Traffic feature set generation method, model training method and equipment

Abstract

The invention provides a traffic feature set generation method, a model training method and equipment, and the method comprises the steps: inputting random noise and a preset rare traffic feature sample into a sample generation model, and obtaining a forged traffic feature sample; the forged traffic feature sample has a forged traffic feature, and the forged traffic feature is similar to the rare traffic feature of the rare traffic feature sample; determining whether the fake traffic characteristic sample is an effective traffic characteristic sample; and under the condition that the forged traffic feature sample is determined as an effective traffic feature sample, the forged traffic feature sample is newly added to a preset traffic feature set as a rare traffic feature sample, so that the number difference value between the rare traffic feature sample and the common traffic feature sample in the traffic feature set is reduced. According to the scheme, the problem of data imbalance in the traffic feature set can be effectively solved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a method for generating a traffic feature set, a model training method and equipment. Background Art

[0002] Before training a network traffic classification model, it is usually necessary to manually collect traffic features from traffic data and mark the traffic features with category labels to form traffic feature samples, and then use the traffic feature samples to train the network traffic classification model so that the network traffic classification model can accurately identify known traffic feature samples. However, in a traffic feature set consisting of a large number of traffic feature samples, the number of rare traffic feature samples is far less than the number of common traffic feature samples, making the traffic feature set an unbalanced data set. In the process of training a network traffic classification model using an unbalanced traffic feature set, it is impossible to ensure that the network traffic classification model can fully learn the traffic features in the rare traffic feature samples, which can easily reduce the classification accuracy of the network traffic classification model. Summary of the invention

[0003] The present application provides a method for generating a traffic feature set, a model training method and a device to solve the problem of traffic feature set imbalance existing in related technologies.

[0004] The first aspect of the present application provides a method for generating a traffic feature set, including: inputting random noise and preset rare traffic feature samples into a sample generation model to obtain a forged traffic feature sample; the forged traffic feature sample has a forged traffic feature, and the forged traffic feature is similar to the rare traffic feature of the rare traffic feature sample; determining whether the forged traffic feature sample is a valid traffic feature sample; when the forged traffic feature sample is determined to be a valid traffic feature sample, adding the forged traffic as a rare traffic feature sample to the preset traffic feature set to reduce the difference in quantity between the rare traffic feature samples and the common traffic feature samples in the traffic feature set.

[0005] The second aspect of the present application provides a training method for a network traffic classification model, wherein the classification model to be trained includes t classifiers, t≥1 and is an integer, and the training method includes iteratively training the classification model to be trained using p traffic feature samples in a traffic feature set to obtain a network traffic model; p is an integer greater than or equal to 1, and the traffic feature set is generated by the generation method of the first aspect above; wherein, in the i-th round of training, it includes:

[0006] Input the ith traffic feature sample in the traffic feature set into t classifiers respectively, and obtain t initial classification results output by the t classifiers in a one-to-one correspondence; the initial classification result is the initial confidence that the ith traffic feature sample is the target category; 1≤i≤p, and i is an integer;

[0007] Based on the initial classification results and feature weights output by each classifier, the target classification result of the classification model to be trained in the i-th round of training is determined; the target classification result is the target confidence that the i-th traffic feature sample is the target category;

[0008] When the target confidence is greater than the preset threshold, the training is stopped.

[0009] The third aspect of the application provides an electronic device, including a processor and a memory, wherein the memory stores instructions, and the instructions are loaded and executed by the processor to implement the methods of the first and second aspects above.

[0010] The fourth aspect of the application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the method of any of the above-mentioned embodiments is implemented.

[0011] The advantages or beneficial effects of the above technical solution include at least: by inputting random noise and preset rare traffic feature samples into the sample generation model, the sample generation model outputs a forged traffic feature sample, and when it is determined that the forged traffic feature sample is a valid traffic feature sample, the forged traffic feature sample is added as a rare traffic feature sample to the preset traffic feature set, which can effectively reduce the difference in the number of rare traffic feature samples and common traffic feature samples in the traffic feature set, so that the number of rare traffic feature samples is close to the number of common traffic feature samples, which is conducive to ensuring that the traffic feature set is a balanced data set, and then in the process of using the traffic feature set to train the classification model to be trained to obtain the network traffic classification model, it helps to ensure that the classification model to be trained can fully learn the traffic features in the rare traffic feature samples, thereby improving the classification accuracy of the network traffic classification model finally obtained. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The accompanying drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present application, and together with the specification are used to explain the principles of the present application. In addition, these drawings and text descriptions are not intended to limit the scope of the concept of the present application in any way, but to illustrate the concept of the present application for those skilled in the art by referring to specific embodiments.

