Malicious Traffic Classification Method and System Based on Gradient Sharing Feature Fusion Network

Abstract

The present invention belongs to, but is not limited to, the field of 5G Internet of Things and network security technology, and discloses a malicious traffic classification method and system based on a gradient-sharing feature fusion network. The method preprocesses the raw data of 5G Internet of Things traffic and constructs a structured feature channel and an image feature channel respectively; processes the image feature channel data using a local feature extraction module based on a convolutional neural network; constructs a global feature extraction module using a KAN to capture the time series distribution and global dependency of traffic; fuses the features extracted from the structured feature channel and the image feature channel; performs gradient sharing initialization, gradient sharing training, KAN and convolutional neural network model training and optimization, and model testing. The present invention effectively improves the ability to identify malicious traffic in the 5G Internet of Things through feature fusion and gradient sharing technology, while reducing dependence on large-scale annotated data and enhancing the generalization and adaptability of the model in complex network environments.

Description

Technical Field

[0001] The present invention belongs to but is not limited to the field of 5G Internet of Things and network security technology, and in particular relates to a malicious traffic classification method and system based on a gradient-sharing feature fusion network. Background Art

[0002] With the rapid development of 5G networks and the Internet of Things (IoT) technology, network traffic data has become a key factor in ensuring network security and detecting malicious traffic. However, the increasingly complex network environment, coupled with the low latency, high bandwidth, and massive connectivity of 5G networks and the widespread access of IoT devices, has led to a high degree of complexity and dynamism in network traffic, posing a significant challenge to traditional methods of detecting malicious traffic. While some traditional methods have demonstrated some success in specific scenarios, their limitations are becoming increasingly apparent in the complex 5G and IoT environments, making it difficult to effectively address diverse malicious traffic attacks.

[0003] In the early days, malicious traffic detection mainly used traditional methods such as rule matching and statistical feature analysis. However, these methods have many problems: (1) Insufficient feature modeling capabilities. When extracting network traffic features, existing detection methods are often limited to modeling a certain type of features, such as focusing only on local statistical information or global traffic relationships, and it is difficult to simultaneously obtain complementary information of local and global features. In the 5G environment, the high concurrency and low latency characteristics of network traffic make attack patterns more hidden. For example, the traffic fluctuations of DDoS attacks may appear as large-scale global patterns, which are difficult to effectively identify by models that rely only on local features; and relying only on global features will ignore the microscopic information at the packet level, resulting in omissions or false positives when facing complex attack scenarios. (2) Insufficient adaptability in dynamically changing environments. With the popularization of 5G networks and Internet of Things technologies, network environments, user behaviors, and attack strategies are constantly changing, and network traffic patterns are also evolving. Many traditional methods are based on fixed features and static rules for detection, which makes it difficult to adapt to these changes. In 5G networks, dynamically switching network topology will affect attack paths and render traditional traffic analysis methods ineffective; malicious attackers will also quickly adjust their strategies to evade detection, and the detection performance of traditional static models will drop significantly when traffic patterns change significantly.

[0004] Given the above analysis, existing technologies face the following urgent technical challenges: Existing methods struggle to fully capture the complex traffic patterns in 5G and IoT environments and lack adaptability to dynamically changing network environments. Traditional methods fail to balance the synergy between local and global features when extracting features, limiting detection accuracy. Furthermore, traditional detection methods based on fixed features and static rules struggle to adapt quickly to the ever-changing network environment and attack strategies, resulting in unstable detection performance. Summary of the Invention

[0005] To address the challenges of existing technologies, this paper provides a 5G IoT malicious traffic classification model and method based on feature fusion and gradient sharing. This model aims to address the shortcomings of traditional malicious traffic detection methods in terms of feature modeling and environmental adaptability. By using feature fusion and gradient sharing, the model's ability to learn complex traffic patterns is improved, its reliance on specific features is reduced, and its adaptability and robustness in diverse network environments are enhanced.

[0006] The present invention is implemented as follows: a malicious traffic classification method based on a gradient-sharing feature fusion network comprises the following steps:

[0007] S1. Data Preprocessing: 5G IoT traffic raw data is preprocessed to construct structured feature channels and image feature channels. For the structured feature channel, Wireshark is used to parse the PCAP files in the 5G traffic data into a vector format, extract communication features, and perform normalization. For the image feature channel, the byte distribution of the 5G traffic is mapped to an image format. The raw byte stream in the PCAP file is reorganized into a fixed-length one-dimensional vector. After binarization, the first 784 bits are selected and mapped to a grayscale image.

[0008] S2, local feature extraction: Use the local feature extraction module based on convolutional neural networks to process the data in the image feature channel, automatically learn the local spatial characteristics in the traffic data by stacking convolutional layers and pooling layers, and extract micro-pattern features such as packet length, time interval and protocol identification.

[0009] S3, Global Feature Extraction: A global feature extraction module is built using KAN to dynamically model the data in the structured feature channel, capturing the time series distribution and global dependencies of traffic, and constructing the overall behavioral characteristics of traffic at a macro level. When constructing global features, samples are input in a chronological order to simulate a real-world network environment.

[0010] S4, Feature Fusion: In the feature fusion module, features extracted from the structured feature channel and the image feature channel are fused. For the structured feature channel, both packet-level features (such as source IP, destination IP, protocol type, and packet length) and stream-level features (such as stream duration, total number of packets, and total number of bytes) are extracted and combined to construct a comprehensive feature representation for each packet. For the image feature channel, the byte stream is converted into a grayscale image, and a convolutional neural network is used to extract local features. Finally, the features of the two channels are merged into a unified high-dimensional feature vector to capture both the global characteristics and local details of the traffic data.

[0011] S5, Gradient sharing initialization: Before model training, initialize the parameters related to the gradient sharing mechanism, including determining the formula for calculating the gradient weights of the convolutional neural network and KAN channels, initializing the KAN and convolutional neural network models and optimizers.

[0012] S6, Gradient Sharing Training: During training, for each batch of training data, structural features and image features are fed into the KAN and convolutional neural network models, respectively, and their respective outputs and losses are calculated. Based on the losses, the gradients of the convolutional neural network and KAN channels themselves are calculated, as well as the gradient guidance between them. The final updated gradient for each channel is calculated by dynamically adjusting weights.

[0013] S7, Model Training and Optimization: Through multiple rounds of training and utilizing a gradient sharing mechanism, the KAN and convolutional neural network models collaborate and optimize with each other during feature learning. This continuously adjusts model parameters, improves the model's ability to identify malicious traffic, reduces conflicts between local and global feature learning, and enhances the model's sensitivity to diverse malicious traffic patterns.

[0014] S8, model testing: The trained malicious traffic classification model is tested on the test set. The model performance is evaluated through indicators such as accuracy, precision, recall, and F1 score to verify the model's accuracy in classifying malicious traffic in different 5G IoT traffic scenarios.

[0015] Furthermore, S1 specifically includes: processing the collected 5G IoT traffic raw data set, converting it into a format suitable for model input, and constructing structured feature channel and image feature channel data. For the construction of structured feature channel data: first, the PCAP file in the 5G traffic data is parsed into a vector format using the Wireshark tool to extract rich communication features such as source IP, destination IP, protocol type, packet length, flow duration, total number of packets, and total number of bytes during the communication process. These features cover information at the packet level and data flow level, and fully reflect the static properties and dynamic behavior of network communication. Subsequently, all extracted features are standardized. Assuming X is the current value, X max is the maximum value of the feature, X min is the minimum value of the feature, and the normalization formula is:

[0016]

[0017] Unify features of different magnitudes and distributions into the same scale range to avoid inconsistent weights of different features on model learning, ensuring that the model can learn feature information more effectively.

