Two-channel multi-scale network flow anomaly detection method

Abstract

The invention discloses a dual-channel multi-scale network traffic anomaly detection method, and belongs to the technical field of network security. Aiming at the problem that an existing method cannot comprehensively analyze time and space features of network traffic to carry out anomaly detection, firstly, all features of network traffic data are divided into space features and time features, the space features are extracted and expanded through hole convolution of multiple different scales, space information in different distances is captured, and the time and space features are extracted and expanded through hole convolution of multiple different scales; the outputs of a plurality of dilated convolution blocks are combined, fusion is carried out through a full connection layer and time features, the time features distribute different weights for each time step in a sequence through BIGRU modeling time sequence dependency, an attention mechanism, and capture of important time sequence features is enhanced; then fusion of the two channel features is completed through a fusion layer; and finally, mapping to an output space through a linear layer, and generating probability distribution of each category. Experimental results show that a good result is obtained on a real world data set.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a dual-channel multi-scale network traffic anomaly detection method. Background Art

[0002] As the Internet penetration rate increases, network applications increase, and Internet technology plays an increasingly important role, which in turn promotes the rapid development of Internet technology. A large amount of network traffic data is generated in all aspects of daily life. Among these data, there is a large amount of valuable information, including information of sensitive organizations or individuals. With the increase in the scale of computer networks, this huge amount of network traffic data is vulnerable to attacks and intrusions, and network security issues are becoming increasingly serious, even rising to the level of national security. Therefore, network security issues need to be solved urgently.

[0003] With the rapid development of information technology, network traffic anomaly detection technology is also constantly evolving and innovating. Network traffic anomaly detection refers to analyzing and modeling traffic data to find traffic data that does not conform to normal behavior. The first is the rule-based method, which detects anomalies based on pre-defined rules. These rules are formulated based on the network administrator's understanding and experience of normal network space characteristics. For example, it is stipulated that internal network hosts can only communicate with a specific external IP address range, or certain ports can only be used for specific services. When network traffic violates these rules, it is judged as abnormal. However, the formulation of rules requires network administrators to have an in-depth understanding of the network environment and potential attacks, and the rules are often static. For new and complex attacks, especially those that can disguise themselves as normal traffic space characteristics, false detection and missed detection may occur. In order to solve the above problems, machine learning and deep learning methods have been widely used in the field of anomaly detection and have achieved remarkable results. The detection method based on machine learning can automatically build a normal traffic behavior model by learning a large amount of historical network traffic data, thereby effectively identifying abnormal traffic that deviates greatly from the normal model. Deep learning technology, with its powerful automatic feature extraction capabilities and complex model building capabilities, has demonstrated excellent performance in processing large-scale, high-dimensional network traffic data, and can more accurately capture subtle abnormal features and complex nonlinear relationships in traffic data. Among these features, they are mainly divided into time features and spatial features. Network traffic data is actually a kind of ordered sequence data that changes over time, and has obvious time correlation in some features. The network traffic anomaly detection method based on time features uses this feature to analyze the correlation and regularity of sequence data in the time dimension to detect anomalies. However, when complex, nonlinear abnormal patterns appear in network traffic (such as sudden, large-scale DDoS attacks, whose traffic growth is exponential), traditional time series models may not be able to fit and predict well. Because most of these models are built based on linear assumptions, they have weak processing capabilities for nonlinear relationships. On the other hand, if the pattern of traffic data does not have a specific time period, the predicted traffic data cannot correctly classify the actual traffic data. In the context of network traffic anomaly detection, spatial features refer to the characteristics of network traffic described from the spatial dimensions of network topology and traffic distribution. Different from the time series-based method, it focuses on analyzing the relationship and distribution of traffic between different nodes (such as hosts, servers, routers, etc.) in the network at the same time. For example, the distribution of traffic between different subnets, different server groups or different geographical areas, and the connection status of each node in the network. In a complex network environment, it is not enough to rely solely on time series data to detect anomalies.Network attacks and abnormal traffic often show specific patterns in space. Therefore, considering spatial features can provide a more comprehensive perspective for anomaly detection. However, among the current methods, there are few traffic anomaly detection methods that process spatial features and temporal features in parallel and effectively integrate them. Summary of the invention

[0004] In view of the problem that existing methods cannot comprehensively analyze the temporal and spatial characteristics of network traffic for anomaly detection, the present invention provides a dual-channel multi-scale network traffic anomaly detection method. The detection method uses multiple different-scale dilated convolutions (MC) in deep learning and a bidirectional gated recurrent unit (Bi-GRU) and a self-attention mechanism to realize network traffic anomaly detection.

