Malicious Traffic Detection Method Based on Selective State-Space Model

Abstract

This invention discloses a malicious traffic detection method based on a selective state-space model. Existing methods have high false positive rates and poor detection performance. This invention achieves zero-shot malicious traffic detection by converting raw traffic data to grayscale, extracting latent features, training the detection model, and pre-training with known malicious traffic data. First, known malicious traffic data is prepared and data augmented. Then, the known malicious traffic data and the data-augmented synthetic malicious traffic data are used together to pre-train the zero-shot malicious traffic detection model. Finally, the pre-trained model is used to identify previously unseen types of malicious traffic data. For previously unseen malicious traffic data obtained from the network, after preprocessing, it is input into the pre-trained zero-shot malicious traffic detection model to determine whether the current traffic is malicious. This invention retains effective semantic information, removes redundant semantic information, improves the effectiveness of feature extraction, and thus improves the accuracy of the model.

Description

Technical Field

[0001] This invention belongs to the field of network security and network defense technology, particularly the field of malicious traffic detection, and specifically relates to a malicious traffic detection method based on a selective state space model. Background Technology

[0002] As cyberattack methods continue to evolve, common threat tactics have expanded beyond traditional malware and viruses to include more covert advanced persistent threats (APTs) and zero-day attacks. These attacks often utilize sophisticated encryption, obfuscation, and social engineering techniques, making traditional detection methods increasingly ineffective in identifying and responding to these increasingly complex cyber threats. Therefore, the research and development of advanced malicious traffic detection technologies has become particularly important. In the field of malicious traffic detection, zero-shot learning has attracted attention due to its potential in handling unknown threats. In the context of malicious traffic detection, this means that detection systems need to be able to identify and respond to novel malicious traffic that may use advanced encryption techniques to evade traditional detection methods.

[0003] To address the challenges of cybersecurity, research into malicious traffic detection technology is shifting towards intelligent approaches. Current detection methods are mainly categorized into three types: behavior analysis-based methods, machine learning-based methods, and deep learning methods. Behavior analysis-based methods identify potential malicious activity by monitoring abnormal behavioral patterns in network traffic. This method does not rely on known malicious characteristics but rather analyzes the statistical properties and behavioral patterns of network traffic to detect unknown or variant malicious traffic. However, with further research, this method may produce false positives due to the complexity and variability of the network environment.

[0004] Therefore, with the development of network technology, machine learning-based detection methods have been widely studied. These methods train models to identify the characteristics of malicious traffic in order to achieve automated threat identification and response. However, these methods lack dynamism and adaptability. Network attackers frequently update their attack strategies and techniques, which makes models trained based on historical data unable to effectively identify newly emerging attack patterns.

[0005] As attackers' techniques advance, the encryption and obfuscation methods of malicious traffic are constantly evolving, making traditional feature-based detection methods increasingly inadequate for the new threat landscape. Therefore, researchers have begun exploring more advanced deep learning detection methods to more effectively identify and defend against unknown malicious traffic. These methods improve detection accuracy and efficiency by building complex models to learn intricate patterns in network traffic. However, traditional deep learning methods also have limitations, especially when facing unknown malicious traffic. These methods typically rely on large amounts of labeled data, which is often impractical in real-world applications. Therefore, developing a method capable of detecting unknown malicious traffic without direct samples is crucial. Zero-shot learning is a special type of machine learning method whose core objective is to correctly identify new categories without having seen any labeled samples of those categories during training. Currently, research on zero-shot malicious traffic detection is still in its early stages. Some existing methods attempt to improve the model's ability to identify unknown malicious traffic through techniques such as transfer learning and meta-learning. For example, some research has constructed cross-domain feature representations, enabling the model to learn features useful for unknown categories from known categories.

[0006] When faced with previously unseen malicious traffic, it often employs various techniques to evade detection. Traditional malicious traffic detection methods, which rely primarily on known characteristics, typically perform poorly in such situations. Meanwhile, unknown malicious traffic is constantly emerging on the internet, and past detection methods are unable to handle it, frequently leading to serious misjudgments.

