An early detection method for mining traffic based on knowledge distillation

Abstract

This invention discloses a method for early detection of mining traffic based on knowledge distillation, aiming to address the existing problem of reliance on expert knowledge for feature extraction and poor real-time detection performance during mining traffic detection. This method screens the basic features of data packets, verifies the optimal early flow features, extracts traffic features suitable for mining traffic detection tasks, and utilizes knowledge distillation technology to further extract timing features from the early flow features without increasing model complexity, thereby improving detection accuracy. Through the above method, the present invention can quickly and accurately detect mining behavior in the early stages of a session, with the advantages of strong real-time performance and high accuracy.

Description

Technical Field

[0001] The present invention relates to the field of traffic analysis and network security technology, and in particular to an early detection method for mining traffic based on knowledge distillation. Background Art

[0002] Rampant mining activities consume vast amounts of energy, pose a threat to the environment and health, and violate the principles of energy conservation, emission reduction, and sustainable development. Therefore, timely detection and identification of mining activities, coupled with reasonable restrictions and policy oversight, can effectively curb the energy consumption of cryptocurrency mining activities.

[0003] Detection methods for mining activity can be broadly categorized as host-based and network traffic-based. Host-based mining behavior models are primarily applied to end hosts. This method aims to extract host system calls and operations as key features to detect possible mining activity. While host-based detection methods can accurately identify the presence of mining activity on a target host, they can only detect a single target host, making deployment difficult when a large number of hosts need to be monitored. Detection tools also require maintenance and upgrades, further increasing maintenance costs.

[0004] Mining behavior detection based on network traffic has the advantages of flexibility and easy deployment. However, due to the complexity of network traffic and communication protocols, related work still has the following problems:

[0005] 1) Deep packet inspection methods struggle to establish a comprehensive fingerprint database. Traditional deep packet inspection-based methods match data packets with known mining protocol instructions to detect mining traffic, requiring frequent maintenance. However, the wide variety of proprietary protocols used for mining activities makes it difficult to establish a comprehensive fingerprint database. Traditional methods also require extensive manual effort to maintain the relevant database. Furthermore, mining pools can circumvent detection simply by changing protocol instructions.

[0006] 2) Constructing mining traffic statistical features relies on expert knowledge. Existing mining traffic feature construction often relies on expert knowledge. Common mining traffic detection methods extract features such as packet interval, packet size, and packet rate within a flow, or construct unique features to characterize mining traffic. These feature extraction methods are subjective and have limitations. Different experts have different understandings and extraction methods of mining traffic features, resulting in different detection focuses, which may ultimately affect the actual detection results.

[0007] 3) Statistical traffic features lead to poor real-time detection: Detection methods based on statistical features of network traffic are ineffective in real-time detection, suffering from high false positive rates. Statistical features are typically based on complete triplet or quintuple flows, which are difficult to obtain in real-time detection. This severely impacts the accuracy of the statistical features, leading to reduced detection precision. Summary of the Invention

[0008] This invention proposes a method for early detection of mining traffic based on knowledge distillation to address the aforementioned technical issues. This method aims to rapidly and accurately detect mining traffic in the early stages of session establishment using as few early traffic packets as possible.

[0009] The technical solution adopted by the present invention is: extracting the early basic features of traffic to make up for the shortcomings of statistical features, and using knowledge distillation technology to further extract the temporal features in the early basic features without increasing the complexity of the model to improve the detection accuracy.

[0010] In order to achieve the above object, the present invention comprises the following steps:

[0011] 1) Early feature extraction method of flow:

[0012] Step S101: Traffic data collection and preprocessing: collect plaintext and encrypted mining traffic, as well as background traffic from normal network activities such as web browsing, online chatting, and online meetings to construct a traffic dataset D1. The raw traffic dataset D1 is then preprocessed at the packet level to construct a basic traffic feature dataset D2.

[0013] Step S102: Filtering basic features of data packets; using three feature selection methods: filtering, wrapping, and embedding, the importance of basic features in the traffic basic feature dataset D2 for the mining traffic detection task is evaluated, and the basic features that are most suitable for the mining traffic detection task are selected;

[0014] Step S103: Verify the optimal early flow features; conduct multiple experiments on the first ten packet-level early flow features using a classic machine learning algorithm, and select the optimal early flow features through the Wilcoxon signed-rank test to construct the optimal early flow feature dataset D3;

[0015] 2) Mining behavior detection model based on knowledge distillation:

[0016] Step S104: Construct a convolutional neural network traffic detection model based on knowledge distillation; pre-train a teacher model based on the optimal flow early feature dataset D3, and use the feature map of the convolutional neural network and the output features of the timing model to construct a guidance function. By introducing the guidance function, the parameters of the main loss function are optimized, and the guidance parameters are adjusted to ensure the model's optimal performance in mining traffic detection.