[0018] To construct image feature channel data, this method converts the byte distribution of 5G traffic into an image. Specifically, the raw byte stream in the PCAP file is reorganized into a fixed-length one-dimensional vector. Instead of normalization, it is directly binarized to produce a series of vectors consisting only of 0s and 1s. The first 784 bits are then selected and mapped into a 28×28 grayscale image, where each pixel value corresponds to a byte value in the vector. This allows the subsequent convolutional neural network module to extract the local spatial characteristics of the traffic.

[0019] Furthermore, S2 specifically includes: utilizing a local feature extraction module based on a convolutional neural network to process data in the image feature channel. The convolutional neural network module consists of two stacked convolutional layers and a pooling layer. In the convolutional layer, sliding convolutions are performed on the image using convolution kernels of varying sizes and strides, automatically learning local spatial characteristics in traffic data, such as microscopic pattern features such as packet length, time interval, and protocol identifier. In the pooling layer, maximum pooling or average pooling operations are used to downsample the feature maps output by the convolutional layer, reducing the amount of data while retaining key features, lowering the computational complexity of the model, and improving model training efficiency and generalization capabilities.

[0020] Furthermore, S3 specifically includes: Using KAN to construct a global feature extraction module, dynamically modeling the data in the structured feature channel. The KAN module receives preprocessed structured feature vectors and, through its unique network structure, dynamically captures the time series distribution and global dependencies of traffic. When constructing global features, rather than inputting all data at once, it gradually inputs samples in chronological order, simulating the dynamic changes of data in a real network environment. This constructs the overall behavioral characteristics of traffic at a macro level, capturing macro information such as the time series characteristics of traffic and the network topology, complementing the local features extracted by the convolutional neural network.

[0021] Furthermore, S4 specifically includes: In the feature fusion module, features extracted from the structured feature channel and the image feature channel are fused. For structured features, at the packet level, features such as source IP, destination IP, protocol type, and packet length are extracted. These features provide static information about the traffic sample. At the data flow level, traffic samples with the same five-tuple (source IP, destination IP, source port, destination port, protocol) are grouped as a data flow, and features such as flow duration, total number of packets, and total number of bytes are extracted. These features dynamically reflect the spatiotemporal correlations between packets and the overall behavioral characteristics of the data flow. The data flow-level features are then added to the features of the corresponding packets to construct a comprehensive feature representation for each packet, which not only contains its own attributes but also incorporates the contextual information of the corresponding data flow. For image features, after feature extraction by the convolutional neural network module, the features of the two channels are concatenated in a certain order into a unified high-dimensional feature vector. This enables the model to simultaneously capture both the global characteristics and local details of the traffic data, improving its ability to identify malicious traffic.

[0022] Furthermore, S5 specifically includes: before model training, initializing the parameters related to the gradient sharing mechanism. Determine the formula for calculating the gradient weights of the image feature channel and the structured feature channel, assuming that ω Local is the weight of the image feature channel, ω Global is the weight of the structured feature channel, L Local is the loss of image feature channel, L Global is the loss of the structured feature channel, and the weight formulas of the two channels are:

[0023]

[0024] Furthermore, S6 specifically includes: during the training process, for each batch of training data, inputting the structural features and image features into the KAN and convolutional neural network models respectively. The KAN model outputs the prediction results of the global features, and the convolutional neural network model outputs the prediction results of the local features, and the loss values between them and the true labels are calculated respectively to obtain the gradient G of the convolutional neural network and KAN channel itself. Local，self and G Global，self Then, according to the gradient sharing mechanism, the gradient guidance G of the structured feature channel to the image feature channel is calculated. Global→Local And the gradient guidance G of the image feature channel to the structured feature channel Local→Global . The weight ω calculated previously Local and ω Global , the gradient calculation formula of the two channels is as follows:

[0025] G Local =ω Local GLocal，self +(1-ω Local )G Global，self (4)

[0026] G Global =ω Local G Local，self +(1-ω Local )G Global，self (5)

[0027] Finally, the parameters of the image feature channel and structured feature channel models are updated separately according to the updated gradient, so that the two models can cooperate and optimize with each other during the training process, thereby improving the model's ability to identify malicious traffic.

[0028] Furthermore, S7 specifically includes: through multiple rounds of training, using the gradient sharing mechanism, allowing the KAN and convolutional neural network models to continuously collaborate with each other in the feature learning process. In each round of training, the two models continuously adjust their own parameters based on the shared gradient information to optimize the learning effect of malicious traffic features. As the number of training rounds increases, the model gradually reduces the conflict between local and global feature learning and enhances its sensitivity to diverse malicious traffic patterns. During the training process, the changes in indicators such as the accuracy and loss value of the model on the validation set are observed. When the performance indicators of the model on the validation set tend to be stable and no longer show significant improvement, the model training is considered to have reached a good state, and the model training and optimization process is completed to obtain a trained malicious traffic classification model.

[0029] Furthermore, S8 specifically includes testing the trained malicious traffic classification model on a test set. During the testing phase, the 5G IoT traffic data in the test set is preprocessed using the same method used in the training phase to construct structured feature channels and image feature channel data, which are then fed into the trained model. The model then infers the test data based on the learned feature patterns and outputs a prediction of whether each traffic sample is malicious.

[0030] Another object of the present invention is to provide a malicious traffic classification method based on a gradient-sharing feature fusion network and a malicious traffic classification system based on a gradient-sharing feature fusion network, comprising:

[0031] Data preprocessing module, used to process 5G traffic data into structured and graphical features suitable for model input;

[0032] The local feature extraction module extracts local microscopic features of traffic data based on convolutional neural networks;

[0033] The global feature extraction module uses KAN to construct the global behavior characteristics of traffic;

[0034] Feature fusion module: used to fuse the features extracted by the structured feature channel and the image feature channel;

[0035] Gradient sharing module: used to enable the two modules to complement each other and coordinate optimization in feature expression, thereby improving the training stability and convergence speed of the model.

[0036] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0037] First, this paper proposes a 5G IoT malicious traffic classification model and method based on feature fusion and gradient sharing. Convolutional neural networks (CNNs) are powerful in extracting local features, while Kolmogorov–Arnold networks (KANs) excel at modeling global features. This paper combines these two approaches. Through a feature fusion module, it simultaneously learns deep information from local and global features, effectively capturing complex patterns in network traffic.

[0038] To enhance the model's collaboration and robustness, the present invention introduces a gradient sharing mechanism. This mechanism allows multiple sub-models to dynamically share gradients in real time and jointly optimize the loss function, enabling the sub-models to guide each other and correct errors during training. This bidirectional learning mechanism overcomes the one-way learning limitation of traditional knowledge distillation methods, where the teacher model guides the student model. It ensures that the refined modeling of local features complements the macroscopic abstraction of global features, reducing conflicts between local and global feature learning and increasing the model's sensitivity to diverse malicious traffic patterns.

[0039] In summary, this invention combines the advantages of feature fusion and gradient sharing to provide a more efficient, accurate, and adaptable 5G IoT malicious traffic classification model and method. Through feature fusion and gradient sharing, the model's ability to learn complex traffic patterns is improved, its reliance on specific features is reduced, and its adaptability and robustness in different network environments are enhanced. This method can effectively address the diversity of malicious traffic patterns and the dynamic changes in network environments, and has broad application prospects and significant commercial value in the field of network security.

