Small sample malignant flow detection method based on hierarchical semantics and prototype learning

Abstract

The invention discloses a small sample malignant traffic detection method based on hierarchical semantics and prototype learning, and belongs to the technical field of network security. Representing the network flow as a multi-level representation matrix, and depicting information of different granularities in the network flow; constructing a plurality of small sample classification tasks under the meta-learning framework; for a flow representation matrix in each small sample classification task, performing feature extraction from a byte level, a data packet level and a network flow level from bottom to top by adopting a three-layer network structure, and constructing to obtain a good flow feature vector; in the similarity measurement stage, a plurality of prototypes are adaptively generated by adopting a neighborhood division mode according to flow feature distribution characteristics, and a classification result is obtained by calculating the distance between a prototype vector and a flow feature vector in a query set, so that the problems of lack of flow hierarchy semantic representation, incapability of adaptively fitting flow feature distribution and difficulty in classification in the prior art are solved. And it is difficult to effectively detect the small sample encrypted malignant traffic.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a small sample malicious traffic detection method based on hierarchical semantics and prototype learning. Background Art

[0002] With the rapid development of the Internet, the scale of the network is also expanding. It is very important to strengthen the effective supervision of Internet operations and timely detect various network threats and risks to ensure network security. Network traffic classification technology plays an extremely important role in modern network supervision. By timely discovering the malicious traffic generated by malicious network activities, network attacks can be discovered in time to avoid network security risks.

[0003] At present, network traffic is showing a trend of encryption, which brings great challenges to the detection of malicious traffic. For encrypted traffic, network security personnel mainly extract side channel features from the traffic, and use a large number of samples combined with deep learning methods to train a good classification model to identify encrypted malicious traffic. However, new types of malicious traffic continue to emerge. Due to the limited number of predefined categories, the fixed parameters in the trained deep learning model are difficult to adapt to new malicious traffic in a timely manner. At the same time, encrypted malicious traffic is highly concealed. In some cases, security agencies can only intercept a limited number of samples. It has small sample characteristics and cannot meet the sample size requirements of traditional deep learning methods. Therefore, it is necessary to effectively detect small sample encrypted malicious traffic.

[0004] Inspired by the ability of humans to quickly learn and adapt to new tasks from a small number of examples, meta-learning has been proposed to solve the small sample problem, including MAML, matching networks, prototype networks, etc. Among them, the prototype network builds a prototype for each class and classifies it by comparing the distance or similarity between the query sample and the class prototype. Due to its simplicity and effectiveness, it has been widely used to solve the problem of small sample malicious traffic classification. The raw bytes of network traffic contain rich underlying information, which is universal and can be effectively transferred between different meta-training tasks and meta-testing tasks. Therefore, researchers use the raw byte features of traffic combined with prototype networks to construct small sample malicious traffic classification tasks. However, these methods lack feature extraction design based on traffic structure. Directly combining the first N bytes of the network flow or the first N bytes of the first M data packets sequentially and inputting them into the feature extraction model may introduce sequential dependencies that do not exist originally, and thus cannot effectively distinguish coarse-grained features (inter-packet relations) and fine-grained features (byte sequences within packets). At the same time, these studies simply treat the payload of the packet header of the packet equally, but ignore the difference in meaning between them, resulting in insufficient feature extraction. In addition, existing methods use a single prototype to describe traffic features in feature embedding space. However, in the problem of malicious traffic classification, traffic samples from different malicious families have different features and present diverse distributions. It is difficult for a single prototype to effectively describe them, resulting in unstable classification performance. Therefore, how to provide deep traffic semantics based on traffic structure features, accurately characterize malicious traffic patterns based on traffic feature distribution, and train high-quality classification models is the key to accurate small-sample encrypted malicious traffic detection. Summary of the invention

[0005] The purpose of the present invention is to provide a small sample malicious traffic detection method based on hierarchical semantics and prototype learning. In view of the problems that the small sample malicious traffic detection method in the related art lacks traffic hierarchical semantic representation, cannot comprehensively characterize the traffic, and a single prototype is difficult to fully represent the diverse traffic characteristics and difficult to adapt to simple and complex traffic feature distributions, resulting in poor detection effect, an adaptive prototype generation method is adopted to adaptively generate multiple prototypes according to the traffic characteristics to handle the complex distribution in the malicious data set.

[0006] To achieve the above object, the present invention provides a small sample malicious traffic detection method based on hierarchical semantics and prototype learning, comprising the following steps:

[0007] Step 1: Obtain encrypted network flows including benign and multiple malignant ones, preprocess the encrypted network flows, and obtain flow representation matrices of different network flows;

[0008] Step 2: According to the categories corresponding to the flow representation matrix, a meta-training set is constructed, and the prototype network in the meta-learning is used as the classification network. The small sample classification tasks in the meta-learning are constructed accordingly. Each meta-training set includes several small sample classification tasks, and each small sample classification task includes a support set and a query set.