[0005] Dilated Convolution is an important variant of convolution operation in the field of convolutional neural network (CNN) of deep learning. Its core lies in the introduction of the key parameter of dilation rate. In traditional convolution, the convolution kernel slides on the input data (such as feature map) with a fixed step size and dense arrangement for calculation. Dilated convolution inserts a specific number of "holes" between the elements of the convolution kernel through the dilation rate. While increasing the receptive field, the amount of calculation remains unchanged. And by adjusting the dilation rate, features can be extracted at different scales. Dilated convolution with a small dilation rate can be used to capture the detailed features of the target, while dilated convolution with a large dilation rate can focus on the long-term features of the target.

[0006] Bidirectional Gated Recurrent Unit (Bi-GRU) is a powerful architecture in the field of recurrent neural networks (RNNs). Bi-GRU builds a bidirectional information processing channel based on GRU, and processes the input sequence from both the forward and reverse directions of the sequence. It can utilize the complete contextual information of the sequence and effectively extract long-distance dependencies in the sequence, showing excellent performance when processing sequence data.

[0007] The self-attention mechanism is based on the quantitative evaluation of the correlation between the input data elements. By calculating the importance weight of each element, the model can focus on the part of the input data that is most relevant to the current task. It works effectively with the bidirectional gated recurrent unit. The dual channels process network traffic data in parallel to better capture the features.

[0008] In order to achieve the above object, the present invention adopts the following technical solutions:

[0009] A dual-channel multi-scale network traffic anomaly detection method, the method comprising the following steps:

[0010] Step 1: Data preprocessing: Use CICFlowMeter to extract features from the collected pcap files, and use the data processing functions in the Python library to preprocess the collected network traffic data (data cleaning, missing value processing, normalization), obtain the corresponding network traffic features, and classify these traffic features to obtain spatial features and temporal features;

[0011] Furthermore, the specific operations of step 1 are:

[0012] Step 1.1: Packet parsing: At a certain moment, a network attack is carried out through a fixed IP address, and network traffic packets are captured to obtain a pcap file. The pcap file is parsed through CICFlowMeter to obtain relevant characteristic information of the network traffic packets, such as: the number of network traffic packets in the outflow direction, the number of network traffic packets in the inflow direction, the maximum size of the network traffic packets in the forward direction, the minimum size of the network traffic packets in the forward direction, the flow duration, the flow byte rate, etc. At the same time, by marking the attacker's IP address, the real labels of abnormal traffic and normal traffic are generated as the input of step 1.2;

[0013] Step 1.2: Data cleaning: Perform missing value processing and normalization on the feature information obtained in step 1.1 to obtain 78-dimensional features for training the network traffic anomaly detection model DMCG;

[0014] Step 1.3: Split time and space features: Split the processed feature information into spatial features and temporal features as input for step 2.

[0015] Step 2: Construction and training of network traffic anomaly detection model DMCG;

[0016] Model construction: Use PyTorch and Scikit-learn to build a network traffic anomaly detection model DMCG consisting of a multi-scale dilated convolution module, a bidirectional gated recurrent unit module, and a self-attention module;

[0017] The multi-scale dilated convolution module is built using the Scikit-learn library, which includes dilated convolution layers, maximum pooling layers, and linear layers.

[0018] The bidirectional gated recurrent unit module and the self-attention module are built based on the PyTorch framework;

[0019] Model training: Set the model training rounds in advance, and input the corresponding spatial and temporal features into the corresponding channels for training;

[0020] Training process: The spatial features and temporal features obtained in step 1 are divided into training set and validation set in proportion, the training set is input into the model, the spatial features are extracted using the multi-scale dilated convolution module, the extracted features are downsampled and the data dimension is reduced through the maximum pooling layer, and the spatial features of different scales are aggregated; the temporal features are input into the bidirectional gated recurrent unit module to capture the temporal dependency and hierarchical structure information, and then different weights are assigned to each time step in the sequence through the self-attention mechanism to enhance the capture of important temporal features; the temporal features are aggregated with the spatial features, and then the two are used to perform the multi-scale dilated convolution module. A classifier consisting of a linear layer and a softmax function generates the category probability of the sample, and then calculates the cross entropy loss between the predicted result and the true label. When the loss is lower than the optimal model, the current model is saved as the optimal model. When the loss is higher than the optimal model, a new round of training is performed. The early stopping mechanism is used to stop training when the loss of the trained model no longer decreases, so that the model converges to the minimum cross entropy loss while avoiding overfitting problems. During the training process, a model will be saved after one round of training, and the model with the smallest loss on the validation set will be regarded as the optimal model. If the model loss of the next round of training is smaller, it is the optimal model.

