A lightweight traffic detection method based on transfer active learning

Abstract

The present application relates to the technical field of malicious traffic detection, and provides a lightweight traffic detection method based on transfer active learning. In this method, a selection sample set and a test sample set are constructed based on the target domain traffic packet, and samples are randomly selected from the selection sample set to construct a first labeled sample set, and the remaining samples are used to construct an unlabeled sample set; in the first training cycle, a malicious traffic detection model #imgabs0# generated by pre-training based on the source domain traffic packet and migrated to the target domain is cyclically trained until the model index of the malicious traffic detection model #imgabs1# on the test sample set meets the first condition, and the training samples in the first labeled sample set are migrated to the second labeled sample set; in the second training cycle, the model parameters of the malicious traffic detection model #imgabs2# trained in the first training cycle are cyclically updated until the model index of the malicious traffic detection model #imgabs3# on the test sample set meets the second condition, and malicious traffic detection is performed using the trained malicious traffic detection model #imgabs4#.

Description

Technical Field

[0001] The present application relates to the technical field of malicious traffic detection, and in particular to a lightweight traffic detection method based on transfer active learning. Background Art

[0002] With the rapid development of technologies such as wireless communications, edge computing, and intelligent sensing, the Internet of Things (IoT) and its various devices have gained widespread application, enabling efficient communication and data exchange. Interaction between mobile devices and the IoT has brought convenience to various fields, including healthcare, transportation, and smart homes. However, with the rapid development and popularization of the IoT, IoT security issues have become increasingly prominent, particularly the spread of malicious programs, vulnerability risks, and malicious attacks.

[0003] As port-based techniques and other approaches begin to fail in detecting malicious traffic in the IoT, machine learning and deep learning methods have become the mainstream. However, the performance of machine learning-based methods relies on the effectiveness of feature selection, which in turn relies on expert experience and is time-consuming. While deep learning-based methods can automatically extract features from raw data without relying on manual feature selection, deep learning model training relies on a large number of labeled samples. Training high-performance models with a small number of labeled samples is extremely difficult. In real-world IoT environments, sample labeling is extremely expensive. Furthermore, deep learning models with a large number of model parameters tend to overfit quickly when trained on small sample datasets, but perform poorly in prediction sets. Summary of the Invention

[0004] The purpose of this application is to provide a lightweight traffic detection method based on transfer active learning to solve or alleviate the problems existing in the above-mentioned prior art.

[0005] In order to achieve the above objectives, this application provides the following technical solutions:

[0006] This application provides a lightweight traffic detection method based on transfer active learning, including:

[0007] A selection sample set and a test sample set are constructed based on the target domain Pcap traffic package, and multiple training samples are randomly selected from the selection sample set to construct the first labeled sample set. , the remaining samples form an unlabeled sample set ;

[0008] In the first training cycle, the malicious traffic detection model generated by pre-training the source domain Pcap traffic packet and migrated to the target domain is trained cyclically. , until the malicious traffic detection model The model index on the test sample set meets the first condition, and the first labeled sample set The training samples in are transferred to the second labeled sample set ;

[0009] In a single cycle of the first training cycle: based on the first labeled sample set Malicious traffic detection model after training From unlabeled sample set Obtain a batch of unlabeled samples for the first labeled sample set by entropy sampling and unlabeled sample sets Update them separately and use the updated first labeled sample set Training a malicious traffic detection model ; Among them, the malicious traffic detection model It is a malicious traffic detection model Lightweight model;

[0010] In the second training cycle, the malicious traffic detection model trained in the first training cycle is trained. The model parameters are updated cyclically until the malicious traffic detection model The model indicators on the test sample set meet the second condition, and the malicious traffic detection model is trained. Conduct malicious traffic detection;

[0011] In a single cycle of the second training cycle: Based on the malicious traffic detection model From the updated unlabeled sample set Obtain a batch of unlabeled samples for the second labeled sample set by confidence sampling Update and use the updated second labeled sample set Training a malicious traffic detection model .

[0012] Preferably, the malicious traffic and benign traffic contained in the pre-processed target domain Pcap traffic package are converted into grayscale images, and divided into a selection sample set and a test sample set, and a plurality of grayscale images are randomly selected from the selection sample set to construct a first labeled sample set. , select the remaining grayscale images in the sample set to construct the unlabeled sample set .

[0013] Preferably, the malicious traffic and benign traffic contained in the pre-processed source domain Pcap traffic packet are converted into grayscale images to construct a source domain training set;

[0014] In the source domain, the malicious traffic detection model is trained using the source domain training set. Perform pre-training and obtain a malicious traffic detection model with pre-trained weight parameters Migrate to the target domain.

