An abnormal traffic detection method based on large model CLIP guidance

Abstract

The application discloses an abnormal traffic detection method based on a large model CLIP guide, relates to the technical field of network security and anomaly detection, and comprises the following steps: preprocessing network data packets to obtain traffic data with a preset length; and inputting the traffic data into a pre-trained abnormal traffic detection model to obtain a detection result; wherein the abnormal traffic detection model is used for extracting traffic features of the traffic data, generating text embedding corresponding to a normal traffic class text description based on a text encoder in an optimized CLIP model, and realizing abnormal traffic detection according to traffic-text joint features obtained by combining the traffic features and the text embedding. The application overcomes the limitations of traditional methods in feature expression and abnormality determination, makes up for the deficiencies of existing traffic detection models in category prior knowledge, and realizes efficient adaptability to various traffic scenarios while maintaining high detection accuracy.

Description

Technical Field

[0001] This invention belongs to the field of network security and anomaly detection technology, specifically involving an anomaly traffic detection method based on large model CLIP (Contrastive Language-Image Pre-Training). Background Technology

[0002] Over the past few decades, with the continuous expansion of network scale and the increasing diversification of applications, anomaly traffic detection technology has become an important tool for ensuring network security and optimizing network performance. Network operators and enterprise network administrators are increasingly relying on anomaly traffic detection technology to cope with evolving network threats and manage complex network traffic.

[0003] In recent years, deep learning technology has been widely applied in the field of network traffic anomaly detection, demonstrating strong research potential and practical value. Mainstream solutions typically employ deep learning models such as Convolutional Neural Networks (CNNs) or Recurrent Neural Networks (RNNs), focusing on modeling and analyzing one-dimensional sequence data of network traffic. These methods, through automatic extraction of low-level features from traffic data and end-to-end training of deep learning models, can efficiently distinguish between normal and abnormal traffic, significantly improving detection accuracy.

[0004] While existing technologies have achieved some success in network traffic anomaly detection, significant shortcomings remain. Current methods primarily rely on low-level feature extraction from one-dimensional sequence data, lacking effective modeling of deep semantic information, resulting in limited generalization ability when faced with complex and diverse traffic patterns. Furthermore, some solutions attempt to improve accuracy by introducing more complex deep learning models, but this often comes at the cost of significantly increased computational complexity, making widespread deployment difficult in real-time applications with high requirements. Summary of the Invention

[0005] To address the aforementioned problems in existing technologies, this invention provides an abnormal traffic detection method based on the large model CLIP. The technical problem to be solved by this invention is achieved through the following technical solution:

[0006] This invention provides an anomaly traffic detection method based on large model CLIP guidance, comprising:

[0007] Network data packets are preprocessed to obtain traffic data of a preset length;

[0008] The traffic data is input into a pre-trained abnormal traffic detection model to obtain detection results; wherein, the abnormal traffic detection model is used to extract traffic features from the traffic data, generate text embeddings corresponding to normal traffic class text descriptions based on the text encoder in the optimized CLIP model, and realize abnormal traffic detection based on the traffic features and the text embeddings combined into a traffic text joint feature.

[0009] In one embodiment of the present invention, network data packets are preprocessed to obtain traffic data of a preset length, including:

[0010] Extract the payload field from the network data packet, and fill or truncate the payload field to obtain traffic data of a preset length.

[0011] In one embodiment of the present invention, before preprocessing the network data packets to obtain traffic data of a preset length, the method further includes: parsing the Pcap file to extract the network data packets.

[0012] In one embodiment of the present invention, the abnormal traffic detection model includes a feature extraction module, a text embedding module, and a feature reconstruction module;

[0013] The feature extraction module is used to extract deep features from the traffic data to obtain the traffic features;

[0014] The text embedding module is used to generate corresponding text embeddings based on the input normal traffic type text description;

[0015] The feature reconstruction module is used to generate corresponding reconstructed joint features based on the input traffic text joint features, calculate the reconstruction error between the traffic text joint features and the reconstructed joint features, and if the reconstruction error exceeds a preset error threshold, the traffic data is malicious traffic; otherwise, it is normal traffic.

[0016] In one embodiment of the present invention, the training process of the abnormal traffic detection model includes:

[0017] A feature extractor is constructed and trained using a training dataset to obtain a trained feature extractor, which serves as the feature extraction module. The training dataset includes multiple normal traffic data sets.