[0013] Figure 1 The figure is a flow chart of a method for generating a traffic feature set according to an embodiment of the present application.

[0014] Figure 2 Shown is a structural block diagram of a sample generation model according to an embodiment of the present application.

[0015] Figure 3 The figure shows a schematic diagram of the data processing process during the i-th round of training.

[0016] Figure 4 Shown is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0017] In the following, only some exemplary embodiments are briefly described. As those skilled in the art will appreciate, the described embodiments may be modified in various ways without departing from the spirit or scope of the present application. Therefore, the drawings and descriptions are considered to be exemplary and non-restrictive in nature.

[0018] Figure 1 The figure is a flow chart of a method for generating a traffic feature set according to an embodiment of the present application.

[0019] like Figure 1 As shown, the generating method includes the following steps S110 to S130.

[0020] Step S110: inputting random noise and preset rare traffic features into a sample generation model to obtain a forged traffic feature sample; the forged traffic feature sample has a forged traffic feature similar to the rare traffic feature.

[0021] Among them, the rare traffic feature samples include abnormal traffic features in the network, the forged traffic feature samples can be traffic features similar to the abnormal traffic features, and the sample generation model can be trained by inputting random noise and existing rare traffic feature samples into the sample generation model to be trained.

[0022] Step S120: Determine whether the forged traffic feature sample is a valid traffic feature sample.

[0023] Step S130: When the forged traffic feature is determined to be a valid feature, the forged traffic feature sample is added as a rare traffic feature sample to the preset traffic feature set to reduce the difference in quantity between the rare traffic feature samples and the common traffic feature samples in the traffic feature set.

[0024] The above scheme, by inputting random noise and preset rare traffic features into the sample generation model, makes the sample generation model output forged traffic feature samples, and when determining that the forged traffic feature samples are valid traffic feature samples, adds the forged traffic feature samples as rare traffic feature samples to the preset traffic feature set, which can effectively reduce the difference in the number of rare traffic feature samples and common traffic feature samples in the traffic feature set, so that the number of rare traffic feature samples is close to the number of common traffic feature samples, which is conducive to ensuring that the traffic feature set is a balanced data set, and then in the process of using the traffic feature set to train the classification model to be trained to obtain the network traffic classification model, it helps to ensure that the classification model to be trained can fully learn the rare traffic features in the rare traffic feature samples, thereby improving the classification accuracy of the network traffic classification model finally obtained.

[0025] It should be noted that in order to ensure that the network traffic classification model can fully learn the traffic features in the rare traffic feature samples, the relevant technology usually constructs the traffic feature set by collecting more traffic feature samples from the traffic data to increase the number of rare traffic feature samples in the traffic feature set. However, since the number of rare traffic features is relatively rare, it will cost a lot of manpower to collect and process traffic feature samples, resulting in high manpower cost and low efficiency in constructing the traffic feature set. Compared with the relevant technology, the sample generation model in the above scheme uses random noise and preset rare traffic feature samples to automatically generate forged traffic feature samples similar to the rare traffic feature samples, and then uses the forged traffic feature samples to construct the traffic feature set, which can effectively reduce the manpower cost of constructing the traffic feature set and improve the construction efficiency.

[0026] In one implementation, step S120, determining whether the forged traffic feature sample is a valid traffic feature sample, includes the following steps S121 to S126.

[0027] Step S121: construct a first traffic feature sample based on the rare traffic feature of the rare traffic feature sample in the traffic feature set and the common traffic feature of the common traffic feature sample and mark its label category;

[0028] Step S122: input the first traffic feature sample and its corresponding label category into the classification model to be trained to obtain a first prediction value of the output classification result.

