server 102 is a single server, or a server cluster consisting of multiple servers, or any one of a cloud computing platform and a virtualization center, which is not limited in the embodiments of the present application. The server 102 is directly or indirectly connected to the terminal device 101 by means of a wired network or a wireless network. The server 102 has a data receiving function, a data processing function, and a data sending function. Of course, the server 102 may also have other functions, which are not limited in the embodiments of the present application.

[0054] Those skilled in the art should understand that the above-mentioned terminal device 101 and server 102 are only for illustration, and other existing or future terminal devices or servers, if applicable to the present application, should also be included in the scope of protection of the present application and are included here by reference.

[0055] The present application embodiment provides a classification model training method, which can be applied to the above-mentioned computer system. The method of the present application embodiment is executed by the terminal device 101 and / or the server 102. For the convenience of description, the terminal device 101 and the server 102 are collectively referred to as electronic devices, that is, the method of the present application embodiment is executed by the electronic device. Figure 2 As shown, the method includes the following steps.

[0056] Step 201, obtain sample traffic data and annotated classification results, where the annotated classification results represent the traffic category to which the sample traffic data belongs.

[0057] Electronic devices can obtain multiple sample traffic data, which are traffic data used to train network models. Traffic data is data generated during the process of accessing the network, including data packets transmitted in the network. Data packets include data and control information to be transmitted. Traffic data flows between different devices and different applications, and is used to provide an analysis basis for network performance analysis, structural optimization, security supervision, etc., and plays a very important role in network performance, availability, and security.

[0058] The electronic device can also obtain the labeled classification results of each sample flow data, and the labeled classification results of the sample flow data are used to characterize the flow category to which the sample flow data belongs. The embodiment of the present application does not limit the flow category. For example, the flow category includes normal flow data and abnormal flow data. Normal flow data is data generated when a user accesses the network, corresponds to legal network behavior, and does not involve any malicious behavior. For example, data generated during the process of a user sending or receiving an email (Email), a user performing instant messaging through the network, and a user obtaining media data from a database through a server are normal flow data. Abnormal flow data is data generated by a network attack, and the type of network attack is not limited here. For example, data generated by a Trojan virus, a botnet, malware, etc. is abnormal flow data. Optionally, different flow categories correspond to different values. For example, normal flow data corresponds to a first value (such as 1), and abnormal flow data corresponds to a second value (such as 0). The first value indicates that the sample flow data belongs to a normal flow category, and the second value indicates that the sample flow data belongs to an abnormal flow category.

[0059] The embodiments of the present application do not limit the method for obtaining sample traffic data and annotated classification results. For example, the electronic device can obtain a traffic data set from the network, and the traffic data set includes normal traffic data and abnormal traffic data, and determine the sample traffic data and annotated classification results based on the traffic data set. Alternatively, the electronic device can obtain normal traffic data by simulating the user's network behavior, thereby obtaining sample traffic data and annotated classification results. Alternatively, the electronic device can obtain sample traffic data according to implementation method A or B as shown below. The following two implementation methods are described in turn.

[0060] In implementation A, the sample traffic data includes first traffic data, second traffic data, and third traffic data. The acquisition of sample traffic data in step 201 includes: acquiring the first traffic data and the second traffic data, the first traffic data is data generated by a user accessing the network, and the second traffic data is data generated by a network attack; encoding the second traffic data to obtain a first traffic feature; sampling the first traffic feature to obtain a second traffic feature; and generating the third traffic data according to the second traffic feature.

[0061] The electronic device can obtain the first traffic data and the second traffic data by obtaining the traffic data set, simulating the user's network behavior, etc. The first traffic data is normal traffic data, and the second traffic data is abnormal traffic data. For example, the electronic device can obtain a certain traffic data set from the network, in which a certain abnormal traffic data in the traffic data set is less than 0.005‰ of a certain normal traffic data. Since the proportion of normal traffic data is too high, if the traffic data set is used directly to train the network model, it will affect the learning effect of the model, resulting in the model's weak ability to detect abnormal traffic data. Based on this, it is necessary to increase the amount of abnormal traffic data to improve the performance of the classification model.

[0062] In this example, the second flow data can be encoded to obtain the first flow feature, and the first flow feature is used to characterize the second flow data. The encoding method is not limited here. For example, the second flow data can be encoded using an encoding function. Then, the first flow feature is randomly sampled or sampled at fixed intervals to obtain the second flow feature, and the second flow feature is used to characterize part of the data in the second flow data. Afterwards, the third flow data is generated according to the second flow feature. The generation method is not limited here. For example, the second flow feature can be interpolated, and the interpolated feature can be mapped into the third flow data through a decoding function.

[0063] Optionally, the first traffic feature is obtained by encoding the second traffic data through a target encoder, and the third traffic data is generated by a target generator according to the second traffic feature. The method of the embodiment of the present application also includes: encoding the training data through an initial encoder to obtain a first data feature, the training data is data generated by a network attack; decoding the first data feature to obtain first reconstructed data; sampling the first data feature to obtain a second data feature; generating second reconstructed data according to the second data feature through an initial generator; obtaining a first discrimination result and a second discrimination result, the first discrimination result characterizing the possibility that the first reconstructed data is generated data, and the second discrimination result characterizing the possibility that the second reconstructed data is generated data; training the initial encoder and the initial generator according to the first discrimination result and the second discrimination result to obtain a target encoder and a target generator.

[0064] The electronic device can obtain a trained generation model, which includes a target encoder and a target generator, input the second flow data into the generation model, encode the second flow data through the target encoder, obtain the first flow feature, and generate the third flow data through the target generator according to the second flow feature obtained by sampling the first flow feature. Among them, the target encoder is obtained by training the initial encoder, and the structures and encoding principles of the two are similar, with only the difference in parameters. Similarly, the target generator is obtained by training the initial generator, and the structures and generation principles of the two are similar, with only the difference in parameters.

[0065] In this example, the electronic device can filter out training data from the traffic data set, where the training data is abnormal traffic data. The training data is input into the initial encoder, and the initial encoder is used to encode the training data to obtain a first data feature, so as to characterize the training data by the first data feature. Figure 3 As shown, the initial encoder is an encoder module in a variational auto-encoder (VAE), which is used to extract features of training data, determine the mean and variance based on the features, determine the normal distribution satisfied by the training data based on the mean and variance, and obtain the first data feature based on normal distribution sampling.

[0066] like Figure 3 As shown, the first data feature can be input into a decoder, and the first reconstructed data can be obtained by decoding the decoder. Optionally, the decoder is a decoding module in the VAE, which can restore the training data according to the first data feature to obtain the first reconstructed data.

[0067] In addition, if Figure 3 As shown, the first data feature can be randomly sampled or sampled at fixed intervals to obtain a second data feature. The second data feature is input into the initial generator, and the second reconstructed data is generated by the initial generator. Optionally, the initial generator is a generator in a conditional generative adversarial network (CGAN) or an optimized network of CGAN (e.g., CWGAN). The initial generator includes at least one network layer of a fully connected layer, a normalization layer, a deconvolution layer, etc., which is used to restore the training data according to the second data feature to obtain the second reconstructed data.