[0021] Furthermore, the specific operations of step 2 are:

[0022] Step 2.1: Data sample loading: Use the deep learning framework PyTorch 2.0, inherit the Dataset class, overload its __getitem__ method, classify the 78-dimensional features obtained in step 1, and package them into batches of size 256 as input for steps 2.2 and 2.3;

[0023] Step 2.2: Construction of spatial feature channel module: Construct three dilated convolutions with different dilation rates at different scales, with convolution kernel sizes of 3, 5, and 7, and dilation rates of 1, 2, and 3, respectively; capture information at different scales of network traffic, and output feature matrices of 256×64, which are concatenated into feature matrices of 256×192, and then integrated through the maximum pooling layer and the linear layer to form a high-level feature representation, which is then fused with the temporal features;

[0024] The receptive field formula of the dilated convolution is as follows:

[0025] k'=k+(k-1)*(d-1)

[0026] In the formula, k' represents the equivalent size of the convolution kernel after the dilated convolution; k represents the convolution kernel size; d represents the dilation rate;

[0027] Step 2.3: Time channel module construction: Use three layers of bidirectional gated recurrent units, with 128 hidden units in each layer; then use the self-attention mechanism to assign different weights to each time step in the sequence; the relevant formula is as follows:

[0028] z t =σ(W z ·[h t-1 ,x t ]+b z )

[0029] r t =σ(W r ·[h t-1 ,x t ]+b r )

[0030]

[0031] In the formula, z t represents the update gate; r t Represents the reset gate; h t Represents the hidden state passed to the next moment; represents the candidate hidden state; σ represents the sigmoid function, through which the data is converted into a value in the range of 0-1; W z represents the weight matrix of the update gate; W r Represents the weight matrix of the reset gate; W h represents the weight matrix used to calculate the candidate hidden state; x t represents the input at the current time t; b z Represents the bias vector of the update gate, which is used to adjust the linear transformation result in the update gate calculation; b r represents the bias vector of the reset gate; b h represents the bias vector of the reset gate; Q represents the query vector obtained by transforming the current traffic data or its characteristics; K represents the vector generated by linear transformation of historical traffic data or its characteristics; V represents the vector containing actual traffic information or its characteristics; represents the scaling of the dimension representing the K vector;

[0032] The outputs of step 2.2 and step 2.3 serve as the input of step 2.4;

[0033] Step 2.4: Model training: The high-level features of the training set from the spatial channel and the temporal channel are concatenated into a unified feature vector. Two linear layers are stacked in sequence to combine and transform the concatenation results of statistical features and temporal features. The first linear layer expands the feature space, and the second linear layer reduces it to 256 dimensions. The fused 256-dimensional features are mapped to the output space, and the probability distribution of each category is generated and compared with the true label. Then, the cross entropy loss is calculated between the predicted results and the true label. When the loss is lower than the optimal model, the current model is saved as the optimal model. When the loss is higher than the optimal model, a new round of training is performed. Using the early stopping mechanism, the training is stopped when the loss of the trained model no longer decreases.

[0034] Furthermore, the calculation formula of the cross entropy loss in the DMCG training process of the network traffic anomaly detection model in step 2 is:

[0035]

[0036] Among them, y i Indicates the label of sample i, the positive class is 1, the negative class is 0, p i Indicates the probability that sample i is predicted to be a positive class; L i represents the loss of the i-th sample.

