Network situation prediction method based on spatial-temporal characteristics and XGBOOST model

Abstract

The invention discloses a network situation prediction method based on spatial-temporal characteristics and an XGBOOST model. The method comprises the following steps: acquiring network traffic data of a to-be-predicted network situation, and extracting network traffic features; inputting the network flow characteristics as input data into the trained prediction module to obtain a network situation prediction result; the prediction module comprises a CNN module and a bidirectional LSTM module, and the CNN module performs convolution processing on input data to obtain flow space features corresponding to the input data; the bidirectional LSTM module processes the input data to obtain network traffic high-dimensional time sequence features corresponding to the input data; and splicing the traffic spatial features and the network traffic high-dimensional time sequence features to obtain spliced features, and inputting the spliced features, the traffic spatial features and the network traffic high-dimensional time sequence features into an XGBOOST model to obtain a network situation prediction result. According to the invention, the time sequence feature-based network situation prediction effect is improved.

Description

Technical Field

[0001] The invention belongs to the technical field of network security, and in particular relates to a network situation prediction method based on spatiotemporal features and an XGBOOST model. Background Art

[0002] Domestic and foreign network situation prediction methods are generally based on node monitoring data (such as memory utilization, CPU utilization, disk read and write rates, network I / O, etc.) or reported abnormal log information data (such as alarm logs), mining the characteristics of each type of situation, and establishing a correlation model between network operation data and network situation, so as to predict the possibility of node abnormalities in the future. The classification prediction model in machine learning can be used to fit the relationship between network operation situation and abnormalities. However, the existing situation prediction methods based on typical classification models such as SVM, decision tree, random forest, etc. are mostly only applicable to the abnormal binary classification prediction of a single component (such as disk, memory, CPU, etc.), and it is difficult to make an effective division of multiple abnormal types of nodes, which weakens the guiding significance of the situation prediction results to a certain extent.

[0003] At present, network situation prediction technology involves the fields of neural network technology, deep learning technology, and machine learning technology. Neural network prediction is one of the most commonly used situation prediction methods. The neural network prediction model is a tool with good fitting, self-learning and self-memory functions for target samples, parallel processing, high fault tolerance, and strong approximation capabilities. It can obtain the characteristic patterns of complex nonlinear data. The principle of using neural network to predict situation is: first, some input and output data are used as training samples, and the weights are adjusted through the self-learning ability of the network to build a situation prediction model; then the model is used to realize the nonlinear mapping from input state to output state space. It has the advantage of being able to minimize risks through experience, but it also has shortcomings: such as it is not easy to determine the structural model and reduce the promotion ability. In the learning process, if the number of samples is insufficient, the learning accuracy is difficult to guarantee, because it is easy to converge to the local minimum point, resulting in errors in the learning process; if the number of samples is large, the learning accuracy can be improved, but it will lead to low generalization performance and fall into the dimensionality disaster.

[0004] With the development of computer technology, research on machine learning, deep learning and other related algorithms has become more and more extensive, and has achieved great success in many fields. There are many ways to process huge amounts of data, and the time required to predict a small amount of data can reach milliseconds. Summary of the invention

[0005] The present invention provides a network situation prediction method based on spatiotemporal features and an XGBOOST model, which is used to solve the problem of inaccurate network situation caused by abnormal cascading changes or at least partially solve the above problem.

[0006] In a first aspect, a network situation prediction method based on spatiotemporal features and an XGBOOST model is disclosed, the method comprising:

[0007] Step S1: Obtain network traffic data of the network situation to be predicted and extract network traffic features; the network traffic features include source IP, destination IP, source port, destination port, and protocol type;

[0008] Step S2: using the network traffic characteristics as input data and inputting them into the trained prediction module to obtain a network situation prediction result;

[0009] The prediction module includes a parallel CNN module and a bidirectional LSTM module. Both the CNN module and the bidirectional LSTM module receive the input data. The CNN module performs convolution processing on the input data to obtain traffic space features corresponding to the input data; the bidirectional LSTM module processes the input data to obtain high-dimensional time series features of network traffic corresponding to the input data; the traffic space features and the high-dimensional time series features of the network traffic are spliced ​​to obtain splicing features, and the splicing features, the traffic space features and the high-dimensional time series features of the network traffic are input into the XGBOOST model to obtain a network situation prediction result.