[0068] like Figure 3As shown, the first reconstructed data can be input into the discriminator, and the first discrimination result is determined by the discriminator. Optionally, the discriminator is a discriminator in a CGAN or an optimized network of CGAN, and the possibility of the first reconstructed data being real data and / or non-real data can be determined based on the first reconstructed data. In this example, the data generated by the neural network is referred to as non-real data, and the data collected through the Internet or obtained by simulating the user's network behavior, that is, data not generated by the neural network, is referred to as real data. Based on this, the first discrimination result includes the possibility that the first reconstructed data is real data or non-real data. Similarly, the second reconstructed data can be input into the discriminator, and the second discrimination result is determined by the discriminator, and the second discrimination result includes the possibility that the second reconstructed data is real data or non-real data. The first discrimination result and the second discrimination result are used to determine the loss value, and the initial encoder and the initial generator are trained once by the loss value.

[0069] In practical applications, such as Figure 3 As shown, the training data can also be input into the discriminator, and the third discrimination result is determined by the discriminator, and the third discrimination result includes the possibility that the training data is real data or non-real data. The loss value is determined according to the first discrimination result, the second discrimination result and the third discrimination result, and the initial encoder and the initial generator are trained once by the loss value. It should be noted that the initial encoder and the initial generator can be trained multiple times according to the above principle, and the trained initial encoder is the target encoder, and the trained initial generator is the target generator, so as to generate the third flow data according to the second flow data through the target encoder and the target generator.

[0070] By implementing method A, the abnormal traffic data can be expanded so that the normal traffic data and the abnormal traffic data can maintain a relative balance in quantity to improve the training effect of the classification model. Optionally, as shown in Table 1 below, in the sample traffic data determined by implementation method A in the embodiment of the present application, the normal traffic data and the abnormal traffic data are relatively close in quantity.

[0071] Table 1

[0072] Normal traffic data name quantity The name of the abnormal traffic data quantity FTP 101037 Virut 22811 MySQL 86089 Shifu 9584 Weibo 39950 Tinba 8504 SMB 38937 Neris 8224 Gmail 8629 Cridex 8189 WorldOfWarcraft 7883 Nsis-ay 6069 Outlook 7524 Geodo 6040 BitTorrent 7517 Zeus 5587 Skype 6321 Miuref 4900 Facetime 6000 Htbot 4672

[0073] In implementation method B, obtaining sample traffic data in step 201 includes: obtaining source traffic data, the source traffic data includes multiple first sub-data; obtaining importance indicators of the multiple first sub-data, the importance indicators represent the importance of any first sub-data; selecting multiple second sub-data from the multiple first sub-data according to the importance indicators of the multiple first sub-data; and determining the sample traffic data according to the multiple second sub-data.

[0074] In the embodiment of the present application, the source flow data includes but is not limited to the first flow data, the second flow data and the third flow data mentioned above. In general, the source flow data can be divided to obtain a plurality of first sub-data. Optionally, the source flow data can be divided according to the Transmission Control Protocol (TCP) connection, flow, session, service and host, etc. Different division criteria will result in different flow units.

[0075] Exemplarily, traffic is defined as a five-tuple, including a source Internet Protocol Address (IP address), a source port, a destination IP address, a destination port, and a transport-level protocol. According to a session, it is defined as traffic in two directions. By dividing the source traffic data according to traffic and session, 78 first sub-data can be obtained, which include the number of bytes, the number of packets, the average packet size, the maximum length of the packet, the minimum length of the packet, etc. transmitted from the source IP address to the destination IP address, the number of bytes, the number of packets, the average packet size, the maximum length of the packet, the minimum length of the packet, etc. transmitted from the destination IP address to the source IP address, the transmission start time, the transmission duration, etc. For example, the source traffic data includes the data shown in Table 2 below.

[0076] Table 2

[0077]

[0078] Since the amount of the first sub-data is large and there is redundant data, which affects the training effect of the classification model, the first sub-data can be screened to screen out valid data and improve the accuracy of the sample flow data, thereby improving the training effect of the classification model. Optionally, the electronic device can obtain the importance index of each first sub-data, and the importance index represents the importance of the first sub-data. For example, the larger the importance index, the more important the first sub-data. Among them, the method of obtaining the importance index is not limited here. For example, the importance index of the first sub-data can be determined by any evaluation method such as random forest and chi-square verification.

[0079] Optionally, obtaining importance indicators of multiple first sub-data includes: for any first sub-data, determining multiple evaluation indicators of any first sub-data according to multiple evaluation methods, one evaluation indicator represents the importance of any first sub-data determined according to one evaluation method; determining the importance indicator of any first sub-data according to the multiple evaluation indicators of any first sub-data.

[0080] The present application embodiment does not limit the evaluation method. Exemplarily, the evaluation method includes at least one of the following: Pearson Correlation Coefficient, Chi-squared Test, Mutual Information, Random Forest, Extra Trees, eXtreme Gradient Boosting (XGBoost), Genetic Algorithm, etc. Among them, the Pearson correlation coefficient is an evaluation method for measuring the relationship between two variables, which can determine the correlation coefficient pcc i , pcc i Characterizes the relationship between the first sub-data of the ith element and the traffic category to which the source traffic data belongs. Chi-square validation is an evaluation method used to compare the difference between the actual frequency and the theoretical frequency, which can determine the statistic chi2 i , chi2 i Characterizes the difference between the actual frequency and theoretical frequency of the first sub-data of the i-th variable. Mutual information is an evaluation method used to measure the correlation between two variables. The mutual information result mi can be determined. i , mi i Characterizes the mutual information result between the i-th first sub-data and other first sub-data. Random forest is a supervised machine learning algorithm based on ensemble learning, which can determine the prediction result rf i , rf i Characterizes the importance of the i-th first sub-data. Extreme random tree is an ensemble learning algorithm similar to random forest, which can determine the prediction result et i , et i Characterizes the importance of the i-th first sub-data. Extreme gradient boosting is an ensemble learning algorithm based on gradient boosting decision trees, which can determine the prediction result xgb i ,xgb i Characterizes the importance of the first child data of the i-th. Genetic algorithm is an optimization search algorithm that simulates the principles of natural selection and genetics, which can determine the search result ga i , ga i Characterizes the importance of the i-th first sub-data.

[0081] Based on the above, if Figure 4 and Figure 5As shown, for a first sub-data set including multiple first sub-data, multiple evaluation indicators for each first sub-data can be determined according to multiple evaluation methods. These evaluation methods include at least one of Pearson correlation coefficient, chi-square validation, mutual information, random forest, extreme random tree, extreme gradient boosting, genetic algorithm, etc., and the corresponding evaluation indicators include correlation coefficient pcc i , statistic chi2 i , mutual information result mi i 、Prediction result rf i , prediction resultset i 、Prediction result xgb i 、Search resultsga i At least one of the above. A voting mechanism may be used to determine whether the first sub-dataset belongs to an optimal sub-dataset, where the optimal sub-dataset includes a plurality of second sub-datasets. Based on this, the optimal sub-dataset is also referred to as a second sub-dataset.