[0037] Step 3: DMCG performance evaluation of network traffic anomaly detection model; use the macro average of precision, recall, and F1 score as the evaluation indicators of the model to evaluate the performance of the model;

[0038] Furthermore, the calculation formula of the DMCG evaluation index of the network traffic anomaly detection model in step 3 is:

[0039]

[0040] Among them, ACC represents accuracy, P represents precision, and R represents recall; TP (true positive) represents the number of abnormal traffic detected as abnormal; FP (false positive) represents the number of normal traffic detected as abnormal; FN (false negative) represents the number of abnormal traffic detected as normal; TN (true negative) represents the number of normal traffic detected as normal.

[0041] Step 4: Detection of network traffic: Use the CICFlowMeter tool to collect network traffic from the real network environment, perform data cleaning, missing value processing, normalization, etc. on the collected traffic, and send it to the network traffic anomaly detection model for detection;

[0042] Furthermore, the specific operations of step 4 are:

[0043] Step 4.1: First, analyze and extract features through step 1.1; then, perform data cleaning, missing value processing, and normalization through step 1.2 to obtain corresponding network traffic features, and classify these network traffic features into spatial features and temporal features through step 1.3;

[0044] Step 4.2: Extraction of spatial and temporal features: First, reshape the features obtained in step 4.1 through step 2.1 and package them into a batch of 256; then extract spatial features and temporal features through steps 2.2 and 2.3 respectively, and finally fuse the extracted features through step 2.4, and use the obtained features as the input of step 4.3;

[0045] Step 4.3: Anomaly detection: The obtained features are input into the classifier composed of two linear layers and softmax function to obtain the predicted category of abnormal traffic of the feature sample.

[0046] Compared with the prior art, the present invention has the following advantages:

[0047] (1) By classifying the features of network traffic data, feature extraction is made more targeted, feature information is effectively extracted, and efficient feature representation of network traffic data is achieved.

[0048] (2) Through multiple dilated convolutions with different kernel sizes and different dilation rates, the spatial features of network traffic data are extracted at multiple scales in terms of short-term mutations and long-term trends, making the features more comprehensive. Through the combination of self-attention and bidirectional GRU, the model can focus on the most relevant parts of the sequence, enhance the capture of important temporal features, and help identify abnormal behaviors that manifest as time deviations.

[0049] (3) A complex fusion network is proposed. It is able to process different feature information in parallel and capture global dependencies sequentially, which enables network security practitioners to identify abnormal traffic more comprehensively and accurately in complex network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 This is a diagram of the architecture of network traffic anomaly detection in the present invention;

[0051] Figure 2 A detailed diagram of the spatial features extracted in the present invention;

[0052] Figure 3 Detailed diagram of the time features extracted in the present invention;

[0053] Figure 4 Parameter setting diagram of DMCG in the present invention

[0054] Figure 5 This is the algorithm for the training phase and execution phase of DMCG in the present invention. DETAILED DESCRIPTION

[0055] In order to gain a deeper understanding of the present invention, we will provide a comprehensive and detailed description of the present invention. However, the present invention has multiple implementations and is not limited to the specific examples listed herein. The presentation of these examples is intended to deepen the comprehensive understanding of the disclosure of the present invention.

[0056] As attached Figure 1 As shown, the network traffic anomaly detection model DMCG used in the present invention consists of two modules, namely, a spatial feature channel and a temporal feature channel. DMCG first divides all the features of the network traffic data into spatial features and temporal features. The spatial features are refined and expanded through multiple hole convolutions of different scales to capture spatial information within different distances. The outputs of multiple hole convolution blocks are combined and fused with the temporal features through a fully connected layer. The temporal features model the temporal dependency through BIGRU. The attention mechanism assigns different weights to each time step in the sequence to enhance the capture of important temporal features. Then, the fusion layer is used to complete the fusion of the two channel features. Finally, the linear layer is used to map to the output space to generate the probability distribution of each category.

[0057] A dual-channel multi-scale network traffic anomaly detection method, the method comprising the following steps:

[0058] Step 1: Data preprocessing: Use CICFlowMeter to extract features from the collected pcap files, and use the data processing functions in the Python library to preprocess the collected network traffic data (data cleaning, missing value processing, normalization), obtain the corresponding network traffic features, and classify these traffic features to obtain spatial features and temporal features;

[0059] Furthermore, the specific operations of step 1 are:

