Block chain power system malicious encrypted traffic detection method and system based on incremental learning

Abstract

The invention discloses a method and a system for detecting malicious encrypted traffic of a block chain power system based on incremental learning, and belongs to the technical field of network security. The method comprises the steps of obtaining a traffic data set, and obtaining a plurality of feature vector groups based on the traffic data set; constructing a detection model which takes the feature vector group as input and outputs a detection result of each flow; constructing a buffer pool for storing feature vectors in the feature vector group received by the detection model; when the feature vector group is input into the detection model, historical feature vectors in the buffer pool are updated, and then the detection model is trained based on the feature vectors in the buffer pool at the current moment; constructing incremental learning loss, updating the detection model based on the incremental learning loss, and finally obtaining a trained detection model; and detecting the traffic to be detected by using the trained detection model. The invention provides a solution for automatically identifying and coping with novel malicious encrypted traffic attacks, and the security of a power system is improved.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and specifically relates to a method and system for detecting malicious encrypted traffic in a blockchain power system based on incremental learning. Background Art

[0002] With the continuous growth of global energy demand, the power system is gradually developing towards intelligence, automation and digitalization, forming a smart grid with deep integration of information and communication technology. In this context, data interaction and information transmission in the power system are becoming more frequent. However, with the sharp increase in data traffic and the number of network connections, the power system is also facing increasingly complex network security threats, especially in the detection and protection of malicious encrypted traffic. Malicious encrypted traffic uses data encryption technology to disguise itself, allowing it to bypass traditional detection methods and hide in normal encrypted communications, thus posing a serious threat to the network security of the power system. How to effectively identify and detect malicious encrypted traffic while ensuring the privacy of encrypted communications has become a technical problem that needs to be solved in the field of power system network security.

[0003] Existing network security detection methods have many limitations, especially when dealing with malicious encrypted traffic. Traditional detection methods usually rely on static feature extraction and fixed classification models, which are difficult to effectively deal with the diversity of malicious traffic and the continuous evolution of attack methods. Due to the dynamic characteristics of malicious attack behaviors, static detection methods often show high false alarm rates and missed alarm rates when facing new malicious traffic, which is difficult to meet the high requirements of power systems for real-time and accuracy. In addition, the network environment in the power system is complex and changeable, with a large number of heterogeneous devices and distributed architectures, which further exacerbates the limitations of traditional malicious traffic detection methods. Summary of the invention

[0004] In order to solve the problems in the prior art, the present invention proposes a method and system for detecting malicious encrypted traffic in a blockchain power system based on incremental learning.

[0005] The technical solution of the present invention is as follows:

[0006] In a first aspect, the present invention discloses a method for detecting malicious encrypted traffic in a blockchain power system based on incremental learning, comprising:

[0007] A flow data set is obtained, and flows in the flow data set are sorted according to a time sequence, and then the sorted flows are grouped to obtain a plurality of flow groups; a feature vector of each flow in each flow group is obtained to obtain a plurality of feature vector groups;

[0008] A detection model is constructed, which uses the feature vector group as input for model training and outputs the detection results of each flow; a buffer pool is constructed, which is used to store the feature vectors in the feature vector group received by the detection model;

[0009] When the feature vector group is input into the detection model, the historical feature vectors in the buffer pool are updated based on the reservoir sampling algorithm, and then the detection model is trained based on the updated feature vectors in the buffer pool, an incremental learning loss is constructed, and the detection model is updated based on the incremental learning loss; finally, the trained detection model is obtained;

[0010] The trained detection model is used to detect the traffic to be detected in the blockchain power system to detect whether the traffic to be detected is malicious encrypted traffic.

[0011] In a second aspect, the present invention discloses a blockchain power system malicious encrypted traffic detection system based on incremental learning for implementing the detection method, comprising:

[0012] A preprocessing module is used to obtain a flow data set, sort the flow in the flow data set according to the time sequence, and then group the sorted flow to obtain multiple flow groups; obtain a feature vector of each flow in each flow group to obtain multiple feature vector groups;

[0013] An incremental learning module is used to build a detection model, which uses a feature vector group as input for model training and outputs the detection results of each flow; a buffer pool is built, which is used to store feature vectors in the feature vector group received by the detection model;

[0014] When the feature vector group is input into the detection model, the historical feature vectors in the buffer pool are updated based on the reservoir sampling algorithm, and then the detection model is trained based on the updated feature vectors in the buffer pool; an incremental learning loss is constructed, and the detection model is updated based on the incremental learning loss, and finally a trained detection model is obtained;

[0015] The detection module is used to detect the traffic to be detected using the trained detection model to detect whether the traffic to be detected is malicious encrypted traffic.