[0029] Step S123: input the first traffic feature sample after adding the forged traffic feature and the corresponding label category into the classification model to be trained to obtain a second prediction value of the output classification result.

[0030] Step S124: Based on the first prediction value and the label category, a first loss value of the classification model to be trained is calculated using a loss function.

[0031] Step S125: Based on the second prediction value and the label category, a second loss value of the classification model to be trained is calculated using a loss function.

[0032] Step S126: When the difference between the first loss value and the second loss value is less than 0, determine that the forged traffic feature sample is a valid traffic feature sample.

[0033] In step S126, the difference ΔL(f) between the first loss value L(f) and the second loss value L(f+f') is calculated using the following formula (1):

[0034] ΔL(f)=L(f)-L(f+f') Formula (1).

[0035] In the above scheme, after generating the forged traffic feature sample, the first traffic feature sample is first constructed using the rare traffic feature and the common traffic feature and its label category is marked, and then the first traffic feature sample and its label category, the first traffic feature sample after adding the forged traffic feature and the label category are respectively input into the classification model to be trained, so that the classification model to be trained outputs the first prediction value and the second prediction value corresponding to the classification result, and then based on the first prediction value, the second prediction value and their corresponding label categories, the first loss value and the second loss value of the classification model to be trained are respectively calculated using the loss function, so that the change between the first loss value and the second loss value can be used to characterize the loss change caused by the forged traffic feature to the classification model to be trained, and when the difference between the first loss value and the second loss value is less than 0, it can be estimated that the forged traffic feature can improve the convergence speed of the classification model to be trained. Based on this, the corresponding forged traffic feature sample is determined as a valid traffic feature sample, and the forged traffic feature sample that can best promote the performance improvement of the classification model to be trained can be selected, which is helpful to improve the convergence efficiency of the subsequent use of the forged traffic feature sample to train the classification model to be trained to obtain the network traffic classification model.

[0036] It should be noted that the above steps S122 to S126 do not limit the execution order of each step. It can be understood that the execution order of the above steps S122 to S126 can also be step S122->step S124->step S123->step S125.

[0037] In one embodiment, the first traffic feature sample, the label category, the first prediction value and the second prediction value are all n. Based on the first prediction value and the label category, the first loss value of the classification model to be trained is calculated using a loss function, including the following steps S1241 to S1242.

[0038] Step S1241, using the loss function to calculate the i-th error value between the i-th first prediction value and its corresponding category label; where 1≤i≤n, and i is an integer.

[0039] In step S1241, the i-th error value can be l(y i ,f(x i )) is calculated. Where l() represents the loss function; y i =f(x i ) represents the i-th first traffic feature sample x i The category label of the i-th traffic feature sample x i The classification result of f(x i ) indicates that the classification model to be trained predicts the i-th first traffic feature sample x i is the first predicted value of the target category.

[0040] Step S1242: sum the first error value to the nth error value to obtain a first loss value of the classification model to be trained.

[0041] In step S1241, the first loss value L(f) can be calculated by the following formula (2):

[0042]

[0043] Based on this, the first loss value of the classification model to be trained can be calculated.

[0044] In one embodiment, the first traffic feature sample, the label category, the first prediction value and the second prediction value are all n, and based on the second prediction value and the label category, the second loss value of the classification model to be trained is calculated using a loss function, including steps S1251 to S1252.

[0045] Step S1251, using the loss function to calculate the i-th error value between the i-th second prediction value and its corresponding category label; where 1≤i≤n, and i is an integer.

[0046] In step S1251, the i-th error value can be l(y i ,f(x i )+f'(x i )) is calculated. Where l() represents the loss function; y i =f(x i ) represents the i-th first traffic feature sample x i The category label of the i-th traffic feature sample x i The classification result of f(x i )+f'(x i) indicates that the classification model to be trained predicts the i-th first traffic feature sample x i is the second predicted value of the target category.

[0047] Step S1252: sum the first error value to the nth error value to obtain a second loss value of the classification model to be trained.

[0048] In step S1251, the second loss value L(f+f') can be calculated by the following formula (3):

[0049]

[0050] Based on this, the second loss value of the classification model to be trained can be calculated.

[0051] In one implementation, the forged traffic feature samples include k, k>1 and is an integer, and the generation method further includes the following steps S210 to S230.

