A network intrusion traffic detection method and system based on incremental learning

Abstract

The application discloses a network intrusion flow detection method based on incremental learning, and the method comprises the following steps: constructing a multi-dimensional time sequence feature; arranging the multi-dimensional time sequence feature in time sequence to form a time sequence feature matrix; inputting the time sequence feature matrix into a pre-trained first malicious flow detection model to output a category probability distribution of a flow sample; training a second malicious flow detection model based on an incremental learning task, aligning the second malicious flow detection model training with the first malicious flow detection model by using the category probability distribution of the output flow sample, and optimizing the performance of the second malicious flow detection model; and detecting network flow by using the optimized second malicious flow detection model as a final malicious flow detection model to obtain a malicious flow detection result. The application realizes efficient malicious flow detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of malicious traffic detection, in particular, to a network intrusion traffic detection method and system based on incremental learning. BACKGROUND

[0002] With the increase of network traffic complexity and the diversification of network attack forms, malicious traffic detection has become a research hotspot in the field of network security. Traditional static training models often need to be retrained or updated when facing new malicious traffic, resulting in waste of time and resources, and may also have the problem of "catastrophic forgetting", that is, the model forgets the learned knowledge when learning new tasks. Therefore, proposing a class incremental learning method that can dynamically adapt to new tasks and retain old task knowledge is an important way to improve the ability of malicious traffic detection.

[0003] And the Chinese invention patent application with the application number 202310540038.7 discloses a "malicious traffic detection method, device, equipment and computer readable storage medium", the method includes: inputting the to-be-detected traffic data into different malicious traffic detection models to obtain multiple preliminary detection results, wherein each malicious traffic detection model is trained based on different malicious traffic adversarial sample sets; and obtaining a comprehensive detection result of the to-be-detected traffic data based on each preliminary detection result and the similarity between each preliminary detection result. This method does not solve the "catastrophic forgetting" problem in traditional methods, and the multi-model detection method has the technical problems of low detection efficiency and high memory occupancy. SUMMARY

[0004] To solve the technical problem that the existing malicious traffic detection method needs to be retrained or updated when facing new malicious traffic, resulting in waste of time and resources, and may also have the problem of "catastrophic forgetting", the present application provides a network intrusion traffic detection method and system based on incremental learning, and the technical solution adopted by the present application is:

[0005] The first aspect of the present application provides a network intrusion traffic detection method based on incremental learning, the method comprising:

[0006] Constructing multi-dimensional time series features;

[0007] Arranging the multi-dimensional time series features in time sequence to form a time series feature matrix;

[0008] Inputting the time series feature matrix into a pre-trained first malicious traffic detection model to output the class probability distribution of the traffic sample;

[0009] training a second malicious traffic detection model based on an incremental learning task, and aligning the second malicious traffic detection model training with the first malicious traffic detection model using the class probability distribution of the output traffic sample to optimize the performance of the second malicious traffic detection model;

[0010] detecting network traffic using the optimized second malicious traffic detection model as a final malicious traffic detection model to obtain a malicious traffic detection result.

[0011] As a preferred scheme, before constructing the multi-dimensional time series feature, it further includes:

[0012] According to the public data set, different categories of malicious samples are divided, and class incremental learning tasks T = [T 1 , T 2 , T 3 , T 4 ] are set, wherein T 1 includes benign network traffic and one malicious category network traffic, T 2 , in addition to the benign traffic and malicious category traffic in T 1 , two categories of malicious network traffic are added, T 3 , in addition to the benign traffic and malicious category traffic in T 2 , two categories of malicious network traffic are added, and T 4 , in addition to the benign traffic and malicious category traffic in T 3 , two categories of malicious network traffic are added.

[0013] As a preferred scheme, the method for constructing the multi-dimensional time series feature includes:

[0014] Feature extraction is performed on the network traffic data to obtain a multi-dimensional time series feature, and each traffic sample is represented as a matrix X ∈ R k×l , wherein k represents the feature dimension, and l represents the fixed time series length.