[0040] This paper proposes a gradient sharing and feature fusion mechanism to construct a malicious traffic classification model based on a convolutional neural network and a knowledge network annotation (KAN) for 5G IoT malicious traffic classification. During model construction, data preprocessing constructs structured feature channels and image feature channels, which are used by the KAN and convolutional neural network for feature extraction, respectively. The convolutional neural network leverages its powerful local feature extraction capabilities to capture packet-level micro-patterns; the KAN, with its advantage in modeling global features, captures the time series distribution and global dependencies of traffic. In the feature fusion module, the features extracted by both methods are combined, enabling the model to simultaneously learn deep information about local and global features. During training, the gradient sharing mechanism allows multiple sub-models to dynamically share gradients in real time and jointly optimize the loss function. In the initial training phase, although there is no fixed master-slave relationship like in traditional knowledge distillation, the two modules each learn features based on their respective strengths. As training progresses, gradient sharing is achieved through dynamic weight adjustment, allowing the two modules to guide each other and correct errors. In this way, the present invention can effectively improve the accuracy of 5G IoT malicious traffic classification. On multiple public 5G-IoT traffic datasets, the F1 score of the proposed model increased by 7% compared to existing methods, enabling accurate identification of malicious traffic.

[0041] The technical effects and advantages of the technical solution of the present invention are as follows: First, the method of the present invention effectively improves the feature modeling capability. Traditional malicious traffic detection methods can often only focus on a certain type of feature, while the present invention uses feature fusion and gradient sharing, while taking into account the complementary information of local and global features, to fully capture the complexity of network traffic. Secondly, in the dynamically changing 5G and Internet of Things environment, the present invention shows good adaptability. The gradient sharing mechanism enables the model to quickly learn new traffic patterns, and maintain stable detection performance when the network environment, user behavior and attack strategy change. Compared with traditional methods, the present invention has significant improvements in core indicators such as detection accuracy, precision, and recall rate, and has stronger generalization capabilities.

[0042] Second, as auxiliary evidence for the inventiveness of the claims of the present invention, it is also reflected in the following important aspects:

[0043] (1) The expected benefits and commercial value of the technical solution of the present invention after transformation are as follows: The expected benefits are to improve the security protection level of 5G Internet of Things networks, provide an efficient and accurate malicious traffic detection model for network security protection systems, and reduce the losses caused by network attacks. It can be widely used in the fields of telecommunications operators, Internet of Things equipment manufacturers, enterprise network security protection, etc., supports traffic detection in various network environments, and has broad market prospects and commercial value.

[0044] (2) The technical solution of the present invention solves a technical problem that people have long been eager to solve but have never been able to solve successfully: it solves the problem of difficulty in detecting malicious traffic in the 5G Internet of Things environment due to the complex and changeable traffic patterns, the difficulty in fully capturing features, and the poor adaptability of traditional methods. Through gradient sharing and feature fusion, the present invention allows convolutional neural networks and KANs to collaborate with each other during the training process, which to a certain extent overcomes the limitations of a single model, reduces dependence on specific types of features, improves detection accuracy and model robustness, and can effectively respond to diverse malicious traffic attacks.

[0045] (3) The technical solution of the present invention overcomes the limitations of traditional methods: traditional malicious traffic detection methods cannot take into account the synergistic effect of local and global features during feature extraction and have poor adaptability to dynamically changing network environments. The present invention, through the proposed gradient sharing and feature fusion mechanism, enables convolutional neural networks and KANs to share gradient information during training, optimizes the feature learning process, reduces the conflict between local and global feature learning, and enhances the model's sensitivity to diverse malicious traffic patterns, thereby improving the accuracy and generalization ability of malicious traffic classification.

[0046] Third, this invention addresses a number of technical issues in the prior art and achieves significant technological advancement by introducing a 5G IoT malicious traffic classification method based on feature fusion and gradient sharing. These aspects are described in detail below.

[0047] Technical issues solved:

[0048] 1. Limitations of traditional methods: Existing 5G IoT malicious traffic detection methods have serious deficiencies in feature modeling. They usually only focus on the modeling of a certain type of features and find it difficult to capture the complementary information of local and global features at the same time. Moreover, these methods are mostly based on fixed features and static rules for detection. When the network environment, user behavior and attack strategies change, it is difficult for the model to quickly adapt to new traffic patterns. The present invention integrates the powerful local feature extraction capabilities of CNN with the advantages of KAN in global feature modeling through a feature fusion module, and simultaneously learns the deep information of local and global features; with the help of a gradient sharing mechanism, multiple sub-models are allowed to dynamically share gradients in real time and jointly optimize the loss function, so that the model can quickly adjust the learning strategy in the dynamically changing 5G and IoT environment, thereby improving the adaptability of detection.

[0049] 2. Poor generalization ability: Traditional malicious traffic detection methods are often designed for specific network environments or data sets and lack broad applicability. Faced with the complex and diverse traffic patterns in the 5G IoT environment, including encrypted traffic and industrial IoT scenario traffic, traditional methods are difficult to effectively cope with. The present invention integrates multiple types of feature information during feature extraction and training, and uses gradient sharing to promote collaborative learning between sub-models, enabling the model to learn more universal traffic feature representations, thereby improving the generalization ability in different network environments and traffic data sets.

[0050] 3. Low accuracy: Due to the complexity and dynamism of 5G IoT traffic, traditional detection methods are prone to omissions or false positives, resulting in low detection accuracy. Some methods may be overly dependent on certain features and fail to accurately identify malicious traffic in complex attack scenarios. This invention obtains more comprehensive traffic features through feature fusion, combines a gradient sharing mechanism to enhance the model's sensitivity to diverse malicious traffic patterns, and continuously optimizes model parameters during training, thereby improving overall detection accuracy and F1 value.

[0051] Significant technological advancements achieved:

[0052] 1. Reduced number of abnormally labeled samples required: This method uses gradient sharing and feature fusion for model training. In the early stages of training, each sub-model can learn features based on its own strengths. As training progresses, gradient sharing enables collaborative optimization. This approach enables the model to effectively learn the characteristic patterns of malicious traffic using only a portion of normal traffic samples and a small number of malicious traffic samples, reducing reliance on large-scale malicious traffic annotated data.

[0053] 2. Improved generalization: The method is applicable to 5G IoT traffic detection in a variety of network environments, including network traffic, encrypted traffic, industrial IoT scenarios, and 5G traffic. Through feature fusion and gradient sharing, the model can learn the common and differentiated characteristics of different types of traffic. This allows it to quickly adapt to and accurately detect malicious traffic in new network environments and traffic patterns, improving the model's applicability across diverse environments.

[0054] 3. Improved Accuracy and Efficiency: Through a gradient sharing mechanism, the convolutional neural network and the KAN sub-models guide each other during training, correcting errors and optimizing feature learning. This collaborative training approach not only improves detection accuracy but also reduces training time and computational overhead compared to traditional single-model training. Experiments on multiple public datasets demonstrate that the malicious traffic detection model significantly outperforms existing methods in core metrics such as detection accuracy and false alarm rate, achieving up to a 7% improvement in classification accuracy and faster training convergence.

[0055] The method provided by this invention represents a significant technological advancement, effectively addressing several shortcomings of existing technologies and providing an innovative solution for detecting malicious traffic in the 5G IoT. These technological advancements not only improve detection accuracy but also reduce reliance on large-scale annotated data, thus having significant implications for the development of 5G IoT network security.

[0056] Fourth, the model and technical design adopted by the 5G Internet of Things malicious traffic classification method based on feature fusion and gradient sharing in the present invention targets several key technical problems in the existing technology and achieves significant technological progress.

[0057] 1. Feature Fusion and Gradient Sharing Mechanism: This invention utilizes an architecture that combines a convolutional neural network and a KAN. Through the feature fusion module, it leverages the powerful local feature extraction capabilities of convolutional neural networks and the global feature modeling advantages of KAN to simultaneously learn deep information about local and global features. During the training process, a gradient sharing mechanism is introduced. In the initial stage, each module learns features based on its own strengths. As training progresses, different modules dynamically adjust their parameters by sharing gradient information. The gradient information of the local feature extraction module and the global feature modeling module is dynamically interacted and shared, improving the ability to identify complex malicious traffic patterns.