[0009] Step 3: For each small sample classification task, a three-layer network is used to perform hierarchical feature extraction to obtain the support set flow feature vector and the query set flow feature vector;

[0010] Step 4: The classification network calculates several benign and malignant class prototype feature vectors according to the support set flow feature vector and stores them accordingly;

[0011] Step 5: Measure the similarity between the query set flow feature vector and the class prototype feature vector to determine the category to which the query set belongs, and establish a loss function. According to the loss function, optimize the classification network until the target is met and the classification network training is completed.

[0012] Step 6: Introduce new malignant samples and benign samples to form a meta-test set. Similarly, obtain the support set flow feature vector and query set flow feature vector of the meta-test set through step 3, calculate and obtain several benign and malignant class prototype feature vectors, and store them accordingly.

[0013] Step 7: For the query set samples in the meta-test set, the similarity between the query set flow feature vector of the meta-test set and the class prototype feature vector is calculated through the classification network to determine the category of the unknown data.

[0014] Preferably, the specific process of step 1 is as follows: the preprocessing process includes cleaning, quintuple splitting and anonymization;

[0015] For the flow representation matrix: for each flow, take the original bytes of the first M packets, convert the hexadecimal bytes to decimal, truncate or fill the IP header bytes, TCP header bytes and payload bytes respectively; the reserved bytes of each data packet are normalized into an 8×40 byte matrix, containing 8 rows and 40 columns, the first two rows represent the IP header bytes and TCP header bytes respectively, and the 3rd to 8th rows represent the payload bytes; then the packet byte matrices of M packets are stacked to form a (M×8)×40 flow representation matrix.

[0016] Preferably, the specific process of step 2 is as follows:

[0017] The meta-training dataset is Dataset = {(x1, l1), ..., (x N , l N )}, where (x i , l i ) represents the i-th flow sample, xi Represents the flow representation matrix of the i-th traffic sample, l i Represents the category of the i-th sample, which includes benign samples and various types of malignant samples; N s is the number of samples in each class support set for each small sample task, N q is the number of samples of each type of query set in each small sample task;

[0018] The process of constructing small sample tasks in the meta-training set is as follows: for each small sample task, first randomly select N from the benign traffic samples. s samples to construct the support set of benign samples, and randomly select N samples from the remaining samples of benign samples. q samples to build a benign sample query set; then randomly select a type of malignant traffic sample and select N from the malignant samples of this type s samples to construct the support set of malignant samples, and randomly select N samples from the remaining samples of this type of malignant samples. q samples to construct a query set of malignant samples; finally, the support set and query set of the two types of samples are merged as a small sample classification task. For each sample in the small sample task, a label is assigned according to its sample type. If the sample type is benign, the sample label is 0, and if the sample type is malignant, the sample label is 1. In this way, the construction of a binary classification small sample task is completed, and the small sample classification task is added to the meta-training set; the above process is repeated until the number of constructed small sample tasks reaches the requirement.

[0019] Preferably, in step three, the specific process is as follows:

[0020] The same three-layer network structure is used to implement bottom-up hierarchical feature extraction at the byte level, data packet level, and network flow level. Each layer of the network structure includes a bidirectional long short-term memory network BiLSTM and an Attention mechanism. The specific extraction process is as follows:

[0021] Convert the flow representation matrix into where e m,n，i represents the ith byte of the nth row of the mth packet, M represents the number of packets in the flow representation matrix, N represents the number of rows contained in each packet in the flow representation matrix, L represents the number of bytes contained in each row, and the word embedding matrix W is randomly initialized. e , convert byte e m,n，i Embed, get vector x m,n，i , formula (1) is as follows:

[0022] x m,n,i =W e e m,n，i ; (1)

[0023] Byte-level extraction, first extract features from the bytes in each row of the flow representation matrix, and use BiLSTM to encode the bytes in each row in both the front and back directions to obtain the context information of the bytes, as shown in formula (2), h m，n，i is x m,n，i The encoding vector after LSTM, the bytes in each row are encoded to obtain the encoding vector H:

[0024] H=[h m，n，1 ,…,h m，n，L ]=BiLSTM([x m,n，1 , …, x m，n，L ]); (2)

[0025] The attention mechanism is introduced to extract the encoding representation of bytes containing important information and aggregate them into byte-level vectors: First, h m，n，i After passing through the multi-layer perceptron, its hidden representation u is obtained m，n，i , and then calculate its correlation with the context vector u w The similarity of m，n，i , calculate the weighted sum of the byte encodings to get the byte-level vector s m，n , as shown in formulas (3)-(5)

[0026] u m，n，i =tanh(W w h m，n，i +b w ); (3)