[0018] Design a traffic text description, optimize the parameters of the text encoder in the CLIP model based on the traffic text description, the training dataset, and the feature extraction module, and use the optimized text encoder in the CLIP model as the text embedding module;

[0019] A transformation matrix is ​​constructed. Joint features of traffic text are obtained based on the training dataset, the traffic text description, the feature extraction module, and the text embedding module. The transformation matrix is ​​trained based on the joint features of traffic text to obtain a trained transformation matrix. The feature reconstruction module is constructed based on the trained transformation matrix and the corresponding inverse transformation matrix.

[0020] In one embodiment of the present invention, the feature extractor includes an autoencoder, an encoder, and a discriminator, wherein the autoencoder includes a cascaded first encoder and a decoder;

[0021] The first encoder generates an original feature latent vector based on the input traffic data, and the decoder generates reconstructed data based on the original feature latent vector.

[0022] The encoder is used to generate a reconstructed feature latent vector based on the reconstructed data;

[0023] Based on the input traffic data and the corresponding reconstructed data, the discriminator is used to perform adversarial training of the autoencoder.

[0024] In one embodiment of the present invention, the overall training loss function for training the feature extractor is defined as follows:

[0025] L = w adv L adv +w con L con +w enc L enc ;

[0026] Among them, L adv It is adversarial loss, defined as follows:

[0027]

[0028] L con It is the context loss, defined as follows:

[0029]

[0030] L enc It is the encoder loss, defined as follows:

[0031]

[0032] Among them, w adv w is the weight parameter for the adversarial loss. con w represents the weight parameters for the context loss. enc Here are the weight parameters for the encoder loss, where x is the input data, E is the encoder, D is the discriminator, G is the autoencoder, and G is the weight parameter for the encoder loss.E For the first encoder, This indicates the calculation of the average loss for a batch of training.

[0033] In one embodiment of the present invention, the traffic text description includes: normal traffic text description and malicious traffic text description.

[0034] In one embodiment of the present invention, optimizing the parameters of the text encoder in the CLIP model based on the traffic text description, the training dataset, and the feature extraction module includes:

[0035] The training dataset is input into the feature extraction module to obtain the corresponding traffic features, wherein the traffic features are formed by concatenating the original feature latent vector and the reconstructed feature latent vector corresponding to the traffic data by channel;

[0036] The traffic text description is input into the text encoder in the CLIP model to generate a first text embedding corresponding to the normal traffic text description and a second text embedding corresponding to the malicious traffic text description.

[0037] The similarity values ​​between the traffic features and the first text embedding and the second text embedding are calculated respectively. The cross-entropy loss function is calculated based on the similarity values. The parameters of the text encoder in the CLIP model are optimized based on the cross-entropy loss function.

[0038] In one embodiment of the present invention, a joint feature of traffic text is obtained based on the training dataset, the traffic text description, the feature extraction module, and the text embedding module. The transformation matrix is ​​then trained based on the joint feature of traffic text, including:

[0039] The training dataset is input into the feature extraction module to obtain the corresponding traffic features;

[0040] The normal traffic type text description is input into the text embedding module to generate the corresponding text embedding;

[0041] The traffic features and the text embeddings are concatenated along the channel dimension and then vectorized to obtain the traffic-text joint features;

[0042] The transformation matrix and the corresponding inverse transformation matrix are used to obtain the reconstructed joint features corresponding to the traffic text joint features. The transformation matrix is ​​optimized based on the error between the traffic text joint features and the reconstructed joint features, so that the transformation matrix learns the relationship between the text embedding of the normal traffic data and the normal traffic class text description.

[0043] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0044] This invention presents an anomaly traffic detection method based on the CLIP (Complex Learning Platform) large model. By combining a multimodal deep learning model with feature reconstruction technology, it effectively improves the efficiency and accuracy of anomaly traffic detection. By introducing a feature extraction module to extract deep features from traffic data and fine-tuning the text encoder of the CLIP model, traffic features and text descriptions are aligned in a shared embedding space, significantly enhancing the model's ability to identify anomaly traffic data. Feature reconstruction is performed after embedding traffic features with text, and the reconstruction error is used to measure anomaly traffic data, overcoming the limitations of traditional methods in feature representation and anomaly judgment. Simultaneously, by utilizing global semantic information from natural language descriptions, it compensates for the shortcomings of existing traffic detection models in category prior knowledge, achieving high adaptability to various traffic scenarios while maintaining high detection accuracy. This invention provides convenient and efficient technical support for network security, auditing, and traffic management, not only compensating for the deficiencies of existing technologies in multimodal information utilization and detection performance but also improving detection efficiency while ensuring detection accuracy. This helps reduce the manpower costs of network security management and improve the real-time performance and robustness of the system.

