Abnormal traffic detection method based on large model CLIP guidance

Abstract

The invention discloses an abnormal traffic detection method based on large model CLIP guidance, and relates to the technical field of network security and anomaly detection, and the method comprises the steps: carrying out the preprocessing of a network data package, and obtaining traffic data with a preset length; inputting the traffic data into a pre-trained abnormal traffic detection model to obtain a detection result; wherein the abnormal traffic detection model is used for extracting traffic characteristics of traffic data, generating text embedding corresponding to normal traffic class text description based on a text encoder in the optimized CLIP model, and realizing abnormal traffic detection according to traffic text joint characteristics obtained by combining the traffic characteristics and the text embedding. According to the method, the limitation of a traditional method on feature expression and anomaly judgment is overcome, the defect of an existing traffic detection model on category priori knowledge is made up, and efficient adaptability to various traffic scenes is achieved while high detection precision is kept.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security and anomaly detection, and particularly relates to an anomaly traffic detection method guided by the large model CLIP (Contrastive Language-Image Pre-Training). Background Art

[0002] In the past few decades, with the continuous expansion of the network scale and the increasing diversification of applications, anomaly traffic detection technology has become an important tool for ensuring network security and optimizing network performance. Network operators and enterprise network administrators increasingly rely on anomaly traffic detection technology to cope with evolving network threats and manage complex network traffic.

[0003] In recent years, deep learning technology has been widely applied in the field of network traffic anomaly detection, demonstrating strong research potential and practical value. Mainstream technical solutions usually adopt deep learning models such as convolutional neural networks (CNNs) or recurrent neural networks (RNNs), focusing on the modeling and analysis of one-dimensional sequence data of network traffic. These methods can efficiently distinguish normal traffic from abnormal traffic through the automatic extraction of low-level features of traffic data and the end-to-end training of deep learning models, significantly improving the detection accuracy.

[0004] Although the existing technology has achieved certain results in network traffic anomaly detection, there are still obvious deficiencies. The current methods mainly rely on the extraction of low-level features of one-dimensional sequence data and lack effective modeling of the deep semantic information of the data, resulting in limited generalization ability when facing complex and diverse traffic patterns. In addition, some technical solutions attempt to improve the accuracy by introducing more complex deep learning models, but often at the cost of significantly increasing the computational complexity, making it difficult to be widely deployed in practical applications with high real-time requirements. Summary of the Invention

[0005] In order to solve the above problems existing in the prior art, the present invention provides an anomaly traffic detection method guided by the large model CLIP. The technical problems to be solved by the present invention are realized through the following technical solutions:

[0006] The present invention provides an anomaly traffic detection method guided by the large model CLIP, including:

[0007] Preprocess the network data packets to obtain traffic data of a preset length;

[0008] Input the traffic data into a pre-trained abnormal traffic detection model to obtain a detection result; wherein, the abnormal traffic detection model is used to extract traffic features of the traffic data, generate text embeddings corresponding to normal traffic class text descriptions based on the text encoder in the optimized CLIP model, and implement abnormal traffic detection according to the traffic text joint features after combining the traffic features and the text embeddings.

[0009] In an embodiment of the present invention, preprocess the network data packets to obtain traffic data of a preset length, including:

[0010] Extract the payload field in the network data packet, and pad or truncate the payload field to obtain traffic data of a preset length.

[0011] In an embodiment of the present invention, before preprocessing the network data packets to obtain traffic data of a preset length, the method further includes: parsing the Pcap file to extract the network data packets.

[0012] In an embodiment of the present invention, the abnormal traffic detection model includes a feature extraction module, a text embedding module, and a feature reconstruction module;

[0013] The feature extraction module is used to extract deep features of the traffic data to obtain the traffic features;

[0014] The text embedding module is used to generate corresponding text embeddings according to the input normal traffic class text descriptions;

[0015] The feature reconstruction module is used to generate corresponding reconstructed joint features according to the input traffic text joint features, calculate the reconstruction error between the traffic text joint features and the reconstructed joint features, and if the reconstruction error exceeds a preset error threshold, the traffic data is malicious traffic, otherwise it is normal traffic.