[0082] Optionally, due to the characteristics of different evaluation methods, different evaluation indicators determined using different evaluation methods for the same first sub-data may differ. Figure 6 As shown, Figure 6 (1) to (7) in FIG. 1 show evaluation indicators obtained by evaluating a plurality of first sub-data using seven evaluation methods, wherein the horizontal axis represents the numerical value of the evaluation indicator and the vertical axis represents the first sub-data. Figure 6 It can be seen that for the same first sub-data, different evaluation methods determine different evaluation indicators. Based on this, Figure 5 As shown, multiple evaluation indicators of any first sub-data can be weighted to obtain the importance indicator sort (m i ). According to the importance index of each first sub-data, a second sub-data set is selected from the first sub-data set. The selection method is not limited here. For example, according to the importance index of each first sub-data, each first sub-data is sorted in the order of decreasing importance, and the first several first sub-data are selected to obtain the second sub-data set. For example, n (n is a positive integer) second sub-data sets {D1, D2, ..., D n}, where D1 contains the first 10 sub-data in the sorting, D2 contains the first 20 sub-data in the sorting, and so on. n The sample flow data includes the first 10×n first sub-data in the sorting order. The sample flow data includes each second sub-data in any second sub-data set.

[0083] It is understandable that the number of second sub-data in the sample traffic data will affect the training effect of the classification model. Figure 7 As shown, Figure 7(1) to (4) in FIG. 4 show the relationship between the number of sub-data of the second sub-data in the sample traffic data and the accuracy, precision, recall rate, and F1 score of the classification model. Figure 7 It can be seen that when the number of second sub-data is not less than 30, the accuracy, precision, recall rate and F1 score of the classification model are all maintained at a relatively high level. When the number of second sub-data is 60, the performance of the classification model is the highest, and the accuracy rate can reach 98.71%. Based on this, it can be seen that the number of second sub-data in the sample traffic data is not less than 30. Optionally, the sample traffic data includes 60 second sub-data.

[0084] Step 202 , feature filtering is performed on the sample traffic data through a network model to obtain a first sample feature for characterizing first sample data, where the first sample data is the data remaining after redundant data is removed from the sample traffic data.

[0085] The electronic device can obtain a network model, which is a pre-trained model that has the ability to classify traffic data. The method for obtaining the network model is not limited here. For example, the electronic device can obtain a pre-trained network model through the Internet, or the electronic device can build an initial model and pre-train the initial model to obtain the network model. The structure and size of the network model are not limited here. Exemplarily, the network model includes a convolutional network, a visual converter (Visio n Transform r , ViT), residual network, etc.

[0086] The network model includes a first network, and the first network has the function of performing feature filtering on traffic data. In this example, the sample traffic data can be input into the first network, and feature filtering can be performed through the first network to filter out the features of redundant data, retain the features of the first sample data, and improve the accuracy and characterization ability of the first sample features, thereby improving the training effect of the model. Among them, redundant data includes data in the sample traffic data that is irrelevant to the traffic category to which it belongs, repeated data, etc. The embodiment of the present application does not limit the structure and size of the first network.

[0087] In a possible implementation, the network model (the first network in) includes multiple feature filtering sub-networks, a concatenation layer and a first pooling layer in parallel; step 202 includes steps 2021 to 2023 (not shown in the figure).

[0088] Step 2021: For any feature filtering sub-network, feature filtering is performed on the sample traffic data through any feature filtering sub-network to obtain a sub-feature for characterizing the first sample data.

[0089] The sample flow data can be input into each feature filtering subnetwork. Since each feature filtering subnetwork is connected in parallel, each feature filtering subnetwork can independently perform feature filtering on the sample flow data to obtain sub-features. Among them, each feature filtering subnetwork performs feature filtering at different scales. By performing feature filtering at different scales through each feature filtering subnetwork, the filtering effect can be improved, and sub-features at different levels can be captured, so that the first sample feature with higher accuracy can be determined based on each sub-feature, thereby improving the training effect of the model.

[0090] In an exemplary embodiment, any feature filtering subnetwork includes a convolution layer and a second pooling layer; step 2021 includes: performing convolution processing on the sample flow data through the convolution layer to obtain a convolution result, performing pooling processing on the convolution result through the second pooling layer to obtain a pooling result, and determining the sub-feature according to the pooling result; or, performing pooling processing on the sample flow data through the second pooling layer to obtain a pooling result, performing convolution processing on the pooling result through the convolution layer to obtain a convolution result, and determining the sub-feature according to the convolution result.

[0091] It should be noted that there is at least one convolution layer and at least one second pooling layer. Any convolution layer can be connected to another convolution layer or a second pooling layer. A second pooling layer can be connected to another second pooling layer or a convolution layer. The scale of any convolution layer for convolution processing of features and the scale of any second pooling layer for pooling processing of features are not limited here. For example, the convolution layer can be a one-dimensional convolution layer such as 1×1, 1×3, 1×25, and the scale of the second pooling layer can be 1×3, 1×5, etc. The second pooling layer is used to remove redundant data.

[0092] Alternatively, if Figure 8As shown, the network in the dotted box is a feature filtering subnetwork. That is, the first network includes four feature filtering subnetworks in parallel. Among them, the first feature filtering subnetwork includes a 1×1 convolution layer and a 1×3 maximum pooling layer, the sample flow data is input into the first feature filtering subnetwork, the sample flow data is convolved by the 1×1 convolution layer to obtain a convolution result, the convolution result is pooled by the 1×3 maximum pooling layer to obtain a pooling result, and the pooling result is the sub-feature output by the first feature filtering subnetwork. The second feature filtering subnetwork includes a 1×1 convolution layer, a 1×25 convolution layer, and a 1×3 maximum pooling layer, the sample flow data is input into the second feature filtering subnetwork, the sample flow data is convolved by the 1×1 convolution layer to obtain a convolution result, the convolution result is convolved again by the 1×25 convolution layer to obtain a convolution result, the convolution result is pooled by the 1×3 maximum pooling layer to obtain a pooling result, and the pooling result is the sub-feature output by the second feature filtering subnetwork. The third feature filtering subnetwork includes a 1×1 convolution layer, a 1×35 convolution layer, and a 1×3 maximum pooling layer. The sample flow data is input into the third feature filtering subnetwork, and the sample flow data is convolved by the 1×1 convolution layer to obtain a convolution result. The convolution result is convolved again by the 1×35 convolution layer to obtain a convolution result. The convolution result is pooled by the 1×3 maximum pooling layer to obtain a pooling result. The pooling result is the sub-feature output by the third feature filtering subnetwork. The fourth feature filtering subnetwork includes a 1×3 maximum pooling layer, a 1×1 convolution layer, and a 1×3 maximum pooling layer. The sample flow data is input into the fourth feature filtering subnetwork, and the sample flow data is pooled by the 1×3 maximum pooling layer to obtain a pooling result. The pooling result is convolved by the 1×1 convolution layer to obtain a convolution result. The convolution result is pooled by the 1×3 maximum pooling layer to obtain a pooling result. The pooling result is the sub-feature output by the fourth feature filtering subnetwork.

[0093] Step 2022, multiple sub-features are spliced ​​through the splicing layer to obtain a splicing feature.

[0094] That is, you can splice one sub-feature after another, and in this way, multiple sub-features can be spliced ​​into a spliced ​​feature. Figure 8 As shown, the sub-features output from the first feature filtering sub-network to the fourth feature filtering sub-network are spliced ​​through the splicing layer to obtain the splicing features.