[0060] Step 1.1: Packet parsing: At a certain moment, a network attack is carried out through a fixed IP address, and network traffic packets are captured to obtain a pcap file. The pcap file is parsed through CICFlowMeter to obtain relevant characteristic information of the network traffic packets, such as: the number of network traffic packets in the outflow direction, the number of network traffic packets in the inflow direction, the maximum size of the network traffic packets in the forward direction, the minimum size of the network traffic packets in the forward direction, the flow duration, the flow byte rate, etc. At the same time, by marking the attacker's IP address, the real labels of abnormal traffic and normal traffic are generated as the input of step 1.2;

[0061] Step 1.2: Data cleaning: Perform missing value processing and normalization on the feature information obtained in step 1.1 to obtain 78-dimensional features for training the network traffic anomaly detection model DMCG;

[0062] Step 1.3: Spatiotemporal feature division: The processed feature information is divided into spatial features and temporal features as the input of step 2, as shown in the attached figure. Figure 2 With attached Figure 3 As shown;

[0063] Step 2: Construction and training of the network traffic anomaly detection model DMCG; important parameters of each part are as shown in the attached Figure 4 shown.

[0064] Model construction: Use PyTorch and Scikit-learn to build a network traffic anomaly detection model DMCG consisting of a multi-scale dilated convolution module, a bidirectional gated recurrent unit module, and a self-attention module;

[0065] The multi-scale dilated convolution module is built using the Scikit-learn library, which includes dilated convolution layers, maximum pooling layers, and linear layers.

[0066] The bidirectional gated recurrent unit module and the self-attention module are built based on the PyTorch framework;

[0067] Model training: Set the model training rounds in advance, and input the corresponding spatial and temporal features into the corresponding channels for training;

[0068] Training process: The spatial features and temporal features obtained in step 1 are divided into training set and validation set in proportion, the training set is input into the model, the spatial features are extracted using the multi-scale dilated convolution module, the extracted features are downsampled and the data dimension is reduced through the maximum pooling layer, and the spatial features of different scales are aggregated; the temporal features are input into the bidirectional gated recurrent unit module to capture the temporal dependency and hierarchical structure information, and then different weights are assigned to each time step in the sequence through the self-attention mechanism to enhance the capture of important temporal features; the temporal features are aggregated with the spatial features, and then the two are used to perform the multi-scale dilated convolution module. A classifier consisting of a linear layer and a softmax function generates the category probability of the sample, and then calculates the cross entropy loss between the predicted result and the true label. When the loss is lower than the optimal model, the current model is saved as the optimal model. When the loss is higher than the optimal model, a new round of training is performed. The early stopping mechanism is used to stop training when the loss of the trained model no longer decreases, so that the model converges to the minimum cross entropy loss while avoiding overfitting problems. During the training process, a model will be saved after one round of training, and the model with the smallest loss on the validation set will be regarded as the optimal model. If the model loss of the next round of training is smaller, it is the optimal model.

[0069] Furthermore, the specific operations of step 2 are:

[0070] Step 2.1: Data sample loading: Use the deep learning framework PyTorch 2.0, inherit the Dataset class, overload its __getitem__ method, classify the 78-dimensional features obtained in step 1, and package them into batches of size 256 as input for steps 2.2 and 2.3;

[0071] Step 2.2: Construction of spatial feature channel module: Construct three dilated convolutions with different dilation rates at different scales, with convolution kernel sizes of 3, 5, and 7, and dilation rates of 1, 2, and 3, respectively; capture information at different scales of network traffic, and output feature matrices of 256×64, which are concatenated into feature matrices of 256×192, and then integrated through the maximum pooling layer and the linear layer to form a high-level feature representation, which is then fused with the temporal features;

[0072] The receptive field formula of the dilated convolution is as follows:

[0073] k'=k+(k-1)*(d-1)

[0074] In the formula, k' represents the equivalent size of the convolution kernel after the dilated convolution; k represents the convolution kernel size; d represents the dilation rate;

[0075] Step 2.3: Time channel module construction: Use three layers of bidirectional gated recurrent units, with 128 hidden units in each layer; then use the self-attention mechanism to assign different weights to each time step in the sequence; the relevant formula is as follows:

[0076] z t =σ(W z ·[h t-1 ,x t ]+b z )

[0077] r t =σ(W r ·[h t-1 ,x t ]+b r )

[0078]