[0017] Furthermore, the step S101 is specifically as follows:

[0018] Step S201: Collect mining traffic, including plaintext mining traffic and encrypted mining traffic. The payload information of the plaintext mining traffic is not encrypted and can be directly read for detection, while the encrypted mining traffic is encrypted using the TLS or SSL protocol.

[0019] Step S202: Collect background traffic, including batch web page access traffic generated by the automation tool selenium, as well as web chat and online meeting traffic generated by normal users, and combine it with mining traffic to form a traffic data set D1;

[0020] Step S203: Preprocess the basic features at the packet level and select some basic features suitable for the traffic detection task. In the traffic dataset D1, remove the MAC address, IP address, port, sequence number, confirmation number and other inappropriate features in the original packet information, extract the remaining basic features of the packet, and construct the traffic basic feature dataset D2;

[0021] Furthermore, the step S102 is specifically as follows:

[0022] Step S301: The filtering feature selection method uses three statistical methods: variance difference, chi-square distribution, and correlation coefficient to evaluate the importance of basic features of the traffic basic feature dataset D2.

[0023] Step S302: The wrapper feature selection method uses the recursive feature elimination method to perform feature selection in the SVM, LDA, and SGD models, and sorts the basic features of the traffic basic feature data set D2.

[0024] Step S303: The embedded feature selection method combines the AdaBoost algorithm of decision tree, random forest and integrated decision tree to calculate the importance of basic features of the traffic basic feature dataset D2.

[0025] Step S304: Based on the comprehensive ranking of the importance of the basic features in the mining traffic detection task in the nine methods, the basic features most suitable for mining traffic detection are selected.

[0026] Furthermore, step S103 is specifically as follows:

[0027] Step S401: Divide the original data into five-tuples. After observing and summarizing the communication patterns of mining traffic and background traffic, extract the payload length and packet direction of the early data packets of the flow, as well as the filtered basic features, and sequentially construct the early features of the flow containing different numbers of data packets.

[0028] Step S402: For the early flow features at the first ten packet levels, multiple experiments are conducted on five classic machine learning algorithms: RF, SVM, LDA, NB, and KNN, and the model performance indicators are recorded.

[0029] Step S403: Use the Wilcoxon signed-rank test to verify the performance difference of the adjacent level flow early features, select the best flow early features, and form the optimal flow early feature data set D3.

[0030] Furthermore, the step S104 is specifically as follows:

[0031] Step S501: Traffic packets divided into streams and arranged sequentially can be considered a special case of time series data. LSTM or GRU can effectively capture the temporal characteristics of mining traffic. A baseline model is pre-trained using the optimal early stream feature dataset D3. Appropriate time series models and convolutional neural networks are selected as the teacher and student models, respectively.

[0032] Step S502: The feature graph in the convolutional neural network and the output features of the temporal model can be expressed by batch size (b), number of channels (c), height (h), and width (w) respectively:

[0033] O c ∈R (b×c×h×w)

[0034] O s ∈R (h×b(c×w))

[0035] The two models are trained differently, resulting in differences in the output features of the convolutional layer and the time series model. To accurately calculate the distance metric between the two features, they are converted into two-dimensional data of the same size, specifically represented as:

[0036] F c =Linear(O c ), F c ∈R (b×(c×h×w))

[0037] F s =reshape(O s ),F s ∈R (b×(c×h×w))

[0038] The Linear function is a learnable linear projection implemented by a 1×1 convolution. The 1×1 convolution performs a weighted summation of the channels at each position in the feature map, ultimately converting it into a single-channel output. The Linear function effectively preserves feature information and aligns the convolution with the time series output features. The reshape function converts the time series output into an image-like output and calculates the feature differences to form a guidance function:

[0039] L guide =||F c -F s || 2

[0040] Step S503: The main loss function generated by training is generated by CNN completing the detection and classification task, and its time series output is obtained to guide the task. cls The cross entropy loss function generated by the CNN's autonomous learning of local features during detection and classification tasks is also known as the main loss function. The difference between the extracted local information features and the global information features is added to the main loss function, allowing the CNN to learn the temporal characteristics of the data while updating the parameters. The final loss function during training consists of two parts: the main loss function and the guidance function of the CNN:

[0041] L=L cls -β·L guide

[0042] The guidance parameter β is a hyperparameter set based on practical experience. The grid search algorithm is used to adjust the guidance parameter to ensure the best performance of the model in the mining traffic detection task.