[0027]

[0028] s m,n =∑ i a m,n，i h m，n，i ; (5)

[0029] Among them, W w and b w Represent the weight matrix and bias vector respectively, which are the training parameters of the model and are used to convert the input h m,n，i Mapped to the attention space, is u m，n，i The transposed vector, u w It is a context vector that can be trained by the model, representing the important semantic direction in the task;

[0030] At the packet level, we extract and aggregate features of several row vectors in each packet to form a representation of each packet, and use BiLSTM to represent the byte-level vector s in each packet. m，n Encode, extract the context information, and then calculate the attention weight a of the byte-level vector encoding m,nFinally, the weighted sum of the byte-level vectors is calculated to obtain the packet vector representation p m , as shown in formulas (6)-(9)

[0031] [q m,1 , ..., q m,N ]=BiLSTM([s m,1 , ..., s m,N ]); (6)

[0032] r m，n =tanh(W s q m,n +b s ); (7)

[0033]

[0034] p m =∑ n a m,n q m,n ; (9)

[0035] Among them, W s and b s Represent the weight matrix and bias vector respectively, which are used to convert the input q m,n Mapped to the attention space, Yes m，n The transposed vector, u s is the context vector that the model can train;

[0036] At the network flow level, as shown in formula (10)-formula (13), BiLSTM is used to train the packet vector p m Encode and then calculate the attention weight a of the bag vector encoding m , and finally calculate the weighted sum f of the packet vectors as the flow feature vector representation:

[0037] [t1, ..., t M ]=BiLSTM([p1,...,p M ]); (10)

[0038] v m =tanh(W o r m +b o ); (11)

[0039]

[0040] f=∑ m a m v m ; (13)

[0041] Among them, W o and b o Represent the weight matrix and bias vector respectively, which are used to convert the input r m Mapped to the attention space, Yes m The transposed vector, u j is the context vector that the model can train;

[0042] The output vector f is the flow feature vector obtained through three-layer network feature extraction, corresponding to the support set flow feature vector and query set flow feature vector in different small sample classification tasks.

[0043] Preferably, the specific process in step 4 is as follows:

[0044] The process of calculating the class prototype feature vector according to the support set flow feature vector is as follows: for each class of support set samples in each small sample classification task, calculate the cosine similarity between the flow feature vectors of any two support set samples in the feature embedding space, obtain the nearest neighbor information of the flow feature vector of each support set sample in the feature embedding space, and then obtain the sample adjacency matrix according to the following formula:

[0045]

[0046] in Represents the flow feature vector closest to the flow feature vector of sample i. According to the above formula, three adjacency relationships are established for the support set samples of each class in each small sample task: if the nearest neighbor of the flow feature vector of sample i is the flow feature vector of sample j, then there is an adjacency relationship between the two samples; if the nearest neighbor of the flow feature vector of sample j is the flow feature vector of sample i, then there is an adjacency relationship between the two samples; in addition, if i and j are connected through the same nearest neighbor, it means that the similarity between them is high, and the adjacency relationship between the samples is established. After these steps, the flow feature vectors of the connected samples have a high degree of similarity. The center points of the flow feature vectors of these samples are calculated, and the above process is repeated until the difference in the number of center points generated in the two iterations is less than the set threshold Z. Finally, the center point after the iteration is completed is used as the prototype of each class, and the feature vector of the center point is used as the class prototype feature vector.

[0047] Preferably, in step 5, the process of verifying and optimizing the classification network through the query set is as follows:

[0048] After the classification network classifies the query set samples, cross entropy is used as the classification loss. m}, their actual categories are {y1,y2,…,y m}, the predicted probability of the model is Then calculate the cross entropy loss LCE as follows:

[0049]

[0050] In the above formula, m represents the number of query set samples;

[0051] Constrained loss L of class prototype feature vector PC ,Will Defined as the i-th prototype in class z, μ z Defined as a prototype center of type Z, Defined as the prototype center of the anti-class, then the constraint loss term of the i-th prototype of class z is

[0052]

[0053] The total class prototype feature vector constraint loss is:

[0054]

[0055] Where Z is the total number of traffic categories, k z is the number of prototype eigenvectors of class z;

[0056] The total loss is calculated as

[0057] L Total =λ·L CE +(1-λ)·δ·L PC ; (18)

[0058] where λ and δ are two hyperparameters with values ​​in the range [0,1].

[0059] Preferably, in step seven, the process of calculating the similarity adopts a method based on Euclidean distance to calculate the Euclidean distance between the query set flow feature vector and the class prototype feature vector. According to the calculation result, the category of the unknown query set sample is determined as the category to which the class prototype feature vector with the closest Euclidean distance belongs.