[0016] In an embodiment of the present invention, the training process of the abnormal traffic detection model includes:

[0017] Construct a feature extractor, and train the feature extractor using a training data set to obtain a trained feature extractor as the feature extraction module; the training data set includes multiple normal traffic data;

[0018] Design traffic text descriptions, and optimize the parameters of the text encoder in the CLIP model according to the traffic text descriptions, the training data set, and the feature extraction module. The text encoder in the optimized CLIP model is used as the text embedding module;

[0019] Construct a transformation matrix, obtain the joint feature of the traffic text according to the training data set, the traffic text description, the feature extraction module and the text embedding module, train the transformation matrix according to the joint feature of the traffic text, obtain the trained transformation matrix, and construct the feature reconstruction module according to the trained transformation matrix and the corresponding inverse transformation matrix.

[0020] In an embodiment of the present invention, the feature extractor includes an autoencoder, an encoder, and a discriminator, wherein the autoencoder includes a cascaded first encoder and a decoder;

[0021] The first encoder generates an original feature latent vector according to the input traffic data, and the decoder generates reconstructed data according to the original feature latent vector;

[0022] The encoder is used to generate a reconstructed feature latent vector according to the reconstructed data;

[0023] According to the input traffic data and the corresponding reconstructed data, use the discriminator to implement the adversarial training of the autoencoder.

[0024] In an embodiment of the present invention, the overall training loss function of the feature extractor is defined as follows:

[0025] L = w adv L adv + w con L con + w enc L enc ;

[0026] Wherein, L adv is the adversarial loss, which is defined as follows:

[0027]

[0028] L con is the context loss, which is defined as follows:

[0029]

[0030] L enc is the encoder loss, which is defined as follows:

[0031]

[0032] Wherein, w adv is the weight parameter of the adversarial loss, w con is the weight parameter of the context loss, w enc is the weight parameter of the encoder loss, x is the input data, E is the encoder, D is the discriminator, G is the autoencoder, GE is the first encoder, indicating to obtain the average loss of a batch of training.

[0033] In one embodiment of the present invention, the traffic text description includes: normal traffic type text description and malicious traffic type text description.

[0034] In one embodiment of the present invention, optimizing the parameters of the text encoder in the CLIP model according to the traffic text description, the training data set, and the feature extraction module includes:

[0035] Inputting the training data set into the feature extraction module to obtain corresponding traffic features, where the traffic features are formed by concatenating the original feature latent vectors and the reconstructed feature latent vectors corresponding to the traffic data along the channel dimension;

[0036] Inputting the traffic text description into the text encoder in the CLIP model to generate a first text embedding corresponding to the normal traffic type text description and a second text embedding corresponding to the malicious traffic type text description;

[0037] Calculating the similarity values between the traffic features and the first text embedding and the second text embedding respectively, calculating the value of the cross-entropy loss function according to the similarity values, and optimizing the parameters of the text encoder in the CLIP model according to the value of the cross-entropy loss function.

[0038] In one embodiment of the present invention, obtaining the traffic text joint feature according to the training data set, the traffic text description, the feature extraction module, and the text embedding module, and training the transformation matrix according to the traffic text joint feature, including:

[0039] Inputting the training data set into the feature extraction module to obtain corresponding traffic features;

[0040] Inputting the normal traffic type text description into the text embedding module to generate corresponding text embeddings;

[0041] Vectorizing the concatenation of the traffic features and the text embeddings along the channel dimension to obtain the traffic text joint feature;

[0042] Using the transformation matrix and the corresponding inverse transformation matrix to obtain the reconstructed joint feature corresponding to the traffic text joint feature, and optimizing the transformation matrix according to the error between the traffic text joint feature and the reconstructed joint feature, so that the transformation matrix learns the relationship between the normal traffic data and the text embeddings of the normal traffic type text description.

[0043] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0044] The abnormal traffic detection method based on the large model CLIP guidance of the present invention combines a multimodal deep learning model and a feature reconstruction technology, effectively improving the efficiency and accuracy of abnormal traffic detection. By introducing a feature extraction module to extract the deep features of traffic data and fine-tuning the text encoder of the CLIP model, the traffic features and text descriptions are aligned in the shared embedding space, significantly enhancing the model's ability to identify abnormal traffic data. After the traffic features and text are embedded, feature reconstruction is performed, and the reconstruction error is used to measure the abnormal traffic data, overcoming the limitations of traditional methods in feature expression and abnormal determination. At the same time, using the global semantic information described in natural language makes up for the deficiency of the existing traffic detection model in category prior knowledge, realizing high-efficiency adaptability to various traffic scenarios while maintaining high detection accuracy. The method of the present invention can provide a convenient and efficient technical support for network security, auditing, and traffic management. It not only makes up for the deficiencies of the prior art in the utilization of multimodal information and detection performance, but also improves the detection efficiency while ensuring the detection accuracy, helping to reduce the labor cost of network security management and improve the real-time performance and robustness of the system.