[0045] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described in detail below with reference to the accompanying drawings. Attached Figure Description

[0046] Figure 1 This is a flowchart of an abnormal traffic detection method based on large model CLIP provided in an embodiment of the present invention;

[0047] Figure 2 This is a schematic diagram of the structure of a feature extractor provided in an embodiment of the present invention;

[0048] Figure 3 This is a schematic diagram of the parameter optimization process of a text embedding module provided in an embodiment of the present invention;

[0049] Figure 4 This is a schematic diagram of the structure of a feature reconstruction module provided in an embodiment of the present invention. Detailed Implementation

[0050] To further illustrate the technical means and effects adopted by the present invention to achieve the intended purpose, the following describes in detail, with reference to the accompanying drawings and specific embodiments, an abnormal traffic detection method based on the large model CLIP guided by the present invention.

[0051] The foregoing and other technical contents, features, and effects of the present invention will be clearly presented in the following detailed description of specific embodiments in conjunction with the accompanying drawings. Through the description of the specific embodiments, a more in-depth and concrete understanding can be gained of the technical means and effects adopted by the present invention to achieve its intended purpose. However, the accompanying drawings are for reference and illustration only and are not intended to limit the technical solutions of the present invention.

[0052] Firstly, embodiments of the present invention provide an abnormal traffic detection method based on the large model CLIP (Clearly Interpretive Propagation) guideline. Please refer to [link to relevant documentation]. Figure 1 , Figure 1 This is a flowchart of an abnormal traffic detection method based on a large model CLIP provided in an embodiment of the present invention, as shown below. Figure 1 As shown, the abnormal traffic detection method based on the large model CLIP guided by this embodiment includes:

[0053] S1: Preprocess network data packets to obtain traffic data of a preset length.

[0054] Optionally, S1 includes: extracting the payload field from the network data packet, padding or truncating the payload field to obtain traffic data of a preset length.

[0055] To simplify analysis and focus on key features, this embodiment retains only the payload field (TCP / UDP data portion) for each data packet, using it as the core content for subsequent processing. Since the payload data length may vary, a uniform strategy is adopted to adapt to the model's input requirements; for example, the data length can be standardized to 1600 bytes. Specifically, packets shorter than the target length are padded to the required length, while packets longer than the target length are truncated to 1600 bytes, thus generating traffic data with a consistent format.

[0056] It is understood that, prior to S1, the method of this embodiment of the invention further includes S0: parsing the Pcap file and extracting network data packets.

[0057] S2: Input the traffic data into the pre-trained abnormal traffic detection model to obtain the detection result; wherein, the abnormal traffic detection model is used to extract the traffic features of the traffic data, generate the text embedding corresponding to the normal traffic class text description based on the text encoder in the optimized CLIP model, and realize abnormal traffic detection based on the traffic text joint features after the traffic features and text embedding are combined.

[0058] Furthermore, the structure and training process of the abnormal traffic detection model in this embodiment will be described in detail.

[0059] Optionally, the abnormal traffic detection model includes a feature extraction module, a text embedding module, and a feature reconstruction module. The feature extraction module is used to extract deep features from the traffic data to obtain traffic features. The text embedding module is used to generate corresponding text embeddings based on the input normal traffic text description. The feature reconstruction module is used to generate corresponding reconstructed joint features based on the input traffic text joint features, calculate the reconstruction error between the traffic text joint features and the reconstructed joint features, and if the reconstruction error exceeds a preset error threshold, the traffic data is malicious traffic; otherwise, it is normal traffic.

[0060] In this embodiment, the feature extraction module extracts high-level features from one-dimensional traffic data, providing a semantic representation of the traffic; the text embedding module, based on the CLIP model, fine-tunes the text embedding by designing text prompts relevant to the traffic task, thus associating it with traffic features; the feature reconstruction module integrates traffic features and text embedding, using reconstruction errors to determine the anomaly of the traffic. The organic combination of these three modules significantly improves the accuracy and efficiency of detection, providing reliable technical support for anomaly traffic detection in complex network environments.