[0060] Therefore, the present invention adopts the above-mentioned small sample malicious traffic detection method based on hierarchical semantics and prototype learning, which has the following advantages:

[0061] (1) The problem of identifying small-sample encrypted malicious traffic is solved by using a meta-learning framework. A large number of similar small-sample classification tasks are used to train the classification model and learn meta-knowledge. A small number of new encrypted malicious traffic samples to be detected are used to build similar classification tasks. Accurate detection of new encrypted malicious traffic is achieved through similarity measurement without time-consuming fine-tuning. In terms of feature extraction, a hierarchical extraction method for traffic features is proposed to construct a multi-level representation matrix of traffic bytes. A hierarchical network structure is used to perform bottom-up traffic feature abstraction on the traffic. This structure can fully extract important information between different packets in the flow and different layers in the data packet, providing a more comprehensive traffic representation. In terms of similarity measurement, a class prototype adaptive generation method is proposed to dynamically generate adaptive prototypes based on traffic feature distribution and feature neighborhood relationship, balance simple and complex traffic feature distribution, and achieve accurate detection of small-sample malicious traffic.

[0062] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 This is a flow chart of a small sample malicious traffic detection method based on hierarchical semantics and prototype learning of the present invention;

[0064] Figure 2 The present invention discloses a process of constructing a flow representation matrix in a small sample malicious flow detection method based on hierarchical semantics and prototype learning;

[0065] Figure 3 A flow chart for constructing a meta-learning task in a small sample malicious traffic detection method based on hierarchical semantics and prototype learning of the present invention;

[0066] Figure 4 This is a feature extraction structure diagram of a small sample malicious traffic detection method based on hierarchical semantics and prototype learning in the present invention. DETAILED DESCRIPTION

[0067] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. The components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations. The specific model specifications need to be selected and determined according to the actual specifications of the device, and the specific selection calculation method adopts the existing technology in the field, so it will not be described in detail.

[0068] Example

[0069] like Figure 1-Figure 4As shown, the present invention provides a small sample malicious traffic detection method based on hierarchical semantics and prototype learning, comprising the following steps:

[0070] Step 1: Obtain encrypted network flows containing benign and multiple malignant ones, and preprocess the encrypted network flows. The preprocessing process includes cleaning, five-tuple splitting and anonymization. Specifically, the PCAP file of the original encrypted traffic is cleaned to remove retransmitted packets and out-of-order packets. Then, it is split according to the five-tuple of <source IP, source port, destination IP, destination port, protocol> into several network flows, and the IP addresses in the flows are anonymized and replaced with 0.0.0.0.

[0071] For each flow, take the original bytes of the first M packets (M=7 in this article), convert the hexadecimal bytes to decimal, and truncate or fill the IP header bytes, TCP header bytes, and payload bytes respectively; in order to avoid excessive filling and retain as much information as possible, the length of the IP header and TCP header is retained to 40 bytes respectively, and the first 240 bytes are retained for the payload; the reserved bytes of each data packet are normalized into an 8×40 byte matrix, containing 8 rows and 40 columns. The first two rows represent the IP header bytes and the TCP header bytes, respectively, and the 3rd to 8th rows represent the payload bytes; then the packet byte matrices of the M packets are stacked to form a (M×8)×40 flow representation matrix; the processing process is as follows Figure 2 As shown;

[0072] Step 2: According to the categories corresponding to the flow representation matrix, a meta-training set is constructed, and the prototype network in the meta-learning is used as the classification network. The small sample classification tasks in the meta-learning are constructed accordingly. Each meta-training set includes several small sample classification tasks, and each small sample classification task includes a support set and a query set.

[0073] The specific process is as follows: The meta-training data set is Dataset = {(x1, l1),…, (x N ,l N )}, where (x i ,l i represents the i-th flow sample, x i Represents the flow representation matrix of the i-th traffic sample, l i Represents the category of the i-th sample, which includes benign samples and various types of malignant samples; N s is the number of samples in each class support set for each small sample task, N q is the number of samples of each type of query set in each small sample task;

[0074] like Figure 3As shown in the figure, three types of encrypted malicious traffic samples A, B, and C, as well as some O encrypted benign traffic samples are used as meta-training sets. The process of constructing small sample tasks in the meta-training set is as follows: for each small sample task, first randomly select N from the benign traffic samples. s samples to construct the support set of benign samples, and randomly select N samples from the remaining samples of benign samples. q samples to build a benign sample query set; then randomly select a type of malignant traffic sample and select N from the malignant samples of this type s samples to construct the support set of malignant samples, and randomly select N samples from the remaining samples of this type of malignant samples. q samples to construct a query set of malignant samples; finally, the support set and query set of the two types of samples are merged as a small sample classification task. For each sample in the small sample task, a label is assigned according to its sample type. If the sample type is benign, the sample label is 0, and if the sample type is malignant, the sample label is 1. In this way, the construction of a binary classification small sample task is completed, and the small sample classification task is added to the meta-training set; the above process is repeated until the number of constructed small sample tasks reaches the requirement.