[0015] As a preferred scheme, the multi-dimensional time series feature includes:

[0016] The number of bytes per second, the packet arrival time interval, the distribution of source IP address and destination IP address, the TCP / UDP port distribution, and the traffic protocol type.

[0017] As a preferred scheme, the method for inputting the time series feature matrix into the pre-trained first malicious traffic detection model to output the class probability distribution of the traffic sample includes:

[0018] Feature extraction is performed on the time series feature matrix X ∈ R k×l to convert it into a sequence feature map F(X);

[0019] convert the sequence feature map F(X) into a fixed-dimension feature vector;

[0020] input the fixed-dimension feature vector into a pre-trained classifier for classification, and output a class probability distribution of the traffic sample.

[0021] As a preferred solution, the method of converting the sequence feature map into a fixed-dimension feature vector comprises:

[0022] vectorizing the sequence feature map F(X) along the time dimension to generate a fixed-dimension feature vector:

[0023]

[0024] wherein l' is the sequence length after downsampling.

[0025] As a preferred solution, the method of inputting the fixed-dimension feature vector into a pre-trained classifier for classification, and outputting a class probability distribution of the traffic sample comprises:

[0026] using a fully connected layer as the classifier h to map the feature vector V(X) to a class probability distribution ∈R n+1 wherein n+1 represents n malicious traffic classes and 1 benign traffic class;

[0027] The training method of the classifier comprises:

[0028] using a cross-entropy loss function L CE optimizing the classification performance, whose formula is:

[0029]

[0030] wherein N is the number of samples, y i is the real class label, is the predicted probability distribution.

[0031] As a preferred solution, the method of training a second malicious traffic detection model based on an incremental learning task, and aligning the second malicious traffic detection model training with the first malicious traffic detection model using the class probability distribution of the output traffic sample to optimize the performance of the second malicious traffic detection model comprises:

[0032] when training the current model, using Soft-DTW to align the sequence feature maps of the current model f t and the old model f o , and calculating an alignment loss function wherein dtw γ (·, ·) is the Soft-DTW alignment distance, whose formula is: D(A i , B j ) = |A i - B j | 2 is the Euclidean distance, and π is the alignment path;

[0033] The category probability distribution of the first malicious traffic detection model is used as guidance, and time knowledge distillation cross entropy loss L LwF is optimized: Where τ is a time parameter for smoothing the probability distribution;

[0034] The feature prototype μ c of each category is calculated, pseudo samples are generated for classifier calibration, and the pseudo sample classification loss is optimized to further improve the model performance; wherein the feature prototype μ c of each category is calculated by the category sample and is represented as: The pseudo sample is generated by the feature prototype and the standard normal distribution random noise Where r is the enhancement radius, z is the standard normal distribution random noise, and the enhancement radius r is dynamically adjusted by the following formula:

[0035] The above loss is integrated into the total loss function L = L CE + λ1L DTW + λ2L LwF + λ3L proto , wherein λ1, λ2, λ3 are weight hyperparameters determined by cross-validation;

[0036] The random gradient descent or Adam optimizer is used to optimize the total loss function L, and the learning rate and loss weight are dynamically adjusted during the training process, and finally the performance of the second malicious traffic detection model is optimized.

[0037] The second aspect of the application provides a network intrusion traffic detection system based on incremental learning, which comprises a multi-dimensional time series feature construction module, a time series feature matrix construction module, a category probability distribution output module, a model alignment optimization module and a malicious traffic detection module.

[0038] The multi-dimensional time series feature construction module is used to construct multi-dimensional time series features;

[0039] The time series feature matrix construction module is used to arrange the multi-dimensional time series features in time sequence to form a time series feature matrix;

[0040] The category probability distribution output module is configured to input the time series feature matrix into a pre-trained first malicious traffic detection model and output a category probability distribution of a traffic sample.

[0041] The model alignment optimization module is configured to train a second malicious traffic detection model based on an incremental learning task, align the second malicious traffic detection model training with the first malicious traffic detection model using the category probability distribution of the output traffic sample, and optimize the performance of the second malicious traffic detection model.