[0061] Optionally, the training process of the abnormal traffic detection model is divided into three stages. The first stage focuses on training a feature extractor for extracting features from traffic data. The second stage optimizes the text encoder part in the CLIP model based on the trained feature extractor to achieve alignment between traffic features and text descriptions. In the third stage, the traffic features and text descriptions are fused and input into the feature reconstruction module to calculate the reconstruction error and use it for anomaly detection. In this stage, the sum of reconstruction errors is defined as the optimization target for training.

[0062] In this embodiment, the training process of the abnormal traffic detection model may include the following steps:

[0063] Step 1: Build a feature extractor. Train the feature extractor using the training dataset to obtain the trained feature extractor as the feature extraction module.

[0064] The training dataset includes multiple normal traffic datasets. The training dataset can be constructed using the UNB-CIC Tor and nonTor, ISCX VPN and nonVPN, or USTC-TFC2016 datasets.

[0065] For example, taking the USTC-TFC2016 dataset as an example, this dataset contains Pcap files of various benign and malicious traffic, which record the raw data packet information of network communication. First, these Pcap files are parsed to extract the network data packets. For each data packet, its payload field, i.e., the TCP / UDP data portion, is retained and used as the core content for subsequent processing. Since the length of the payload data may vary, a unified strategy is adopted to standardize the data length to 1600 bytes to adapt to the model's input requirements. Specifically, data packets that are too short are padded to the target length, while data packets that exceed the length are truncated to 1600 bytes, thus generating traffic data with a consistent format. In the data partitioning stage, a specific dataset partitioning scheme is designed according to the characteristics of unsupervised anomaly detection. The training set contains only normal traffic data to ensure that the model's learning process does not depend on the characteristics of anomaly traffic data. 10,000 samples are randomly selected from all normal traffic data to construct the training set, used to train the model's feature extractor and related modules. The test set is designed as a balanced binary classification dataset, containing 5000 normal traffic data points and 5000 abnormal traffic data points. These data points are randomly drawn from the remaining normal traffic data pool and the abnormal traffic data pool, respectively, ensuring the balance and representativeness of the test set. This partitioning strategy satisfies the requirements of unsupervised learning and effectively verifies the model's ability to distinguish between normal and abnormal traffic during the testing phase.

[0066] Because network traffic typically contains multidimensional data and features, this introduces noise and reduces detection efficiency. To address this challenge, a feature extraction method has been developed to capture a high-dimensional and compact representation of traffic data. Inspired by the feature extraction capabilities of autoencoders, this embodiment employs a reconstruction-based model to reconstruct normal traffic data, replacing the original input with intermediate latent vectors. The key idea here is that latent vectors from anomalous traffic data amplify biases, while latent vectors from normal traffic data accurately represent the data, since the anomalous traffic detection model is trained only on normal traffic data. Therefore, the high-dimensional features extracted by the feature extractor provide more representative information from the network, thereby enhancing the accuracy of anomaly detection.

[0067] Please see Figure 2 , Figure 2 This is a schematic diagram of the structure of a feature extractor provided in an embodiment of the present invention, as shown below. Figure 2 As shown, in an optional embodiment, the feature extractor includes an autoencoder G(G) E and G D The encoder includes an encoder E and a discriminator D, wherein the automatic encoder includes a cascaded first encoder G. E and decoder G DThe first encoder generates the original feature latent vector based on the input traffic data, and the decoder generates reconstructed data based on the original feature latent vector. The encoder is used to generate reconstructed feature latent vectors based on the reconstructed data. Based on the input traffic data and the corresponding reconstructed data, the discriminator is used to implement adversarial training of the autoencoder.

[0068] Optionally, the feature extractor can consist of multiple one-dimensional convolutional layers and normalization layers, capable of capturing deep pattern features in traffic data and generating high-dimensional feature representations. The input traffic data is first processed by an autoencoder to generate original feature latent vectors and corresponding reconstructed data; subsequently, the reconstructed data is again processed by an encoder to generate reconstructed feature latent vectors. The discriminator's task is to distinguish between traffic data and reconstructed data, marking the input traffic data as true and the reconstructed data as false, thereby guiding the generator, i.e., the autoencoder and encoder, to generate more realistic reconstruction results.