[0010] Preferably, the training process of the prediction module is:

[0011] Step S11: Acquire training data, where the training data is traffic data with marked attack types; perform dimensionality reduction operation on the training data;

[0012] Step S22: input the reduced-dimensional training data into the prediction module, input the labels corresponding to the reduced-dimensional training data as labels, and input them into the CNN module and the bidirectional LSTM module respectively; the CNN module extracts the traffic space features corresponding to the reduced-dimensional training data; the bidirectional LSTM module extracts the high-dimensional time series features of the network traffic corresponding to the reduced-dimensional training data; splice the traffic space features corresponding to the reduced-dimensional training data and the high-dimensional time series features of the network traffic corresponding to the reduced-dimensional training data, and input the spliced ​​features, the traffic space features corresponding to the reduced-dimensional training data, and the high-dimensional time series features of the network traffic corresponding to the reduced-dimensional training data into the XGBOOST model to obtain a network situation prediction result corresponding to the training data.

[0013] Preferably, performing a dimensionality reduction operation on the training data includes:

[0014] Performing feature importance analysis on the various network traffic features contained in the training data; sorting the network traffic features contained in the training data according to the analysis results, and performing a dimensionality reduction operation on the training data based on the sorting results.

[0015] In a second aspect, a network situation prediction device based on spatiotemporal features and an XGBOOST model is disclosed, the device comprising:

[0016] Feature extraction module: configured to obtain network traffic data of the network situation to be predicted and extract network traffic features; the network traffic features include source IP, destination IP, source port, destination port, and protocol type;

[0017] Prediction module: configured to use the network traffic characteristics as input data, input the trained prediction module, and obtain the network situation prediction result;

[0018] The prediction module includes a parallel CNN module and a bidirectional LSTM module. Both the CNN module and the bidirectional LSTM module receive the input data. The CNN module performs convolution processing on the input data to obtain traffic space features corresponding to the input data; the bidirectional LSTM module processes the input data to obtain high-dimensional time series features of network traffic corresponding to the input data; the traffic space features and the high-dimensional time series features of the network traffic are spliced ​​to obtain splicing features, and the splicing features, the traffic space features and the high-dimensional time series features of the network traffic are input into the XGBOOST model to obtain a network situation prediction result.

[0019] Preferably, the training process of the prediction module is:

[0020] Acquire training data, where the training data is traffic data with annotated attack types; perform a dimensionality reduction operation on the training data;

[0021] The reduced-dimensional training data is input into the prediction module, and the labels corresponding to the reduced-dimensional training data are input as labels and respectively input into the CNN module and the bidirectional LSTM module; the CNN module extracts the traffic space features corresponding to the reduced-dimensional training data; the bidirectional LSTM module extracts the high-dimensional time series features of the network traffic corresponding to the reduced-dimensional training data; the traffic space features corresponding to the reduced-dimensional training data and the high-dimensional time series features of the network traffic corresponding to the reduced-dimensional training data are spliced, and the spliced ​​features, the traffic space features corresponding to the reduced-dimensional training data and the high-dimensional time series features of the network traffic corresponding to the reduced-dimensional training data are input into the XGBOOST model to obtain a network situation prediction result corresponding to the training data.

[0022] Preferably, performing a dimensionality reduction operation on the training data includes:

[0023] Performing feature importance analysis on the various network traffic features contained in the training data; sorting the network traffic features contained in the training data according to the analysis results, and performing a dimensionality reduction operation on the training data based on the sorting results.