[0016] Compared with the prior art, the present invention has the following beneficial effects:

[0017] 1) The present invention proposes a blockchain power system malicious encrypted traffic detection system based on incremental learning, which monitors encrypted traffic in real time and uses incremental learning models to gradually adapt to and handle new encrypted traffic attacks. This overcomes the problem that malicious behavior identification of encrypted traffic in the prior art relies on static models and cannot quickly adapt to emerging attack patterns, and power grid security monitoring has high requirements for real-time performance and accuracy. The following technical effects have been achieved:

[0018] 1. Automated malicious traffic detection: For the first time, automatic detection of malicious traffic attacks in a blockchain-based power grid system was achieved.

[0019] 2. Real-time adaptability: Through incremental learning technology, the system can dynamically learn new attack behaviors and continuously improve detection performance.

[0020] 3. Improve grid security: effectively respond to malicious behaviors in complex encrypted traffic and ensure the stable operation of the power system.

[0021] 2) The present invention proposes a new incremental learning loss function, derives the design principle of the loss through mathematical methods, and proves its effectiveness in learning new attack patterns through theoretical analysis, while ensuring the memory of historical knowledge and avoiding catastrophic forgetting. It overcomes the catastrophic forgetting problem that is common in existing incremental learning technologies, that is, the loss of knowledge of old patterns when learning new patterns. At the same time, the existing methods lack theoretical support and cannot prove their stability when dealing with new attacks. The present invention has achieved the following technical effects:

[0022] 1. Solve the catastrophic forgetting problem: By optimizing the incremental learning loss, the model retains the memory of historical attack patterns when learning new attack patterns.

[0023] 2. Rigorous theoretical support: Provides mathematical derivation and theoretical analysis of incremental learning loss to prove its effectiveness and convergence.

[0024] 3. Efficient model training: Through this loss function, the model can maintain efficient learning ability in the constantly updated encrypted traffic.

[0025] 3) The present invention designs a buffer mechanism to store representative traffic samples during the incremental learning process and reuse these samples efficiently in subsequent model training. This overcomes the problem in traditional incremental learning methods that the generalization ability of the model is easily reduced due to insufficient training samples. The buffer mechanism can efficiently manage and store key samples to make up for this deficiency. The following technical effects are achieved:

[0026] 1. Key sample storage: The buffer can dynamically store representative samples from different categories to ensure the diversity and comprehensiveness of model training.

[0027] 2. Improve training efficiency: With samples stored in the buffer, the model does not need to access all historical data when updating, which significantly reduces computing overhead.

[0028] 3. Enhanced adaptability: The buffer mechanism ensures that the model can quickly adapt to new situations based on limited storage resources when facing ever-changing attack patterns. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 This is a diagram of the malicious encrypted traffic detection system of the blockchain power system based on incremental learning according to the present invention.

[0030] Figure 2 This is a flow chart of the method for detecting malicious encrypted traffic in a blockchain power system based on incremental learning according to the present invention. DETAILED DESCRIPTION

[0031] The present invention is further described and illustrated below in conjunction with specific embodiments. The embodiments are merely exemplary of the present disclosure and do not define the scope of limitation. The technical features of each embodiment of the present invention may be combined accordingly without conflicting with each other.

[0032] As an emerging machine learning method, incremental learning technology can adapt to changing environments and new data features by continuously updating and optimizing existing models. Unlike traditional static learning models, incremental learning can dynamically update parameters without retraining the entire model, respond to changes in malicious traffic in a timely manner, and ensure the timeliness and accuracy of the detection model. Therefore, the potential application prospects of incremental learning in detecting malicious encrypted traffic in power systems have attracted much attention.