[0075] Step 3: For each small sample classification task, a three-layer network is used to perform hierarchical feature extraction to obtain the support set flow feature vector and the query set flow feature vector. The specific process is as follows: Figure 4 As shown in the figure, three layers of the same network structure are used to realize the bottom-up hierarchical feature extraction at the byte level, data packet level, and network flow level. Each layer of the network structure includes a bidirectional long short-term memory network BiLSTM and an Attention mechanism. BiLSTM is used to learn context information from two directions at each level of the flow representation matrix. The Attention mechanism is used to focus on important features in different flow levels and suppress invalid features. Hierarchical feature extraction can better understand the semantic information and hierarchical structure of traffic in different layers of traffic, thereby forming a network flow representation containing rich information. The specific extraction process is as follows:

[0076] Convert the flow representation matrix into where e m,n，i represents the ith byte of the nth row of the mth packet, M represents the number of packets in the flow representation matrix, N represents the number of rows contained in each packet in the flow representation matrix, L represents the number of bytes contained in each row, and the word embedding matrix W is randomly initialized. e , convert byte e m,n，i Embed, get vector x m,n，i , formula (1) is as follows:

[0077] x m,n,i =W e e m,n，i; (1)

[0078] Byte-level extraction, first extract features from the bytes in each row of the flow representation matrix, and use BiLSTM to encode the bytes in each row in both the front and back directions to obtain the context information of the bytes, as shown in formula (2), h m，n，i is x m,n，i The encoding vector after LSTM, the bytes in each row are encoded to obtain the encoding vector H:

[0079] H=[h m，n，1 ,…,h m，n，L ]=BiLSTM([x m,n，1 , …, x m,n，L ]); (2)

[0080] The attention mechanism is introduced to extract the encoding representation of bytes containing important information and aggregate them into byte-level vectors: First, h m，n，i After passing through the multi-layer perceptron, its hidden representation u is obtained m，n，i , and then calculate its correlation with the context vector u w The similarity of m,n，i , calculate the weighted sum of the byte encodings to get the byte-level vector s m，n , as shown in formulas (3)-(5)

[0081] u m，n，i =tanh(W w h m，n，i +b w ); (3)

[0082]

[0083] s m,n =∑ i a m,n，i h m，n，i ; (5)

[0084] Among them, W w and b w Represent the weight matrix and bias vector respectively, which are the training parameters of the model and are used to convert the input h m,n，i Mapped to the attention space, is u m，n，i The transposed vector, u w It is a context vector that can be trained by the model, representing the important semantic direction in the task;

[0085] At the packet level, we extract and aggregate features of several row vectors in each packet to form a representation of each packet, and use BiLSTM to represent the byte-level vector s in each packet. m,nEncode, extract the context information, and then calculate the attention weight a of the byte-level vector encoding m，n Finally, the weighted sum of the byte-level vectors is calculated to obtain the packet vector representation p m , as shown in formulas (6)-(9)

[0086] [q m,1 , ..., q m,N ]=BiLSTM([s m,1 , ..., s m，N ]); (6)

[0087] r m，n =tanh(W s q m,n +b s ); (7)

[0088]

[0089] p m =∑ n a m,n q m,n ; (9)

[0090] Among them, W s and b s Represent the weight matrix and bias vector respectively, which are used to convert the input q m,n Mapped to the attention space, Yes m，n The transposed vector, u s is the context vector that the model can train;

[0091] At the network flow level, as shown in formula (10)-formula (13), BiLSTM is used to train the packet vector p m Encode and then calculate the attention weight a of the bag vector encoding m , and finally calculate the weighted sum f of the packet vectors as the flow feature vector representation:

[0092] [t1, ..., t M ]=BiLSTM([p1,...,p M ]); (10)

[0093] v m =tanh(W o r m +b o ); (11)

[0094]

[0095] f=∑ m a m vm ; (13)

[0096] Among them, W o and b o Represent the weight matrix and bias vector respectively, which are used to convert the input r m Mapped to the attention space, Yes m The transposed vector, u j is the context vector that the model can train;

[0097] The output vector f is the flow feature vector obtained through three-layer network feature extraction, corresponding to the support set flow feature vector and query set flow feature vector in different small sample classification tasks.