[0007] Chinese invention patent application CN202411018887.7 discloses a method for detecting encrypted malicious traffic based on traffic interaction behavior and attention mechanisms. This method extracts traffic features by constructing a traffic interaction graph and using a multi-head self-attention model, achieving the ability to detect unknown encrypted malicious traffic. Its limitation lies in its reliance on the constructed traffic interaction graph and features extracted by the self-attention mechanism; when facing novel unknown malicious traffic, it may not effectively capture all key features, leading to a decrease in detection accuracy. Furthermore, this method requires significant computational resources to process and compare large amounts of network traffic data, potentially encountering cost and efficiency issues in practical deployment. Chinese invention patent application CN202410254307.8 discloses a method for identifying malicious encrypted traffic based on multi-granularity feature extraction. This method constructs a multi-classifier to analyze abnormal encrypted traffic, obtaining unknown malicious or attack-related abnormal encrypted traffic. Its limitation lies in the significant complexity of the multi-granularity feature extraction involved, increasing the difficulty of implementation; and its reliance on a large amount of labeled data to train the model may limit its generalization ability on unknown or zero-sample malicious traffic. Chinese invention patent application CN202311794220.1 discloses a method and terminal for classifying malicious encrypted traffic in a network information system scenario. This method designs a more efficient lightweight network model, uses a classification model to classify and identify unknown encrypted traffic, and combines this with performance evaluation metrics for analysis. Its limitation lies in its insufficient ability to extract potential features from traffic data, which may affect the quality and depth of feature extraction.

[0008] Existing technologies have several shortcomings. First, existing methods generally perform well in detecting known malicious traffic, but often make misjudgments when faced with malicious traffic that has never been seen before. Second, existing methods usually cannot simultaneously possess strong local feature processing and global information processing capabilities, making it difficult to achieve high-accuracy detection. Third, most existing methods use neural network models that have performed well in other fields, and have not specifically designed models for the characteristic of malicious traffic data having limited semantic information. Summary of the Invention

[0009] The purpose of this invention is to address the shortcomings of existing malicious traffic detection methods, such as low accuracy and limited practical usability, in novel malicious traffic detection scenarios where previously unseen malicious traffic can easily evade detection. This invention provides a malicious traffic detection method based on a selective state-space model. Through steps including converting raw traffic data to grayscale, extracting latent features from traffic data, training the detection model, and pre-training with a large amount of known malicious traffic data, it achieves high-accuracy zero-sample malicious traffic detection. This invention aims to propose a zero-sample malicious traffic detection method for previously unseen malicious traffic types, further improving the detection accuracy of unseen malicious traffic data through data preprocessing, latent feature extraction, detection model design, and model pre-training, thereby enhancing its usability and robustness in real-world scenarios.

[0010] The method of this invention is specifically as follows:

[0011] Step (1) Prepare training data for the malicious traffic classification model: Considering that the data volume and model performance exhibit a power-law distribution, and that large data volumes have a significant impact on the emergent effect of model performance, download known malicious traffic data from the Internet as the raw traffic data; convert the raw traffic data into grayscale image data that is more convenient for classification through slicing, truncation, zero-padding, and pixel value mapping operations. The specific data conversion includes:

[0012] (1-1) Data Slicing: The original PCAP file is sliced ​​according to the data stream format. The data packets in the PCAP file are grouped according to the five-tuple information and arranged in chronological order. The five-tuple information consists of the source IP address, destination IP address, source port, destination port, and protocol. This step ensures that each data stream is a set of data packets with the same five-tuple information, thereby maintaining the correlation and order between data packets.

[0013] (1-2) Data length standardization: The beginning of each file... Each byte is retained, and the file is discarded. Bytes and all subsequent information. If the file length is less than [number] bytes. If the file length is not specified, 0x00 bytes are appended to the end of the file. This is done to standardize the length of all data stream files, facilitating subsequent image conversion and model processing.