[0045] The above description is only an overview of the technical solution of the present invention. In order to be able to understand the technical means of the present invention more clearly, it can be implemented according to the content of the specification. And in order to make the above and other purposes, features, and advantages of the present invention more obvious and understandable, the following specific preferred embodiments are given and described in detail in conjunction with the accompanying drawings. Brief Description of the Drawings

[0046] Figure 1 is a flowchart of an abnormal traffic detection method based on the large model CLIP guidance provided by an embodiment of the present invention;

[0047] Figure 2 is a schematic structural diagram of a feature extractor provided by an embodiment of the present invention;

[0048] Figure 3 is a schematic diagram of the parameter optimization process of a text embedding module provided by an embodiment of the present invention;

[0049] Figure 4 is a schematic structural diagram of a feature reconstruction module provided by an embodiment of the present invention. Detailed Description of the Preferred Embodiments

[0050] In order to further elaborate on the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the following provides a detailed description of an abnormal traffic detection method based on the large model CLIP guidance proposed by the present invention in conjunction with the accompanying drawings and specific embodiments.

[0051] The foregoing and other technical contents, features and effects of the present invention will be clearly presented in the following detailed description in conjunction with the accompanying drawings. Through the description of the specific embodiments, a more in-depth and specific understanding of the technical means and effects adopted by the present invention to achieve the predetermined purpose can be obtained. However, the attached drawings are only for reference and illustration, and are not used to limit the technical solutions of the present invention.

[0052] In a first aspect, an embodiment of the present invention provides an abnormal traffic detection method guided by the large model CLIP. Please refer to Figure 1 , Figure 1 which is a flowchart of an abnormal traffic detection method guided by the large model CLIP provided by an embodiment of the present invention. As Figure 1 shown, the abnormal traffic detection method guided by the large model CLIP in this embodiment includes:

[0053] S1: Preprocess the network data packets to obtain traffic data of a preset length.

[0054] Optionally, S1 includes: extracting the payload field in the network data packets, and padding or truncating the payload field to obtain traffic data of a preset length.

[0055] To simplify the analysis and focus on the key features, in this embodiment, for each data packet, only its payload field, that is, the TCP / UDP data part, is retained as the core content for subsequent processing. Since the lengths of the payload data may be inconsistent, in order to adapt to the input requirements of the model, a unified strategy is adopted. For example, the data length can be standardized to 1600 bytes. Specifically, data packets with insufficient length are padded to the target length, and data packets with excessive length are truncated to 1600 bytes, thereby generating traffic data with a consistent format.

[0056] It can be understood that before S1, the method of the embodiment of the present invention further includes S0: parsing the Pcap file to extract network data packets.

[0057] S2: Input the traffic data into a pre-trained abnormal traffic detection model to obtain a detection result; wherein, the abnormal traffic detection model is used to extract the traffic features of the traffic data, generate text embeddings corresponding to the text descriptions of normal traffic classes based on the text encoder in the optimized CLIP model, and implement abnormal traffic detection according to the traffic text joint features after combining the traffic features and the text embeddings.

[0058] Furthermore, the structure and training process of the abnormal traffic detection model in this embodiment will be described in detail.

[0059] Optionally, the abnormal traffic detection model includes a feature extraction module, a text embedding module, and a feature reconstruction module; the feature extraction module is used to extract the deep features of traffic data to obtain traffic features; the text embedding module is used to generate corresponding text embeddings according to the input normal traffic class text description; the feature reconstruction module is used to generate corresponding reconstructed joint features according to the input traffic text joint features, calculate the reconstruction error between the traffic text joint features and the reconstructed joint features, and if the reconstruction error exceeds the preset error threshold, the traffic data is malicious traffic, otherwise it is normal traffic.

[0060] In this embodiment, the feature extraction module is used to extract high-level features from one-dimensional traffic data to provide a semantic representation of the traffic; the text embedding module is based on the CLIP model and fine-tunes the text embedding by designing text prompts related to the traffic task to make it associated with the traffic features; the feature reconstruction module fuses the traffic features and the text embedding, and judges the abnormality of the traffic through the reconstruction error. The organic combination of the three modules significantly improves the accuracy and efficiency of detection, providing reliable technical support for abnormal traffic detection in complex network environments.