[0098] Step 4: The classification network calculates several benign and malignant class prototype feature vectors according to the support set flow feature vector and stores them accordingly. The specific process is as follows:

[0099] The process of calculating the class prototype feature vector according to the support set flow feature vector is as follows: for each class of support set samples in each small sample classification task, calculate the cosine similarity between the flow feature vectors of any two support set samples in the feature embedding space, obtain the nearest neighbor information of the flow feature vector of each support set sample in the feature embedding space, and then obtain the sample adjacency matrix according to the following formula:

[0100]

[0101] in Represents the flow feature vector closest to the flow feature vector of sample i. According to the above formula, three adjacency relationships are established for the support set samples of each class in each small sample task: if the nearest neighbor of the flow feature vector of sample i is the flow feature vector of sample j, then there is an adjacency relationship between the two samples; if the nearest neighbor of the flow feature vector of sample j is the flow feature vector of sample i, then there is an adjacency relationship between the two samples; in addition, if i and j are connected by the same nearest neighbor, it means that they have a high similarity, and the adjacency relationship between the samples is established. After these steps, the flow feature vectors of the connected samples have a high degree of similarity. The center points of the flow feature vectors of these samples are calculated, and the above process is repeated until the difference in the number of center points generated in two iterations is less than the set threshold Z. Finally, the center point after the iteration is used as the prototype of each class, and the feature vector of the center point is used as the class prototype feature vector. This method can adaptively generate prototypes according to the feature distribution of each class, find the closest class prototype for the sample in the query set, and classify the sample and the closest class prototype into one class.

[0102] Step 5: Measure the similarity between the query set flow feature vector and the class prototype feature vector to determine the category to which the query set belongs, and establish a loss function. According to the loss function, optimize the classification network until the target is met and the classification network training is completed. The process of verifying and optimizing the classification network through the query set is as follows:

[0103] After the classification network classifies the query set samples, cross entropy is used as the classification loss. m}, their actual categories are {y1,y2,…,y m}, the predicted probability of the model is Then calculate the cross entropy loss L CE as follows:

[0104]

[0105] In the above formula, m represents the number of query set samples.

[0106] Constrained loss L of class prototype feature vector PC ,Will Defined as the i-th prototype in class z, μ z Defined as a prototype center of type Z, Defined as the prototype center of the anti-class, then the constraint loss term of the i-th prototype of class z is

[0107]

[0108] The total class prototype feature vector constraint loss is:

[0109]

[0110] Where Z is the total number of traffic categories, k z is the number of prototype eigenvectors of class z;

[0111] The total loss is calculated as

[0112] L Total =λ·L CE +(1-λ)·δ·L PC ; (18)

[0113] where λ and δ are two hyperparameters with values ​​in the range [0,1].

[0114] Step 6: Introduce new malignant samples and benign samples to form a meta-test set, such as Figure 2 In the meta-test set, O is a benign sample, and D is a newly introduced malignant sample. Similarly, the support set flow feature vector and the query set flow feature vector of the meta-test set are obtained through step 3. Several benign and malignant class prototype feature vectors are calculated and stored accordingly.

[0115] Step 7: For the query set samples in the meta-test set, the similarity between the query set flow feature vector of the meta-test set and the class prototype feature vector is calculated through the classification network to determine the category of the unknown data. The process of calculating the similarity adopts the method based on Euclidean distance to calculate the Euclidean distance between the query set flow feature vector and the class prototype feature vector. According to the calculation result, the category of the unknown query set sample is determined as the category to which the class prototype feature vector with the closest Euclidean distance belongs.

[0116] Therefore, the present invention adopts a small sample malicious traffic detection method based on hierarchical semantics and prototype learning, and uses the framework of meta-learning to solve the problem of identifying small sample encrypted malicious traffic in a novel way. A large number of similar small sample classification tasks are used to train the classification model and learn meta-knowledge. A small number of new encrypted malicious traffic samples to be detected are used to build similar classification tasks. Accurate new encrypted malicious traffic detection effects are achieved through similarity measurement, and time-consuming fine-tuning is not required. In terms of feature extraction, a hierarchical extraction method for traffic features is proposed, a multi-level representation matrix of traffic bytes is constructed, and a hierarchical network structure is used to perform bottom-up traffic feature abstraction on the traffic. The structure can fully extract important information between different packets in the flow and different layers in the data packet, and provide a more comprehensive traffic representation. In terms of similarity measurement, a class prototype adaptive generation method is proposed, which dynamically generates adaptive prototypes based on traffic feature distribution and feature neighborhood relationships, balances simple and complex traffic feature distributions, and realizes accurate detection of small sample malicious traffic.

[0117] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that they can still modify or replace the technical solution of the present invention with equivalents, and these modifications or equivalent replacements cannot cause the modified technical solution to deviate from the spirit and scope of the technical solution of the present invention.