[0042] The malicious traffic detection module is configured to use the optimized second malicious traffic detection model as a final malicious traffic detection model to detect network traffic and obtain a malicious traffic detection result.

[0043] As a preferred solution, the category probability distribution output module includes a sequence feature map generation module, a feature vector generation module, and a classification module.

[0044] The sequence feature map generation module is configured to perform feature extraction on the time series feature matrix X∈R k×l and convert the time series feature matrix into a sequence feature map F(X);

[0045] The feature vector generation module is configured to convert the sequence feature map F(X) into a fixed-dimension feature vector.

[0046] The classification module is configured to input the fixed-dimension feature vector into a pre-trained classifier for classification and output a category probability distribution of a traffic sample.

[0047] The sequence feature map generation module includes sequentially connected first, second, and third convolutional blocks, and each convolutional block includes a convolutional layer, a batch normalization layer, and a max-pooling layer, wherein the convolutional kernel sizes of the first, second, and third convolutional blocks are 1×5, 1×5, and 1×3, respectively.

[0048] Compared with the prior art, the present application has the following beneficial effects:

[0049] The present application provides an incremental learning method suitable for network malicious traffic detection, which realizes dynamic incremental learning of network traffic through time series feature construction, feature extraction and classifier design initialization, sequence feature alignment and knowledge distillation, and feature prototype generation of pseudo samples, effectively solves the problem of "catastrophic forgetting" in traditional methods, and improves the accuracy and efficiency of malicious traffic detection. BRIEF DESCRIPTION OF DRAWINGS

[0050] Figure 1 A flowchart of a network intrusion traffic detection method based on incremental learning is provided for the present embodiment.

[0051] Figure 2 A network intrusion traffic detection method based on incremental learning is provided for the embodiment. DETAILED DESCRIPTION

[0052] The accompanying drawings are only intended to illustrate the application, and should not be construed as limiting the application;

[0053] It should be clear that the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0054] The terms used in the present application are only for the purpose of describing the specific embodiments, and are not intended to limit the present application. The singular forms "a", "said" and "the" used in the present application and the appended claims are also intended to include the plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein means and includes any or all possible combinations of one or more associated listed items.

[0055] The following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the present application, as detailed in the appended claims. In the description of the present application, it should be understood that the terms "first", "second", "third", etc. are only used to distinguish similar objects, and do not necessarily describe a specific order or sequence, nor can they be understood as indicating or implying relative importance. For those of ordinary skill in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0056] In addition, in the description of the present application, "multiple" means two or more, unless otherwise specified. The association between the associated objects is described, which means that there can be three relationships, for example, A and / or B, which can mean that A exists alone, A and B exist together, and B exists alone. The character " / " generally represents a "or" relationship between the associated objects. The present application is further described below in conjunction with the drawings and examples.

[0057] The present application is further described below in conjunction with the drawings and examples.

[0058] Embodiment 1

[0059] Please refer to Figure 1 andFigure 2 The embodiment provides a network intrusion traffic detection method based on incremental learning, and the method comprises the following steps:

[0060] S1: constructing a multi-dimensional time series feature;

[0061] In a specific embodiment, before constructing the multi-dimensional time series feature, the following steps are further included:

[0062] According to the public data set, different categories of malicious samples are divided, and a class incremental learning task T=[T 1 , T 2 , T 3 , T 4 ] is set, wherein T 1 includes benign network traffic and one malicious category network traffic, T 2 , in addition to the benign traffic and malicious category traffic in T 1 , two categories of malicious network traffic are added, in turn, T 3 , in addition to the benign traffic and malicious category traffic in T 2 , two categories of malicious network traffic are added, and T 4 , in addition to the benign traffic and malicious category traffic in T 3 , two categories of malicious network traffic are added.

[0063] In a specific embodiment, the method for constructing the multi-dimensional time series feature comprises the following steps:

[0064] Feature extraction is performed on the network traffic data to obtain a multi-dimensional time series feature, and each traffic sample is represented as a matrix X∈R k×l , wherein k represents the feature dimension, and l represents a fixed time series length.