[0043] Compared with the prior art, the present invention has the following advantages:

[0044] 1) The traffic feature extraction method proposed in this invention can detect both plaintext mining traffic and encrypted mining traffic simultaneously, does not rely on a fingerprint library, and can effectively cope with the diversity of protocols, thereby improving the coverage and flexibility of detection;

[0045] 2) This invention uses only the raw data of the four non-zero packets in the early stages of a session, avoiding reliance on statistical features and simplifying the data processing process. It also ensures that the early features have the basic characteristics and timing characteristics of the traffic, enhancing the real-time and accuracy of detection.

[0046] 3) Use the knowledge distillation method to further extract the basic characteristics and timing characteristics of traffic while reducing the complexity of the model to achieve rapid detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1This is an overall flow chart of a method for early detection of mining traffic based on knowledge distillation according to the present invention;

[0048] Figure 2 This is a flow chart of flow data collection and preprocessing of the present invention;

[0049] Figure 3 This is a flow chart of the basic features of data packets screened by the present invention;

[0050] Figure 4 Flowchart for verifying the optimal flow early characteristics of the present invention;

[0051] Figure 5 This is a curve diagram showing the change in detection accuracy of early flow characteristics of the present invention;

[0052] Figure 6 A flow chart of the convolutional neural network traffic detection model based on knowledge distillation is constructed for the present invention; DETAILED DESCRIPTION

[0053] The following describes in detail a specific implementation of a method for early detection of mining traffic based on knowledge distillation according to the present invention with reference to the accompanying drawings.

[0054] Figure 1 This is an overall flow chart of a method for early detection of mining traffic based on knowledge distillation according to the present invention;

[0055] The present invention discloses a method for early detection of mining traffic based on knowledge distillation, comprising the following steps:

[0056] Step S101: Traffic data collection and preprocessing: collect plaintext and encrypted mining traffic, as well as background traffic from normal network activities such as web browsing, online chatting, and online meetings to construct a traffic dataset D1, and perform packet-level preprocessing on the original traffic dataset D1 to construct a traffic basic feature dataset D2.

[0057] Figure 2 This is a flow chart of flow data collection and preprocessing of the present invention.

[0058] Specifically, it can be divided into the following steps:

[0059] Step S201: Collect mining traffic, including plaintext mining traffic and encrypted mining traffic. The payload information of the plaintext mining traffic is not encrypted and can be directly read for detection, while the encrypted mining traffic is encrypted using the TLS or SSL protocol;

[0060] Step S202: Collect background traffic, including batch web page access traffic generated by the automation tool Selenium, as well as web chat and online meeting traffic generated by normal users, and combine it with mining traffic to form a traffic dataset D1;

[0061] Step S203: Preprocess the basic features of the data packet level, remove the MAC address, IP address, port, sequence number, and confirmation number of the data packet in the traffic data set D1, extract the remaining basic features of the data packet, and construct the traffic basic feature data set D2

[0062] Specifically, the flow data information of the present invention is shown in Table 1.

[0063] Table 1 Flow data information

[0064]

[0065] Step S102: Filter the basic features of the data packet; evaluate the importance of the basic features in the traffic basic feature dataset D2 in the mining traffic detection task through three types of feature selection methods: filtering, wrapping, and embedding, and select the basic features that are most suitable for the mining traffic detection task.

[0066] Figure 3 This is a flow chart of the basic feature screening of data packets in the present invention.

[0067] Specifically, it can be divided into the following steps:

[0068] Step S301: The filtering feature selection method uses three statistical methods: variance difference, chi-square distribution, and correlation coefficient to evaluate the importance of basic features of the traffic basic feature dataset D2.

[0069] Specifically, the VarianceThreshold function in the scikit-learn library is used to measure the degree of dispersion of feature variance, and features are sorted according to the size of the variance; the chi2 function in the scikit-learn library is used to use the chi-square test to evaluate the independence of features between two categories, and features are sorted according to the chi-square statistic between the features and the target variable; the pearsonr function in scipy is used to calculate the correlation coefficient between each feature and the target variable, and features are sorted according to feature correlation.