[0033] At the same time, blockchain technology has gradually been applied in the field of network security of power systems due to its decentralization, immutability, data transparency and traceability. Blockchain technology can not only ensure the safe sharing of traffic data among multiple nodes, but also prevent malicious data tampering, providing higher security and credibility for the monitoring and analysis of malicious traffic. With the support of blockchain technology, the malicious encrypted traffic detection system can realize the secure sharing of data among distributed nodes, improve the robustness of the system, and ensure the transparency and credibility of the detection results.

[0034] Therefore, the present invention proposes a method and system for detecting malicious encrypted traffic in a blockchain power system based on incremental learning. By introducing incremental learning, the detection model is trained by extracting comprehensive traffic features through supervised learning, and malicious encrypted traffic attacks are automatically identified in a blockchain-based power system. New malicious encrypted traffic attacks can be processed through continuous learning. The purpose is to build an efficient and accurate malicious encrypted traffic detection system by combining the distributed security characteristics of blockchain with the dynamic adaptability of incremental learning.

[0035] In a specific embodiment of the present invention, a flowchart of a method for detecting malicious encrypted traffic in a blockchain power system based on incremental learning is shown in FIG. Figure 2 As shown, the details are as follows:

[0036] Step 1: Obtain a traffic data set, sort the traffic in the traffic data set according to time sequence, and then group the sorted traffic to obtain multiple traffic groups; obtain the feature vector of each traffic in each traffic group to obtain multiple feature vector groups.

[0037] Traffic datasets are collections of network traffic information, often used to analyze and detect network behavior. They include features of data packets, such as source and destination IP addresses, port numbers, protocol types, timestamps, and data content. These datasets can be used to train and test machine learning models to identify normal and abnormal traffic, helping to improve network security. For example, CICIDS contains normal traffic and multiple attack types, CICIDS contains simulated traffic data for multiple network attacks; UNSW-NB15 is suitable for machine learning research; KDD Cup 1999 is a classic network intrusion detection dataset; ISCX VPN-nonVPN contains VPN and non-VPN traffic.

[0038] Step 1.1: The traffic data set includes a large amount of traffic, each of which includes the source IP address, destination IP address, source port, destination port, transport layer protocol, etc. The time information of the traffic can be obtained based on the above information of each traffic itself, and then the traffic in the traffic data set is sorted according to the time sequence. Since the number of traffic in the traffic data set is too large, it is impossible to input it into the detection model together to train the detection model. Therefore, it is necessary to group the traffic, and then train the detection model in batches according to the grouping, and obtain multiple traffic groups after grouping.

[0039] Step 1.2: Each traffic group is input into a feature extractor to obtain a feature vector of each traffic. The feature extractor is an autoencoder that processes the traffic in the input traffic group in an unsupervised manner. The autoencoder is composed of multiple bidirectional gated recurrent units (bi-GRUs). The present invention uses stacked bi-GRUs to convert the input traffic into a feature vector.

[0040] Step 2: Build a detection model, which uses the feature vector group as input for model training and outputs the detection results of each flow; build a buffer pool, which is used to store the feature vectors in the feature vector group received by the detection model;

[0041] When the feature vector group is input into the detection model, the historical feature vectors in the buffer pool are updated based on the reservoir sampling algorithm, and then the detection model is trained based on the feature vectors in the buffer pool at the current moment; an incremental learning loss is constructed, and the detection model is updated based on the incremental learning loss, and finally the trained detection model is obtained; wherein, when the detection model uses the feature vector group for the first training, the incremental learning loss is not constructed, and only the received feature vectors are stored in the buffer pool.

[0042] Step 2.1: The detection model is an MLP model. First, the MLP model receives the first round of training data, that is, receives the first feature vector group. The MLP model includes an input layer, a hidden layer, and an output layer. After the input layer of the MLP model receives the feature vector, it passes the feature vector to the hidden layer. The feature vector is processed by each neuron activation function in the hidden layer. The processed feature vector is output to the next hidden layer and finally input to the output layer. The output layer generates an output judgment to judge the type of traffic corresponding to each feature vector in this round, that is, to judge whether the traffic is malicious encrypted traffic. At the same time, a buffer pool is also constructed. The buffer pool is used to store the feature vectors in the feature vector group received by the detection model. When storing the received feature vectors, the buffer pool uses the incremental learning model to obtain the confidence function output value of the traffic corresponding to the feature vector and store it; wherein the incremental learning model is an improved der (discrete elastic rod) model, which is used to update the existing learning results when new data arrives without retraining the entire model. This is very effective for processing streaming data or real-time data, especially when the amount of data is huge or constantly changing. At this time, the buffer pool will store all the feature vectors in the first feature vector group.