[0095] Step 2023, pooling the concatenated features through a first pooling layer to obtain a first sample feature.

[0096] The embodiment of the present application does not limit the scale of the second pooling layer. For example, the scale of the first pooling layer may be 1×3, 1×5, etc., to remove redundant data. Figure 8 As shown, the concatenated features are pooled through a 1×3 maximum pooling layer to obtain the first sample feature.

[0097] By filtering features of different dimensions on sample traffic data through multiple feature filtering sub-networks, it is possible to better capture sub-features of different levels in sequence data on the theoretical basis that sample traffic data is sequence data. The first sample feature is determined based on sub-features of different levels, which further filters the features of redundant data and improves the accuracy of the first sample feature. The first sample feature includes sub-features of multiple dimensions, which makes the first sample feature have a strong representation ability and is conducive to improving the training effect.

[0098] Step 203: Encode the first sample feature through a network model to obtain a second sample feature for characterizing second sample data, where the second sample data is data in the first sample data that is related to the traffic category to which it belongs.

[0099] The network model includes a second network, and the second network has a function of encoding features. In this example, the first sample feature can be input into the second network and encoded by the second network to extract the second sample data related to the traffic category in the first sample data, so that when classification is performed based on the second sample feature, the accuracy of the predicted classification result can be improved, thereby improving the training effect.

[0100] The first sample feature is a feature map, which can be divided into multiple feature blocks. Optionally, the feature block is a feature obtained by pooling the sub-features through the first pooling layer. Exemplarily, there are four sub-features. Based on this, Fig. 9 As shown, the first sample feature can be divided into four feature blocks. The dimensions of any two feature blocks can be the same or different. The feature block can be represented as X, whose dimensions are N×H×W×C, where N is the batch size, H and W are the height and width of the feature block respectively, and C is the number of channels of the feature block.

[0101] In addition, the electronic device may obtain the position codes of each feature block and concatenate the feature block and the corresponding position codes, where the position codes are used to characterize the position of the feature block in the first sample feature. For example, the position codes of the four feature blocks may be 1 to 4 in sequence. Fig. 9 As shown in the figure, the feature block is mapped to a lower dimensional space through a linear projection layer to obtain a mapped feature block. The mapped feature block can be represented as E, E = Embedding (X), where Embedding represents the linear projection operation performed by the linear projection layer. The dimension of the mapped feature block is N × H × W × D, where D is the number of channels of the mapped feature block, and D is less than C. Afterwards, the mapped feature block and the corresponding position encoding can be concatenated to obtain a concatenated feature. For example, the position encoding can be represented as PE, then the concatenated feature Eposition =E+PE. Each concatenated feature can be used as an input feature of the second network and input into the second network.

[0102] Alternatively, if Fig. 9 As shown, the electronic device can concatenate the traffic category code "&" and the corresponding position code "0", and place the concatenated feature before or after each concatenated feature to obtain the input feature of the second network, and input it into the second network. Wherein, the traffic category code is a specified embedding vector, for example, the traffic category code can be a unit matrix or a code for representing "class".

[0103] Among them, the embodiment of the present application does not limit the structure and size of the second network. For example, the second network includes at least one of a fully connected layer, a convolutional layer, a normalization layer, etc.

[0104] In a possible implementation, the network model (the second network in the network) includes a plurality of encoding modules connected in series; step 203 includes steps 2031 to 2033 (not shown in the figure).

[0105] Step 2031: encode the first sample feature through the first encoding module to obtain the encoding feature of the first encoding module.

[0106] That is, the first sample feature is input into the first encoding module, and the encoding operation is performed by the first encoding module to obtain the encoding feature. The embodiment of the present application does not limit the structure, size, type, etc. of the first encoding module. For example, the first encoding module is an encoding module or a transformer in the VAE. r ) modules, etc.

[0107] In an exemplary embodiment, the first encoding module includes a multi-head attention network and a first fully connected layer; step 2031 includes: performing attention processing on the first sample feature through the multi-head attention network to obtain an attention processing result; mapping the attention processing result through the first fully connected layer to obtain the encoding feature of the first encoding module.

[0108] In this example, the first encoding module is Transforme r Module, Transforme r The module includes a multi-head attention network and a first fully connected layer. The first sample feature is input into the multi-head attention network, and the multi-head attention network is used to To perform attention processing, obtain the processing results of each attention network, and concatenate the processing results of each attention network to obtain the attention processing result. Among them, Attention (Q, K, V) represents the processing result of an attention network, Q represents the query vector determined according to the first sample feature, K represents the key vector determined according to the first sample feature, and V represents the value vector determined according to the first sample feature. Softmax is a normalized exponential function used to perform normalization operations, T is the transposition symbol, d k is the dimension of an attention network.

[0109] Next, the attention processing result is input into the first fully connected layer, and the mapping process is performed through the first fully connected layer according to FFN(X)=ReLU(XW1+b1)W2+b2 to obtain the encoding features of the first encoding module. Among them, FFN(X) represents the encoding features of the first encoding module, and X represents the attention processing result. ReLU is a linear rectification function (Linear Rectification Function), also known as a linear correction unit, which is an activation function. W1 and W2 are weight matrices, and b1 and b2 are bias matrices. It can be seen from the mapping function that the mapping process mainly includes linear processing and activation processing.

[0110] Step 2032: Encode the encoding feature of the previous encoding module through the non-first encoding module to obtain the encoding feature of the non-first encoding module.

[0111] The coding features of the first coding module are input into the second coding module, and the coding operation is performed through the second coding module to obtain the coding features of the second coding module. The coding features of the second coding module are input into the third coding module, and the coding operation is performed through the third coding module to obtain the coding features of the third coding module. And so on. The embodiment of the present application does not limit the structure, size, type, etc. of the non-first coding module. Exemplarily, the non-first coding module is a coding module or a transformer module in a VAE, etc. Among them, the implementation method of step 2032 can be seen in the description of step 2031. The implementation principles of the two are similar and will not be repeated here.

[0112] Step 2033: determine the second sample feature according to the encoding feature of the last encoding module.

[0113] Optionally, the coding feature of the last coding module is used as the second sample feature. Alternatively, the coding features of each coding module are weighted to obtain the second sample feature. Alternatively, a convolution operation, a mapping operation, etc. are performed on the coding feature of the last coding module to obtain the second sample feature.

[0114] Step 204, classify the second sample feature through the network model to obtain a predicted classification result, and the predicted classification result represents the possibility that the sample traffic data belongs to the traffic category.

[0115] The network model includes a third network, which has the function of classifying features. In this example, Fig. 9 As shown, the traffic category code "&" and the corresponding position code "0", as well as each mapped feature block and the corresponding position code (i.e., "1" to "4") are input into the second network, and the second sample feature is output through the second network. After that, the second sample feature is input into the third network, and the third network is used for classification to obtain a predicted classification result. The predicted classification result includes at least one sub-result, and any sub-result represents the possibility that the sample traffic data belongs to a traffic category. For example, if the traffic categories include normal and abnormal, the predicted classification result includes two sub-results, the first sub-result represents the probability that the sample traffic data belongs to the normal traffic category, and the second sub-result represents the probability that the sample traffic data belongs to the abnormal traffic category.