[0014] (1-3) Pixel value mapping: Each byte of data value is mapped to a grayscale pixel value, where 0x00 corresponds to black and 0xff corresponds to white. This step converts the data stream file from binary form to image form, making it processable by deep learning models such as convolutional neural networks.

[0015] Step (2) Perform data augmentation on malicious traffic data:

[0016] Malicious traffic samples are generated using a variational autoencoder (VAE) model. The VAE model consists of an encoder and a decoder. The encoder maps malicious traffic data to a probability distribution in the latent space and samples from the latent space using a reparameterization technique; the decoder reconstructs the malicious traffic data. The reconstructed malicious traffic data is the synthesized malicious traffic sample.

[0017] Step (3) Design a malicious traffic detection model:

[0018] The malicious traffic detection model is constructed based on the Ghost module, S2M module, Mamba module, global pooling layer and linear layer, wherein each convolutional layer is followed by a batch normalization layer and a non-linear activation layer.

[0019] The malicious traffic detection model consists of a convolutional kernel with a size of It consists of a Ghost module, multiple cross-designed S2M modules and the S2MGhostMamba module, a global pooling layer, and a linear layer. The Ghost module itself comprises a... The Ghost module consists of a convolutional layer and a point convolutional layer; it first uses... Convolutional layers compress the number of channels in the input image, and then depthwise separable convolutional layers are used to obtain more feature maps. The different feature maps are then stitched together to form a new output.

[0020] The S2M module separates the token mixer and channel mixer from the MobileNetV2 module, and simplifies the module structure through reparameterization techniques, resulting in the final S2M module; the specific steps are to use... The depthwise separable convolutional layer integrates spatial information along the channel direction, and then a residual connection and two 1×1 convolutional layers are used to learn the relationship between features of different channels.

[0021] The S2MGhostMamba module consists of a convolutional kernel size of... The Ghost module, a Ghost module with a convolution kernel size of 1×1, One Mamba module, one Ghost module with a convolution kernel size of 1×1, and one convolution kernel size of... The Ghost module is composed of Mamba modules. The Mamba module includes neural network layers such as root mean square normalization layers, linear layers, and selective state-space models.

[0022] Step (4) Pre-train the malicious traffic detection model:

[0023] (4-1) Parameter initialization: Randomly initialize the weight parameters of the learning network. and bias parameters Initialize the iteration rounds Set the initial learning rate Training sample batch size Maximum number of iterations ;

[0024] (4-2) Data batching: According to the set sample batch size Dataset Divide evenly Each batch contains a subset of malicious traffic data. Its corresponding tag set is ;

[0025] (4-3) Data input: Randomly select a subset of data from a certain batch. The data is fed into a malicious traffic detection model, where feature representations are extracted using the Ghost, S2M, and Mamba modules. These feature representations are then input into a global pooling layer and a linear layer to obtain the predicted label set for that batch of data. ;

[0026] (4-4) Contrastive learning feature enhancement: Calculate the contrastive loss function value based on the feature representations extracted by the Ghost module, S2M module, and Mamba module. It maximizes the distance between samples of different categories and minimizes the distance between samples of the same category in the feature space, learns more discriminative feature representations, and outputs enhanced feature representations.

[0027] (4-5) Parameter update: based on the actual label of this batch of data. and predicted label set Calculate the loss function value And based on the loss function value Update model parameters;

[0028] (4-6) Single-round training: When the first round of training... rounds If all batches of data are input into the detection model, it means that the training round is over and proceed to step (4-7); otherwise, return to step (4-3).

[0029] (4-7) Training termination judgment: When the loss function... In continuous The reduction within the wheel is less than ,in The minimum number of convergence rounds required to determine whether the detection model has converged. To judge If the threshold no longer decreases, it indicates that the detection model has converged, and proceed to step (4-9); otherwise, proceed to step (4-8).

[0030] (4-8) If ,but Continue iterating and return to step (4-2); if This indicates that the detector training is complete, and proceed to step (4-9);

[0031] (4-9) Model saving: Save the optimal weight parameters of the detector model. and optimal bias parameters .