[0061] Optionally, the training process of the abnormal traffic detection model is divided into three stages. The first stage focuses on training a feature extractor for feature extraction of traffic data; in the second stage, the text encoder part in the CLIP model is optimized based on the trained feature extractor to achieve the alignment of traffic features and text descriptions; in the third stage, the traffic features and text descriptions are fused and jointly input into the feature reconstruction module to calculate the reconstruction error and be used for anomaly detection. In this stage, the sum of the reconstruction errors is defined as the optimization objective for training.

[0062] In this embodiment, the training process of the abnormal traffic detection model may include the following steps:

[0063] Step 1: Construct a feature extractor, and use the training data set to train the feature extractor to obtain the trained feature extractor as the feature extraction module.

[0064] Among them, the training data set includes multiple normal traffic data. The training data set can be constructed using the UNB-CIC Tor and nonTor, ISCX VPN and nonVPN, or USTC-TFC2016 data sets.

[0065] Exemplarily, taking the USTC-TFC2016 dataset as an example, in this dataset, there are Pcap files containing various benign and malicious traffic, and these files record the original packet information of network communication. First, these Pcap files are parsed to extract the network packets. For each packet, its payload field, that is, the TCP / UDP data part, is retained as the core content for subsequent processing. Since the lengths of the payload data may be inconsistent, in order to adapt to the input requirements of the model, a unified strategy is adopted to standardize the data length to 1600 bytes. Specifically, packets with insufficient length are padded to the target length, while packets with excessive length are truncated to 1600 bytes, thus generating traffic data with a consistent format. In the data partitioning stage, according to the characteristics of unsupervised anomaly detection, a special dataset partitioning scheme is designed. The training set only contains normal traffic data to ensure that the learning process of the model does not depend on the characteristics of abnormal traffic data. Randomly select 10,000 samples from all normal traffic data to construct the training set, which is used to train the feature extractor and related modules of the model. The test set is designed as a balanced binary classification dataset, containing 5000 normal traffic data and 5000 abnormal traffic data respectively. These data are randomly selected from the remaining normal traffic data sample pool and abnormal traffic data sample pool respectively to ensure the balance and representativeness of the test set. This partitioning strategy not only meets the requirements of unsupervised learning but also can effectively verify the model's ability to distinguish normal and abnormal traffic in the test stage.

[0066] Because network traffic usually contains multi-dimensional data and features, which will introduce noise and reduce the detection efficiency. To address this challenge, a feature extraction method is developed that can capture the high-dimensional and compact representation of traffic data. Inspired by the feature extraction function of the autoencoder, in this embodiment, a reconstruction-based model is adopted to reconstruct normal traffic data, and the intermediate latent vector is used to replace the original input. The key idea here is that the latent vector of abnormal traffic data will amplify the deviation, while the latent vector of normal traffic data will correctly represent the data because the abnormal traffic detection model is only trained on normal traffic data. Therefore, the high-dimensional features extracted by the feature extractor provide more representative information from the network, thereby enhancing the accuracy of anomaly detection.

[0067] Please refer to Figure 2 , Figure 2 is a schematic structural diagram of a feature extractor provided by an embodiment of the present invention. As Figure 2 shown, in an optional embodiment, the feature extractor includes autoencoders G (G E and G D ), an encoder E and a discriminator D. Among them, the autoencoder includes a cascaded first encoder G E and a decoder G D. The first encoder generates an original feature latent vector based on the input traffic data, and the decoder generates reconstructed data based on the original feature latent vector; the encoder is used to generate a reconstructed feature latent vector based on the reconstructed data; according to the input traffic data and the corresponding reconstructed data, the discriminator is used to implement adversarial training of the autoencoder.

[0068] Optionally, each part in the feature extractor can be composed of multiple one-dimensional convolutional layers and normalization layers, which can capture the deep pattern features in the traffic data and generate high-dimensional feature representations. The input traffic data first passes through the autoencoder to generate an original feature latent vector and the corresponding reconstructed data; subsequently, the reconstructed data passes through the encoder again to generate a reconstructed feature latent vector. The task of the discriminator is to distinguish between the traffic data and the reconstructed data, mark the input traffic data as real, and the reconstructed data as fake, so as to guide the generator, that is, the autoencoder and the encoder, to generate more realistic reconstruction results.

[0069] At this stage, with anomaly detection as the core goal, the anomaly score is defined by calculating the difference between the original feature latent vector of the input traffic data and the reconstructed feature latent vector of its corresponding reconstructed data, and the abnormal traffic data is detected accordingly until the feature extractor can complete the feature characterization task well, that is, the feature extractor is trained and the feature extraction module is obtained.