Claims

1. A small sample malicious traffic detection method based on hierarchical semantics and prototype learning, characterized by: The following steps are involved: Step 1: Obtain encrypted network flows including benign and multiple malignant ones, preprocess the encrypted network flows, and obtain flow representation matrices of different network flows; Step 2: According to the categories corresponding to the flow representation matrix, a meta-training set is constructed, and the prototype network in the meta-learning is used as the classification network. The small sample classification tasks in the meta-learning are constructed accordingly. Each meta-training set includes several small sample classification tasks, and each small sample classification task includes a support set and a query set. Step 3: For each small sample classification task, a three-layer network is used to perform hierarchical feature extraction to obtain the support set flow feature vector and the query set flow feature vector; Step 4: The classification network calculates several benign and malignant class prototype feature vectors according to the support set flow feature vector and stores them accordingly; Step 5: Measure the similarity between the query set flow feature vector and the class prototype feature vector to determine the category to which the query set belongs, and establish a loss function. According to the loss function, optimize the classification network until the target is met and the classification network training is completed. Step 6: Introduce new malignant samples and benign samples to form a meta-test set. Similarly, obtain the support set flow feature vector and query set flow feature vector of the meta-test set through step 3, calculate and obtain several benign and malignant class prototype feature vectors, and store them accordingly. Step 7: For the query set samples in the meta-test set, the similarity between the query set flow feature vector of the meta-test set and the class prototype feature vector is calculated through the classification network to determine the category of the unknown data.

2. According to claim 1, a small sample malicious traffic detection method based on hierarchical semantics and prototype learning is characterized by: The specific process of step 1 is as follows: the preprocessing process includes cleaning, quintuple splitting and anonymization; For the flow representation matrix: for each flow, take the original bytes of the first M packets, convert the hexadecimal bytes to decimal, truncate or fill the IP header bytes, TCP header bytes and payload bytes respectively; the reserved bytes of each data packet are normalized into an 8×40 byte matrix, containing 8 rows and 40 columns, the first two rows represent the IP header bytes and TCP header bytes respectively, and the 3rd to 8th rows represent the payload bytes; then the packet byte matrices of M packets are stacked to form a (M×8)×40 flow representation matrix.

3. According to claim 1, a small sample malicious traffic detection method based on hierarchical semantics and prototype learning is characterized by: The specific process of step 2 is as follows: The meta-training dataset is Dataset = {(x1,l1),…,(x N ,l N )}, where (x i ,l i ) represents the i-th flow sample, x i Represents the flow representation matrix of the i-th traffic sample, l i Represents the category of the i-th sample, which includes benign samples and various types of malignant samples; N s is the number of samples in each class support set for each small sample task, N q is the number of samples of each type of query set in each small sample task; The process of constructing small sample tasks in the meta-training set is as follows: for each small sample task, first randomly select N from the benign traffic samples. s samples to construct the support set of benign samples, and randomly select N samples from the remaining samples of benign samples. q samples to build a benign sample query set; then randomly select a type of malignant traffic sample and select N from the malignant samples of this type s samples to construct the support set of malignant samples, and randomly select N samples from the remaining samples of this type of malignant samples. q samples to construct a query set of malignant samples; finally, the support set and query set of the two types of samples are merged as a small sample classification task. For each sample in the small sample task, a label is assigned according to its sample type. If the sample type is benign, the sample label is 0, and if the sample type is malignant, the sample label is 1. In this way, the construction of a binary classification small sample task is completed, and the small sample classification task is added to the meta-training set; the above process is repeated until the number of constructed small sample tasks reaches the requirement.