[0032] Step (5) Detect malicious traffic data that has never been seen before:

[0033] (5-1) Preprocess the malicious traffic data that has never been seen before, using the same method as step (1);

[0034] (5-2) Input a convolution kernel with a size of... The Ghost module performs preliminary feature extraction; the Ghost module first uses ordinary... The convolutional layer compresses the number of channels in the input image, and then the depthwise separable convolutional layer is used to obtain more feature maps. The different feature maps are then stitched together to form a new output.

[0035] (5-3) Use multiple S2M modules to perform deep local feature extraction;

[0036] (5-4) Further global feature extraction is performed by interleaving the S2MGhostMamba module among multiple S2M modules:

[0037] The S2MGhostMamba module passes the feature map through a convolutional kernel of size [size missing]. The Ghost module performs local feature modeling, and then the number of channels is adjusted through a Ghost module with a convolutional kernel size of 1×1 to obtain the output. , Represents the real number field. and These represent the height and width of the effective receptive field, respectively. Represent the dimension; then... Expand as non-overlapping one-dimensional vectors Among them, the effective receptive field patch is determined according to a fixed area. Divided into The number of one-dimensional vectors obtained by expanding a small region is . Height of each patch and width That is, the height and width of each one-dimensional vector. , , This is the size of the convolution kernel. Then, the Mamba module is used for each pixel in each patch. Encode to obtain A one-dimensional vector with global feature information .Will A one-dimensional vector with global feature information Fold back to high-dimensional vector .

[0038] A Ghost module with a 1×1 kernel is used to resize the number of channels back to their original size, mapping them back to a low-dimensional feature space. Then, residual connections are used to concatenate the original input feature map along the channel direction. Finally, a Ghost module with a 1×1 kernel is used for further processing. The Ghost module is used to perform feature fusion to obtain the output features;

[0039] (5-5) Output the final detection results using the detector: use a 1×1 Ghost module for feature compression, a global pooling layer to adjust the size of the feature map to a fixed size, flatten the feature map into a one-dimensional vector, add a Dropout layer to prevent overfitting, and finally output the detection results through a linear layer.

[0040] Compared with the prior art, the present invention has the following beneficial effects:

[0041] 1. This invention is based on the principle that model performance and data volume exhibit a power-law distribution. It pre-trains the model using a large amount of known malicious traffic data and augments the malicious traffic data using a variational autoencoder, thereby achieving an emergence effect and demonstrating excellent performance on previously unseen malicious traffic data.

[0042] 2. This invention employs contrastive learning to learn highly discriminative feature representations in the feature space. By maximizing the feature distance between samples of different categories and minimizing the feature distance between samples of the same category, it enhances the model's ability to identify malicious traffic data. Specifically, a contrastive loss function is used to drive the model to learn more discriminative feature embeddings, making malicious traffic samples from different categories easier to distinguish in the feature space, thereby improving the model's generalization performance and the detection accuracy of novel malicious traffic.

[0043] 3. This invention converts traffic data into grayscale data that is easier to classify and detect through operations such as slicing, truncating, zero-padding, and pixel value mapping, thereby enabling better analysis and extraction of the potential features of traffic data.

[0044] 4. This invention takes into account the characteristics of malicious traffic data, which has little effective semantic information and a lot of redundant information. It uses the Mamba module with a selective state-space model and utilizes the mechanism of meta-learning to learn how to retain as much effective semantic information as possible and filter out useless information during feature extraction, thereby improving the effectiveness of the extracted features and thus improving the accuracy of the model. Attached Figure Description

[0045] Figure 1 This is a schematic diagram of the overall framework for malicious traffic detection in this invention;

[0046] Figure 2 This is a schematic diagram of the data preprocessing steps of the present invention;

[0047] Figure 3 This is a schematic diagram of the malicious traffic detection model in the method of the present invention;

[0048] Figure 4 This is a schematic diagram of the Ghost module in the method of the present invention;