[0070] Exemplarily, for the input traffic data x, the autoencoder first processes the traffic data x, where x ∈ R n . The first encoder G E generates an original feature latent vector z, which encapsulates the intrinsic features of the data, where z ∈ R d . Then, the original feature latent vector z is fed into the decoder G D , and the decoder reconstructs the data to match the original input dimension. Subsequently, the reconstructed data is fed into the encoder E, and the encoder E extracts the reconstructed feature latent vector Since the feature extractor is only trained on normal traffic data, it can effectively reconstruct normal traffic data, but cannot reconstruct abnormal traffic data well, resulting in an obvious difference between z and .

[0071] In this embodiment, the autoencoder and the encoder of the feature extractor are jointly trained, and the overall training loss function is defined as follows:

[0072] L = w adv L adv + w con L con + w enc L enc ;

[0073] Among them, L adv is the adversarial loss, that is, the discriminator discrimination loss, which is defined as follows:

[0074]

[0075] L con is the context loss, that is, the loss between the input data and the reconstructed data, which is defined as follows:

[0076]

[0077] L enc is the encoder loss, that is, the loss between the input data features and the reconstructed data features, which is defined as follows:

[0078]

[0079] Among them, w adv is the weight parameter of the adversarial loss, w con is the weight parameter of the context loss, w enc is the weight parameter of the encoder loss, x is the input data, E is the encoder, D is the discriminator, G is the autoencoder, G E is the first encoder, represents obtaining the average loss of a batch of training.

[0080] Step 2: Design the traffic text description, and optimize the parameters of the text encoder in the CLIP model according to the traffic text description, the training dataset, and the feature extraction module. The optimized text encoder in the CLIP model serves as the text embedding module.

[0081] In this embodiment, the traffic text description includes: normal traffic class text description and malicious traffic class text description.

[0082] Optionally, optimizing the parameters of the text encoder in the CLIP model according to the traffic text description, the training dataset, and the feature extraction module may include the following steps:

[0083] Step i: Input the training dataset into the feature extraction module to obtain the corresponding traffic features, where the traffic features are formed by concatenating the original feature latent vectors and the reconstructed feature latent vectors corresponding to the traffic data by channel;

[0084] Step ii: Input the traffic text description into the text encoder in the CLIP model to generate the first text embedding corresponding to the normal traffic class text description and the second text embedding corresponding to the malicious traffic class text description;

[0085] Step iii: Calculate the similarity values between the traffic features and the first text embedding and the second text embedding respectively, calculate the value of the cross-entropy loss function according to the similarity values, and optimize the parameters of the text encoder in the CLIP model according to the value of the cross-entropy loss function.

[0086] It can be understood that the CLIP model is pre-trained by using millions of image-text pairs from the Internet, encoding the input image and the corresponding text description into a shared embedding space. However, in this embodiment, it is based on traffic data rather than image data. Therefore, the image encoder in the CLIP model is removed, and the feature extraction module obtained in the previous step 1 is used to extract the feature representation of the traffic data. On this basis, the text encoder of CLIP is retained and fine-tuned to adapt to the abnormal traffic detection task.

[0087] Specifically, text prompts corresponding to the "normal traffic class" and the "malicious traffic class" are designed, and the feature representations of these prompts are calculated using the text encoder in the CLIP model. For each traffic feature z extracted by the feature extraction module, calculate its cosine similarity with the text representations of the normal class and the malicious class respectively. Among them, the similarity between the traffic feature z and the text representation of the normal class should be higher, while the similarity with the text representation of the malicious class should be lower. In this way, two similarity values are generated for each traffic data in the batch, and these values are used as the logical scores of the classes and further passed to the cross-entropy loss function for optimization.

[0088] To solve the problem of limited training data, an alignment strategy for traffic and text description sets is introduced. Specifically, for the text descriptions of the normal traffic class and the malicious traffic class, multiple text descriptions are designed respectively, and the text representations t of these descriptions are calculated, that is, generated by the text encoder. Subsequently, the average value of the text representations of each class of descriptions is taken to obtain the text embedding representation representing the whole of this class of text descriptions as By aligning the traffic features with multiple text descriptions, the model can more comprehensively capture the feature clues of specific classes, thereby improving the generalization ability. Table 1 shows specific text description examples for describing the normal traffic class and the malicious traffic class.