[0069] In this stage, anomaly detection is the core objective. Anomaly scores are defined by calculating the difference between the original feature latent vector of the input traffic data and the reconstructed feature latent vector of the corresponding reconstructed data. Anomaly traffic data is then detected based on this difference until the feature extractor can perform the feature representation task well. This completes the feature extractor training and yields the feature extraction module.

[0070] For example, for input flow data x, the autoencoder first processes the flow data x, where x∈R n First encoder G E The original feature latent vector z is generated, which encapsulates the intrinsic features of the data, where z∈R. d Then, the original feature latent vector z is fed into the decoder G. D Decoder reconstructs data To match the original input dimensions. The data will then be reconstructed. The data is fed into encoder E, which extracts and reconstructs the latent feature vectors. Because the feature extractor is trained only on normal traffic data, it can effectively reconstruct normal traffic data but cannot reconstruct abnormal traffic data well, resulting in z and There are significant differences between them.

[0071] In this embodiment, the autoencoder and encoder of the feature extractor are trained together, and the overall training loss function is defined as follows:

[0072] L = w adv L adv +w con L con +w enc L enc ;

[0073] Among them, L adv It is the adversarial loss, i.e., the discriminant loss, defined as follows:

[0074]

[0075] L con It is the context loss, which is the loss between the input data and the reconstructed data, defined as follows:

[0076]

[0077] L enc It is the encoder loss, which is the loss between the input data features and the reconstructed data features, defined as follows:

[0078]

[0079] Among them, w adv w is the weight parameter for the adversarial loss. con w represents the weight parameters for the context loss. enc Here are the weight parameters for the encoder loss, where x is the input data, E is the encoder, D is the discriminator, G is the autoencoder, and G is the weight parameter for the encoder loss. E For the first encoder, This indicates the calculation of the average loss for a batch of training.

[0080] Step 2: Design traffic text description. Based on the traffic text description, training dataset, and feature extraction module, optimize the parameters of the text encoder in the CLIP model. The optimized text encoder in the CLIP model serves as the text embedding module.

[0081] In this embodiment, the traffic text description includes: normal traffic text description and malicious traffic text description.

[0082] Optionally, optimizing the parameters of the text encoder in the CLIP model based on the traffic text description, training dataset, and feature extraction module may include the following steps:

[0083] Step i: Input the training dataset into the feature extraction module to obtain the corresponding traffic features. The traffic features are formed by concatenating the original feature latent vector and the reconstructed feature latent vector corresponding to the traffic data by channel.

[0084] Step ii: Input the traffic text description into the text encoder in the CLIP model to generate the first text embedding corresponding to the normal traffic text description and the second text embedding corresponding to the malicious traffic text description;

[0085] Step iii: Calculate the similarity value between the traffic feature and the first text embedding and the second text embedding respectively. Calculate the value of the cross-entropy loss function based on the similarity value. Optimize the parameters of the text encoder in the CLIP model based on the value of the cross-entropy loss function.

[0086] Understandably, the CLIP model is pre-trained using millions of image-text pairs from the internet, encoding input images and corresponding text descriptions into a shared embedding space. However, in this embodiment, traffic data is used instead of image data. Therefore, the image encoder in the CLIP model is removed, and the feature extraction module obtained in step 1 above is used to extract feature representations of the traffic data. Based on this, the CLIP text encoder is retained and fine-tuned to adapt to the abnormal traffic detection task.

[0087] Specifically, text prompts corresponding to "normal traffic" and "malicious traffic" were designed, and the feature representations of these prompts were calculated using the text encoder in the CLIP model. For each traffic feature z extracted by the feature extraction module, its cosine similarity with the text representations of the normal and malicious classes was calculated, respectively. Traffic feature z should have a higher similarity to the text representation of the normal class and a lower similarity to the text representation of the malicious class. In this way, two similarity values ​​are generated for each traffic data in the batch. These values ​​serve as the logical score of the class and are further passed to the cross-entropy loss function for optimization.

[0088] To address the limitation of training data, an alignment strategy between traffic and text description sets is introduced. Specifically, multiple text descriptions are designed for both normal and malicious traffic categories, and their text representations, 't', are calculated using a text encoder. Subsequently, the average of the text representations for each category is taken to obtain the text embedding representation representing the entire category of text descriptions. By aligning traffic features with multiple text descriptions, the model can capture more comprehensive feature cues for specific categories, thereby improving generalization ability. Table 1 shows examples of specific text descriptions used to describe normal traffic and malicious traffic categories.