[0049] Figure 5 This is a schematic diagram of the improved MobileNetV2 module (S2M module) in the method of this invention;

[0050] Figure 6 This is a schematic diagram of the S2MGhostMamba module in the method of this invention;

[0051] Figure 7 This is a schematic diagram of the Mamba module in the method of the present invention. Detailed Implementation

[0052] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0053] This embodiment randomly selects data from 20 malicious traffic datasets and normal traffic datasets from the CIC-AndMal2017 and USTC-TFC2016 datasets as pre-training sets. Four previously unseen malicious traffic data types—Plankton, Selfmite, Shuanet, and Zeus—are selected as test sets. This demonstrates the zero-shot malicious traffic detection method based on convolutional neural networks and a selective state-space model proposed in this invention. Its overall framework is as follows: Figure 1 As shown.

[0054] Step (1) Obtain zero-sample malicious traffic types (in this example, including data for 20 malicious traffic types: beanbot, biige, dowgin, ewind, fakeinst, fakemart, fakenotify, feiwo, gooligan, jifake, kemoge, koodous, mazarbot, miuref, mobidash, nandrobox, smssniffer, tinba, youmi, and zsone) from the CIC-AndMal2017 and USTC-TFC2016 datasets, along with normal traffic data, for model pre-training. Then, convert the original traffic data into grayscale data, which is easier to classify, through slicing, truncation, zero-padding, and pixel value mapping operations. The specific data conversion is as follows: Figure 2 As shown:

[0055] 1. Data Slicing: The original PCAP file is sliced ​​according to the data stream. The data packets in the PCAP file are grouped according to the five-tuple information (source IP address, destination IP address, source port, destination port, and protocol) and arranged in chronological order.

[0056] 2. Data uniform length processing: The length of each data stream file in the CIC-AndMal2017 and USTC-TFC2016 datasets is uniformly shortened. (In this example) ) bytes are retained and discarded. Bytes and subsequent information. For lengths less than [a certain value]... Files of a certain length are padded with 0x00 bytes to achieve a uniform length, facilitating subsequent image conversion and model processing.

[0057] 3. Pixel value mapping: Map each byte of data value to a grayscale pixel value, where 0x00 corresponds to black (0) and 0xff corresponds to white (255) (in this example, the final output image data format is PNG).

[0058] Step (2) Perform data augmentation on malicious traffic data:

[0059] A large number of malicious traffic samples are generated using a variational autoencoder (VAE) model. The VAE model consists of an encoder and a decoder. The encoder maps the malicious traffic data to a probability distribution in the latent space (in this example, a Gaussian distribution) and samples from the latent space using a reparameterization technique; the decoder reconstructs the malicious traffic data. The reconstructed malicious traffic data is the synthesized malicious traffic sample.

[0060] Step (3) Design a malicious traffic detection model:

[0061] like Figure 3 As shown, the model is built upon Ghost, S2M, Mamba modules, global pooling layers, and linear layers. Each Ghost module's convolutional layer is followed by a batch normalization layer and a non-linear activation layer. The S2M and Mamba modules are used to extract local and global features, respectively.

[0062] Specifically, the model consists of a convolutional kernel with a size of (In this example) It consists of the Ghost module, multiple cross-designed S2M modules and the S2MGhostMamba module, a global pooling layer, and a linear layer. The Ghost module comprises a... (In this example) The Ghost module consists of a convolutional layer and a point convolutional layer, and the final result is as follows: Figure 4 As shown; the S2M module separates the token mixer and channel mixer based on the MobileNetV2 module, and simplifies the structure of the module through reparameterization techniques. The final S2M module is shown below. Figure 5 As shown, the specific steps include using (In this example) The S2MGhostMamba module integrates spatial information along the channel direction using depthwise separable convolutional layers, and then uses a residual connection and two 1×1 convolutional layers to learn the relationships between features from different channels. Figure 6 As shown, it consists of a convolution kernel with a size of The Ghost module (in this example) A Ghost module with a convolution kernel size of 1×1. One Mamba module (in this example) A Ghost module with a kernel size of 1×1 and a convolutional module with a kernel size of... The Ghost module (in this example) It consists of ) modules. Among them, the Mamba module is as follows: Figure 7 As shown, it specifically includes neural network layers such as root mean square normalization layer, linear layer, and selective state space model.