[0089] Table 1 Text description set

[0090]

[0091] At this stage, the original feature latent vectors and reconstructed feature latent vectors generated from the feature extraction module are concatenated by channel to obtain traffic features. This method not only preserves the original feature information but also explicitly introduces the reconstructed features and the relationship between the reconstructed features and the original features. Subsequently, the similarity between the traffic features and the normal-class text embeddings and malicious-class text embeddings is calculated respectively. In this stage, the optimization objective is to make the similarity between the traffic features and the normal-class text embeddings higher and the similarity between the traffic features and the malicious-class text embeddings lower. This training method ensures the effective alignment of the traffic features of the text description and its corresponding traffic data in the shared embedding space, providing a solid foundation for subsequent feature reconstruction and anomaly detection. A brief process for optimizing the parameters of the text embedding module is as Figure 3 shown, Figure 3 which is a schematic diagram of the parameter optimization process of a text embedding module provided by an embodiment of the present invention. It should be noted that when training the text encoding, the weights of the feature extractor have been fixed.

[0092] In this embodiment, the traffic features output by the feature extraction module are used to fine-tune the text encoder of the CLIP model, enabling it to associate the text description with the traffic data features in the shared embedding space. Through this process, the model can not only understand the traffic features but also obtain the semantic information of the category through the text description, improving the understanding ability of the traffic data.

[0093] Step 3: Construct a transformation matrix. According to the training dataset, traffic text descriptions, feature extraction module, and text embedding module, obtain the traffic text joint features. Train the transformation matrix according to the traffic text joint features to obtain the trained transformation matrix. Construct a feature reconstruction module based on the trained transformation matrix and its corresponding inverse transformation matrix.

[0094] Compared with directly relying on the reconstruction error in the data space, the method of anomaly detection based on the reconstruction error in the feature space is more effective and robust. Therefore, in this embodiment, a transformation matrix T is introduced to map the high-dimensional features to an appropriate low-dimensional subspace, that is, T: H → L, where dim(L) << dim(H). At the same time, the parameters of the inverse transformation matrix T - are also learned to embed the low-dimensional features back to the high-dimensional space by inverse transformation. Different from the traditional principal component analysis (PCA) method that simply calculates the transformation through the singular value decomposition (SVD) of the data matrix, the transformation matrix T in this embodiment is learnable and more adaptable to the task requirements.

[0095] Optionally, obtaining the traffic text joint features according to the training dataset, traffic text descriptions, feature extraction module, and text embedding module, and training the transformation matrix according to the traffic text joint features may include the following steps:

[0096] Step i: Input the training data set into the feature extraction module to obtain the corresponding traffic features;

[0097] Step ii: Input the text descriptions of normal traffic classes into the text embedding module to generate the corresponding text embeddings;

[0098] Step iii: Concatenate the traffic features and the text embeddings along the channel dimension and vectorize them to obtain the traffic-text joint features;

[0099] Step iv: Use the transformation matrix and the corresponding inverse transformation matrix to obtain the reconstructed joint features of the traffic-text joint features, and optimize the transformation matrix according to the error between the traffic-text joint features and the reconstructed joint features, so that the transformation matrix learns the relationship between the normal traffic data and the text embeddings of the text descriptions of normal traffic classes.

[0100] Please refer to Figure 4 , Figure 4 which is a schematic structural diagram of a feature reconstruction module provided by an embodiment of the present invention. Specifically, first, the traffic features and the text embeddings of the text descriptions of normal traffic classes are concatenated along the channel dimension and vectorized to obtain the traffic-text joint features, which are used as inputs and applied to the transformation matrix T. Then, through the inverse transformation matrix T - inverse-map the low-dimensional subspace embedding back to the original space to obtain the reconstructed joint features. Finally, calculate the reconstruction error (FRE) as the difference between the traffic-text joint features and the reconstructed joint features. The specific calculation formula is as follows:

[0101]

[0102] where u represents the traffic-text joint features, represents matrix multiplication. Therefore, the anomaly score is defined as the Euclidean distance of the reconstruction error. The specific calculation formula is as follows:

[0103]

[0104] For abnormal traffic data, it is difficult for the feature extraction module to extract traffic features that can accurately represent the original data. At the same time, the correlation between these traffic features and the reconstructed data is weak, and the similarity with the text embeddings is also significantly reduced. This characteristic makes it difficult for the feature reconstruction module not only to effectively reconstruct the features of abnormal traffic data, but also to reproduce the correct relationship between them and the text embeddings, resulting in a significantly higher reconstruction error for abnormal traffic data than for normal traffic data. In this way, the reconstruction error can be directly used as a basis for judging anomalies, effectively distinguishing normal traffic from abnormal traffic. Therefore, at this stage, the sum of the reconstruction errors is defined as the optimization objective for training.