[0043] Step 2.2: The MLP model receives the second-round training data, that is, it receives the second feature vector group. When the MLP model receives the second feature vector group, it updates the historical feature vectors in the buffer based on the reservoir sampling algorithm. That is, assume there are k feature vectors in the first feature vector group, then there are k historical feature vectors in the buffer. Let the first feature vector in the second feature vector group be the (k + 1)-th feature vector, and so on, reorder each feature vector in the second feature vector group. When processing the i-th (i > k) feature vector after reordering, generate a random number r, 0 ≤ r ≤ i. If r < k, replace the (r + 1)-th element in the buffer with the i-th feature vector. If r ≥ k, store the i-th feature vector as the (r + 1)-th element in the buffer. Repeat the above steps and continue to process the next feature vector until all feature vectors in the second feature vector group are processed. In this way, more representative traffic in the traffic flow can be obtained. Then, based on the updated feature vectors in the buffer, the MLP model is trained once again, and an incremental learning loss is constructed. Based on the incremental learning loss, the detection model is updated, that is, the weights and biases are adjusted to optimize the model.

[0044] Step 2.3: Repeat Step 2.2 until all feature vector groups complete the training of the MLP model. At this time, the trained MLP model will be obtained. Among them, when the third feature vector group is input into the detection model, let the first feature vector in the third feature vector group be the (2k + 1)-th feature vector, and so on, reorder each feature vector in all feature vector groups.

[0045] In Step 2.2, by introducing an incremental learning module that can adapt to new attacks, and then obtaining the incremental learning loss function through strict mathematical derivation, experience replay is realized during the incremental learning process. While preventing the model from catastrophic forgetting, it can identify new malicious encrypted traffic when it appears. The process of obtaining the incremental learning loss is specifically as follows:

[0046] (1) Design the classification loss function as follows:

[0047]

[0048] Among them, θ is the parameter of the detection model, L ce Using the classification loss, D represents the distribution dataset of the true labels of the traffic corresponding to the input feature vector and the feature vector. f(x) is the output result of the detection model (here is the predicted output of the MLP model), and y is the true label of the traffic corresponding to the input feature vector; E (x,y)～DRepresents the expected value of the sample (x, y) in the distribution data set D; (x, y)~D means that (x, y) is a set of feature vectors randomly sampled from the distribution data set D and the label of the traffic corresponding to the feature vector; x is the input feature vector, that is, the feature vector in D; l(*) is the loss function, which is used to calculate the error between the output result f(x) of the detection model and the true label y.

[0049] (2) To mitigate catastrophic forgetting, the present invention introduces a new loss function that aims to balance the learning between new and old traffic. The present invention uses past traffic samples to obtain an output f(x′) in the updated model that is very close to the output of the pre-updated model (the model before the update) trained based on past traffic samples, denoted as f θ*t .

[0050] L il =αE (x′,z′)～M [D KL (softmax(z′)||f(x′))] (2)

[0051] Among them, L il is the anti-forgetting loss; α is the weight coefficient; E (x′,z′)～M represents the expected value of the sample (x′, z′) in the buffer pool M; (x′, z′)~M represents the sample (x′, z′) is extracted from the data distribution M; M is the buffer pool; D KL is the KL divergence; softmax is the normalization function; x′ is the historical feature vector re-input into the detection model in the buffer pool M; z′ is the output value of the confidence function of the incremental learning model for the traffic corresponding to x′.

[0052] In order to reduce resource consumption, the present invention uses z′ to replace the model output f θ*t , perform softmax transformation on z′ to obtain the probability vector, which is used to calculate the model output f θ The KL divergence of (x).

[0053] Theorem 1: If the confidence function output values ​​of the model output are similar, then the KL divergence between them can be approximated as the Euclidean distance.