[0063] Step (4) Pre-train the malicious traffic detection model using the malicious traffic data obtained in step (1). Specifically:

[0064] (4-1) Parameter Initialization: Randomly initialize the weight and bias parameters in the model. Set the initial learning rate to... (In this example) The training sample batch size is (In this example) The maximum number of iterations is (In this example) That is, in each iteration, the model will process 64 samples until 200 iterations are completed.

[0065] (4-2) Data Batching: Divide the preprocessed dataset into equal portions. Each batch contains 64 subsets of malicious traffic data and their corresponding tags. In this example, 1000 samples are selected. (1000 / 64), each batch contains 64 samples, and the last batch may contain fewer samples.

[0066] (4-3) Data input: In each round of training, a subset of data is randomly selected from a batch. In this example, the 64 samples are fed into the model one by one. The model extracts the feature representation of each sample through the Ghost, S2M, and Mamba modules, and inputs them into the global pooling layer and linear layer to obtain the predicted label set for this batch of data. .

[0067] (4-4) Contrastive learning feature enhancement: Calculate the contrastive loss function value based on the feature representations extracted by the Ghost module, S2M module, and Mamba module. It maximizes the distance between samples of different categories and minimizes the distance between samples of the same category in the feature space, learns more discriminative feature representations, and outputs enhanced feature representations.

[0068] (4-5) Parameter update: based on the actual label of this batch of data. (In this embodiment) ) and the label set predicted by the model (In this embodiment) Calculate the loss function value The weight parameters are updated using a gradient descent-based optimizer (in this embodiment, the AdamW optimizer with a decoupled weight decay regularization method). and bias parameters .

[0069] (4-6) Single-round training: When a round of training... (In this example) If all batches of data are input into the model, it means that the training round is over and proceed to step (4-7); otherwise, return to step (4-3).

[0070] (4-7) Training termination judgment: When the loss function... In continuous The reduction within the wheel is less than ,in (In this embodiment) This represents the minimum number of convergence rounds required to determine whether the detection model has converged. (In this embodiment) ) for judgment If the threshold no longer decreases, it indicates that the detection model has converged, and step (4-9) is executed; otherwise, step (4-8) is executed.

[0071] (4-8) If ,but Continue iterating and return to step (3-2); if The detector training is complete, proceed to step (3-8).

[0072] (4-9) Model saving: Save the optimal weight parameters of the detector model. and optimal bias parameters .

[0073] Step (5) Identify the types of malicious traffic data:

[0074] The malicious traffic data is preprocessed using the same method as step (1), and then input into the model for feature extraction and detection. Specifically:

[0075] (5-1) Malicious traffic data is preprocessed by slicing, truncation, zero padding, and pixel value mapping to obtain grayscale data. The specific method is the same as step (1).

[0076] (5-2) Input the grayscale image data into a... (In this example) The Ghost module (in this example, the Ghost module consists of a convolutional layer with a kernel size of 3×3 and a depthwise separable convolutional layer of 3×3) is used for preliminary feature extraction.

[0077] (5-3) Use multiple S2M modules to perform deep local feature extraction.