[0105] It is understandable that for the trained abnormal traffic detection model, the constructed test set can be used to test the performance of the model.

[0106] First, the traffic data of the test set is input into the feature extraction module to generate its traffic features. The purpose of this step is to capture the deep features of the traffic data for subsequent reconstruction and judgment. At the same time, since the text encoder of the CLIP model has been optimized during the training phase, the text embeddings are generated using the text descriptions of the normal traffic class. These text embeddings represent the feature distribution of the normal traffic class in the embedding space and provide an aligned reference for the traffic features. Next, the obtained traffic features and text embeddings are fused by channel to generate traffic-text joint features. This fusion process not only utilizes the local information of the traffic features but also combines the global semantic information of the text embeddings, improving the robustness of anomaly detection. The traffic-text joint features are input into the feature reconstruction module to generate reconstructed joint features through inverse mapping. The design of the feature reconstruction module aims to reconstruct the features of normal traffic data with high quality, while it is difficult to accurately restore the features of abnormal traffic data. Finally, by calculating the difference (i.e., reconstruction error) between the input traffic-text joint features and the reconstructed joint features, the classification of traffic data is achieved. Specifically, the error between the traffic features of normal traffic data and the reconstructed joint features is small because the feature extraction module and the feature reconstruction module can well capture the feature distribution of normal traffic data; while for abnormal traffic data, due to the deviation of the feature distribution, the reconstruction error is large. Therefore, by setting an appropriate error threshold, normal traffic and malicious traffic can be effectively distinguished, thus achieving high-precision anomaly detection.

[0107] The abnormal traffic detection method based on the large model CLIP guidance in the embodiments of the present invention combines a multimodal deep learning model with a feature reconstruction technique, effectively improving the efficiency and accuracy of abnormal traffic detection. By introducing a feature extraction module to extract the deep features of traffic data and fine-tuning the text encoder of the CLIP model, the traffic features and text descriptions are aligned in the shared embedding space, significantly enhancing the model's ability to identify abnormal traffic data. After the traffic features and text embeddings, feature reconstruction is performed, and the abnormal traffic data is measured by the reconstruction error, overcoming the limitations of traditional methods in feature expression and anomaly determination. At the same time, by using the global semantic information of natural language descriptions, the deficiency of the existing traffic detection model in category prior knowledge is made up, achieving high detection accuracy while realizing efficient adaptability to various traffic scenarios. The method of the present invention can provide a convenient and efficient technical support for network security, auditing, and traffic management, etc. It not only makes up for the deficiencies of the existing technology in the utilization of multimodal information and detection performance but also improves the detection efficiency while ensuring the detection accuracy, helping to reduce the human cost of network security management and improve the real-time performance and robustness of the system.

[0108] It should be noted that in this text, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprising", "including" or any other variant are intended to cover non-exclusive inclusion, so that an article or device comprising a series of elements not only includes those elements, but also includes other elements not expressly listed. Without further limitation, an element defined by the statement "comprising an..." does not exclude the presence of additional identical elements in the article or device comprising the element. Similar words such as "connected" or "coupled" are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The orientation or positional relationship indicated by "upper", "lower", "left", "right", etc. is based on the orientation or positional relationship shown in the drawings, and is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the present invention.

[0109] In the description of this specification, the description with reference to terms such as "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification.

[0110] The above content is a further detailed description of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is only limited to these descriptions. For those of ordinary skill in the technical field to which the present invention pertains, without departing from the concept of the present invention, several simple deductions or substitutions can still be made, and all should be regarded as belonging to the protection scope of the present invention.

Claims

1. An abnormal traffic detection method based on large model CLIP guidance, characterized in that: include: Preprocess the network data packets to obtain flow data of preset length; The traffic data is input into a pre-trained abnormal traffic detection model to obtain a detection result; wherein the abnormal traffic detection model is used to extract the traffic features of the traffic data, generate text embeddings corresponding to normal traffic class text descriptions based on the text encoder in the optimized CLIP model, and implement abnormal traffic detection based on the traffic-text joint features obtained by combining the traffic features with the text embeddings.

2. The abnormal traffic detection method based on large model CLIP guidance according to claim 1 is characterized in that: Preprocess the network data packets to obtain traffic data of preset length, including: Extract the payload field in the network data packet, fill or truncate the payload field, and obtain traffic data of a preset length.

3. The abnormal traffic detection method based on large model CLIP guidance according to claim 1 is characterized in that: Before preprocessing the network data packet to obtain flow data of a preset length, the method further includes: parsing the Pcap file to extract the network data packet.