[0058] 2. Model Collaborative Optimization: During gradient sharing, the convolutional neural network and the KAN model collaborate on optimization. During backpropagation, each sub-model not only updates its own parameters but also receives gradient signals from other modules, enabling multi-module collaborative optimization during feature learning. This mechanism ensures that the refined modeling of local features complements the macroscopic abstraction of global features, enabling more comprehensive learning of malicious traffic patterns and improving detection performance.

[0059] 3. Reduced reliance on specific features and large-scale annotated data: Through feature fusion, the model can comprehensively utilize multiple types of feature information, reducing its reliance on a single type of feature. Furthermore, the gradient sharing mechanism enables the model to better learn the characteristics of different traffic patterns during training. Even with only a portion of normal traffic samples and a small number of malicious traffic samples for training, it can effectively learn the characteristic patterns of malicious traffic, reducing its reliance on large-scale annotated malicious traffic data.

[0060] Technical issues solved:

[0061] 1. Limitations of a Single Model: Traditional 5G IoT malicious traffic detection methods typically rely on a single model, making it difficult to simultaneously extract and analyze local and global features, limiting detection capabilities. This invention utilizes feature fusion and gradient sharing to enable convolutional neural networks and KANs to collaborate, leveraging their respective strengths to enhance detection capabilities.

[0062] 2. Insufficient generalization: Previous methods are typically designed for specific network environments or datasets, making them difficult to adapt to the complex and diverse traffic patterns of 5G IoT environments, including encrypted traffic and traffic in industrial IoT scenarios. This invention, through feature fusion and gradient sharing, enables the model to learn more universal traffic feature representations, improving its adaptability to different network environments and traffic datasets.

[0063] 3. Accuracy of anomaly detection: Existing methods for detecting malicious traffic in 5G IoT are prone to high false positives or missed detections due to their inability to fully capture complex traffic patterns. This new method uses feature fusion to obtain more comprehensive traffic features. In combination with a gradient sharing mechanism, it enhances the model's sensitivity to diverse malicious traffic patterns. The model parameters are continuously optimized during training, improving detection accuracy and stability.

[0064] Technological advancements achieved:

[0065] 1. Improved accuracy of malicious traffic detection in 5G IoT: By integrating features and gradient sharing between convolutional neural networks and KANs, this method effectively improves the accuracy of malicious traffic detection. On multiple public 5G-IoT traffic datasets, the model's F1 score improved by 7% compared to existing methods.

[0066] 2. Reduced the number of labeled samples required for model training: The present invention mainly relies on feature fusion and gradient sharing to learn malicious traffic features, which greatly reduces the demand for large-scale malicious traffic annotation data. Efficient model training can be achieved by using only some normal traffic samples and a small number of malicious traffic samples.

[0067] 3. Improved system adaptability and generalization capabilities: Feature fusion and gradient sharing mechanisms enable the present invention to adapt to 5G IoT traffic in different network environments, including network traffic, encrypted traffic, industrial IoT scenarios, and 5G traffic, thereby improving the ability to detect unknown malicious traffic patterns.

[0068] This invention not only solves existing problems technically, but also demonstrates significant technical advantages in practical applications, providing an efficient and flexible new method for malicious traffic detection in 5G Internet of Things. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 This is a flow chart of a malicious traffic classification method based on a gradient-sharing feature fusion network provided by an embodiment of the present invention;

[0070] Figure 2 This is a feature fusion flow chart provided by an embodiment of the present invention;

[0071] Figure 3 This is a structural diagram of a malicious traffic classification system based on a gradient-sharing feature fusion network provided by an embodiment of the present invention.

[0072] Figure 4 This is the result of comparing the embodiment of the present invention with other methods on the 5G-NIDD dataset. DETAILED DESCRIPTION

[0073] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0074] In response to the problems existing in the existing technology in detecting malicious traffic in the 5G Internet of Things, the present invention provides a 5G Internet of Things malicious traffic classification method based on feature fusion and gradient sharing. This method combines the powerful local feature extraction capability of convolutional neural networks with the modeling advantage of KAN for global features. With the help of the information interaction mechanism of gradient sharing, it effectively improves the ability to identify malicious traffic in the 5G Internet of Things, while reducing the dependence on large-scale labeled data, and enhancing the generalization and adaptability of the model in complex network environments.

[0075] First, the raw 5G IoT traffic data is preprocessed to construct structured and image feature channels. For the structured feature channel, Wireshark is used to parse the PCAP file into a vector format, extracting and standardizing communication features. For the image feature channel, the traffic byte distribution is mapped to an image format, and the raw byte stream is processed into a grayscale image of a specific size.

[0076] Next, a local feature extraction module based on convolutional neural networks is used to process the image feature channel data. Micro-pattern features such as packet length and time interval are automatically learned by stacking convolutional layers and pooling layers. A global feature extraction module is constructed with the help of KAN to dynamically model the structured feature channel data and capture the time series distribution and global dependency of traffic.

[0077] Under the gradient sharing mechanism, the convolutional neural network and KAN modules of the present invention are trained collaboratively. Each module independently learns traffic data features based on its own strengths, while simultaneously transferring knowledge to each other through shared gradient information, achieving collaborative optimization and improving malicious traffic detection performance. When one module has an advantage in learning a specific malicious traffic pattern, the other module can use gradient sharing to obtain relevant information, thereby improving overall detection accuracy. Furthermore, the gradient sharing mechanism enables the two modules to supervise each other during training, further optimizing the model's ability to detect malicious traffic.

[0078] like Figure 1 As shown, an embodiment of the present invention provides a malicious traffic classification method based on a gradient-sharing feature fusion network, comprising the following steps:

[0079] S1. Data Preprocessing: 5G IoT traffic raw data is preprocessed to construct structured feature channels and image feature channels. For the structured feature channel, Wireshark is used to parse the PCAP files in the 5G traffic data into a vector format, extract communication features, and perform normalization. For the image feature channel, the byte distribution of the 5G traffic is mapped to an image format. The raw byte stream in the PCAP file is reorganized into a fixed-length one-dimensional vector. After binarization, the first 784 bits are selected and mapped to a grayscale image.

[0080] S2, local feature extraction: Use the local feature extraction module based on convolutional neural networks to process the data in the image feature channel, automatically learn the local spatial characteristics in the traffic data by stacking convolutional layers and pooling layers, and extract micro-pattern features such as packet length, time interval and protocol identification.

[0081] S3, Global Feature Extraction: A global feature extraction module is built using KAN to dynamically model the data in the structured feature channel, capturing the time series distribution and global dependencies of traffic, and constructing the overall behavioral characteristics of traffic at a macro level. When constructing global features, samples are input in a chronological order to simulate a real-world network environment.

[0082] S4, Feature Fusion: In the feature fusion module, features extracted from the structured feature channel and the image feature channel are fused. For the structured feature channel, both packet-level features (such as source IP, destination IP, protocol type, and packet length) and stream-level features (such as stream duration, total number of packets, and total number of bytes) are extracted and combined to construct a comprehensive feature representation for each packet. For the image feature channel, the byte stream is converted into a grayscale image, and a convolutional neural network is used to extract local features. Finally, the features of the two channels are merged into a unified high-dimensional feature vector to capture both the global characteristics and local details of the traffic data.

[0083] S5, Gradient sharing initialization: Before model training, initialize the parameters related to the gradient sharing mechanism, including determining the formula for calculating the gradient weights of the convolutional neural network and KAN channels, initializing the KAN and convolutional neural network models and optimizers.