[0116] The embodiment of the present application does not limit the structure, size, type, etc. of the third network. For example, the third network includes at least one of a fully connected layer, a convolutional layer, a normalization layer, an activation layer, etc.

[0117] In one possible implementation, the network model (the third network in the network) includes a second fully connected layer and a normalization layer; step 204 includes: mapping the second sample feature through the second fully connected layer to obtain a mapping result; normalizing the mapping result through the normalization layer to obtain a predicted classification result.

[0118] In this example, the third network can be a multilayer perceptron (MLP), which includes a second fully connected layer and a normalization layer, and the second fully connected layer is at least one. The second sample features are gradually mapped through each second fully connected layer to obtain a mapping result. The mapping processing method can be seen in the description of the first fully connected layer, which will not be repeated here. Afterwards, the mapping result is normalized through the normalization layer to obtain a predicted classification result. Optionally, the normalization layer is a softmax function.

[0119] Step 205 , training a network model according to the predicted classification results and the labeled classification results to obtain a classification model, which is used to classify the target traffic data.

[0120] The loss value can be determined according to the predicted classification result and the labeled classification result, and the network model can be trained once by the loss value to update the network model. The network model can be trained multiple times according to the implementation principle of steps 201 to 205 to obtain a classification model. The structure, function, size, etc. of the classification model and the network model are similar, and the two only differ in parameters. Based on this, the target traffic data can be classified by the classification model according to the implementation principle of steps 201 to 204.

[0121] It should be noted that in the field of network security technology, on the one hand, there is a phenomenon of imbalanced categories in traffic data. Abnormal traffic data is far less than normal traffic data, which makes the model's detection ability for abnormal traffic data weak, affecting the accuracy of the model. Based on this, the embodiment of the present application expands the abnormal traffic data through implementation method A to balance the number of samples of different traffic categories, thereby improving the training effect of the model and improving the accuracy of the classification model. On the other hand, the traffic data contains a large amount of redundant data. Directly encoding and classifying the traffic data will increase the complexity of the calculation and reduce the accuracy of the classification results. Based on this, the embodiment of the present application first performs feature filtering on the sample traffic data to remove the redundant data in the sample traffic data, reduce the data volume of the first sample feature, and improve the accuracy of the first sample feature. And by converting the sequence data (i.e., the sample traffic data) into a feature map (i.e., the first sample feature), it is possible to capture features of different scales and improve the representation ability of the first sample feature. When the first sample feature is subsequently encoded, the global features of the traffic data can be captured through the attention mechanism, and the representation ability of the second sample feature can be further improved, thereby improving the accuracy of the predicted classification results, and then improving the accuracy of the classification model. And because the amount of data of the first sample feature is small, the encoding speed and classification speed can be improved. On the other hand, traffic data has a strong disguise and contains complex and changeable sub-data. These sub-data are mixed and will affect the robustness and accuracy of the classification model. Based on this, the embodiment of the present application screens out sub-data with higher importance through implementation method B, thereby improving the accuracy of the traffic data and thus improving the accuracy of the classification model. And by screening sub-data through a voting mechanism, the traffic data has complexity and variability, which can improve the generalization ability of the classification model and improve the robustness of the classification model.

[0122] The embodiment of the present application also obtains models in the related art that have the ability to classify traffic data (i.e., models 1 to 6), and tests the performance of models 1 to 6 and the classification model of the embodiment of the present application in classifying traffic data. The test results are shown in Table 3.

[0123] Table 3

[0124] Model Accuracy Accuracy Recall F1 score Model 1 97.47％ 97.25％ 95.41％ 96.32％ Model 2 97.38％ 97.46％ 94.29％ 95.85％ Model 3 96.68％ 96.23％ 94.76％ 95.49％ Model 4 97.82％ 97.81％ 95.06％ 96.42％ Model 5 98.30％ 98.11％ 96.54％ 97.32％ Model 6 98.54％ 98.28％ 97.13％ 97.70％ Model of the embodiment of the present application 99.19％ 98.90％ 97.78％ 98.34％

[0125] As can be seen from Table 3, compared with the models in the related art, the classification model of the embodiment of the present application has the highest index values ​​in accuracy, precision, recall rate and F1 score, indicating that the classification model of the embodiment of the present application has the highest performance. Among them, due to the small amount of abnormal traffic data, the recall rate of the model is often low, and the classification model of the embodiment of the present application has a higher recall rate, indicating that the model can more accurately classify abnormal traffic data and the performance is more stable.

[0126] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant regions. For example, the traffic data involved in this application is obtained with full authorization.

[0127] In the above method, by filtering the sample flow data by features, redundant data is removed from the sample flow data, and valid first sample data is retained, thereby improving the accuracy and characterization ability of the first sample features. Subsequently, by encoding the first sample features and classifying the encoded second sample features, a prediction classification result with high accuracy can be obtained, so that a classification model with high accuracy can be trained based on the prediction classification result, so that the target flow data can be accurately classified through the classification model, thereby improving the accuracy of the classification result.

[0128] The present application embodiment provides a method for classifying flow data, which can be applied to the above-mentioned computer system. The method of the present application embodiment is executed by the terminal device 101 and / or the server 102. For the convenience of description, the terminal device 101 and the server 102 are collectively referred to as electronic devices, that is, the method of the present application embodiment is executed by the electronic device. Fig.10 As shown, the method includes the following steps.

[0129] Step 1001, obtain target traffic data and classification model. The classification model is based on Figure 2 The relevant classification model training method is trained.

[0130] Step 1002, feature filtering is performed on the target traffic data through a classification model to obtain a first target feature for characterizing first target data, where the first target data is the data remaining after redundant data is removed from the target traffic data.

[0131] Step 1003: Encode the first target feature through a classification model to obtain a second target feature for characterizing second target data, where the second target data is data in the first target data that is related to the traffic category to which it belongs.

[0132] Step 1004, classify the second target feature through the classification model to obtain a target classification result, which represents the possibility that the target traffic data belongs to multiple traffic categories.

[0133] The implementation of steps 1001 to 1004 can be found in the description of steps 201 to 204. The implementation principles of the two are similar and will not be repeated here.

[0134] In the above method, by filtering the target traffic data, redundant data is removed from the target traffic data, and valid first target data is retained, thereby improving the accuracy and characterization ability of the first target feature. Subsequently, by encoding the first target feature and classifying the encoded second target feature, a target classification result with higher accuracy can be obtained.

[0135] Fig.11 FIG. 1 is a schematic diagram of a structure of a training device for a classification model provided in an embodiment of the present application. Fig.11 As shown, the device comprises:

[0136] An acquisition module 1101 is used to acquire sample traffic data and annotate classification results, where the annotated classification results represent the traffic category to which the sample traffic data belongs;

[0137] A filtering module 1102 is used to perform feature filtering on the sample flow data through a network model to obtain a first sample feature for characterizing first sample data, where the first sample data is data remaining after redundant data is removed from the sample flow data;

[0138] The encoding module 1103 is used to encode the first sample feature through the network model to obtain a second sample feature for characterizing the second sample data, where the second sample data is data related to the traffic category in the first sample data;

[0139] A classification module 1104 is used to classify the second sample feature through a network model to obtain a predicted classification result, wherein the predicted classification result represents the possibility that the sample traffic data belongs to a traffic category;

[0140] The training module 1105 is used to train the network model according to the predicted classification results and the labeled classification results to obtain a classification model, and the classification model is used to classify the target traffic data.