[0079] In the formula, z t represents the update gate; r t Represents the reset gate; h t Represents the hidden state passed to the next moment; represents the candidate hidden state; σ represents the sigmoid function, through which the data is converted into a value in the range of 0-1; W z represents the weight matrix of the update gate; W r Represents the weight matrix of the reset gate; W h represents the weight matrix used to calculate the candidate hidden state; x t represents the input at the current time t; b z Represents the bias vector of the update gate, which is used to adjust the linear transformation result in the update gate calculation; b r represents the bias vector of the reset gate; b h represents the bias vector of the reset gate; Q represents the query vector obtained by transforming the current traffic data or its characteristics; K represents the vector generated by linear transformation of historical traffic data or its characteristics; V represents the vector containing actual traffic information or its characteristics; represents the scaling of the dimension representing the K vector;

[0080] The outputs of step 2.2 and step 2.3 serve as the input of step 2.4;

[0081] Step 2.4: Model training: The high-level features of the training set from the spatial channel and the temporal channel are concatenated into a unified feature vector. Two linear layers are stacked in sequence to combine and transform the concatenation results of statistical features and temporal features. The first linear layer expands the feature space, and the second linear layer reduces it to 256 dimensions. The fused 256-dimensional features are mapped to the output space, and the probability distribution of each category is generated and compared with the true label. Then, the cross entropy loss is calculated between the predicted results and the true label. When the loss is lower than the optimal model, the current model is saved as the optimal model. When the loss is higher than the optimal model, a new round of training is performed. Using the early stopping mechanism, the training is stopped when the loss of the trained model no longer decreases.

[0082] Furthermore, the calculation formula of the cross entropy loss in the DMCG training process of the network traffic anomaly detection model in step 2 is:

[0083]

[0084] Among them, y i Indicates the label of sample i, the positive class is 1, the negative class is 0, p i Indicates the probability that sample i is predicted to be a positive class; L i represents the loss of the i-th sample.

[0085] Step 3: DMCG performance evaluation of network traffic anomaly detection model; use the macro average of precision, recall, and F1 score as the evaluation indicators of the model to evaluate the performance of the model;

[0086] Furthermore, the calculation formula of the DMCG evaluation index of the network traffic anomaly detection model in step 3 is:

[0087]

[0088] Among them, ACC represents accuracy, P represents precision, and R represents recall; TP (true positive) represents the number of abnormal traffic detected as abnormal; FP (false positive) represents the number of normal traffic detected as abnormal; FN (false negative) represents the number of abnormal traffic detected as normal; TN (true negative) represents the number of normal traffic detected as normal. The DMCG anomaly detection algorithm is shown in the attached figure. Figure 5 shown.

[0089] Step 4: Detection of network traffic: Use the CICFlowMeter tool to collect network traffic from the real network environment, perform data cleaning, missing value processing, normalization, etc. on the collected traffic, and send it to the network traffic anomaly detection model for detection;

[0090] Furthermore, the specific operations of step 4 are:

[0091] Step 4.1: First, analyze and extract features through step 1.1; then, perform data cleaning, missing value processing, and normalization through step 1.2 to obtain corresponding network traffic features, and classify these network traffic features into spatial features and temporal features through step 1.3;

[0092] Step 4.2: Extraction of spatial and temporal features: First, reshape the features obtained in step 4.1 through step 2.1 and package them into a batch of 256; then extract spatial features and temporal features through steps 2.2 and 2.3 respectively, and finally fuse the extracted features through step 2.4, and use the obtained features as the input of step 4.3;

[0093] Step 4.3: Anomaly detection: The obtained features are input into the classifier composed of two linear layers and softmax function to obtain the predicted category of abnormal traffic of the feature sample.

[0094] In order to verify the effectiveness of the DMCG model proposed in the present invention, a large number of experiments were conducted to evaluate DMCG. The datasets used and the dataset division method are shown in Table 1. The comparison of the evaluation results of the present invention and other detection models is shown in Table 2. The recall rate, precision rate and F1 Score indicators on the dataset are better than most existing methods, proving the superiority and effectiveness of the DMCG model in traffic analysis.

[0095] Table 1 Datasets and data set division methods

[0096]

[0097] Table 2 Comparison of evaluation results of the present invention with other detection models

[0098]

[0099] The above shows and describes the main features and advantages of the present invention. For those skilled in the art, it is obvious that the specific implementation of the present invention is not limited to the details of the above exemplary embodiments, and the creative ideas and design ideas of the present invention can be realized in other specific forms without departing from the spirit or basic features of the present invention, which should be equivalent to the protection scope disclosed in the technical solution of the present invention. Therefore, no matter from which point of view, the embodiments should be regarded as exemplary and non-restrictive. The scope of the present invention is defined by the attached claims rather than the above description, and it is intended to include all changes within the meaning and scope of the equivalent elements of the claims in the present invention.