[0078] (5-4) Multiple S2MGhostMamba modules are interspersed among multiple S2M modules (in this example, the number and types of modules are, in order, 5 S2M modules, 2 S2MGhostMamba modules, 1 S2M module, 4 S2MGhostMamba modules, 1 S2M module, and 3 S2MGhostMamba modules) for further global feature extraction: The specific steps of the S2MGhostMamba module include passing the feature map through a convolutional kernel of size... The Ghost module (in this example) Local feature modeling is performed, and then the number of channels is adjusted through a Ghost module with a convolutional kernel size of 1×1 to obtain the output. Then Expand as non-overlapping one-dimensional vectors .in, (In this example) )and It is the number of one-dimensional vectors. (In this example) , )and (In this example) , ) are the width and height of each one-dimensional vector, respectively. Then use One Mamba module (in this example) For each Encode to obtain Then, a Ghost module with a 1×1 kernel is used to adjust the number of channels back to their original size, mapping them back to the low-dimensional feature space. Next, residual connections are used to concatenate the original input feature map along the channel direction, and finally, a Ghost module with a 1×1 kernel is used. The Ghost module (in this example) Feature fusion is performed to obtain the output features.

[0079] (5-5) Use the detector to output the final detection results: The specific steps of the detector include using a 1×1 Ghost module for feature compression, a global pooling layer to adjust the size of the feature map to a fixed size, flattening the feature map into a one-dimensional vector, adding a Dropout layer to prevent overfitting, and finally outputting the detection results through a linear layer.

[0080] The above examples are merely illustrative of implementations of the present invention. The scope of protection of the present invention should not be limited to the specific forms described in the embodiments, and the scope of protection of the present invention should also include similar inventive methods conceived based on the present invention.

Claims

1. A malicious traffic detection method based on a selective state-space model, characterized in that: Step (1) Prepare training data for the malicious traffic classification model: Download known malicious traffic data from the Internet as raw traffic data; process the raw traffic data and convert it into grayscale data for pre-training of the malicious traffic detection model; Step (2) Perform data augmentation on malicious traffic data: Malicious traffic samples generated using a variational autoencoder model; The variational autoencoder model consists of an encoder and a decoder; the encoder is used to map malicious traffic data to a probability distribution in the latent space and to sample from the latent space through reparameterization techniques. The decoder is used to reconstruct malicious traffic data; the reconstructed malicious traffic data is the synthesized malicious traffic sample. Step (3) Design a malicious traffic detection model: The malicious traffic detection model described above is built based on the Ghost module, S2M module, Mamba module, global pooling layer and linear layer, wherein each convolutional layer is followed by a batch normalization layer and a non-linear activation layer; Step (4) Pre-train the malicious traffic detection model: (4-1) Parameter initialization: Randomly initialize the weight parameters of the learning network. and bias parameters Initialize the iteration rounds Set the initial learning rate Training sample batch size Maximum number of iterations ; (4-2) Data batching: According to the set sample batch size. Dataset Divide evenly Each batch contains a subset of malicious traffic data. Its corresponding tag set is ; (4-3) Data input: Randomly select a subset of data from a certain batch. The data is fed into a malicious traffic detection model, where feature representations are extracted using the Ghost, S2M, and Mamba modules. These feature representations are then input into a global pooling layer and a linear layer to obtain the predicted label set for that batch of data. ; (4-4) Contrastive learning feature enhancement: Calculate the contrastive loss function value based on the feature representations extracted by the Ghost module, S2M module, and Mamba module. In the feature space, the distance between samples of different categories is maximized and the distance between samples of the same category is minimized, so as to learn more discriminative feature representations and output the enhanced feature representations. (4-5) Parameter update: based on the actual label of this batch of data. and predicted label set Calculate the loss function value And based on the loss function value Update model parameters; (4-6) Single-round training: When the first round of training... rounds If all batches of data are input into the detection model, it means that the training round is over and proceed to step (4-7); otherwise, return to step (4-3). (4-7) Training termination judgment: When the loss function... In continuous The reduction within the wheel is less than ,in The minimum number of convergence rounds required to determine whether the detection model has converged. To judge If the threshold no longer decreases, it indicates that the detection model has converged, and step (4-9) is executed; otherwise, step (4-8) is executed. (4-8) If ,but Continue iterating and return to step (4-2); if This indicates that the detector training is complete, and proceed to step (4-9); (4-9) Model saving: Save the optimal weight parameters of the detector model. and optimal bias parameters ; Step (5) Detect malicious traffic data that has never been seen before: (5-1) Preprocessing malicious traffic data that has never been seen before; (5-2) Input a convolution kernel with a size of... The Ghost module performs preliminary feature extraction; the Ghost module first uses... The convolutional layer compresses the number of channels in the input image, and then the depthwise separable convolutional layer is used to obtain feature maps. The different feature maps are then stitched together to form a new output. (5-3) Use multiple S2M modules to perform deep local feature extraction; (5-4) The S2MGhostMamba module is used intermittently among multiple S2M modules for further global feature extraction. Specifically, the S2MGhostMamba module passes the feature map through a convolutional kernel of size [missing information]. The Ghost module performs local feature modeling, and then the number of channels is adjusted through a Ghost module with a convolutional kernel size of 1×1 to obtain the output. , Represents the real number field. and These represent the height and width of the effective receptive field, respectively. Represent the dimension; then... Expand as non-overlapping one-dimensional vectors Among them, the effective receptive field patch is based on a fixed area. Divided into The number of one-dimensional vectors obtained by expanding a small region is . Height of each patch and width That is, the height and width of each one-dimensional vector. , , The size of the convolution kernel; then the Mamba module is used for each pixel in each patch. Encode to obtain A one-dimensional vector with global feature information ;Will A one-dimensional vector with global feature information Fold back to high-dimensional vector ; The channel count is adjusted back to its original size using a Ghost module with a 1×1 kernel, mapping it back to a low-dimensional feature space. Then, residual connections are used to concatenate the original input feature map along the channel direction. Finally, another convolutional module with a kernel size of [missing information] is applied. The Ghost module is used to perform feature fusion to obtain the output features; (5-5) Output the final detection results using the detector: use a 1×1 Ghost module for feature compression, a global pooling layer to adjust the size of the feature map to a fixed size, flatten the feature map into a one-dimensional vector, add a Dropout layer to prevent overfitting, and finally output the detection results through a linear layer.