[0065] In a specific embodiment, the multi-dimensional time series feature comprises the following steps:

[0066] The number of bytes per second, the packet arrival time interval, the distribution of source IP addresses and destination IP addresses, the TCP / UDP port distribution, and the traffic protocol type.

[0067] S2: arranging the multi-dimensional time series feature in time sequence to form a time series feature matrix;

[0068] S3: inputting the time series feature matrix into a pre-trained first malicious traffic detection model to output a category probability distribution of the traffic sample;

[0069] In a specific embodiment, the method for inputting the time series feature matrix into the pre-trained first malicious traffic detection model to output the category probability distribution of the traffic sample comprises the following steps:

[0070] The time series feature matrix X ∈ R k×l The feature extraction transformation is converted into a sequence feature map F(X);

[0071] The sequence feature map F(X) is converted into a fixed-dimensional feature vector;

[0072] The fixed-dimensional feature vector is input into a pre-trained classifier for classification, and the class probability distribution of the traffic sample is output.

[0073] In one specific embodiment, the method of converting the sequence feature map into a fixed-dimensional feature vector includes:

[0074] The sequence feature map F(X) is vectorized along the time dimension to generate a fixed-dimensional feature vector:

[0075]

[0076] Where l' is the sequence length after downsampling.

[0077] In one specific embodiment, the method of inputting the fixed-dimensional feature vector into a pre-trained classifier for classification, and outputting the class probability distribution of the traffic sample includes:

[0078] A fully connected layer is used as a classifier h to map the feature vector V(X) to a class probability distribution ∈ R n+1 Where n+1 represents n malicious traffic categories and 1 benign traffic category;

[0079] The training method of the classifier includes:

[0080] A cross-entropy loss function L CE is used to optimize the classification performance, and the formula is:

[0081]

[0082] Where N is the number of samples, y i is the real class label, is the predicted probability distribution.

[0083] S4: Perform second malicious traffic detection model training based on the incremental learning task, and align the second malicious traffic detection model training with the first malicious traffic detection model using the class probability distribution of the output traffic sample to optimize the performance of the second malicious traffic detection model;

[0084] In one specific embodiment, the method for optimizing the performance of the second malicious traffic detection model based on the incremental learning task and using the class probability distribution of the output traffic sample to align the second malicious traffic detection model training with the first malicious traffic detection model comprises:

[0085] In the current model training, the Soft-DTW is used to align the sequence feature maps of the current model f t and the old model f o , and the alignment loss function L is calculated. γ where dtw i (·,·) is the Soft-DTW alignment distance, and the formula is: D(A j , B i ) = |A j -B 2 | LwF is the Euclidean distance, and π is the alignment path.

[0086] Using the class probability distribution of the first malicious traffic detection model as guidance, the model is optimized through time knowledge distillation cross-entropy loss L c . where τ is the time parameter used to smooth the probability distribution.

[0087] The feature prototype μ c of each class is calculated, pseudo samples are generated for classifier calibration, and the model performance is further improved by optimizing the pseudo sample classification loss L ; where the feature prototype μ c of each class is calculated by the class sample as follows: The pseudo sample is generated by the feature prototype and the standard normal distribution random noise , where r is the enhancement radius, and z is the standard normal distribution random noise, and the enhancement radius r is dynamically adjusted by the following formula:

[0088] The above loss is integrated into the total loss function L = L CE + λ1L DTW + λ2L LwF + λ3L proto , where λ1, λ2, λ3 are weight hyperparameters determined by cross-validation.

[0089] The total loss function L is optimized using the stochastic gradient descent or Adam optimizer, and the learning rate and loss weight are dynamically adjusted during the training process to ultimately optimize the performance of the second malicious traffic detection model.

[0090] S5: detecting network traffic by using the optimized second malicious traffic detection model as a final malicious traffic detection model to obtain a malicious traffic detection result.