[0141] In a possible implementation, the sample flow data includes first flow data, second flow data, and third flow data;

[0142] The acquisition module 1101 is used to acquire first traffic data and second traffic data, where the first traffic data is data generated by users accessing the network, and the second traffic data is data generated by network attacks; encode the second traffic data to obtain a first traffic feature; sample the first traffic feature to obtain a second traffic feature; and generate third traffic data based on the second traffic feature.

[0143] In a possible implementation, the first flow feature is obtained by encoding the second flow data through a target encoder, and the third flow data is generated according to the second flow feature through a target generator;

[0144] The encoding module 1103 is further used to encode the training data through the initial encoder to obtain a first data feature, where the training data is data generated by the network attack;

[0145] The device of the embodiment of the present application also includes:

[0146] A decoding module, used for decoding the first data feature to obtain first reconstructed data;

[0147] A sampling module, used for sampling the first data feature to obtain a second data feature;

[0148] A generating module, configured to generate second reconstructed data according to the second data feature by means of an initial generator;

[0149] The acquisition module 1101 is further used to acquire a first discrimination result and a second discrimination result, wherein the first discrimination result indicates the possibility that the first reconstructed data is generated data, and the second discrimination result indicates the possibility that the second reconstructed data is generated data;

[0150] The training module 1105 is also used to train the initial encoder and the initial generator according to the first discrimination result and the second discrimination result to obtain the target encoder and the target generator.

[0151] In one possible implementation, the acquisition module 1101 is used to obtain source traffic data, which includes multiple first sub-data; obtain importance indicators of the multiple first sub-data, where the importance indicators represent the importance of any first sub-data; select multiple second sub-data from the multiple first sub-data based on the importance indicators of the multiple first sub-data; and determine sample traffic data based on the multiple second sub-data.

[0152] In one possible implementation, acquisition module 1101 is used to determine, for any first sub-data, multiple evaluation indicators for any first sub-data according to multiple evaluation methods, where one evaluation indicator represents the importance of any first sub-data determined according to one evaluation method; and determine the importance indicator of any first sub-data based on the multiple evaluation indicators of any first sub-data.

[0153] In a possible implementation, the network model includes a plurality of feature filtering subnetworks, a concatenation layer, and a first pooling layer connected in parallel;

[0154] The filtering module 1102 is used to perform feature filtering on the sample flow data through any feature filtering sub-network to obtain a sub-feature for characterizing the first sample data; to splice multiple sub-features through a splicing layer to obtain a spliced ​​feature; and to pool the spliced ​​feature through a first pooling layer to obtain a first sample feature.

[0155] In a possible implementation, any feature filtering subnetwork includes a convolutional layer and a second pooling layer;

[0156] The filtering module 1102 is used to convolve the sample flow data through a convolution layer to obtain a convolution result, pool the convolution result through a second pooling layer to obtain a pooling result, and determine sub-features according to the pooling result; or, pool the sample flow data through a second pooling layer to obtain a pooling result, convolve the pooling result through a convolution layer to obtain a convolution result, and determine sub-features according to the convolution result.

[0157] In one possible implementation, the network model includes a plurality of encoding modules connected in series;

[0158] The encoding module 1103 is used to encode the first sample feature through the first encoding module to obtain the encoding feature of the first encoding module; encode the encoding feature of the previous encoding module through the non-first encoding module to obtain the encoding feature of the non-first encoding module; and determine the second sample feature according to the encoding feature of the last encoding module.

[0159] In one possible implementation, the first encoding module includes a multi-head attention network and a first fully connected layer;

[0160] The encoding module 1103 is used to perform attention processing on the first sample feature through a multi-head attention network to obtain an attention processing result; and map the attention processing result through a first fully connected layer to obtain the encoding feature of the first encoding module.

[0161] In a possible implementation, the network model includes a second fully connected layer and a normalization layer;

[0162] The classification module 1104 is used to map the second sample feature through the second fully connected layer to obtain a mapping result; and normalize the mapping result through the normalization layer to obtain a predicted classification result.

[0163] The device provided in the embodiment of the present application is Figure 2 The related method embodiments belong to the same concept, and their specific implementation processes are detailed in the method embodiments, which will not be repeated here.

[0164] In the above device, by filtering the sample flow data by features, redundant data is removed from the sample flow data, and valid first sample data is retained, thereby improving the accuracy and characterization ability of the first sample features. Subsequently, by encoding the first sample features and classifying the encoded second sample features, a prediction classification result with high accuracy can be obtained, so that a classification model with high accuracy can be trained based on the prediction classification result, so that the target flow data can be accurately classified through the classification model, thereby improving the accuracy of the classification result.

[0165] Fig.12 FIG. 1 is a schematic diagram of a flow data classification device provided in an embodiment of the present application. Fig.12 As shown, the device comprises:

[0166] The acquisition module 1201 is used to obtain target traffic data and a classification model. The classification model is based on Figure 2 The relevant classification model training method is trained;

[0167] A filtering module 1202 is used to perform feature filtering on the target flow data through a classification model to obtain a first target feature for characterizing first target data, where the first target data is data remaining after redundant data is removed from the target flow data;

[0168] The encoding module 1203 is used to encode the first target feature through the classification model to obtain a second target feature for characterizing the second target data, where the second target data is data related to the traffic category in the first target data;

[0169] The classification module 1204 is used to classify the second target feature through the classification model to obtain a target classification result, and the target classification result represents the possibility that the target traffic data belongs to multiple traffic categories.

[0170] The device provided in the embodiment of the present application is Fig.10 The related method embodiments belong to the same concept, and their specific implementation processes are detailed in the method embodiments, which will not be repeated here.

[0171] In the above device, by filtering the target flow data, redundant data is removed from the target flow data, and valid first target data is retained, thereby improving the accuracy and characterization ability of the first target feature. Subsequently, by encoding the first target feature and classifying the encoded second target feature, a target classification result with higher accuracy can be obtained.

[0172] It should be understood that the above Fig.11 as well as Fig.12 When the provided device implements its functions, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0173] Fig.13 The structure block diagram of a terminal device 1300 provided by an exemplary embodiment of the present application is shown. The terminal device 1300 includes: a processor 1301 and a memory 1302 .

[0174] The processor 1301 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 1301 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 1301 may also include a main processor and a coprocessor. The main processor is a processor for processing data in an awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in a standby state. In some embodiments, the processor 1301 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 1301 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0175] The memory 1302 may include one or more computer-readable storage media, which may be non-transitory. The memory 1302 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In some embodiments, the non-transitory computer-readable storage medium in the memory 1302 is used to store at least one computer program, which is used to be executed by the processor 1301 to implement the training method of the classification model or the classification method of traffic data provided in the method embodiment of the present application.

[0176] In some embodiments, the terminal device 1300 may also optionally include: a peripheral device interface 1303 and at least one peripheral device. The processor 1301, the memory 1302 and the peripheral device interface 1303 may be connected via a bus or a signal line. Each peripheral device may be connected to the peripheral device interface 1303 via a bus, a signal line or a circuit board. Specifically, the peripheral device includes: at least one of a radio frequency circuit 1304, a display screen 1305, a camera assembly 1306, an audio circuit 1307 and a power supply 1308.