4. The abnormal traffic detection method based on large model CLIP guidance according to claim 1 is characterized in that: The abnormal traffic detection model includes a feature extraction module, a text embedding module and a feature reconstruction module; The feature extraction module is used to extract deep features of the flow data to obtain the flow features; The text embedding module is used to generate corresponding text embedding according to the input normal traffic class text description; The feature reconstruction module is used to generate a corresponding reconstructed joint feature based on the input traffic text joint feature, and calculate the reconstruction error between the traffic text joint feature and the reconstructed joint feature. If the reconstruction error exceeds a preset error threshold, the traffic data is malicious traffic, otherwise it is normal traffic.

5. The abnormal traffic detection method based on large model CLIP guidance according to claim 4 is characterized in that: The training process of the abnormal traffic detection model includes: Constructing a feature extractor, and training the feature extractor using a training data set to obtain a trained feature extractor as the feature extraction module; the training data set includes a plurality of normal traffic data; Designing a traffic text description, optimizing parameters of a text encoder in the CLIP model according to the traffic text description, the training data set, and the feature extraction module, and using the optimized text encoder in the CLIP model as the text embedding module; Construct a transformation matrix, obtain the traffic text joint features according to the training data set, the traffic text description, the feature extraction module and the text embedding module, train the transformation matrix according to the traffic text joint features to obtain a trained transformation matrix, and construct the feature reconstruction module according to the trained transformation matrix and the corresponding inverse transformation matrix.

6. The abnormal traffic detection method based on large model CLIP guidance according to claim 5 is characterized in that: The feature extractor includes an autoencoder, an encoder and a discriminator, wherein the autoencoder includes a cascaded first encoder and a decoder; The first encoder generates an original feature latent vector according to the input traffic data, and the decoder generates reconstructed data according to the original feature latent vector; The encoder is used to generate a reconstruction feature latent vector according to the reconstructed data; The discriminator is used to implement adversarial training of the autoencoder according to input traffic data and corresponding reconstructed data.

7. The abnormal traffic detection method based on large model CLIP guidance according to claim 6 is characterized in that: The overall training loss function for the feature extractor training is defined as follows: L=w adv L adv +w con L con +w enc L enc ; Among them, L adv is the adversarial loss, defined as follows: L con is the contextual loss, defined as follows: L enc is the encoder loss, defined as follows: Among them, w adv is the weight parameter of adversarial loss, w con is the weight parameter of the context loss, w enc is the weight parameter of the encoder loss, x is the input data, E is the encoder, D is the discriminator, G is the autoencoder, G E is the first encoder, It means to find the average loss of a batch training.

8. The abnormal traffic detection method based on large model CLIP guidance according to claim 6 is characterized in that: The traffic text description includes: a normal traffic type text description and a malicious traffic type text description.

9. The abnormal traffic detection method based on large model CLIP guidance according to claim 8 is characterized in that: Optimizing parameters of a text encoder in the CLIP model according to the traffic text description, the training data set, and the feature extraction module includes: Inputting the training data set into the feature extraction module to obtain corresponding traffic features, wherein the traffic features are formed by connecting the original feature latent vector and the reconstructed feature latent vector corresponding to the traffic data according to channels; Input the traffic text description into a text encoder in the CLIP model to generate a first text embedding corresponding to the normal traffic class text description and a second text embedding corresponding to the malicious traffic class text description; The similarity values ​​between the traffic feature and the first text embedding and the second text embedding are respectively calculated, a value of a cross entropy loss function is calculated according to the similarity values, and the parameters of the text encoder in the CLIP model are optimized according to the value of the cross entropy loss function.

10. The abnormal traffic detection method based on large model CLIP guidance according to claim 9 is characterized in that: Obtaining a traffic text joint feature according to the training data set, the traffic text description, the feature extraction module, and the text embedding module, and training the transformation matrix according to the traffic text joint feature, including: Inputting the training data set into the feature extraction module to obtain corresponding traffic features; Inputting the normal traffic class text description into the text embedding module to generate a corresponding text embedding; The flow feature and the text embedding are connected according to the channel dimension and then vectorized to obtain the flow text joint feature; The transformation matrix and the corresponding inverse transformation matrix are used to obtain the reconstructed joint features corresponding to the traffic text joint features, and the transformation matrix is ​​optimized according to the error between the traffic text joint features and the reconstructed joint features so that the transformation matrix can learn the relationship between the normal traffic data and the text embedding of the normal traffic class text description.

Images