[0052] Step S210: Determine the contribution of the k forged traffic features to the classification result of the classification model to be trained.

[0053] Step S220: sort the k forged traffic feature samples in descending order of contribution.

[0054] Step S230: Determine the forged traffic feature samples within a preset contribution range as valid traffic feature samples, wherein the preset contribution range may be 60% to 80% (including the endpoint values).

[0055] In practical applications, the traffic feature set contains a large number of traffic features. In the process of using the traffic feature set to train the classification model to be trained, redundant traffic feature samples will not only increase the complexity of the classification model to be trained, but may also cause overfitting, thereby reducing the generalization ability of the final network traffic classification model.

[0056] The above scheme first determines the contribution of k forged traffic feature samples to the classification result of the classification model to be trained, and then sorts the k forged traffic feature samples in descending order of contribution, and then determines the forged traffic feature samples within a preset contribution range as valid traffic feature samples. It can realize the selection of valid traffic feature samples according to the contribution of the forged traffic feature samples, and only retain the forged traffic feature samples with higher contribution. It is also helpful to remove redundant forged traffic feature samples, so as to reduce the complexity of the model in the process of training the classification model to be trained using the forged traffic feature samples, prevent overfitting, and improve the generalization ability of the network traffic classification model finally obtained.

[0057] Specifically, in step S210, determining the contribution of k forged traffic feature samples to the classification result of the classification model to be trained includes the following steps S211 to S216.

[0058] Step S211: Combine k forged traffic feature samples into a second traffic feature sample, wherein the k forged traffic feature samples have different forged traffic features.

[0059] Step S212: input the second traffic feature sample into the classification model to be trained to obtain m first classification results as output; m≥1 and is an integer.

[0060] Step S213, input the second traffic feature sample from which the i-th forged traffic feature sample is removed into the classification model to be trained, and obtain m second classification results as output; 1≤i≤k, and i is an integer.

[0061] Step S214: Determine the degree of influence of the i-th forged traffic feature sample on the classification result based on the difference between the m second classification results and the m first classification results.

[0062] Step S215: The sum of the influence degree of the first forged traffic feature sample on the classification result to the influence degree of the kth forged traffic feature sample on the classification result is taken as the total influence degree.

[0063] Step S216: The ratio of the influence of the i-th forged traffic feature sample on the classification result to the total influence is taken as the contribution of the i-th forged traffic feature sample to the classification result.

[0064] Among them, the contribution of the i-th forged traffic feature sample to the classification result is ω i It can be calculated using the following formula (4):

[0065]

[0066] In formula (4), μ i Indicates the influence of the i-th forged traffic feature sample on the classification result, μ j Indicates the influence of the j-th forged traffic feature sample on the classification result.

[0067] Based on this, the contribution of the i-th forged traffic feature sample to the classification result can be determined.

[0068] In one implementation, step S214, determining the degree of influence of the i-th forged traffic feature sample on the classification result based on the difference between the second classification result and the first classification result, includes:

[0069] Compare the m first classification results with the m second classification results, and determine the number m of classification results that are different from the m first classification results in the m second classification results i ;

[0070] The number of different classification results m i The ratio between and m is taken as the influence of the i-th forged traffic feature sample on the classification result.

[0071] Among them, the influence of the i-th forged traffic feature sample on the classification result is μ i It can be calculated using the following formula (5):

[0072]

[0073] Based on this, the influence of the i-th forged traffic feature sample on the classification result can be determined.

[0074] In one embodiment, Figure 2 As shown, the sample generation model includes a generator and a discriminator. Random noise and preset rare traffic feature samples are input into the sample generation model to obtain forged traffic feature samples, including:

[0075] Input the random noise z into the generator, so that the generator generates a forged traffic feature sample G(z);

[0076] The rare traffic feature sample x and the forged traffic feature sample G(z) are input into the discriminator to determine the similarity between the forged traffic feature sample and the rare traffic feature sample;

[0077] When the discriminator determines that the similarity is greater than a preset similarity threshold, the forged traffic feature sample is output. For example, the preset similarity threshold may be 0.5. When the discriminator determines that the similarity between the forged traffic feature sample and the rare traffic feature sample is greater than 0.5, it means that the discriminator cannot distinguish the feature difference between the forged traffic feature sample and the rare traffic feature sample, and the forged traffic feature of the forged traffic feature sample is similar to the rare traffic feature of the rare traffic feature sample.