[0100] In addition, it should be understood that although the present specification is described according to implementation modes, not every implementation mode contains only one independent technical solution. This description of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment may also be appropriately combined to form other implementation modes that can be understood by those skilled in the art.

[0101] The contents not described in detail in the specification of the present invention belong to the prior art known to the professional and technical personnel in the field. Although the illustrative specific embodiments of the present invention are described above to facilitate the understanding of the present invention by the technical personnel in the field, it should be clear that the present invention is not limited to the scope of the specific embodiments. For the ordinary technical personnel in the field, as long as various changes are within the spirit and scope of the present invention defined and determined by the attached claims, these changes are obvious, and all inventions and creations using the concept of the present invention are protected.

Claims

1. A dual-channel multi-scale network traffic anomaly detection method, characterized by: The method comprises the following steps: Step 1: Data preprocessing: Use CICFlowMeter to extract features from the collected pcap files, use the data processing functions in the Python library to preprocess the collected network traffic data, obtain the corresponding network traffic features, and classify these traffic features to obtain spatial features and temporal features; Step 2: Construction and training of network traffic anomaly detection model DMCG; Model construction: Use PyTorch and Scikit-learn to build a network traffic anomaly detection model DMCG consisting of a multi-scale dilated convolution module, a bidirectional gated recurrent unit module, and a self-attention module; The multi-scale dilated convolution module is built using the Scikit-learn library, which includes dilated convolution layers, maximum pooling layers, and linear layers. The bidirectional gated recurrent unit module and the self-attention module are built based on the PyTorch framework; Model training: Set the model training rounds in advance, and input the corresponding spatial and temporal features into the corresponding channels for training; Training process: The spatial features and temporal features obtained in step 1 are divided into training set and validation set in proportion, and the training set is input into the model. The spatial features are extracted using the multi-scale dilated convolution module. The extracted features are downsampled and data dimension reduced through the maximum pooling layer, and spatial features of different scales are aggregated. The temporal features are input into the bidirectional gated recurrent unit module to capture the temporal dependency and hierarchical structure information. Then, different weights are assigned to each time step in the sequence through the self-attention mechanism to enhance the capture of important temporal features. The temporal features are aggregated with the spatial features, and then the classifier composed of two linear layers and a softmax function is used to generate the category probability of the sample. Then, the cross entropy loss is calculated between the predicted results and the true labels. When the loss is lower than the optimal model, the current model is saved as the optimal model. When the loss is higher than the optimal model, a new round of training is performed. The early stopping mechanism is used to stop the training when the loss of the trained model no longer decreases. Step 3: Performance evaluation of the DMCG network traffic anomaly detection model; the macro average of precision, recall, and F1 score is used as the evaluation index of the model to evaluate the performance of the model; Step 4: Detection of network traffic: Use the CICFlowMeter tool to collect network traffic from the real network environment, clean the collected traffic, process missing values, normalize it, and then send it to the network traffic anomaly detection model for detection.

2. According to claim 1, a dual-channel multi-scale network traffic anomaly detection method is characterized by: The specific operations of step 1 are: Step 1.1: Data packet analysis: At a certain moment, a network attack is carried out through a fixed IP address, network traffic data packets are captured, and a pcap file is obtained. The pcap file is analyzed through CICFlowMeter to obtain relevant feature information of the network traffic data packets. At the same time, the attacker's IP address is marked to generate the real labels of abnormal traffic and normal traffic as the input of step 1.2; Step 1.2: Data cleaning: Perform missing value processing and normalization on the feature information obtained in step 1.1 to obtain 78-dimensional features for training the network traffic anomaly detection model DMCG; Step 1.3: Split time and space features: Split the processed feature information into spatial features and temporal features as input for step 2.