[0070] Step S302: The wrapper feature selection method uses the recursive feature elimination method to perform feature selection in the SVM, LDA, and SGD models, and sorts the basic features of the traffic basic feature data set D2.

[0071] Specifically, the RFE function in the scikit-learn library is used for feature selection, in which three classic linear machine learning models, SVM, LDA, and SGD, are nested, and the ranking of the basic features of the data packets by the three models is output.

[0072] Step S303: The embedded feature selection method combines the AdaBoost algorithm of decision tree, random forest and integrated decision tree to calculate the importance of basic features of the traffic basic feature dataset D2.

[0073] Specifically, the RFE function in the scikit-learn library is used for feature selection, in which three classic linear machine learning models, SVM, LDA, and SGD, are nested, and the ranking of the basic features of the data packets by the three models is output.

[0074] Step S304: Based on the comprehensive ranking of the importance of the basic features in the mining traffic detection task in the nine methods, the basic features most suitable for mining traffic detection are selected.

[0075] Specifically, taking the wrapping feature selection method based on feature recursive elimination as an example, the ranking of basic features is shown in Table 2.

[0076] Table 2 Basic feature ranking of feature recursive elimination method

[0077] Serial number Support Vector Machine LDA SGD 1 Total length Total length Total length 2 Flag Flag Flag 3 Header length window Header length 4 Survival time Survival time Survival time 5 Slice offset Differentiated Services Slice offset

[0078] The present invention selects the total length, lifetime, flag, window and slice offset features of the data packet after comprehensively sorting the basic features.

[0079] Step S103: Verify the optimal early flow features; conduct multiple experiments on the first ten packet-level early flow features using a classic machine learning algorithm, and select the optimal early flow features through the Wilcoxon signed-rank test to construct the optimal early flow feature dataset D3;

[0080] Figure 4 This is a flow chart for verifying the optimal flow early characteristics of the present invention.

[0081] Specifically, it can be divided into the following steps:

[0082] Step S401: Divide the original data into five-tuples. After observing and summarizing the communication patterns of mining traffic and background traffic, extract the payload length and packet direction of the early data packets of the flow, as well as the filtered basic features, and sequentially construct the early features of the flow containing different numbers of data packets.

[0083] Step S402: For the early flow features at the first ten packet levels, multiple experiments are conducted on five classic machine learning algorithms: RF, SVM, LDA, NB, and KNN, and the model performance indicators are recorded.

[0084] Step S403: Use the Wilcoxon signed-rank test to verify the performance difference of the adjacent level flow early features, select the best flow early features, and form the optimal flow early feature data set D3.

[0085] Specifically, the detection accuracy of early features of each level of flow on five classic machine learning algorithms, RF, SVM, LDA, NB and KNN, is as follows: Figure 5 As shown in Table 3, as the number of packets included in the early flow features increases, the classification accuracy of each algorithm generally shows an upward trend. However, once the feature size reaches a certain level, the detection accuracy tends to stabilize. Taking the Wilcoxon signed-rank test results of various levels of early flow features on the RF algorithm as an example, as shown in Table 3, when the early flow features include five packet features, their detection performance on the RF algorithm no longer significantly improves. Therefore, we construct an optimal early flow feature dataset D3 consisting of the first four non-zero packets.

[0086] Table 3 RF algorithm Wilcoxon signed rank test results

[0087] P-value Significant difference 1—2 0.139 no 2—3 0.005 yes 3—4 0.009 yes 4—5 0.508 no 5—6 0.959 no 6—7 0.539 no 7—8 0.646 no 8—9 0.515 no 9—10 0.139 no

[0088] 2) Mining traffic detection model based on knowledge distillation:

[0089] Step S104: Construct a convolutional neural network detection model based on knowledge distillation; pre-train a teacher model based on the optimal flow early feature dataset D3, and use the feature graph of the convolutional neural network and the output features of the timing model to construct a guidance function. By introducing the guidance function, the parameters of the main loss function are optimized, and the guidance parameters are adjusted to ensure the model's optimal performance in mining traffic detection.

[0090] Figure 6 A flow chart of the convolutional neural network traffic detection model based on knowledge distillation is constructed for the present invention.