[0084] S6, Gradient Sharing Training: During training, for each batch of training data, structural features and image features are fed into the KAN and convolutional neural network models, respectively, and their respective outputs and losses are calculated. Based on the losses, the gradients of the convolutional neural network and KAN channels themselves are calculated, as well as the gradient guidance between them. The final updated gradient for each channel is calculated by dynamically adjusting weights.

[0085] S7, Model Training and Optimization: Through multiple rounds of training and utilizing a gradient sharing mechanism, the KAN and convolutional neural network models collaborate and optimize with each other during feature learning. This continuously adjusts model parameters, improves the model's ability to identify malicious traffic, reduces conflicts between local and global feature learning, and enhances the model's sensitivity to diverse malicious traffic patterns.

[0086] S8, model testing: The trained malicious traffic classification model is tested on the test set. The model performance is evaluated through indicators such as accuracy, precision, recall, and F1 score to verify the model's accuracy in classifying malicious traffic in different 5G IoT traffic scenarios.

[0087] Furthermore, S1 specifically includes: processing the collected 5G IoT traffic raw data set, converting it into a format suitable for model input, and constructing structured feature channel and image feature channel data. For the construction of structured feature channel data: first, the PCAP file in the 5G traffic data is parsed into a vector format using the Wireshark tool to extract rich communication features such as source IP, destination IP, protocol type, packet length, flow duration, total number of packets, and total number of bytes during the communication process. These features cover information at the packet level and data flow level, and fully reflect the static properties and dynamic behavior of network communication. Subsequently, all extracted features are standardized. Assuming X is the current value, X max is the maximum value of the feature, X min is the minimum value of the feature, and the normalization formula is:

[0088]

[0089] Unify features of different magnitudes and distributions into the same scale range to avoid inconsistent weights of different features on model learning, ensuring that the model can learn feature information more effectively.

[0090] To construct image feature channel data, this method converts the byte distribution of 5G traffic into an image. Specifically, the raw byte stream in the PCAP file is reorganized into a fixed-length one-dimensional vector. Instead of normalization, it is directly binarized, resulting in a vector consisting solely of 0s and 1s. The first 784 bits are then selected and mapped into a 28×28 grayscale image, where each pixel value corresponds to a byte value in the vector. This allows the subsequent convolutional neural network module to extract the local spatial characteristics of the traffic.

[0091] Furthermore, S2 specifically includes: utilizing a local feature extraction module based on a convolutional neural network to process data in the image feature channel. The convolutional neural network module consists of two stacked convolutional layers and a pooling layer. In the convolutional layer, sliding convolutions are performed on the image using convolution kernels of varying sizes and strides, automatically learning local spatial characteristics in traffic data, such as microscopic pattern features such as packet length, time interval, and protocol identifier. In the pooling layer, maximum pooling or average pooling operations are used to downsample the feature maps output by the convolutional layer, reducing the amount of data while retaining key features, lowering the computational complexity of the model, and improving model training efficiency and generalization capabilities.

[0092] Furthermore, S3 specifically includes: Using KAN to construct a global feature extraction module, dynamically modeling the data in the structured feature channel. The KAN module receives preprocessed structured feature vectors and, through its unique network structure, dynamically captures the time series distribution and global dependencies of traffic. When constructing global features, rather than inputting all data at once, it gradually inputs samples in chronological order, simulating the dynamic changes of data in a real network environment. This constructs the overall behavioral characteristics of traffic at a macro level, capturing macro information such as the time series characteristics of traffic and the network topology, complementing the local features extracted by the convolutional neural network.

[0093] Furthermore, S4 specifically includes: In the feature fusion module, features extracted from the structured feature channel and the image feature channel are fused. For structured features, at the packet level, features such as source IP, destination IP, protocol type, and packet length are extracted. These features provide static information about the traffic sample. At the data flow level, traffic samples with the same five-tuple (source IP, destination IP, source port, destination port, protocol) are grouped as a data flow, and features such as flow duration, total number of packets, and total number of bytes are extracted. These features dynamically reflect the spatiotemporal correlations between packets and the overall behavioral characteristics of the data flow. The data flow-level features are then added to the features of the corresponding packets to construct a comprehensive feature representation for each packet, which not only contains its own attributes but also incorporates the contextual information of the corresponding data flow. For image features, after feature extraction by the convolutional neural network module, the features of the two channels are concatenated in a certain order into a unified high-dimensional feature vector. This enables the model to simultaneously capture both the global characteristics and local details of the traffic data, improving its ability to identify malicious traffic.

[0094] Furthermore, S5 specifically includes: before model training, initializing the parameters related to the gradient sharing mechanism. Determine the formula for calculating the gradient weights of the image feature channel and the structured feature channel, assuming that ω Local is the weight of the image feature channel, ω Global is the weight of the structured feature channel, L Local is the loss of image feature channel, L Global is the loss of the structured feature channel, and the weight formulas of the two channels are:

[0095]

[0096] Furthermore, S6 specifically includes: during the training process, for each batch of training data, inputting the structural features and image features into the KAN and convolutional neural network models respectively. The KAN model outputs the prediction results of the global features, and the convolutional neural network model outputs the prediction results of the local features, and the loss values between them and the true labels are calculated respectively to obtain the gradient G of the convolutional neural network and KAN channel itself. Local，self and G Global，self Then, according to the gradient sharing mechanism, the gradient guidance G of the structured feature channel to the image feature channel is calculated. Global→Local And the gradient guidance G of the image feature channel to the structured feature channel Local→Global . The weight ω calculated previously Local and ω Global , the gradient calculation formula of the two channels is as follows:

[0097] G Local =ω Local GLocal，self +(1-ω Local )G Global，self (4)

[0098] G Global =ω Local G Local，self +(1-ω Local )G Global，self (5)

[0099] Finally, the parameters of the image feature channel and structured feature channel models are updated separately according to the updated gradient, so that the two models can cooperate and optimize with each other during the training process, thereby improving the model's ability to identify malicious traffic.

[0100] Furthermore, S7 specifically includes: through multiple rounds of training, using the gradient sharing mechanism, allowing the KAN and convolutional neural network models to continuously collaborate with each other in the feature learning process. In each round of training, the two models continuously adjust their own parameters based on the shared gradient information to optimize the learning effect of malicious traffic features. As the number of training rounds increases, the model gradually reduces the conflict between local and global feature learning and enhances its sensitivity to diverse malicious traffic patterns. During the training process, the changes in indicators such as the accuracy and loss value of the model on the validation set are observed. When the performance indicators of the model on the validation set tend to be stable and no longer show significant improvement, the model training is considered to have reached a good state, and the model training and optimization process is completed to obtain a trained malicious traffic classification model.

[0101] Furthermore, S8 specifically includes testing the trained malicious traffic classification model on a test set. During the testing phase, the 5G IoT traffic data in the test set is preprocessed using the same method used in the training phase to construct structured feature channels and image feature channel data, which are then fed into the trained model. The model then infers the test data based on the learned feature patterns and outputs a prediction of whether each traffic sample is malicious.

[0102] This invention can effectively make up for the shortcomings of traditional methods in 5G Internet of Things malicious traffic detection, such as incomplete feature extraction and poor adaptability to complex traffic patterns. At the same time, it enhances the recognition ability of unknown malicious traffic patterns through gradient sharing and feature fusion, reduces dependence on large-scale labeled data, and provides an innovative solution for efficient and accurate malicious traffic detection in the 5G Internet of Things environment.