[0089] Table 1. Collection of Text Descriptions

[0090]

[0091] In this stage, the original and reconstructed latent feature vectors generated by the feature extraction module are concatenated by channel to obtain traffic features. This approach not only preserves the original feature information but also explicitly introduces the reconstructed features and their relationship with the original features. Subsequently, the similarity between the traffic features and normal and malicious text embeddings is calculated. The optimization objective in this stage is to maximize the similarity between the traffic features and normal text embeddings while minimizing the similarity with malicious text embeddings. This training method ensures effective alignment between the text description and the traffic features of its corresponding traffic data in the shared embedding space, providing a solid foundation for subsequent feature reconstruction and anomaly detection. A brief flowchart of optimizing the text embedding module parameters is as follows: Figure 3 As shown, Figure 3 This is a schematic diagram of the parameter optimization process of a text embedding module provided in an embodiment of the present invention. It should be noted that the weights of the feature extractor have been fixed when training the text encoding.

[0092] In this embodiment, the traffic features output by the feature extraction module are used to fine-tune the text encoder of the CLIP model, enabling it to associate text descriptions with traffic data features in a shared embedding space. Through this process, the model can not only understand traffic features, but also obtain semantic information about categories through text descriptions, thereby improving its ability to understand traffic data.

[0093] Step 3: Construct the transformation matrix. Obtain the joint features of traffic text based on the training dataset, traffic text description, feature extraction module, and text embedding module. Train the transformation matrix based on the joint features of traffic text to obtain the trained transformation matrix. Construct the feature reconstruction module based on the trained transformation matrix and the corresponding inverse transformation matrix.

[0094] Compared to methods that directly rely on reconstruction errors in the data space, anomaly detection based on reconstruction errors in the feature space is more effective and robust. Therefore, in this embodiment, a transformation matrix T is introduced to map high-dimensional features to an appropriate low-dimensional subspace, i.e., T:H→L, where dim(L)<<dim(H). Simultaneously, the inverse transformation matrix T is also learned. - The parameters are used to embed low-dimensional features into the inverse transformation back to the high-dimensional space. Unlike the traditional principal component analysis (PCA) method, which simply calculates the transformation through singular value decomposition (SVD) of the data matrix, the transformation matrix T in this embodiment is learnable and more adaptable to task requirements.

[0095] Optionally, the traffic text joint features are obtained based on the training dataset, traffic text description, feature extraction module, and text embedding module. The transformation matrix is ​​then trained based on the traffic text joint features, which may include the following steps:

[0096] Step i: Input the training dataset into the feature extraction module to obtain the corresponding traffic features;

[0097] Step ii: Input the normal traffic type text description into the text embedding module to generate the corresponding text embedding;

[0098] Step iii: After concatenating the traffic features and text embeddings along the channel dimension, vectorize them to obtain the joint traffic-text features;

[0099] Step iv: Use the transformation matrix and the corresponding inverse transformation matrix to obtain the reconstructed joint features of the traffic text joint features. Optimize the transformation matrix based on the error between the traffic text joint features and the reconstructed joint features so that the transformation matrix learns the relationship between the text embeddings of normal traffic data and normal traffic class text descriptions.

[0100] Please see Figure 4 , Figure 4 This is a schematic diagram of a feature reconstruction module provided in an embodiment of the present invention. Specifically, firstly, the traffic features and the text embeddings of normal traffic-type text descriptions are concatenated along the channel dimension and quantized to obtain joint traffic-text features, which are then used as input to the transformation matrix T. Then, the inverse transformation matrix T is used... - The low-dimensional subspace is embedded and inversely mapped back to the original space to obtain the reconstructed joint features. Finally, the reconstruction error (FRE) is calculated as the difference between the traffic text joint features and the reconstructed joint features. The specific calculation formula is as follows:

[0101]

[0102] Where u represents the joint feature of traffic and text. This represents matrix multiplication. Therefore, the anomaly score is defined as the Euclidean distance of the reconstruction error, calculated using the following formula:

[0103]

[0104] For abnormal traffic data, the feature extraction module struggles to extract traffic features that accurately represent the original data. Furthermore, these traffic features have weak correlations with the reconstructed data and significantly reduced similarity to the text embeddings. This characteristic makes it difficult for the feature reconstruction module to effectively reconstruct the features of abnormal traffic data, and also to reproduce the correct relationship between them and the text embeddings. Consequently, the reconstruction error for abnormal traffic data is significantly higher than that for normal traffic data. In this way, the reconstruction error can be directly used as a basis for judging anomalies, effectively distinguishing between normal and abnormal traffic. Therefore, at this stage, the sum of the reconstruction errors is defined as the optimization objective for training.