[0078] The sample generation model composed of the generator and the discriminator is a generative adversarial network (GAN). The sample generation model is pre-trained to be a model that cannot distinguish between forged traffic feature samples and rare traffic feature samples.

[0079] The above scheme uses a generator to generate forged traffic feature samples based on input random noise, and uses a discriminator to output forged traffic feature samples when it is judged that the similarity between the forged traffic feature samples and the rare traffic feature samples is greater than a preset similarity threshold. This can make the forged traffic feature samples close to the rare traffic feature samples, which helps to improve the generation quality of the traffic feature set and enhance its diversity.

[0080] The present application also provides a training method for a network traffic classification model, wherein the classification model to be trained includes t classifiers, t≥1 and is an integer, and the training method includes: iteratively training the classification model to be trained using p traffic feature samples in a traffic feature set to obtain a network traffic model; p is an integer greater than or equal to 1, and the traffic feature set is generated by the generation method of any of the above implementations. The i-th round of training includes the following steps S310 to S330.

[0081] Step S310: Figure 3 As shown, in the i-th round of training, the i-th traffic feature sample in the traffic feature set is input into t classifiers respectively, and t initial classification results are obtained which are outputted by the t classifiers in a one-to-one correspondence; the traffic feature set is generated by the generation method of any of the above implementations. The initial classification result is the initial confidence that the i-th traffic feature sample is the target category.

[0082] Step S320: Based on the initial classification results and feature weights output by each classifier, determine the target classification result of the classification model to be trained in the i-th round of training; the target classification result is the target confidence that the i-th flow feature sample is the target category.

[0083] Please refer to Figure 3 , the target classification result R of the classification model to be trained in the i-th round of training i It can be calculated by the following formula (6):

[0084]

[0085] Among them, a j represents the feature weight of the jth classifier, C ij Represents the initial classification result of the j-th classifier in the i-th round of training.

[0086] Step S330: When the target confidence is greater than a preset threshold, stop training.

[0087] In the above scheme, since the traffic feature set is a balanced data set, in the process of using the traffic feature set to train the classification model to be trained, the classification model to be trained can fully learn the rare traffic features in the rare traffic feature samples, so that the network traffic classification model finally formed has a high traffic classification accuracy; in addition, in the training process, t classifiers are first used to output t initial classification results of the ith traffic feature sample, and then the initial classification results of the ith traffic feature sample are integrated as the target classification result of the ith traffic feature sample, and then the training is stopped when the target confidence of the ith traffic feature sample as the target category in the target classification result is greater than the preset threshold, so as to obtain the network traffic classification model. In the training process, the performance of the classification model to be trained composed of multiple classifiers will be better than the performance of the classification model to be trained composed of a single classifier, which helps to reduce overfitting and improve generalization ability and stability.

[0088] It should be noted that since the training method for training the classification model to be trained to obtain a network traffic classification model includes all the technical solutions of all embodiments of the above-mentioned traffic feature set generation method, it at least has all the beneficial effects brought by the technical solutions of the above-mentioned embodiments, which will not be repeated here one by one.

[0089] In one embodiment, the training method further comprises the following steps:

[0090] When the target confidence is less than a preset threshold, the feature weight of the classifier whose initial classification result is a correct classification is increased, and the feature weight of the classifier whose initial classification result is an incorrect classification is decreased, so as to update the classification model to be trained;

[0091] The updated classification model to be trained is trained for the i+1th round using the i+1th traffic feature sample in the traffic feature set.

[0092] Among them, the method for judging that the initial classification result is a correct classification includes: when the initial confidence that the i-th flow feature sample output by the classifier is the target category is greater than 0.5, the initial classification result of the classifier is a correct classification. On the contrary, the method for judging that the initial classification result is a misplaced classification includes: when the initial confidence that the i-th flow feature sample output by the classifier is the target category is less than or equal to 0.5, the initial classification result of the classifier is an incorrect classification.