[0103] The 5G IoT malicious traffic classification method based on feature fusion and gradient sharing provided by the embodiment of the present invention involves 5G traffic data preprocessing, local and global feature extraction module training, feature fusion and gradient sharing training, and finally testing on a test set. The signal and data processing process in each step is explained in detail below:

[0104] S101, Data Conversion and Partitioning: First, a structured feature channel and an image feature channel are constructed for 5G traffic data. For the structured feature channel, Wireshark is used to parse the PCAP file in the 5G traffic data into a vector format, extracting communication features such as source IP, destination IP, protocol type, and packet length, and performing normalization. For the image feature channel, the byte distribution of the 5G traffic is mapped to an image format, and the raw byte stream in the PCAP file is reorganized into a fixed-length one-dimensional vector. After binarization, the first 784 bits are selected and mapped into a 28×28 grayscale image. Next, the processed dataset is divided into three parts: a normal sample training set, a mixed sample training set, and a mixed sample test set, to ensure effective evaluation of model performance during the training and testing phases.

[0105] S102, training normal local patterns: This module uses a CNN-based local feature extraction module for training on a training set of normal samples. This module processes grayscale images in the image feature channels by stacking convolutional and pooling layers, automatically learning micro-pattern features such as packet length and time interval, thereby accurately grasping the local characteristic patterns of normal traffic.

[0106] S103, Unsupervised Collaborative Learning: On a mixed sample training set, a KAN-based global feature extraction module and a CNN-based local feature extraction module jointly model 5G traffic data by processing data from different feature channels. The former dynamically models structured features to capture the time series distribution and global dependencies of traffic, while the latter continuously extracts local micro-features. The two modules learn in parallel, capturing normal and abnormal patterns, respectively, to better understand the complex relationships underlying the data.

[0107] S104, initial one-way guidance: In the early stages of mixed sample training, the CNN-based local feature extraction module plays a guiding role, providing the local feature information learned by itself to the KAN-based global feature extraction module, helping the latter to better learn and gain a preliminary understanding of the local feature performance in normal and abnormal traffic patterns.

[0108] S105, Gradient Sharing: As training progresses, when the performance of the KAN-based global feature extraction module gradually approaches 70% of the CNN-based local feature extraction module, the two modules enter the collaborative optimization phase. During this phase, the two modules collaborate, exchange information, and jointly adjust parameters to further improve the model's learning efficiency and accuracy.

[0109] S106, Collaborative Optimization: During the collaborative optimization phase, the local feature extraction module based on the convolutional neural network and the global feature extraction module based on the KAN not only share their learned features but also further adjust parameters through shared gradients, enhancing each other's learning. This process enhances the model's generalization capabilities, allowing it to adapt to more complex and variable 5G traffic data.

[0110] S107, Model Consistency: After multiple rounds of collaborative optimization, the performance of the convolutional neural network-based local feature extraction module and the KAN-based global feature extraction module has become increasingly stable and complementary, enabling them to identify malicious traffic patterns in a wider and more diverse range of 5G traffic data. This significantly reduces the model's reliance on large amounts of annotated data and allows it to effectively process 5G traffic data of varying characteristics and types.

[0111] S108, Final Prediction: After completing multiple rounds of collaborative optimization, the trained model is applied to data from the mixed sample test set. Using this test set, the model can predict whether new 5G traffic samples fall into the malicious traffic category, providing accurate results for subsequent malicious traffic detection.

[0112] Throughout the entire process, each step involves processing and transforming data to meet the needs of subsequent steps. At the same time, by combining graph convolutional networks, graph attention networks, and collaborative learning, this method can more comprehensively extract abnormal patterns in log data and improve the accuracy of abnormal traffic detection.

[0113] Furthermore, S101 specifically includes: converting the original log data set into a directed graph and dividing it into a normal sample training set, a mixed sample training set, and a mixed sample test set. Among them, the normal sample training set only contains normal log data, the mixed sample training set contains a certain proportion of abnormal logs, and the mixed sample test set serves as the final evaluation data set. In data preprocessing, the log data is deduplicated, format normalized, timestamp converted, and feature vectorized to ensure that the input data is suitable for graph neural network modeling. The directed graph after log data conversion can be represented as a heterogeneous graph G = (V, E), where V is a node set and E is an edge set.

[0114] Furthermore, S102 specifically includes: using a graph convolutional network to perform pre-training on a normal sample training set to learn the structural patterns and feature relationships between normal logs. Assume that H (l) Represents the node representation matrix of the layer, A is the adjacency matrix of the directed graph, w (l) is the weight matrix of layer l, and σ is the activation function. The graph convolutional network represents the nodes using the following formula:

[0115] H (l+1) =σ(AH (l) W (l) ) (6)

[0116] Furthermore, S103 specifically includes: on the mixed sample training set, the graph attention network and the graph convolution network simultaneously perform unsupervised learning. The two models jointly learn the normal and abnormal patterns in the mixed samples through the graph structure. At this stage, the graph attention network calculates the attention weights between adjacent nodes, performs weighted aggregation on the neighbors of each node, and learns the mutual dependence between nodes. Assume that there is a graph containing N nodes, and the feature vector of each node is represented as h = {h1, h2, ..., h N},in Represents the feature vector of node i, F is the feature dimension. The graph attention network calculates the attention coefficient e between adjacent nodes i and j. ij The formula is as follows:

[0117] e ij =LeakyReLU(a T [Wh i ||Wh j ]) (7)

[0118] Furthermore, S104 specifically includes: in the early stage of the mixed sample training set, the graph convolutional network acts as a teacher network to guide the graph attention network to train. At this stage, the learning samples of the graph attention network depend on the output of the graph convolutional network, and the prediction results of the graph convolutional network serve as the true labels of the graph attention network. During the training process, the loss function of the graph attention network is combined with the loss function of the graph convolutional network to accelerate the training of the graph attention network through collaborative learning, so that it can better learn abnormal patterns. Let y be the predicted value of the graph convolutional network, is the predicted value of the graph attention network, σ is the sigmoid function, and the training loss function is as follows:

[0119]

[0120] Furthermore, S105 specifically includes the following: When the prediction accuracy of the graph attention network reaches 70% of that of the graph convolutional network, the two models begin the collaborative learning phase. During this phase, the graph attention network and the graph convolutional network guide each other, alternating between the roles of teacher and student. The two models share their respective feature information and are optimized through gradient sharing. At this point, the graph attention network is able to optimize based on the output of the graph convolutional network, while the graph convolutional network also adjusts based on the prediction results of the graph attention network to improve overall detection performance.

[0121] Furthermore, S106 specifically includes: During the collaborative learning process, the graph attention network and the graph convolutional network share and fuse feature information, transferring learned knowledge and shared gradients to each other. Through this knowledge sharing mechanism, the two models can continuously improve each other, enhancing the generalization ability and adaptability of the models, thereby better adapting to various complex and dynamic log data.

[0122] Furthermore, S107 specifically involves: Through multiple rounds of collaborative learning, the two models gradually converge to a consensus, enabling them to identify anomalous patterns in a wider range of log data. At this point, both models have, to a certain extent, eliminated their reliance on large-scale annotated data and are able to consistently and effectively identify anomalous patterns across diverse log formats and variations, improving the robustness of the models. By iterating the loss value and gradient after each iteration, the accuracy of the entire model improves, ultimately enabling a robust prediction for each sample.

[0123] Furthermore, S108 specifically includes: Finally, the trained model is used to perform predictions on a mixed sample test set. During the testing phase, the model infers the characteristics of the samples in the test set and outputs a prediction result indicating whether each sample is an anomaly. The test results are evaluated based on metrics such as precision, recall, and F1 score to verify the actual performance and effectiveness of the model.

[0124] like Figure 3 As shown, the abnormal traffic classification model based on feature fusion and gradient sharing provided by the embodiment of the present invention includes:

[0125] Data preprocessing module, used to process 5G traffic data into structured and graphical features suitable for model input;

[0126] The local feature extraction module extracts local microscopic features of traffic data based on convolutional neural networks;

[0127] The global feature extraction module uses KAN to construct the global behavior characteristics of traffic;

[0128] Feature fusion module: used to fuse the features extracted by the structured feature channel and the image feature channel;

[0129] Gradient sharing module: used to enable the two modules to complement each other and coordinate optimization in feature expression, thereby improving the training stability and convergence speed of the model.