[0054] Proof: Assume that logits z1 and logits z2 are the sample spaces of logits z, R = {1, 2, 3, ..., n}, n is the dimension of z, so z2 can be expressed as:

[0055] z2=z1+∈Δz (3)

[0056] Among them, z1 represents the model logits vector before updating; z2 represents the model logits vector after updating; ∈ is the scaling factor.

[0057] For some small ∈>0 and the perturbation vector Δz=[Δz(1)···Δz(n)] T , it is important that Δz satisfies:

[0058]

[0059] When defining z2 from z1, we must ensure that ∈z satisfies:

[0060]

[0061] Among them, z1(i) represents the logits output value of the historical model (past model, model before update) for the sample in the i-th category.

[0062] Because ∈ can be arbitrarily small, the above conditions can be assumed to be true. Next, the present invention locally approximates the KL divergence.

[0063]

[0064] Substituting z2(i)=z1(i)+∈Δz(i) into the KL divergence formula gives:

[0065]

[0066] Among them, z2(i) represents the logits output value of the current model (updated model) for the sample in the i-th category, which is calculated after perturbation.

[0067] Apply the second-order Taylor approximation to

[0068]

[0069] make The above formula can be simplified as:

[0070]

[0071] Undoubtedly, for all i∈R, z1(i)>0, the weighted Euclidean norm is introduced:

[0072]

[0073] in, is the weighted Euclidean norm.

[0074] Using this notation, the KL divergence becomes:

[0075]

[0076] in, is the weighted square norm.

[0077] Therefore, under local approximation, the KL divergence approximates a weighted Euclidean distance.

[0078] According to Theorem 1, L il Can be simplified to:

[0079]

[0080] (3) When new attack patterns undergo significant changes, the model usually shows a strong preference for previous attack patterns. This leads to significant differences between the logits and labels of these new attacks. To solve this problem, the present invention also stores the correct labels of the sample data in the buffer and uses a smooth loss function:

[0081] L lb =βE (x″,y″,z″)～M [l(y″,f(x″))] (13)

[0082] Among them, L lb is the smoothing loss; β is the weight coefficient; E (x"",y"",z"")～M is the expectation of the samples stored in the buffer M; (x″, y″, z″)~M means that the samples (x″, y″, z″) are extracted from the buffer M; x″ is the updated feature vector in the buffer M; y″ is the true label of the traffic corresponding to the updated feature vector in the buffer M; z″ is the confidence function output value of the incremental learning model for the traffic corresponding to the updated feature vector in the buffer M.

[0083] Obviously, the higher the L il , the greater the difference between new and old attack samples in the buffer pool. Therefore, using this correlation, we propose a balance coefficient k to adjust L il and L lb Through mathematical derivation and experimental verification, we set k as the dynamic balance coefficient, which represents the adaptive adjustment factor of the smooth loss, k = 0.5 + softmax (L il *γ), γ is the scaling factor; so the final incremental learning loss function is:

[0084]

[0085] Where L is the incremental learning loss.

[0086] In a specific embodiment of the present invention, the parameters of the detection model are updated with the goal of minimizing the incremental learning loss.

[0087] Step 3: Use the trained detection model to detect the traffic to be detected in the blockchain power system to detect whether the traffic to be detected is malicious encrypted traffic.

[0088] First, the feature vector of the flow to be detected in the blockchain power system is obtained, and then the obtained feature vector is input into the trained detection model to obtain the detection result of the flow to be detected, that is, to detect whether the flow to be detected is malicious encrypted flow.

[0089] Simulation experiment 1: Comparison of the malicious encrypted traffic identification accuracy of the present invention and four existing methods.