[0093] Based on this, the performance of the classifier that can correctly classify the traffic feature samples in the classification model to be trained can be improved, and the performance of the classifier that incorrectly classifies the traffic feature samples in the classification model to be trained can be reduced, ensuring that the final network traffic classification model has a higher classification accuracy.

[0094] Figure 4FIG. 1 is a block diagram showing a structure of an electronic device according to an embodiment of the present application. Figure 4 As shown, the electronic device includes: a memory 10 and a processor 20, wherein the memory 10 stores a computer program that can be run on the processor 20. When the processor 20 executes the computer program, the generation method or training method in the above embodiment is implemented. The number of the memory 10 and the processor 20 can be one or more.

[0095] The electronic device also includes: a communication interface 30, which is used to communicate with external devices and perform data exchange transmission.

[0096] If the memory 10, the processor 20 and the communication interface 30 are implemented independently, the memory 10, the processor 20 and the communication interface 30 can be connected to each other through a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0097] Optionally, in a specific implementation, if the memory 10, the processor 20 and the communication interface 30 are integrated on a chip, the memory 10, the processor 20 and the communication interface 30 can communicate with each other through an internal interface.

[0098] An embodiment of the present application provides a computer-readable storage medium storing a computer program, which implements the method provided in the embodiment of the present application when the program is executed by a processor.

[0099] It should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. It is worth noting that the processor may be a processor supporting the Advanced RISC Machines (ARM) architecture.

[0100] Further, optionally, the above-mentioned memory may include a read-only memory and a random access memory, and may also include a non-volatile random access memory. The memory may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may include a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may include a random access memory (RAM), which is used as an external cache. By way of exemplary but not limiting description, many forms of RAM are available. For example, static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DR RAM).

[0101] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.

[0102] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they contradict each other.

[0103] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0104] Any process or method description in the flow chart or otherwise described herein can be understood to represent a module, fragment or portion of a code including one or more executable instructions for implementing the steps of a specific logical function or process. And the scope of the preferred embodiment of the present application includes other implementations, in which the functions may not be performed in the order shown or discussed, including in a substantially simultaneous manner or in a reverse order according to the functions involved.

[0105] In addition, each functional unit in each embodiment of the present application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into one module. The above-mentioned integrated module can be implemented in the form of hardware or in the form of a software functional module. If the above-mentioned integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. The storage medium can be a read-only memory, a disk or an optical disk, etc.

[0106] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for generating a traffic feature set, characterized in that: include: Inputting random noise and preset rare traffic feature samples into the sample generation model to obtain forged traffic feature samples; The forged traffic feature sample has a forged traffic feature, and the forged traffic feature is similar to the rare traffic feature of the rare traffic feature sample; Determining whether the forged traffic characteristic sample is a valid traffic characteristic sample; When the forged traffic feature sample is determined to be the valid traffic feature sample, the forged traffic feature sample is added as a rare traffic feature sample to the preset traffic feature set to reduce the difference in quantity between the rare traffic feature samples and the common traffic feature samples in the traffic feature set.

2. The generation method according to claim 1, characterized in that: Determining whether the forged traffic feature sample is a valid traffic feature sample includes: Based on the rare traffic features of the rare traffic feature samples in the traffic feature set and the common traffic features of the common traffic feature samples, a first traffic feature sample is constructed and its label category is marked; the first traffic feature sample has the forged traffic feature, the rare traffic feature and the common traffic feature; Inputting the first traffic feature sample and its corresponding label category into the classification model to be trained to obtain a first prediction value of the output classification result; Inputting the first traffic feature sample after adding the forged traffic feature and the corresponding label category into the classification model to be trained, and obtaining a second prediction value of the classification result as output; Based on the first prediction value and the label category, using a loss function to calculate a first loss value of the classification model to be trained; Based on the second predicted value and the label category, using a loss function to calculate a second loss value of the classification model to be trained; When the difference between the first loss value and the second loss value is less than 0, the forged traffic feature sample is determined to be a valid traffic feature sample.