4. According to claim 1, a small sample malicious traffic detection method based on hierarchical semantics and prototype learning is characterized by: In step three, the specific process is as follows: The same three-layer network structure is used to implement bottom-up hierarchical feature extraction at the byte level, data packet level, and network flow level. Each layer of the network structure includes a bidirectional long short-term memory network BiLSTM and an Attention mechanism. The specific extraction process is as follows: Convert the flow representation matrix into where e m,n,i represents the ith byte of the nth row of the mth packet, M represents the number of packets in the flow representation matrix, N represents the number of rows contained in each packet in the flow representation matrix, L represents the number of bytes contained in each row, and the word embedding matrix W is randomly initialized. e , convert byte e m,n,i Embed, get vector x m,n,i , formula (1) is as follows: x m,n,i =W e e m,n,i ; (1) Byte-level extraction: First, extract features from the bytes in each row of the stream representation matrix, and use BiLSTM to encode the bytes in each row in both the front and back directions to obtain the context information of the bytes, as shown in formula (2), h m,n,i is x m,n,i The encoding vector after LSTM, the bytes in each row are encoded to obtain the encoding vector H: H=[h m,n,1 ,…,h m,n,L ]=BiLSTM([x m,n,1 ,…,x m,n,L ]); (2) The attention mechanism is introduced to extract the encoding representation of bytes containing important information and aggregate them into byte-level vectors: First, h m,n,i After passing through the multi-layer perceptron, its hidden representation u is obtained m,n,i , and then calculate its correlation with the context vector u w The similarity of m,n,i , calculate the weighted sum of byte encodings to get the byte-level vector s m,n , as shown in formulas (3)-(5) u m,n,i =tanh(W w h m,n,i +b w ); (3) Among them, W w and b w Represent the weight matrix and bias vector respectively, which are the training parameters of the model and are used to convert the input h m,n,i Mapped to the attention space, is u m,n,i The transposed vector, u w It is a context vector that can be trained by the model, representing the important semantic direction in the task; At the packet level, we extract and aggregate features of several row vectors in each packet to form a representation of each packet, and use BiLSTM to represent the byte-level vector s in each packet. m,n Encode, extract the context information, and then calculate the attention weight a of the byte-level vector encoding m,n Finally, the weighted sum of the byte-level vectors is calculated to obtain the packet vector representation p m , as shown in formulas (6)-(9) [q m,1 ,…,q m,N ]=BiLSTM([s m,1 ,…,s m,N ]); (6) r m,n =tanh(W s q m,n +b s ); (7) p m =∑ n a m,n q m,n ; (9) Among them, W s and b s Represent the weight matrix and bias vector respectively, which are used to convert the input q m,n Mapped to the attention space, Yes m,m The transposed vector, u s is the context vector that the model can train; At the network flow level, as shown in formula (10)-formula (13), BiLSTM is used to train the packet vector p m Encode and then calculate the attention weight a of the bag vector encoding m , and finally calculate the weighted sum f of the packet vectors as the flow feature vector representation: [t1,…,t M ]=BiLSTM([p1,…,p M ]); (10) v m =tanh(W o r m +b o ); (11) f=∑ m a m v m ; (13) Among them, W o and b o Represent the weight matrix and bias vector respectively, which are used to convert the input r m Mapped to the attention space, Yes m The transposed vector, u j is the context vector that the model can train; The output vector f is the flow feature vector obtained through three-layer network feature extraction, corresponding to the support set flow feature vector and query set flow feature vector in different small sample classification tasks.

5. According to claim 1, a small sample malicious traffic detection method based on hierarchical semantics and prototype learning is characterized by: The specific process in step 4 is as follows: The process of calculating the class prototype feature vector according to the support set flow feature vector is as follows: for each class of support set samples in each small sample classification task, calculate the cosine similarity between the flow feature vectors of any two support set samples in the feature embedding space, obtain the nearest neighbor information of the flow feature vector of each support set sample in the feature embedding space, and then obtain the sample adjacency matrix according to the following formula: in Represents the flow feature vector closest to the flow feature vector of sample i. According to the above formula, three adjacency relationships are established for the support set samples of each class in each small sample task: if the nearest neighbor of the flow feature vector of sample i is the flow feature vector of sample j, then there is an adjacency relationship between the two samples; if the nearest neighbor of the flow feature vector of sample j is the flow feature vector of sample i, then there is an adjacency relationship between the two samples; in addition, if i and j are connected through the same nearest neighbor, it means that the similarity between them is high, and the adjacency relationship between the samples is established. After these steps, the flow feature vectors of the connected samples have a high degree of similarity. The center points of the flow feature vectors of these samples are calculated, and the above process is repeated until the difference in the number of center points generated in the two iterations is less than the set threshold Z. Finally, the center point after the iteration is completed is used as the prototype of each class, and the feature vector of the center point is used as the class prototype feature vector.

6. The method for detecting malicious traffic with a small sample based on hierarchical semantics and prototype learning according to claim 1 is characterized by: In step 5, the process of verifying and optimizing the classification network through the query set is as follows: After the classification network classifies the query set samples, cross entropy is used as the classification loss. m }, their actual categories are {y1,y2,…,y m }, the predicted probability of the model is Then calculate the cross entropy loss L CE as follows: In the above formula, m represents the number of query set samples; Constraint loss L of class prototype feature vector PC ,Will Defined as the i-th prototype in class z, μ z Defined as a prototype center of type Z, Defined as the prototype center of the anti-class, then the constraint loss term of the i-th prototype of class z is The total class prototype feature vector constraint loss is: Where Z is the total number of traffic categories, k z is the number of prototype eigenvectors of class z; The total loss is calculated as L Total =λ·L CE +(1-λ)·δ·L PC (18) where λ and δ are two hyperparameters with values ​​in the range [0,1].

7. The method for detecting malicious traffic with a small sample size based on hierarchical semantics and prototype learning according to claim 1 is characterized by: In the step seven, the process of calculating the similarity adopts a method based on Euclidean distance to calculate the Euclidean distance between the query set flow feature vector and the class prototype feature vector. According to the calculation result, the category of the unknown query set sample is determined to be the category to which the class prototype feature vector with the closest Euclidean distance belongs.

Images