[0091] Embodiment 2

[0092] The embodiment provides a network intrusion traffic detection system based on incremental learning, which comprises a multi-dimensional time series feature construction module, a time series feature matrix construction module, a category probability distribution output module, a model alignment optimization module and a malicious traffic detection module.

[0093] The multi-dimensional time series feature construction module is configured to construct multi-dimensional time series features.

[0094] The time series feature matrix construction module is configured to arrange the multi-dimensional time series features in time sequence to form a time series feature matrix.

[0095] The category probability distribution output module is configured to input the time series feature matrix into a pre-trained first malicious traffic detection model to output a category probability distribution of a traffic sample.

[0096] The model alignment optimization module is configured to train a second malicious traffic detection model based on an incremental learning task, and align the second malicious traffic detection model training with the first malicious traffic detection model by using the category probability distribution of the traffic sample to optimize the performance of the second malicious traffic detection model.

[0097] The malicious traffic detection module is configured to detect network traffic by using the optimized second malicious traffic detection model as a final malicious traffic detection model to obtain a malicious traffic detection result.

[0098] In a specific embodiment, the category probability distribution output module comprises a sequence feature map generation module, a feature vector generation module and a classification module.

[0099] The sequence feature map generation module is configured to perform feature extraction on the time series feature matrix X∈R k×l to convert the time series feature matrix into a sequence feature map.

[0100] The feature vector generation module is configured to convert the sequence feature map F(X) into a fixed-dimensional feature vector.

[0101] The classification module is configured to input the fixed-dimensional feature vector into a pre-trained classifier for classification to output a category probability distribution of a traffic sample.

[0102] The sequence feature map generation module comprises a first convolution block, a second convolution block and a third convolution block connected in sequence; each convolution block comprises a convolution layer, a batch normalization layer and a maximum pooling layer, and the convolution kernel sizes of the first convolution block, the second convolution block and the third convolution block are 1*5, 1*5 and 1*3 in sequence.

[0103] Obviously, the above embodiments of the application are only examples for clearly illustrating the application, and are not intended to limit the implementation modes of the application. Based on the above description, other different forms of changes or variations can be made by those skilled in the art. All the implementation modes do not need to be exhausted here. Any modification, equivalent replacement and improvement made within the spirit and principle of the application shall be included in the protection scope of the claims of the application.

Claims

1. A network intrusion traffic detection method based on incremental learning, characterized in that, The method includes: Constructing multidimensional time series features; The multidimensional time series features are arranged in chronological order to form a time series feature matrix; The time series feature matrix is ​​input into the pre-trained first malicious traffic detection model, and the class probability distribution of the traffic samples is output. The second malicious traffic detection model is trained based on the incremental learning task, and the training of the second malicious traffic detection model is aligned with the first malicious traffic detection model by using the category probability distribution of the output traffic samples, thereby optimizing the performance of the second malicious traffic detection model. The optimized second malicious traffic detection model is used as the final malicious traffic detection model to detect network traffic and obtain malicious traffic detection results. The method for inputting the time series feature matrix into a pre-trained first malicious traffic detection model and outputting the class probability distribution of traffic samples includes: For the time series feature matrix Feature extraction is performed to convert the sequence into a feature map. ,in Representing feature dimension, Indicates a fixed time series length; The sequence feature map Convert to a fixed-dimensional feature vector; A fixed-dimensional feature vector is input into a pre-trained classifier for classification, and the output is the class probability distribution of the traffic samples. Methods that input fixed-dimensional feature vectors into a pre-trained classifier for classification and output the class probability distribution of traffic samples include: Use a fully connected layer as a classifier. , to feature vector Mapping to class probability distribution ,in express One category of malicious traffic and one category of benign traffic; The training method for the classifier includes: Using the cross-entropy loss function The formula for optimizing classification performance is: in, For the sample size, For real category labels, To predict the probability distribution; The method for training a second malicious traffic detection model based on an incremental learning task, and aligning the training of the second malicious traffic detection model with the first malicious traffic detection model using the class probability distribution of the output traffic samples, to optimize the performance of the second malicious traffic detection model includes: During current model training, Soft-DTW is used to align the current model. and the old model Calculate the alignment loss function from the sequence feature maps. ; Using the category probability distribution of the first malicious traffic detection model as a guide, cross-entropy loss is distilled through time knowledge. Optimize; Calculate the feature prototype for each category Pseudo-samples are generated to calibrate the classifier, and the classification loss is optimized by modifying the pseudo-samples. Further improve model performance; Integrate the losses into a total loss function. ,in The weight hyperparameters are determined through cross-validation; Use stochastic gradient descent or the Adam optimizer to optimize the total loss function. Optimization is performed by dynamically adjusting the learning rate and loss weights during training, ultimately improving the performance of the second malicious traffic detection model.