[0130] The method of the present invention provides an effective solution for 5G Internet of Things malicious traffic detection by fusing different types of features and using a gradient sharing mechanism.

[0131] Example 1: Malicious Traffic Classification Detection in a 5G IoT Environment

[0132] 1. Data preprocessing: For 5G traffic data, we construct structured feature channels and image feature channels. When constructing the structured feature channel, we use Wireshark to parse the PCAP files in the 5G traffic data into a vector format, extract communication features such as the source IP address, destination IP address, protocol type, and packet length, and then standardize these features to ensure a more balanced impact of different features in model learning. In terms of constructing the image feature channel, we convert the byte distribution of 5G traffic into an image format, organize the raw byte stream in the PCAP file into a fixed-length one-dimensional vector, perform binarization, and select the first 784 bits to map them into a 28×28 grayscale image to facilitate the subsequent CNN module to extract local features.

[0133] 2. Local and Global Feature Extraction Module Training: A local feature extraction module based on a convolutional neural network and a global feature extraction module based on a KAN are trained on the prepared dataset. The convolutional neural network module processes grayscale images in the image feature channel by stacking convolutional and pooling layers, automatically learning micro-pattern features such as packet length and time interval. The KAN module dynamically models the vector data in the structured feature channel, capturing the time series distribution and global dependencies of traffic, and constructing a holistic behavioral profile of traffic. Model parameters are continuously adjusted during training to enable both modules to better extract their respective features.

[0134] 3. Feature Fusion and Gradient Sharing Training: In the feature fusion module, features extracted from the structured feature channel and the image feature channel are fused. For structured features, packet-level and data stream-level features are integrated to construct a comprehensive feature representation for each packet. The features from both channels are then merged into a unified high-dimensional feature vector. During training, a gradient sharing mechanism is enabled. Initially, each module learns features based on its own strengths. As training progresses, different modules dynamically adjust their parameters by sharing gradient information, achieving collaborative optimization and improving the model's ability to learn malicious traffic patterns.

[0135] 4. Model Evaluation and Testing: After multiple rounds of training, a trained model is obtained. This model is used to test 5G IoT traffic data in the test set. The model infers traffic samples based on learned characteristic patterns and determines whether each sample is malicious. Model performance is evaluated using metrics such as accuracy, precision, recall, and F1 score. Based on the evaluation results, the model is continuously optimized to improve its accuracy and robustness in detecting malicious traffic in the 5G IoT environment.

[0136] This example demonstrates how to leverage feature fusion and gradient sharing to efficiently classify and detect malicious traffic in a 5G IoT environment. These techniques enable the model to fully learn the local and global characteristics of traffic data, adapting to the complex and changing traffic patterns in the 5G IoT environment and improving detection accuracy and model generalization.

[0137] A 5G IoT malicious traffic detection method based on feature fusion and gradient sharing is characterized in that a gradient sharing mechanism is introduced during model training to improve detection performance. The method comprises the following steps:

[0138] Step 1: Load multiple public 5G-IoT traffic datasets, such as TON IoT, ISCXTor2016, and 5G-NIDD, and preprocess the raw traffic data.

[0139] Step 2: Build a structured feature channel and an image feature channel for 5G traffic data. For the structured feature channel, use Wireshark to parse the PCAP file in the 5G traffic data into a vector format, extract communication features, and perform normalization. For the image feature channel, map the byte distribution of the 5G traffic to an image format. Reorganize the raw byte stream in the PCAP file into a fixed-length one-dimensional vector, binarize it, and select the first 784 bits to map it to a grayscale image.

[0140] Step 3: Divide the processed dataset into three parts: normal sample training set, mixed sample training set, and mixed sample test set to ensure that the model has good generalization ability during training and testing.

[0141] Step 4: Design a malicious traffic detection model based on feature fusion and gradient sharing, using convolutional neural networks and KAN as core modules, and introduce an attention mechanism in the feature fusion process to enhance the ability to express malicious traffic features.

[0142] Step 5: Initialize the convolutional neural network and KAN models separately. On the normal sample training set, the convolutional neural network learns the local micro features in the traffic data by stacking convolutional layers and pooling layers, and the KAN learns the global features of the traffic through dynamic modeling, ensuring that both models can learn normal traffic patterns.

[0143] Step 6: Perform model training on the mixed sample training set and introduce a gradient sharing mechanism so that the convolutional neural network and KAN can dynamically share gradients in real time during training and jointly optimize the loss function, achieving mutual guidance between the two modules and optimizing detection performance.

[0144] Step 7: During the training process, the weights shared by the convolutional neural network and the KAN gradient are dynamically adjusted according to the model training status, so that the model can be better collaboratively optimized at different training stages.

[0145] Step 8: After training, the model is evaluated on a mixed sample test set. Performance indicators such as accuracy, precision, recall, and F1 score are calculated and compared with other 5G IoT malicious traffic detection methods.

[0146] Step 9: Use adversarial sample generation methods to test the robustness of the model, analyze the performance of the model in the face of adversarial attacks, and optimize the model structure to enhance its detection ability for unknown malicious traffic patterns.

[0147] In the final experimental results, the proposed malicious traffic detection model based on feature fusion and gradient sharing performed well on multiple public datasets, achieving an accuracy of 98.2% and an F1 score of 98.9% on the 5G-NIDD dataset, and has better detection performance than other methods, as shown in Table 1.

[0148]

[0149] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware portion can be implemented using dedicated logic; the software portion can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. Those skilled in the art will appreciate that the above-mentioned devices and methods can be implemented using computer-executable instructions and / or contained in processor control code, for example, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The devices and modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, or can be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0150] The above description is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with this technical field within the technical scope disclosed by the present invention and within the spirit and principles of the present invention should be covered by the scope of protection of the present invention.

Claims

1. A malicious traffic classification method based on gradient sharing feature fusion network, characterized in that: The following steps are involved: S1, data preprocessing: preprocess the original data of 5G IoT traffic and construct structured feature channels and image feature channels respectively; For the structured feature channel, Wireshark was used to parse the PCAP files in the 5G traffic data into a vector format, extract communication features, and perform normalization. For the image feature channel, the byte distribution of the 5G traffic was mapped into an image format. The original byte stream in the PCAP file was reorganized into a fixed-length one-dimensional vector. After binarization, the first 784 bits were selected and mapped into a grayscale image. S2, local feature extraction: Utilizes a local feature extraction module based on a convolutional neural network to process data in the image feature channel. By stacking convolutional layers and pooling layers, it automatically learns the local spatial characteristics in the traffic data and extracts micro-pattern features, including packet length, time interval, and protocol identifier. S3, global feature extraction: A global feature extraction module is built using KAN to dynamically model the data in the structured feature channel, capturing the time series distribution and global dependencies of traffic, and constructing the overall behavioral characteristics of traffic from a macro perspective. When constructing global features, we use a time-sequential approach to input samples step by step to simulate the real network environment. S4, feature fusion: In the feature fusion module, the features extracted by the structured feature channel and the image feature channel are fused; The structured feature channel extracts packet-level features, including source IP, destination IP, protocol type, and packet length, as well as stream-level features, including flow duration, total number of packets, and total number of bytes. These features are combined to construct a comprehensive feature representation for each packet. For the image feature channel, the byte stream is converted into a grayscale image, and then a convolutional neural network is used to extract local features. Finally, the features of the two channels are merged into a unified high-dimensional feature vector to capture both the global characteristics and local details of the traffic data. S5, Gradient Sharing Initialization: Before model training, initialize the parameters related to the gradient sharing mechanism, including determining the formula for calculating the gradient weights of the convolutional neural network and KAN channels, and initializing the KAN and convolutional neural network models and optimizers; S6, Gradient Sharing Training: During training, for each batch of training data, the structured features and image features are fed into the KAN and CNN models, respectively, and their respective outputs and losses are calculated. Based on the losses, the gradients of the CNN and KAN channels themselves, as well as the gradient guidance between them, are calculated. The final updated gradient of each channel is calculated by dynamically adjusting the weights. S7, Model Training and Optimization: Through multiple rounds of training and utilizing a gradient sharing mechanism, the KAN and convolutional neural network models collaborate and optimize during feature learning. This continuously adjusts model parameters, improves the model's ability to identify malicious traffic, reduces conflicts between local and global feature learning, and enhances the model's sensitivity to diverse malicious traffic patterns. S8, model testing: The trained malicious traffic classification model is tested on the test set. The model performance is evaluated through accuracy, precision, recall, and F1 score indicators to verify the model's classification accuracy for malicious traffic in different 5G IoT traffic scenarios.