[0177] The peripheral device interface 1303 may be used to connect at least one peripheral device related to I / O (Input / Output) to the processor 1301 and the memory 1302. In some embodiments, the processor 1301, the memory 1302, and the peripheral device interface 1303 are integrated on the same chip or circuit board; in some other embodiments, any one or two of the processor 1301, the memory 1302, and the peripheral device interface 1303 may be implemented on a separate chip or circuit board, which is not limited in this embodiment.

[0178] The radio frequency circuit 1304 is used to receive and transmit RF (Radio Frequency) signals, also known as electromagnetic signals. The radio frequency circuit 1304 communicates with the communication network and other communication devices through electromagnetic signals. The radio frequency circuit 1304 converts the electrical signal into an electromagnetic signal for transmission, or converts the received electromagnetic signal into an electrical signal. Optionally, the radio frequency circuit 1304 includes: an antenna system, an RF transceiver, one or more amplifiers, a tuner, an oscillator, a digital signal processor, a codec chipset, a user identity module card, and the like. The radio frequency circuit 1304 can communicate with other terminals through at least one wireless communication protocol. The wireless communication protocol includes, but is not limited to: the World Wide Web, a metropolitan area network, an intranet, various generations of mobile communication networks (2G, 3G, 4G and 5G), a wireless local area network and / or a WiFi (Wireless Fidelity) network. In some embodiments, the radio frequency circuit 1304 may also include circuits related to NFC (Near Field Communication), which is not limited in this application.

[0179] The display screen 1305 is used to display a UI (User Interface). The UI may include graphics, text, icons, videos, and any combination thereof. When the display screen 1305 is a touch display screen, the display screen 1305 also has the ability to collect touch signals on the surface or above the surface of the display screen 1305. The touch signal can be input to the processor 1301 as a control signal for processing. At this time, the display screen 1305 can also be used to provide virtual buttons and / or virtual keyboards, also known as soft buttons and / or soft keyboards. In some embodiments, the display screen 1305 can be one, which is set on the front panel of the terminal device 1300; in other embodiments, the display screen 1305 can be at least two, which are respectively set on different surfaces of the terminal device 1300 or are folded; in other embodiments, the display screen 1305 can be a flexible display screen, which is set on the curved surface or folded surface of the terminal device 1300. Even, the display screen 1305 can also be set to a non-rectangular irregular shape, that is, a special-shaped screen. The display screen 1305 can be made of materials such as LCD (Liquid Crystal Display) and OLED (Organic Light-Emitting Diode).

[0180] The camera assembly 1306 is used to capture images or videos. Optionally, the camera assembly 1306 includes a front camera and a rear camera. Typically, the front camera is arranged on the front panel of the terminal, and the rear camera is arranged on the back of the terminal. In some embodiments, there are at least two rear cameras, which are any one of a main camera, a depth of field camera, a wide-angle camera, and a telephoto camera, so as to realize the fusion of the main camera and the depth of field camera to realize the background blur function, the fusion of the main camera and the wide-angle camera to realize the panoramic shooting and VR (Virtual Reality) shooting function or other fusion shooting functions. In some embodiments, the camera assembly 1306 may also include a flash. The flash can be a monochrome temperature flash or a dual-color temperature flash. A dual-color temperature flash refers to a combination of a warm light flash and a cold light flash, which can be used for light compensation at different color temperatures.

[0181] The audio circuit 1307 may include a microphone and a speaker. The microphone is used to collect sound waves from the user and the environment, and convert the sound waves into electrical signals and input them into the processor 1301 for processing, or input them into the RF circuit 1304 to achieve voice communication. For the purpose of stereo acquisition or noise reduction, there may be multiple microphones, which are respectively arranged at different parts of the terminal device 1300. The microphone may also be an array microphone or an omnidirectional acquisition microphone. The speaker is used to convert the electrical signal from the processor 1301 or the RF circuit 1304 into sound waves. The speaker may be a traditional film speaker or a piezoelectric ceramic speaker. When the speaker is a piezoelectric ceramic speaker, it can not only convert the electrical signal into sound waves audible to humans, but also convert the electrical signal into sound waves inaudible to humans for purposes such as ranging. In some embodiments, the audio circuit 1307 may also include a headphone jack.

[0182] The power supply 1308 is used to power various components in the terminal device 1300. The power supply 1308 can be an alternating current, a direct current, a disposable battery, or a rechargeable battery. When the power supply 1308 includes a rechargeable battery, the rechargeable battery can be a wired rechargeable battery or a wireless rechargeable battery. A wired rechargeable battery is a battery charged through a wired line, and a wireless rechargeable battery is a battery charged through a wireless coil. The rechargeable battery can also be used to support fast charging technology.

[0183] In some embodiments, the terminal device 1300 further includes one or more sensors 1309 , including but not limited to: an acceleration sensor 1311 , a gyroscope sensor 1312 , a pressure sensor 1313 , an optical sensor 1314 , and a proximity sensor 1315 .

[0184] The acceleration sensor 1311 can detect the magnitude of acceleration on the three coordinate axes of the coordinate system established by the terminal device 1300. For example, the acceleration sensor 1311 can be used to detect the components of gravity acceleration on the three coordinate axes. The processor 1301 can control the display screen 1305 to display the user interface in a horizontal view or a vertical view according to the gravity acceleration signal collected by the acceleration sensor 1311. The acceleration sensor 1311 can also be used to collect motion data of games or users.

[0185] The gyroscope sensor 1312 can detect the body direction and rotation angle of the terminal device 1300, and the gyroscope sensor 1312 can cooperate with the acceleration sensor 1311 to collect the user's 3D actions on the terminal device 1300. The processor 1301 can implement the following functions based on the data collected by the gyroscope sensor 1312: motion sensing (such as changing the UI according to the user's tilt operation), image stabilization during shooting, game control, and inertial navigation.

[0186] The pressure sensor 1313 can be set on the side frame of the terminal device 1300 and / or the lower layer of the display screen 1305. When the pressure sensor 1313 is set on the side frame of the terminal device 1300, the user's holding signal of the terminal device 1300 can be detected, and the processor 1301 performs left and right hand recognition or shortcut operations according to the holding signal collected by the pressure sensor 1313. When the pressure sensor 1313 is set on the lower layer of the display screen 1305, the processor 1301 controls the operability controls on the UI interface according to the user's pressure operation on the display screen 1305. The operability controls include at least one of a button control, a scroll bar control, an icon control, and a menu control.

[0187] The optical sensor 1314 is used to collect the ambient light intensity. In one embodiment, the processor 1301 can control the display brightness of the display screen 1305 according to the ambient light intensity collected by the optical sensor 1314. Specifically, when the ambient light intensity is high, the display brightness of the display screen 1305 is increased; when the ambient light intensity is low, the display brightness of the display screen 1305 is reduced. In another embodiment, the processor 1301 can also dynamically adjust the shooting parameters of the camera assembly 1306 according to the ambient light intensity collected by the optical sensor 1314.