[0090] The simulation process is as follows:

[0091] First, the original traffic is obtained from the traffic data set, and the traffic is preprocessed, and the encrypted traffic identification result is obtained by using the present invention and the existing four encrypted traffic identification methods;

[0092] Secondly, according to the encrypted traffic identification results, the number of correctly identified target encrypted traffic TP, the number of correctly identified other encrypted traffic TN, the number of incorrectly identified target encrypted traffic FP, and the number of missed target encrypted traffic FN are counted, and then the accuracy and recall are calculated respectively. According to the calculation results of the accuracy and recall, the F1 score is calculated. The F1 score results are shown in the following table:

[0093] Dataset\Methods RAPIER FS CoinFlip PacketLen This method DoHBr 0.88 0.76 0.28 0.56 0.92 CIC 0.84 0.71 0.27 0.46 0.86 GridET 0.83 0.73 0.31 0.49 0.84

[0094] The present invention is compared with four methods (RAPIER, FS, CoinFlip, PacketLen) on three data sets (DoHBrw, CIC, GridET). The above table shows the F1 scores of malicious encrypted traffic detection of each method on the corresponding data set. Obviously, the present method has been greatly improved compared with other malicious traffic detection methods. And the encrypted traffic recognition accuracy of the present invention is higher than that of the existing four methods.

[0095] The present invention uses continuous computation of incremental learning loss to optimize loss and traffic retraining (replay mechanism). In this way, the detection module can continuously learn autonomously, memorize and identify new malicious encrypted traffic, thereby improving its responsiveness and accuracy to new attacks.

[0096] The present invention maintains a buffer pool to store representative traffic samples. When a new traffic sample arrives, the detection model is trained based on incremental learning loss so that the detection model can dynamically adapt to and detect new attack patterns. At the same time, the present invention designs a dynamic update mechanism for the buffer pool, which replaces or retains the historical feature vectors in the buffer pool by analyzing the representativeness and diversity of the feature vectors of the new traffic and the samples in the buffer pool, so as to ensure the comprehensiveness and timeliness of the samples in the buffer pool. The feature vectors stored in the buffer pool are not only used as representative samples for subsequent training, but also participate in training with new samples through the experience replay mechanism during model training, thereby effectively preventing catastrophic forgetting. Through this dynamic update and replay mechanism, the present invention can continuously improve the performance of the detection model, ensure rapid response to new malicious encrypted traffic attacks and retain memory of old attack patterns.

[0097] The present invention is based on rigorous mathematical derivation and experimental confirmation, and ultimately derives an incremental learning loss function, which calculates the incremental learning loss and works together with experience replay to combat catastrophic forgetting, so that the detection model can adapt to new traffic.

[0098] Based on the large amount of traffic data and high traffic in the blockchain-based power grid scenario, the MLP model architecture is relatively simple, requires lower computing resources, and provides faster training speed. It can monitor traffic data in real time, and experiments have proved that the MLP model is sufficient to meet the needs of the task.

[0099] In this embodiment, a blockchain power system malicious encrypted traffic detection system based on incremental learning for implementing the detection method is also provided, including:

[0100] A preprocessing module is used to obtain a flow data set, sort the flow in the flow data set according to the time sequence, and then group the sorted flow to obtain multiple flow groups; obtain a feature vector of each flow in each flow group to obtain multiple feature vector groups;

[0101] An incremental learning module is used to build a detection model, which uses a feature vector group as input for model training and outputs the detection results of each flow; a buffer pool is built, which is used to store feature vectors in the feature vector group received by the detection model;

[0102] When the feature vector group is input into the detection model, the historical feature vectors in the buffer pool are updated based on the reservoir sampling algorithm, and then the detection model is trained based on the updated feature vectors in the buffer pool; an incremental learning loss is constructed, and the detection model is updated based on the incremental learning loss, and finally a trained detection model is obtained;

[0103] The detection module is used to detect the traffic to be detected using the trained detection model to detect whether the traffic to be detected is malicious encrypted traffic.

[0104] For the system embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment, and the implementation methods of the remaining modules will not be repeated here. The system embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of the present invention. Ordinary technicians in this field can understand and implement it without paying creative work.

[0105] The embodiments of the system of the present invention can be applied to any device with data processing capabilities, and the device with data processing capabilities can be a device or apparatus such as a computer. The system embodiments can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, the corresponding computer program instructions in the non-volatile memory are read into the memory by the processor of any device with data processing capabilities and run.

[0106] The above-mentioned embodiments only express several implementation modes of the present invention, and the description is relatively specific and detailed, but it cannot be understood as limiting the scope of the present invention. For those of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention.