2. The malicious traffic detection method based on a selective state-space model as described in claim 1, characterized in that: Step (1) of raw traffic data processing and step (5-1) of preprocessing previously unseen malicious traffic data use the same method, including: (1-1) Data Slicing: The original PCAP file is sliced ​​according to the data stream. The data packets in the PCAP file are grouped according to the five-tuple information and arranged in chronological order. The five-tuple information is the source IP address, destination IP address, source port, destination port and protocol. (1-2) Data length standardization: The first few lines of each file are... Each byte is retained, and the file is discarded. bytes and all subsequent information; if the file length is less than If the file contains bytes, then append 0x00 bytes to the end of the file. (1-3) Pixel value mapping: Map each byte of data value to a grayscale pixel value, where 0x00 corresponds to black and 0xff corresponds to white.

3. The malicious traffic detection method based on a selective state-space model as described in claim 1, characterized in that: The malicious traffic detection model consists of a convolutional kernel with a size of It consists of a Ghost module, multiple cross-designed S2M modules and an S2MGhostMamba module, a global pooling layer and a linear layer; among which: The Ghost module consists of one The Ghost module consists of a convolutional layer and a point convolutional layer; it first uses... The convolutional layer compresses the number of channels in the input image, and then the feature map is obtained through the depthwise separable convolutional layer. The different feature maps are then concatenated together to form a new output. The S2M module described above separates the token mixer and channel mixer from the MobileNetV2 module, and simplifies the module structure through reparameterization techniques, resulting in the final S2M module; the specific steps are as follows: using The depthwise separable convolutional layer integrates spatial information along the channel direction, and then a residual connection and two 1×1 convolutional layers are used to learn the relationship between features of different channels. The S2MGhostMamba module consists of a convolutional kernel with a size of [missing value]. The Ghost module, a Ghost module with a convolution kernel size of 1×1, One Mamba module, one Ghost module with a convolution kernel size of 1×1, and one convolution kernel size of... The Ghost module is composed of the Mamba module, which includes a root mean square normalization layer, a linear layer, and a selective state-space model.

Images