[0105] Understandably, once the abnormal traffic detection model has been trained, the performance of the model can be tested using the constructed test set.

[0106] First, the traffic data from the test set is input into the feature extraction module to generate its traffic features. This step aims to capture the deep features of the traffic data for subsequent reconstruction and judgment. Simultaneously, since the text encoder of the CLIP model has been optimized during training, text embeddings are generated using normal traffic class text descriptions. These text embeddings characterize the feature distribution of normal traffic classes in the embedding space and provide an alignment reference for the traffic features. Next, the obtained traffic features and text embeddings are fused channel-wise to generate joint traffic-text features. This fusion process utilizes not only the local information of the traffic features but also the global semantic information of the text embeddings, improving the robustness of anomaly detection. The joint traffic-text features are input into the feature reconstruction module, which generates reconstructed joint features through inverse mapping. The feature reconstruction module is designed to reconstruct the features of normal traffic data with high quality, while the features of abnormal traffic data are difficult to accurately reconstruct. Finally, the traffic data is classified by calculating the difference (i.e., reconstruction error) between the input joint traffic-text features and the reconstructed joint features. Specifically, the error between the traffic characteristics of normal traffic data and the reconstructed joint features is small because the feature extraction and feature reconstruction modules can capture the feature distribution of normal traffic data well. However, abnormal traffic data has a larger reconstruction error due to deviations in the feature distribution. Therefore, by setting an appropriate error threshold, normal traffic and malicious traffic can be effectively distinguished, thereby achieving high-precision anomaly detection.

[0107] This invention presents an abnormal traffic detection method based on the CLIP (Complex Learning Platform) large model, which combines a multimodal deep learning model with feature reconstruction technology to effectively improve the efficiency and accuracy of abnormal traffic detection. By introducing a feature extraction module to extract deep features from traffic data and fine-tuning the text encoder of the CLIP model, traffic features and text descriptions are aligned in a shared embedding space, significantly enhancing the model's ability to identify abnormal traffic data. Feature reconstruction is performed after embedding traffic features and text, and the reconstruction error is used to measure abnormal traffic data, overcoming the limitations of traditional methods in feature representation and anomaly judgment. Simultaneously, by utilizing global semantic information from natural language descriptions, the invention compensates for the shortcomings of existing traffic detection models in category prior knowledge, achieving high adaptability to various traffic scenarios while maintaining high detection accuracy. This invention provides convenient and efficient technical support for network security, auditing, and traffic management, not only compensating for the deficiencies of existing technologies in multimodal information utilization and detection performance but also improving detection efficiency while ensuring detection accuracy. This helps reduce the manpower costs of network security management and improve the real-time performance and robustness of the system.

[0108] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations are intended to cover non-exclusive inclusion, such that an article or device comprising a list of elements includes not only those elements but also other elements not expressly listed. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the article or device comprising said element. Terms such as "connected" or "linked" are not limited to physical or mechanical connections but can include electrical connections, whether direct or indirect. The orientations or positional relationships indicated by terms such as "upper," "lower," "left," and "right" are based on the orientations or positional relationships shown in the accompanying drawings and are used only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be construed as limiting the invention.

[0109] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features or characteristics described may be combined in any suitable manner in one or more embodiments or examples. In addition, those skilled in the art can combine and integrate the different embodiments or examples described in this specification.