[0024] In a third aspect, an electronic device is disclosed, the electronic device comprising:

[0025] at least one processor; and

[0026] a memory communicatively connected to the at least one processor; wherein,

[0027] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method described above.

[0028] In a fourth aspect, a non-transitory computer-readable storage medium storing computer instructions is disclosed, wherein the computer instructions are used to cause the computer to execute the method as described above.

[0029] The present invention has the following technical effects:

[0030] The present invention combines CNN to extract high-dimensional local features and LSTM to extract high-dimensional time series features for model training, which can effectively solve the problem of inaccurate network status caused by abnormal cascading changes in the network and improve the network status prediction effect based on time series features.

[0031] This method comprehensively considers the limitations of neural networks, and improves the prediction effect by integrating the advantages of a single neural network through learning multiple neural networks.

[0032] The present invention reduces the dimension of the original data, focuses on several features, strengthens the processing of local features, and enhances the fitting effect of the model for local features;

[0033] The present invention is based on both LSTM model and CNN model, fully exploits the time and space information characteristics, and improves the network situation prediction effect based on time series characteristics. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a flow chart of a network situation prediction method based on spatiotemporal characteristics and XGBOOST model of the present invention;

[0035] Figure 2 It is a schematic diagram of the network situation prediction method architecture based on spatiotemporal characteristics and XGBOOST model of the present invention;

[0036] Figure 3This is a schematic diagram for comparing the prediction effects of the present invention;

[0037] Figure 4 It is a schematic diagram of the structure of the network situation prediction device based on spatiotemporal characteristics and the XGBOOST model of the present invention. DETAILED DESCRIPTION

[0038] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0039] like Figure 1-Figure 2 As shown, the present invention provides a network situation prediction method based on spatiotemporal characteristics and an XGBOOST model, the method comprising:

[0040] Step S1: Obtain network traffic data of the network situation to be predicted and extract network traffic features; the network traffic features include source IP, destination IP, source port, destination port, and protocol type;

[0041] Step S2: using the network traffic characteristics as input data and inputting them into the trained prediction module to obtain a network situation prediction result;

[0042] The prediction module includes a parallel CNN module and a bidirectional LSTM module. Both the CNN module and the bidirectional LSTM module receive the input data. The CNN module performs convolution processing on the input data to obtain traffic space features corresponding to the input data; the bidirectional LSTM module processes the input data to obtain high-dimensional time series features of network traffic corresponding to the input data; the traffic space features and the high-dimensional time series features of the network traffic are spliced ​​to obtain splicing features, and the splicing features, the traffic space features and the high-dimensional time series features of the network traffic are input into the XGBOOST model to obtain a network situation prediction result.

[0043] Furthermore, the training process of the prediction module is:

[0044] Step S11: Acquire training data, where the training data is traffic data with marked attack types; perform dimensionality reduction operation on the training data;

[0045] Step S22: input the reduced-dimensional training data into the prediction module, input the labels corresponding to the reduced-dimensional training data as labels, and input them into the CNN module and the bidirectional LSTM module respectively; the CNN module extracts the traffic space features corresponding to the reduced-dimensional training data; the bidirectional LSTM module extracts the high-dimensional time series features of the network traffic corresponding to the reduced-dimensional training data; splice the traffic space features corresponding to the reduced-dimensional training data and the high-dimensional time series features of the network traffic corresponding to the reduced-dimensional training data, and input the spliced ​​features, the traffic space features corresponding to the reduced-dimensional training data, and the high-dimensional time series features of the network traffic corresponding to the reduced-dimensional training data into the XGBOOST model to obtain a network situation prediction result corresponding to the training data.

[0046] Furthermore, a dimension reduction operation is performed on the training data, including:

[0047] Performing feature importance analysis on the various network traffic features contained in the training data; sorting the network traffic features contained in the training data according to the analysis results, and performing a dimensionality reduction operation on the training data based on the sorting results.