[0091] Specifically, it can be divided into the following steps:

[0092] Step S501: Use the optimal flow early feature dataset D3 to pre-train the baseline model, and select a suitable time series model and convolutional neural network as the teacher model and student model respectively;

[0093] Specifically, we use verified early stream features to train baseline deep learning models, such as LeNet-5, ResNet, LSTM, and GRU. We select the best-performing time series model as the teacher model and the best-performing convolutional neural network model as the student model. In this paper, we select the LeNet-5 model as the guided student model and the pre-trained GRU as the teacher model.

[0094] Step S502: Select the feature map of the convolutional neural network and the output feature of the time series model to align, calculate the feature difference between the two, and construct a guidance function;

[0095] Specifically, this example selects the feature map generated by the first convolutional layer of a convolutional neural network as the guidance object. Specifically, it is a 144×3×7×7 matrix. The output feature map of the selected GRU model is a 7×144×7 matrix. Both features are processed into 144×49 matrices, and the Euclidean distance between the features is calculated to form the guidance function.

[0096] Step S503: Optimize the parameters of the main loss function using the guidance function of step S502, and adjust the guidance parameters using the grid search algorithm to ensure the best performance of the knowledge distillation method in mining traffic detection.

[0097] Specifically, the present invention uses a grid search method to traverse all possible hyperparameter combinations in the range (0, 2, 0.5) set and trains a model for each hyperparameter combination. The main training function of the model is set to CrossEntropyLoss(), in which a guidance function is added to learn the distance difference between the feature map and the time series output. The parameters are updated by the back propagation algorithm to minimize the combined loss function. The performance of each hyperparameter model is evaluated on the validation set, and the optimal guidance hyperparameter is selected based on the accuracy and F1 score of the model. The experimental results are shown in Table 5. When the value of the hyperparameter is 0, the detection performance of the student model is the same as that of the baseline model. When the value of the hyperparameter is 0.5, the performance of the student model is the best.

[0098] Table 5 Hyperparameter β corresponding to model performance

[0099] β Accuracy F1 value 0.0 98.90％ 0.9892 0.5 99.44％ 0.9946 1.0 99.07％ 0.9906 1.5 98.88％ 0.9990 2.0 97.94％ 0.9801

Claims

1. A mining traffic early detection method based on knowledge distillation, characterized by: The following steps are involved: 1) Early feature extraction method of flow: Step S101: flow data collection and preprocessing; We collect plaintext mining traffic and encrypted mining traffic, as well as web browsing, online chatting, and online meeting background traffic data to construct a traffic dataset D1. We then perform packet-level preprocessing on the original traffic dataset D1 to construct a basic traffic feature dataset D2. Step S102: Filtering basic features of data packets; using three feature selection methods: filtering, wrapping, and embedding, the importance of basic features in the traffic basic feature dataset D2 for the mining traffic detection task is evaluated, and the basic features that are most suitable for the mining traffic detection task are selected; Step S103: Verify the optimal early flow features; conduct multiple experiments on the first ten packet-level early flow features using a classic machine learning algorithm, and select the optimal early flow features through the Wilcoxon signed-rank test to construct the optimal early flow feature dataset D3; 2) Mining behavior detection model based on knowledge distillation: Step S104: Construct a convolutional neural network traffic detection model based on knowledge distillation; pre-train a teacher model based on the optimal flow early feature dataset D3, and use the feature map of the convolutional neural network and the output features of the timing model to construct a guidance function. By introducing the guidance function, the parameters of the main loss function are optimized, and the guidance parameters are adjusted to ensure the model's optimal performance in mining traffic detection.

2. The method according to claim 1, characterized in that The step S101 is specifically as follows: Step S201: Collect mining traffic, including plaintext mining traffic and encrypted mining traffic. The payload information of plaintext mining traffic is not encrypted and can be directly read for detection, while the payload information of encrypted mining traffic is encrypted using TLS or SSL protocols and cannot be directly read. Step S202: Collect background traffic, including batch web page access traffic generated by the automation tool Selenium, as well as web chat and online meeting traffic, and combine it with mining traffic to form a traffic dataset D1; Step S203: Preprocess the basic features at the data packet level, remove the MAC address, IP address, port, sequence number, and confirmation number of the data packet in the traffic data set D1, extract the remaining basic features of the data packet, and construct the traffic basic feature data set D2.