3. A dual-channel multi-scale network traffic anomaly detection method according to claim 2, characterized in that: The specific operations of step 2 are: Step 2.1: Data sample loading: Use the deep learning framework PyTorch 2.0, inherit the Dataset class, overload its __getitem__ method, classify the 78-dimensional features obtained in step 1, and package them into batches of size 256 as input for steps 2.2 and 2.3; Step 2.2: Construction of spatial feature channel module: Construct three dilated convolutions with different dilation rates at different scales, with convolution kernel sizes of 3, 5, and 7, and dilation rates of 1, 2, and 3, respectively; capture information at different scales of network traffic, and output feature matrices of 256×64, which are concatenated into feature matrices of 256×192, and then integrated through the maximum pooling layer and the linear layer to form a high-level feature representation, which is then fused with the temporal features; The receptive field formula of the dilated convolution is as follows: k'=k+(k-1)*(d-1) In the formula, k' represents the equivalent size of the convolution kernel after the dilated convolution; k represents the convolution kernel size; d represents the dilation rate; Step 2.3: Time channel module construction: Use three layers of bidirectional gated recurrent units, with 128 hidden units in each layer; then use the self-attention mechanism to assign different weights to each time step in the sequence; the relevant formula is as follows: z t =σ(W z ·[h t-1 ,x t ]+b z ) r t =σ(W r ·[h t-1 ,x t ]+b r ) In the formula, z t represents the update gate; r t Represents the reset gate; h t Represents the hidden state passed to the next moment; represents the candidate hidden state; σ represents the sigmoid function, through which the data is converted into a value in the range of 0-1; W z represents the weight matrix of the update gate; W r Represents the weight matrix of the reset gate; W h represents the weight matrix used to calculate the candidate hidden state; x t represents the input at the current time t; b z Represents the bias vector of the update gate, which is used to adjust the linear transformation result in the update gate calculation; b r represents the bias vector of the reset gate; b h represents the bias vector of the reset gate; Q represents the query vector obtained by transforming the current traffic data or its characteristics; K represents the vector generated by linear transformation of historical traffic data or its characteristics; V represents the vector containing actual traffic information or its characteristics; represents the scaling of the dimension representing the K vector; The outputs of step 2.2 and step 2.3 serve as the input of step 2.4; Step 2.4: Model training: The high-level features of the training sets from the spatial channel and the temporal channel are concatenated into a unified feature vector. Two linear layers are stacked in sequence to combine and transform the concatenation results of statistical features and temporal features. The first linear layer expands the feature space, and the second linear layer reduces it to 256 dimensions. The fused 256-dimensional features are mapped to the output space, and the probability distribution of each category is generated and compared with the true label. Then the cross entropy loss is calculated between the predicted results and the true label. When the loss is lower than the optimal model, the current model is saved as the optimal model. When the loss is higher than the optimal model, a new round of training is performed. Using the early stopping mechanism, training is stopped when the loss of the trained model no longer decreases.

4. The dual-channel multi-scale network traffic anomaly detection method according to claim 3 is characterized by: The calculation formula of the cross entropy loss in the DMCG training process of the network traffic anomaly detection model in step 2 is: Among them, y i Indicates the label of sample i, the positive class is 1, the negative class is 0, p i Indicates the probability that sample i is predicted to be a positive class; L i represents the loss of the i-th sample.

5. A dual-channel multi-scale network traffic anomaly detection method according to claim 4, characterized in that: The calculation formula of the DMCG evaluation index of the network traffic anomaly detection model in step 3 is: Among them, ACC represents accuracy, P represents precision, and R represents recall; TP represents the number of abnormal traffic detected as abnormal; FP represents the number of normal traffic detected as abnormal; FN represents the number of abnormal traffic detected as normal; TN represents the number of normal traffic detected as normal.

6. A dual-channel multi-scale network traffic anomaly detection method according to claim 5, characterized in that: The specific operations of step 4 are: Step 4.1: First, analyze and extract features through step 1.1; then, perform data cleaning, missing value processing, and normalization through step 1.2 to obtain corresponding network traffic features, and classify these network traffic features into spatial features and temporal features through step 1.3; Step 4.2: Extract spatial and temporal features; first, reshape the features obtained in step 4.1 through step 2.1 and package them into a batch of 256; then extract spatial and temporal features through steps 2.2 and 2.3 respectively, and finally fuse the extracted features through step 2.4, and use the obtained features as the input of step 4.3; Step 4.3: Anomaly detection: Input the obtained features into a classifier consisting of two linear layers and a softmax function to obtain the abnormal traffic prediction category of the feature sample.

Images