[0048] The bidirectional LSTM module extracts the temporal variation characteristics of the feature correlation within the time window through the LSTM algorithm, and then performs classification prediction through a fully connected neural network.

[0049] The CNN module includes a CNN model. The convolution layer in the CNN model extracts feature information from the data. The scale of each convolution kernel can be regarded as a receptive field. During the operation, the randomly obtained initialization weights in the convolution kernel are inner-producted with the input data; the convolution layer uses a full zero padding method to ensure that the scale of the output feature is the same as the input feature. The pooling layer performs a dimensionality reduction operation after obtaining the feature to reduce the number of model parameters; the feature information extracted by CNN is input into the fully connected layer, and the fully connected layer outputs the situation prediction result;

[0050] The XGBOOST model includes the XGBoost ensemble learning model:

[0051] The XGBoost ensemble learning model is expressed as:

[0052]

[0053] Among them, obJ(f t ) is the objective function of the XGBoost ensemble learning model;

[0054] is the training error of the XGBoost ensemble learning model;

[0055] Ω(f t) is the complexity of the decision tree in the XGBoost ensemble learning model;

[0056] con is the structure of the first t-1 trees, which is a constant; t is the tth decision tree; f t (x i ) is the final score function of a sample in the tth tree.

[0057] According to Taylor's formula:

[0058]

[0059] At the same time, order:

[0060]

[0061] Among them, g i is the prediction error The first-order partial derivative of g i =f ′ (x); h i is the prediction error The second-order partial derivative, h i =f″(x);

[0062] The XGBoost ensemble learning model iterates in a direction of reducing prediction error during training.

[0063] The experimental results of the present invention are as follows Figure 3 shown.

[0064] like Figure 4 As shown, the present invention provides a network situation prediction device based on spatiotemporal characteristics and an XGBOOST model, the device comprising:

[0065] Feature extraction module: configured to obtain network traffic data of the network situation to be predicted and extract network traffic features; the network traffic features include source IP, destination IP, source port, destination port, and protocol type;

[0066] Prediction module: configured to use the network traffic characteristics as input data, input the trained prediction module, and obtain the network situation prediction result;

[0067] The prediction module includes a parallel CNN module and a bidirectional LSTM module. Both the CNN module and the bidirectional LSTM module receive the input data. The CNN module performs convolution processing on the input data to obtain traffic space features corresponding to the input data; the bidirectional LSTM module processes the input data to obtain high-dimensional time series features of network traffic corresponding to the input data; the traffic space features and the high-dimensional time series features of the network traffic are spliced ​​to obtain splicing features, and the splicing features, the traffic space features and the high-dimensional time series features of the network traffic are input into the XGBOOST model to obtain a network situation prediction result.

[0068] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them. Although the present invention has been described in detail with reference to the above embodiments, it should be understood by those skilled in the art that the technical solutions described in the above embodiments can still be modified, or some or all of the technical features therein can be replaced by equivalents, and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network situation prediction method based on spatiotemporal characteristics and XGBOOST model, characterized in that: The method comprises the following steps: Step S1: Obtain network traffic data of the network situation to be predicted and extract network traffic features; the network traffic features include source IP, destination IP, source port, destination port, and protocol type; Step S2: using the network traffic characteristics as input data and inputting them into the trained prediction module to obtain a network situation prediction result; The prediction module includes a parallel CNN module and a bidirectional LSTM module, both of which receive the input data, and the CNN module performs convolution processing on the input data to obtain traffic space features corresponding to the input data; The bidirectional LSTM module processes the input data to obtain high-dimensional time series features of network traffic corresponding to the input data; splices the traffic spatial features and the network traffic high-dimensional time series features to obtain splicing features, and inputs the splicing features, the traffic spatial features and the network traffic high-dimensional time series features into the XGBOOST model to obtain a network situation prediction result.