2. The malicious traffic classification method based on gradient sharing feature fusion network according to claim 1 is characterized in that: In the step S1: For the construction of structured feature channel data: First, the PCAP file in the 5G traffic data is parsed into a vector format using the Wireshark tool to extract the communication features such as source IP, destination IP, protocol type, packet length, flow duration, total number of packets, and total number of bytes during the communication process. These communication features cover information at the packet level and data flow level, and fully reflect the static properties and dynamic behavior of network communication. Subsequently, all extracted features are standardized. Assuming X is the current value, X max is the maximum value of the feature, X min is the minimum value of the feature, and the normalization formula is: Unify features of different magnitudes and distributions into the same scale range to avoid inconsistent weights of different features on model learning, ensuring that the model can learn feature information more effectively. For image feature channel data construction, the byte distribution of 5G traffic is converted into image form; the specific operation is as follows: the original byte stream in the PCAP file is reorganized into a one-dimensional vector of fixed length, and it is directly binarized without normalization to obtain a series of vectors consisting only of 0s and 1s; the first 784 bits are selected and mapped into a 28×28 grayscale image, where each pixel value corresponds to a byte value in the vector, so that the subsequent convolutional neural network module can extract the local spatial characteristics of the traffic from it.

3. The malicious traffic classification method based on gradient sharing feature fusion network according to claim 1 is characterized in that: In step S2, the convolutional neural network module is composed of two convolutional layers and a pooling layer stacked together. In the convolutional layer, convolution kernels of different sizes and step sizes are used to slide convolution on the image to automatically learn local spatial characteristics in the traffic data, including micro-pattern features such as packet length, time interval, and protocol identifier. In the pooling layer, maximum pooling or average pooling operations are used to downsample the feature map output by the convolutional layer, thereby reducing the amount of data while retaining key features, reducing the model calculation complexity, and improving the model training efficiency and generalization ability.

4. The malicious traffic classification method based on gradient sharing feature fusion network according to claim 1 is characterized in that: In step S3, the KAN module receives the preprocessed structured feature vectors and dynamically captures the time series distribution and global dependencies of traffic through its unique network structure. When constructing global features, it uses a time-sequential step-by-step sample input method to simulate the dynamic changes of data in a real network environment, construct the overall behavioral characteristics of traffic from a macro level, and capture macro information, including the time series characteristics of traffic and the network topology, to complement the local features extracted by the convolutional neural network.

5. The malicious traffic classification method based on gradient sharing feature fusion network according to claim 1 is characterized in that: The step S4 specifically includes: fusing the features extracted by the structured feature channel and the image feature channel in a feature fusion module; For structured features, at the packet level, we extract source IP, destination IP, protocol type, and packet length features. These features provide static information about traffic samples. At the data flow level, we group traffic samples with the same five-tuple (source IP, destination IP, source port, destination port, and protocol) into a single data flow. We then extract flow duration, total number of packets, and total number of bytes. These features dynamically reflect the spatiotemporal correlation between packets and the overall behavioral characteristics of the data flow. We then append the data flow-level features to the features of the packets to which they belong, constructing a comprehensive feature representation for each packet that incorporates both its own attributes and the contextual information of the data flow to which it belongs. For image features, after the convolutional neural network module completes feature extraction, the features of the two channels are spliced into a unified high-dimensional feature vector in a certain order, so that the model can simultaneously obtain the global characteristics and local details of the traffic data, thereby improving the ability to identify malicious traffic.

6. The malicious traffic classification method based on gradient sharing feature fusion network according to claim 1 is characterized in that: The step S5 specifically includes: determining a formula for calculating the gradient weights of the image feature channel and the structured feature channel, assuming that ω Local is the weight of the image feature channel, ω Global is the weight of the structured feature channel, L Local is the loss of image feature channel, L Global is the loss of the structured feature channel, and the weight formulas of the two channels are:

7. The malicious traffic classification method based on gradient sharing feature fusion network according to claim 6 is characterized in that: The step S6 specifically includes: during the training process, for each batch of training data, inputting the structural features and image features into the KAN and convolutional neural network models respectively; the KAN model outputs the prediction results of the global features, and the convolutional neural network model outputs the prediction results of the local features, and respectively calculates the loss values between them and the true labels to obtain the gradient G of the convolutional neural network and the KAN channel itself. Local，self and G Global，self Then, according to the gradient sharing mechanism, the gradient guidance G of the structured feature channel to the image feature channel is calculated Global→Local And the gradient guidance G of the image feature channel to the structured feature channel Local→Global ; The weight ω obtained by calculation Local and ω Global , the gradient calculation formula of the two channels is as follows: G Local =ω Local G Local，self +(1-ω Local )G Global，self (4) G Global =ω Local G Local，self +(1-ω Local )G Global，self (5) Finally, the parameters of the image feature channel and structured feature channel models are updated separately according to the updated gradient, so that the two models can cooperate and optimize with each other during the training process, thereby improving the model's ability to identify malicious traffic.

8. The malicious traffic classification method based on gradient sharing feature fusion network according to claim 1 is characterized in that: The step S7 specifically includes: in each round of training, the two models continuously adjust their own parameters based on the shared gradient information to optimize the learning effect of malicious traffic features; as the number of training rounds increases, the model gradually reduces the conflict between local and global feature learning and enhances its sensitivity to diverse malicious traffic patterns; during the training process, the changes in the accuracy and loss value indicators of the model on the validation set are observed. When the performance indicators of the model on the validation set tend to be stable and no longer show significant improvement, the model training and optimization process is completed to obtain a trained malicious traffic classification model.

9. The malicious traffic classification method based on gradient sharing feature fusion network according to claim 1 is characterized in that: The step S8 specifically includes: in the testing phase, the 5G IoT traffic data in the test set is preprocessed in the training phase to construct structured feature channel and image feature channel data, respectively, and input into the trained model; the model infers the test data based on the learned feature pattern and outputs a prediction result of whether each traffic sample is malicious traffic.

10. A malicious traffic classification system based on gradient sharing feature fusion network according to any one of claims 1 to 9, characterized in that: include: Data preprocessing module, used to process 5G traffic data into structured and graphical features suitable for model input; The local feature extraction module extracts local microscopic features of traffic data based on convolutional neural networks; The global feature extraction module uses KAN to construct the global behavior characteristics of traffic; Feature fusion module: used to fuse the features extracted by the structured feature channel and the image feature channel; Gradient sharing module: used to enable the two modules to complement each other and coordinate optimization in feature expression, thereby improving the training stability and convergence speed of the model.

Images