3. The generation method according to claim 2, characterized in that: The first traffic feature sample, the label category, the first prediction value and the second prediction value are all n; Based on the first prediction value and the label category, using a loss function to calculate a first loss value of the classification model to be trained, including: using a loss function to respectively calculate an i-th error value between the i-th first prediction value and its corresponding category label; wherein 1≤i≤n, and i is an integer; summing the first error value to the n-th error value to obtain the first loss value of the classification model to be trained; And / or, based on the second prediction value and the label category, using the loss function to calculate the second loss value of the classification model to be trained, including: using the loss function to calculate the i-th error value between the i-th second prediction value and its corresponding category label; where 1≤i≤n, and i is an integer; summing the first to nth error values ​​to obtain the second loss value of the classification model to be trained.

4. The generation method according to claim 1, characterized in that: The forged traffic feature samples include k, k>1 and is an integer, and the generation method further includes: Determine respectively the contribution of the k forged traffic feature samples to the classification result of the classification model to be trained; Sorting the k forged traffic feature samples in descending order of contribution; The forged traffic feature samples within a preset contribution range are determined as the valid traffic feature samples.

5. The generation method according to claim 4, characterized in that: Determining the contribution of the k forged traffic feature samples to the classification result of the classification model to be trained includes: Using the k forged traffic features to construct a second traffic feature sample, so that the second traffic feature sample includes the k forged traffic features; Input the second traffic feature sample into the network traffic classification model to obtain m first classification results as output; m ≥ 1 and is an integer; Input the second traffic feature sample from which the i-th forged traffic feature is removed into the network traffic classification model to obtain m second classification results as output; 1≤i≤k, and i is an integer; Determining, based on the difference between the m second classification results and the m first classification results, the degree of influence of the i-th forged traffic feature on the classification result; The sum of the influence of the first to the kth forged traffic features on the classification results is taken as the total influence; The ratio of the influence degree of the i-th forged traffic feature on the classification result to the total influence degree is taken as the contribution degree of the i-th forged traffic feature to the classification result.

6. The generation method according to claim 5, characterized in that: Determining, based on a difference between the second classification result and the first classification result, the degree of influence of the i-th forged traffic feature sample on the classification result, includes: Compare the m first classification results with the m second classification results to determine the number of classification results that are different from the m first classification results; The ratio between the number of different classification results and m is taken as the influence of the i-th forged traffic feature on the classification result.

7. The generation method according to claim 1, characterized in that: The sample generation model includes a generator and a discriminator. Random noise and preset rare traffic feature samples are input into the sample generation model to obtain forged traffic feature samples, including: Inputting the random noise into the generator, so that the generator generates the forged traffic feature sample; Inputting the rare traffic feature sample and the forged traffic feature sample into the discriminator to determine the similarity between the forged traffic feature of the forged traffic feature sample and the rare traffic feature of the rare traffic feature sample; When the similarity is greater than or equal to a preset similarity threshold, the forged traffic feature sample is output.

8. A method for training a network traffic classification model, characterized in that: The classification model to be trained includes t classifiers, t≥1 and is an integer, and the training method includes iteratively training the classification model to be trained using p traffic feature samples in a traffic feature set to obtain the network traffic model; p is an integer greater than or equal to 1, and the traffic feature set is generated by the generation method described in any one of claims 1 to 7; wherein, in the i-th round of training, it includes: Input the ith traffic feature sample in the traffic feature set into t classifiers respectively, and obtain t initial classification results output by the t classifiers in a one-to-one correspondence; the initial classification result is the initial confidence that the ith traffic feature sample is the target category; 1≤i≤p, and i is an integer; Based on the initial classification results and feature weights output by each of the classifiers, a target classification result of the classification model to be trained in the i-th round of training is determined; the target classification result is the target confidence that the i-th flow feature sample is a target category; When the target confidence is greater than a preset threshold, the training is stopped.

9. The training method according to claim 8, characterized in that: The training method further comprises: When the target confidence is less than the preset threshold, increase the feature weight of the classifier whose initial classification result is a correct classification, and decrease the feature weight of the classifier whose initial classification result is an incorrect classification, so as to update the classification model to be trained; The updated classification model to be trained is trained for the i+1th round using the i+1th traffic feature sample in the traffic feature set.

10. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores instructions, and the instructions are loaded and executed by the processor to implement the method according to any one of claims 1 to 9.

Images