2. The method according to claim 1, characterized in that The training process of the prediction module is: Step S11: Acquire training data, where the training data is traffic data with marked attack types; perform dimensionality reduction operation on the training data; Step S22: input the reduced-dimensional training data into the prediction module, input the labels corresponding to the reduced-dimensional training data as labels, and input them into the CNN module and the bidirectional LSTM module respectively; the CNN module extracts the traffic space features corresponding to the reduced-dimensional training data; The bidirectional LSTM module extracts high-dimensional time series features of network traffic corresponding to the training data after dimensionality reduction; The traffic space features corresponding to the reduced-dimensional training data and the high-dimensional time series features of the network traffic corresponding to the reduced-dimensional training data are spliced, and the spliced ​​features, the traffic space features corresponding to the reduced-dimensional training data and the high-dimensional time series features of the network traffic corresponding to the reduced-dimensional training data are input into the XGBOOST model to obtain a network situation prediction result corresponding to the training data.

3. The method according to claim 2, characterized in that Performing a dimensionality reduction operation on the training data includes: Performing feature importance analysis on the various network traffic features contained in the training data; sorting the network traffic features contained in the training data according to the analysis results, and performing a dimensionality reduction operation on the training data based on the sorting results.

4. A network situation prediction device based on spatiotemporal features and XGBOOST model, characterized in that: The device comprises: Feature extraction module: configured to obtain network traffic data of the network situation to be predicted and extract network traffic features; the network traffic features include source IP, destination IP, source port, destination port, and protocol type; Prediction module: configured to use the network traffic characteristics as input data, input the trained prediction module, and obtain the network situation prediction result; The prediction module includes a parallel CNN module and a bidirectional LSTM module. Both the CNN module and the bidirectional LSTM module receive the input data. The CNN module performs convolution processing on the input data to obtain traffic space features corresponding to the input data; the bidirectional LSTM module processes the input data to obtain high-dimensional time series features of network traffic corresponding to the input data; the traffic space features and the high-dimensional time series features of the network traffic are spliced ​​to obtain splicing features, and the splicing features, the traffic space features and the high-dimensional time series features of the network traffic are input into the XGBOOST model to obtain a network situation prediction result.

5. The device according to claim 4, characterized in that The training process of the prediction module is: Acquire training data, where the training data is traffic data with annotated attack types; perform a dimensionality reduction operation on the training data; The training data after dimensionality reduction is input into the prediction module, and the labels corresponding to the training data after dimensionality reduction are input as labels, and are respectively input into the CNN module and the bidirectional LSTM module; the CNN module extracts the traffic space features corresponding to the training data after dimensionality reduction; The bidirectional LSTM module extracts high-dimensional time series features of network traffic corresponding to the training data after dimensionality reduction; The traffic space features corresponding to the reduced-dimensional training data and the high-dimensional time series features of the network traffic corresponding to the reduced-dimensional training data are spliced, and the spliced ​​features, the traffic space features corresponding to the reduced-dimensional training data and the high-dimensional time series features of the network traffic corresponding to the reduced-dimensional training data are input into the XGBOOST model to obtain a network situation prediction result corresponding to the training data.

6. The device according to claim 5, characterized in that Performing a dimensionality reduction operation on the training data includes: Performing feature importance analysis on the various network traffic features contained in the training data; sorting the network traffic features contained in the training data according to the analysis results, and performing a dimensionality reduction operation on the training data based on the sorting results.

7. A computer-readable storage medium, wherein a plurality of instructions are stored in the storage medium; the plurality of instructions are used for a processor to load and execute the method as claimed in any one of claims 1 to 3.

8. An electronic device, characterized in that: The electronic device comprises: A processor, which is used to execute multiple instructions; A memory for storing a plurality of instructions; The plurality of instructions are used to be stored in the memory and loaded and executed by the processor according to any one of claims 1 to 3.

Images