[0110] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A large model CLIP guidance-based abnormal traffic detection method, characterized in that, The method comprises the following steps: Preprocessing network data packets to obtain traffic data of a preset length; Inputting the traffic data into a pre-trained abnormal traffic detection model to obtain a detection result; wherein the abnormal traffic detection model is used to extract traffic features of the traffic data, generate text embedding corresponding to normal traffic text description based on a text encoder in an optimized CLIP model, and realize abnormal traffic detection according to traffic-text joint features after the traffic features and the text embedding are combined; The abnormal traffic detection model comprises a feature extraction module, a text embedding module and a feature reconstruction module; The feature extraction module is used to extract deep features of traffic data to obtain the traffic features; the text embedding module is used to generate corresponding text embedding according to input normal traffic text description; and the feature reconstruction module is used to generate corresponding reconstructed joint features according to input traffic-text joint features, calculate reconstruction error between the traffic-text joint features and the reconstructed joint features, and if the reconstruction error exceeds a preset error threshold, the traffic data is malicious traffic, otherwise it is normal traffic; The training process of the abnormal traffic detection model comprises: Building a feature extractor, training the feature extractor using a training data set to obtain a trained feature extractor as the feature extraction module; the training data set comprises a plurality of normal traffic data; Designing traffic text description, optimizing parameters of a text encoder in the CLIP model according to the traffic text description, the training data set and the feature extraction module, and using the optimized text encoder in the CLIP model as the text embedding module; Building a transformation matrix, obtaining traffic-text joint features according to the training data set, the traffic text description, the feature extraction module and the text embedding module, training the transformation matrix according to the traffic-text joint features, obtaining a trained transformation matrix, and building the feature reconstruction module according to the trained transformation matrix and a corresponding inverse transformation matrix.

2. The large model CLIP-guided abnormal traffic detection method according to claim 1, characterized in that, Preprocessing network data packets to obtain traffic data of a preset length comprises: Extracting a payload field in the network data packet, filling or truncating the payload field, and obtaining traffic data of a preset length.

3. The large model CLIP-guided abnormal traffic detection method according to claim 1, characterized in that, Before preprocessing network data packets to obtain traffic data of a preset length, the method further comprises parsing a Pcap file to extract the network data packet.

4. The large model CLIP-guided abnormal traffic detection method according to claim 1, characterized in that, The feature extractor comprises an autoencoder, an encoder and a discriminator, wherein the autoencoder comprises a cascaded first encoder and a decoder; The first encoder generates an original feature latent vector according to input traffic data, and the decoder generates reconstructed data according to the original feature latent vector; The encoder is used to generate a reconstructed feature latent vector according to the reconstructed data; According to input traffic data and corresponding reconstructed data, the discriminator is used to realize adversarial training of the autoencoder.

5. The large model CLIP-guided abnormal traffic detection method according to claim 4, characterized in that, The overall training loss function of the feature extractor training is defined as follows: ； wherein, is the adversarial loss, defined as follows: is the contextual loss, defined as follows: is the encoder loss, defined as follows: wherein, is a weight parameter for the adversarial loss, is a weight parameter for the contextual loss, is a weight parameter for the encoder loss, is input data, is an encoder, is a discriminator, is an autoencoder, is a first encoder, denotes the average loss over one batch of training.

6. The large model CLIP-guided abnormal traffic detection method according to claim 4, characterized in that, The traffic text description includes a normal traffic class text description and a malicious traffic class text description.

7. The large model CLIP-guided abnormal traffic detection method according to claim 6, characterized in that, According to the traffic text description, the training data set, and the feature extraction module, the parameters of the text encoder in the CLIP model are optimized, including: The training data set is input into the feature extraction module to obtain corresponding traffic features, wherein the traffic features are formed by connecting the original feature latent vector and the reconstructed feature latent vector corresponding to the traffic data according to the channel; The traffic text description is input into the text encoder in the CLIP model to generate a first text embedding corresponding to the normal traffic class text description and a second text embedding corresponding to the malicious traffic class text description; The similarity values between the traffic features and the first text embedding and the second text embedding are calculated respectively, the value of the cross-entropy loss function is calculated according to the similarity values, and the parameters of the text encoder in the CLIP model are optimized according to the value of the cross-entropy loss function.

8. The large model CLIP-guided abnormal traffic detection method of claim 7, wherein, According to the training data set, the traffic text description, the feature extraction module, and the text embedding module, a traffic text joint feature is obtained, and the transformation matrix is trained according to the traffic text joint feature, including: The training data set is input into the feature extraction module to obtain corresponding traffic features; The normal traffic class text description is input into the text embedding module to generate a corresponding text embedding; The traffic features and the text embedding are connected according to the channel dimension and then vectorized to obtain the traffic text joint feature; The transformation matrix and the corresponding inverse transformation matrix are used to obtain the reconstructed joint feature corresponding to the traffic text joint feature, and the transformation matrix is optimized according to the error between the traffic text joint feature and the reconstructed joint feature, so that the transformation matrix learns the relationship between the normal traffic data and the text embedding of the normal traffic class text description.

Images