Claims

1. A method for detecting malicious encrypted traffic in a blockchain power system based on incremental learning, characterized in that: include: A flow data set is obtained, and flows in the flow data set are sorted according to a time sequence, and then the sorted flows are grouped to obtain a plurality of flow groups; a feature vector of each flow in each flow group is obtained to obtain a plurality of feature vector groups; A detection model is constructed, which uses the feature vector group as input for model training and outputs the detection results of each flow; a buffer pool is constructed, which is used to store the feature vectors in the feature vector group received by the detection model; When the feature vector group is input into the detection model, the historical feature vectors in the buffer pool are updated based on the reservoir sampling algorithm, and then the detection model is trained based on the updated feature vectors in the buffer pool, an incremental learning loss is constructed, and the detection model is updated based on the incremental learning loss; finally, the trained detection model is obtained; The trained detection model is used to detect the traffic to be detected in the blockchain power system to detect whether the traffic to be detected is malicious encrypted traffic.

2. The detection method according to claim 1, characterized in that: The traffic dataset is CICIDS, UNSW-NB15, KDD Cup 1999 or ISCX VPN-nonVPN.

3. The detection method according to claim 1, characterized in that: A feature extractor is used to obtain a feature vector of the traffic, and the feature extractor is an autoencoder.

4. The detection method according to claim 1, characterized in that: The detection model is an MLP model.

5. The detection method according to claim 1, characterized in that: When the detection model uses the feature vector group for the first training, the incremental learning loss is not constructed, and the received feature vectors are only stored in the buffer pool; and when the buffer pool stores the received feature vectors, it uses the incremental learning model to obtain and store the confidence function output value of the traffic corresponding to the feature vector.

6. The detection method according to claim 5, characterized in that: The incremental learning loss includes classification loss, anti-forgetting loss and smoothing loss; the formula of the classification loss is: Among them, L ce is the classification loss; f(x) is the output result of the detection model, θ is the parameter of the detection model; D is the distribution data set of the input feature vector and the real label of the flow corresponding to the feature vector; x is the feature vector in D; y is the real label of the flow corresponding to the input feature vector; E (x，y)～D represents the expected value of the sample (x, y) in the distribution data set D; l(*) is the loss function; The formula for the anti-forgetting loss is: Among them, L il is the anti-forgetting loss; α is the weight coefficient; M is the buffer pool; x′ is the historical feature vector re-input into the detection model in the buffer pool M; z′ is the output value of the confidence function of the incremental learning model for the traffic corresponding to x′; E (x′，z′)～M is the expected value of the sample (x′, z′) in the buffer pool M; is the square of the two-norm; The formula for the smoothing loss is: IT lb =βE( x"，y"，z")～M [l(y″, f(x″))] Among them, L lb is the smoothing loss; β is the weight coefficient; E (x″，y″，z″)～M is the expectation of the sample (x″, y″, z″) in the buffer pool M; x″ is the updated feature vector in the buffer pool M; y″ is the true label of the traffic corresponding to the updated feature vector in the buffer pool M; z″ is the output value of the confidence function of the incremental learning model for the traffic corresponding to the updated feature vector in the buffer pool M; The formula for the incremental learning loss is: Where L is the incremental learning loss; k is the dynamic balance coefficient, k = 0.5 + softmax (L il *γ), γ is the scaling factor.

7. A blockchain power system malicious encrypted traffic detection system based on incremental learning that implements the detection method described in claim 1, characterized in that: include: A preprocessing module is used to obtain a flow data set, sort the flow in the flow data set according to the time sequence, and then group the sorted flow to obtain multiple flow groups; obtain a feature vector of each flow in each flow group to obtain multiple feature vector groups; An incremental learning module is used to build a detection model, which uses a feature vector group as input for model training and outputs the detection results of each flow; a buffer pool is built, which is used to store feature vectors in the feature vector group received by the detection model; When the feature vector group is input into the detection model, the historical feature vectors in the buffer pool are updated based on the reservoir sampling algorithm, and then the detection model is trained based on the updated feature vectors in the buffer pool; an incremental learning loss is constructed, and the detection model is updated based on the incremental learning loss, and finally a trained detection model is obtained; The detection module is used to detect the traffic to be detected using the trained detection model to detect whether the traffic to be detected is malicious encrypted traffic.

Images