[0188] The proximity sensor 1315, also called a distance sensor, is usually arranged on the front panel of the terminal device 1300. The proximity sensor 1315 is used to collect the distance between the user and the front of the terminal device 1300. In one embodiment, when the proximity sensor 1315 detects that the distance between the user and the front of the terminal device 1300 is gradually decreasing, the processor 1301 controls the display screen 1305 to switch from the screen-on state to the screen-off state; when the proximity sensor 1315 detects that the distance between the user and the front of the terminal device 1300 is gradually increasing, the processor 1301 controls the display screen 1305 to switch from the screen-off state to the screen-on state.

[0189] Those skilled in the art will understand that Fig.13 The structure shown in the figure does not constitute a limitation on the terminal device 1300, and may include more or fewer components than shown in the figure, or combine certain components, or adopt a different component arrangement.

[0190] Figure 7 This is a schematic diagram of the structure of the server provided in the embodiment of the present application. The server 700 may have relatively large differences due to different configurations or performances, and may include one or more processors 701 and one or more memories 702, wherein the one or more memories 702 store at least one computer program, and the at least one computer program is loaded and executed by the one or more processors 701 to implement the classification model training method or traffic data classification method provided in the above-mentioned various method embodiments. Exemplarily, the processor 701 is a CPU. Of course, the server 700 may also have components such as a wired or wireless network interface, a keyboard, and an input and output interface for input and output. The server 700 may also include other components for implementing device functions, which will not be described in detail here.

[0191] In an exemplary embodiment, a computer-readable storage medium is also provided, in which at least one computer program is stored. The at least one computer program is loaded and executed by a processor so that the electronic device implements any of the above-mentioned classification model training methods or traffic data classification methods.

[0192] Optionally, the computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a compact disc (CD-ROM), a magnetic tape, a floppy disk, an optical data storage device, etc.

[0193] In an exemplary embodiment, a computer program is also provided. The computer program is at least one, and the at least one computer program is loaded and executed by a processor to enable an electronic device to implement any of the above-mentioned classification model training methods or traffic data classification methods.

[0194] In an exemplary embodiment, a computer program product is also provided, in which at least one computer program is stored, and the at least one computer program is loaded and executed by a processor to enable an electronic device to implement any of the above-mentioned classification model training methods or traffic data classification methods.

[0195] It should be understood that the "plurality" mentioned in this article refers to two or more. "And / or" describes the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0196] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0197] The above description is only an exemplary embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present application shall be included in the protection scope of the present application.

Claims

1. A classification model training method, characterized in that: The method comprises: Acquire sample traffic data and a labeled classification result, wherein the labeled classification result represents the traffic category to which the sample traffic data belongs; Performing feature filtering on the sample traffic data through a network model to obtain a first sample feature for characterizing first sample data, where the first sample data is data remaining after redundant data is removed from the sample traffic data; Encoding the first sample feature through the network model to obtain a second sample feature for characterizing second sample data, where the second sample data is data in the first sample data related to the traffic category to which it belongs; Classifying the second sample feature by using the network model to obtain a prediction classification result, wherein the prediction classification result represents the possibility that the sample traffic data belongs to a traffic category; The network model is trained according to the predicted classification result and the labeled classification result to obtain a classification model, and the classification model is used to classify the target traffic data.

2. The method according to claim 1, characterized in that: The sample flow data includes first flow data, second flow data and third flow data; Get sample traffic data, including: Acquire the first flow data and the second flow data, wherein the first flow data is data generated by a user accessing a network, and the second flow data is data generated by a network attack; Encoding the second flow data to obtain a first flow feature; Sampling the first flow characteristic to obtain a second flow characteristic; The third flow data is generated according to the second flow characteristic.

3. The method according to claim 2, characterized in that The first flow feature is obtained by encoding the second flow data through a target encoder, and the third flow data is generated by a target generator according to the second flow feature; the method further includes: Encoding the training data by an initial encoder to obtain a first data feature, wherein the training data is data generated by a network attack; Decoding the first data feature to obtain first reconstructed data; Sampling the first data feature to obtain a second data feature; generating second reconstructed data according to the second data feature by an initial generator; Obtaining a first discrimination result and a second discrimination result, wherein the first discrimination result indicates a possibility that the first reconstructed data is generated data, and the second discrimination result indicates a possibility that the second reconstructed data is generated data; The initial encoder and the initial generator are trained according to the first discrimination result and the second discrimination result to obtain the target encoder and the target generator.

4. The method according to claim 1, characterized in that: Get sample traffic data, including: Acquire source traffic data, where the source traffic data includes a plurality of first sub-data; Acquire importance indicators of the plurality of first sub-data, where the importance indicator represents the importance of any one of the first sub-data; selecting a plurality of second sub-data from the plurality of first sub-data according to the importance indexes of the plurality of first sub-data; The sample flow data is determined according to the plurality of second sub-data.

5. The method according to claim 4, characterized in that The obtaining the importance indicators of the plurality of first sub-data includes: For any first sub-data, multiple evaluation indicators of the first sub-data are determined according to multiple evaluation methods, and one evaluation indicator represents the importance of the first sub-data determined according to one evaluation method; An importance index of any one of the first sub-data is determined according to the multiple evaluation indexes of any one of the first sub-data.

6. The method according to any one of claims 1 to 5, characterized in that: The network model includes a plurality of feature filtering subnetworks, a splicing layer and a first pooling layer connected in parallel; the feature filtering of the sample flow data through the network model to obtain a first sample feature for characterizing the first sample data includes: For any feature filtering sub-network, feature filtering is performed on the sample flow data through any feature filtering sub-network to obtain a sub-feature for characterizing the first sample data; Splicing multiple sub-features through the splicing layer to obtain a splicing feature; The concatenated features are pooled by the first pooling layer to obtain a first sample feature.

7. The method according to any one of claims 1 to 5, characterized in that: The network model includes a plurality of encoding modules connected in series; encoding the first sample feature through the network model to obtain a second sample feature for characterizing the second sample data includes: Encoding the first sample feature by a first encoding module to obtain an encoding feature of the first encoding module; Encoding the encoding feature of the previous encoding module by using the non-first encoding module to obtain the encoding feature of the non-first encoding module; The second sample feature is determined according to the encoding feature of the last encoding module.

8. The method according to claim 7, characterized in that The first encoding module includes a multi-head attention network and a first fully connected layer; encoding the first sample feature through the first encoding module to obtain the encoding feature of the first encoding module includes: Performing attention processing on the first sample feature through the multi-head attention network to obtain an attention processing result; The attention processing result is mapped through the first fully connected layer to obtain the encoding features of the first encoding module.

9. A method for classifying flow data, characterized in that: The method comprises: Obtaining target traffic data and a classification model, wherein the classification model is trained according to any one of the methods of claims 1 to 8; Performing feature filtering on the target flow data by using the classification model to obtain a first target feature for characterizing first target data, where the first target data is data remaining after removing redundant data from the target flow data; Encoding the first target feature by using the classification model to obtain a second target feature for characterizing second target data, where the second target data is data in the first target data that is related to the traffic category to which it belongs; The second target feature is classified by the classification model to obtain a target classification result, wherein the target classification result represents the possibility that the target traffic data belongs to multiple traffic categories.

10. An electronic device, characterized in that: The electronic device comprises a processor and a memory, wherein at least one computer program is stored in the memory, and the at least one computer program is loaded and executed by the processor so that the electronic device implements the method according to any one of claims 1 to 9.

Images