3. The method according to claim 1, characterized in that The step S102 is specifically as follows: Step S301: The filtering feature selection method uses three statistical methods: variance difference, chi-square distribution, and correlation coefficient to evaluate the importance of basic features of the traffic basic feature dataset D2; Step S302: The wrapper feature selection method uses the recursive feature elimination method to perform feature selection in the SVM, LDA, and SGD models to sort the basic features of the traffic basic feature dataset D2; Step S303: The embedded feature selection AdaBoost algorithm calculates the importance of basic features of the traffic basic feature dataset D2; Step S304: Based on the comprehensive ranking of the importance of the basic features in the mining traffic detection task in steps S301 to S303, the basic features most suitable for mining traffic detection are selected.

4. The method according to claim 1, wherein The step S103 is specifically as follows: Step S401: Divide the raw data into quintuples. After observing and summarizing the communication patterns of mining traffic and background traffic, extract the payload length and packet direction of early data packets in the flow, as well as the filtered basic features, and sequentially construct early flow features containing different numbers of data packets. Step S402: Conduct multiple experiments on five classic machine learning algorithms, including RF, SVM, LDA, NB, and KNN, targeting the early flow features at the first ten packet levels, and record model performance indicators. Step S403: Use the Wilcoxon signed-rank test to verify the performance difference of the adjacent level flow early features, select the best flow early features, and form the optimal flow early feature data set D3.

5. The method according to claim 1, wherein The step S104 is specifically as follows: Step S501: Use the optimal flow early feature dataset D3 to pre-train the baseline model, and select a suitable time series model and convolutional neural network as the teacher model and student model respectively; Step S502: Select the feature map of the convolutional neural network and the output feature of the time series model to align, calculate the feature difference between the two, and construct a guidance function; Step S503: Optimize the parameters of the main loss function using the guidance function of step S502, and adjust the guidance parameters using the grid search algorithm to ensure the best performance of the knowledge distillation method in mining traffic detection.

6. The method according to claim 2, characterized in that Step S201: Collect mining traffic, including plaintext mining traffic and encrypted mining traffic. The payload information of the plaintext mining traffic is not encrypted and can be directly read for detection, while the encrypted mining traffic is encrypted by TLS or SSL protocol, and the payload information cannot be directly read.

7. The method according to claim 2, characterized in that The step S203: pre-processes the basic features at the data packet level, selects some basic features suitable for the traffic detection task, removes the MAC address, IP address, port, sequence number, and confirmation number in the original information of the data packet in the traffic data set D1, extracts the remaining basic features of the data packet, and constructs the traffic basic feature data set D2.

8. The method according to claim 5, characterized in that In step S501, traffic data packets divided into streams and arranged in sequence are considered a special case of time series data. LSTM or GRU can effectively capture the temporal characteristics of mining traffic. The baseline model is pre-trained using the optimal stream early feature dataset D3, and appropriate temporal model and convolutional neural network are selected as the teacher model and student model, respectively.

9. The method according to claim 5, characterized in that In step S502, the feature graph in the convolutional neural network and the output features of the time series model are respectively expressed by batch size (b), number of channels (c), height (h), and width (w): THE c ∈R (b×c×h×w) THE s ∈R (h×b(c×w)) The training methods of the two models are also different, resulting in differences in the output features of the convolutional layer and the time series model. To accurately calculate the distance metric between the two features, they are converted into two-dimensional data of the same size, specifically represented as follows: F c =Linear(O c ),F c ∈R (b×(c×h×w)) F s =reshape(O s ),F s ∈R (b×(c×h×w)) Among them, F c represents the feature map generated by the convolutional neural network, F s Represents the features output by the time series model. The Linear function is a learnable linear projection implemented by a 1×1 convolution. The 1×1 convolution performs a weighted summation on the channels at each position of the feature map and finally converts it into a single-channel output. The Linear function can effectively retain feature information and align the convolution with the time series output features. The reshape function converts the time series output into an image-like output and calculates the feature difference to form the guidance function L. guide : L guide =||F c -F s || 2 。 10. The method according to claim 5, characterized in that Step S503: The main loss function generated by training is generated by CNN completing the detection and classification task. Its time series output is obtained during training to guide the task. cls It represents the cross entropy loss function generated by CNN's autonomous learning of local features when performing detection and classification tasks. The cross entropy loss function is used as the main loss function, and the difference between the extracted local information features and the global information features is added to the main loss function, so that CNN can learn the temporal characteristics of the data while updating the parameters. The final loss function L in training consists of two parts: the main loss function and the guidance function of CNN: L=L cls -β·L guide The guidance parameter β is a hyperparameter set based on practical experience. The grid search algorithm is used to adjust the guidance parameter to ensure the best performance of the model in the mining traffic detection task.

Images