2. The network intrusion traffic detection method based on incremental learning according to claim 1, characterized in that, Before constructing multidimensional time series features, the following steps are also included: Based on public datasets, malicious samples are categorized into different classes, and a class incremental learning task is set. ,in This includes benign network traffic and a malicious category of network traffic. remove In addition to the benign and malicious traffic categories, two new categories of malicious network traffic have been added, in the following order: remove In addition to the benign and malicious traffic categories, two new categories of malicious network traffic have been added. remove In addition to the benign and malicious traffic categories, two new categories of malicious network traffic have been added.

3. The network intrusion traffic detection method based on incremental learning according to claim 1, characterized in that, Methods for constructing multidimensional time series features include: Feature extraction is performed on network traffic data to obtain multidimensional time series features, and each traffic sample is represented as a matrix. ,in Representing feature dimension, This indicates a fixed time series length.

4. The network intrusion traffic detection method based on incremental learning according to claim 3, characterized in that, The multidimensional time series features include: Bytes per second, packet arrival time interval, distribution of source and destination IP addresses, TCP / UDP port distribution, and traffic protocol type.

5. The network intrusion traffic detection method based on incremental learning according to claim 1, characterized in that, Methods for converting the sequence feature map into a fixed-dimensional feature vector include: sequence feature maps Vectorize along the time dimension to generate a fixed-dimensional feature vector: in, ' represents the length of the sequence after downsampling.

6. A network intrusion traffic detection system based on incremental learning, wherein the system executes the network intrusion traffic detection method based on incremental learning as described in claim 1, characterized in that, The system includes a multi-dimensional time series feature construction module, a time series feature matrix construction module, a category probability distribution output module, a model alignment optimization module, and a malicious traffic detection module. The multidimensional time series feature construction module is used to construct multidimensional time series features; The time series feature matrix construction module is used to arrange the multidimensional time series features in chronological order to form a time series feature matrix. The category probability distribution output module is used to input the time series feature matrix into the pre-trained first malicious traffic detection model and output the category probability distribution of the traffic samples. The model alignment optimization module is used to train the second malicious traffic detection model based on the incremental learning task, and to align the training of the second malicious traffic detection model with the first malicious traffic detection model using the category probability distribution of the output traffic samples, thereby optimizing the performance of the second malicious traffic detection model. The malicious traffic detection module is used to use the optimized second malicious traffic detection model as the final malicious traffic detection model to detect network traffic and obtain malicious traffic detection results.

7. A network intrusion traffic detection system based on incremental learning according to claim 6, characterized in that, The category probability distribution output module includes a sequence feature map generation module, a feature vector generation module, and a classification module; The sequence feature map generation module is used to process the time series feature matrix. Feature extraction is performed to convert the data into sequence feature maps; The feature vector generation module is used to generate the sequence feature map. Convert to a fixed-dimensional feature vector; The classification module is used to input fixed-dimensional feature vectors into a pre-trained classifier for classification and output the category probability distribution of traffic samples. The sequence feature map generation module includes a first convolutional block, a second convolutional block, and a third convolutional block connected in sequence; each convolutional block includes a convolutional layer, a batch normalization layer, and a max pooling layer, wherein the kernel sizes of the first convolutional block, the second convolutional block, and the third convolutional block are 1×5, 1×5, and 1×3, respectively.

Images