[0015] Preferably, in a single cycle of the first training cycle, in the target domain,

[0016] Based on the first labeled sample set Malicious traffic detection model after training Calculate the unlabeled sample set The entropy value of each sample prediction result in , and select the one with entropy value greater than the first threshold Label the samples and add them to the first labeled sample set , to the first labeled sample set Make updates;

[0017] Use the updated first labeled sample set Malicious traffic detection model with pre-trained weight parameters Perform training and calculate the model indicators on the test sample set.

[0018] Preferably, in a single cycle of the first training cycle:

[0019] For the first labeled sample set Synchronize untagged sample sets when updating Subtract the corresponding samples to identify unlabeled samples Make updates;

[0020] Responding to a malicious traffic detection model with pre-trained weight parameters The model index on the test sample set does not meet the first condition, and the updated first labeled sample set Malicious traffic detection model Update the model parameters;

[0021] Malicious traffic detection model based on updated model parameters From the updated unlabeled sample set In the process, we obtain a batch of unlabeled samples again through entropy sampling to update the first labeled sample set Update again and pass the first labeled sample set after the update Malicious traffic detection model with pre-trained weight parameters Retrain and calculate the model metrics on the test sample set.

[0022] Preferably, in a single cycle of the second training cycle:

[0023] Through the second labeled sample set Malicious traffic detection model Train and detect malicious traffic based on the obtained model Calculate the updated unlabeled sample set The confidence of each sample prediction result in , and select the one with confidence less than the second threshold Label the samples and add them to the second labeled sample set , to the second labeled sample set Make updates;

[0024] Use the updated second labeled sample set Malicious traffic detection model Retrain and calculate the model metrics on the test sample set.

[0025] Preferably, in a single cycle of the second training cycle:

[0026] For the second labeled sample set When updating, synchronize the updated unlabeled sample set Subtract the corresponding samples to update the unlabeled sample set to update again;

[0027] Responding to Malicious Traffic Detection Model The model index on the test sample set does not meet the second condition, and the updated second labeled sample set Malicious traffic detection model Update the model parameters;

[0028] Malicious traffic detection model based on updated model parameters From the updated unlabeled sample set In the process, a batch of unlabeled samples is obtained again through confidence sampling to update the second labeled sample set Update again and pass the updated second labeled sample set Malicious traffic detection model Retrain and calculate the model metrics on the test sample set.

[0029] Optimized, malicious traffic detection model , Malicious Traffic Detection Model They are built based on the same network architecture and include: convolution layer, batch normalization layer (BN), rectified linear unit layer (Relu), attention mechanism module (CA), deep convolution layer DWConv (DepthwiseConvolution), maximum pooling layer, global average pooling layer, fully connected layer and softmax activation function.

[0030] Optimized, malicious traffic detection model In the input feature The output features are obtained by sequentially passing through a convolution layer with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 16, a BN layer, and a Relu layer. ; Output features Then pass through a CA attention module to obtain the output features ; Output features Then, it passes through a deep convolution layer DWConv with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 16, a BN layer, and a Relu layer to obtain the output features. ; Output features Then, it passes through a convolution layer with a convolution kernel size of 1, a step size of 1, no padding, and a channel number of 32, a BN layer, and a Relu layer to obtain the output features. ; Output features Then pass through a CA attention module to obtain the output features ; Output features Then, it passes through a deep convolution layer DWConv with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 32, a BN layer, and a Relu layer to obtain the output features. ; Output features Then, it passes through a convolution layer with a convolution kernel size of 1, a step size of 1, no padding, and a channel number of 64, a BN layer, and a Relu layer to obtain the output features. ; Output features Then pass through a maximum pooling layer with a pooling window of 2 to obtain the output features ; Output features Then it goes through a global average pooling layer, a fully connected layer, and a Softmax activation function layer in sequence to obtain the output result of whether it is benign traffic or malicious traffic.

[0031] Optimized, malicious traffic detection model In the input feature The input features are obtained by sequentially passing through a convolution layer with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 16, a BN layer, and a Relu layer. ; Input features Then pass through a CA attention module to obtain input features ; Input features Then, the input features are obtained by passing through a deep convolution layer DWConv with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 16, a BN layer, and a Relu layer. ; Input features Then, the input features are obtained by passing through a convolution layer with a convolution kernel size of 1, a step size of 1, no padding, and a channel number of 32, a BN layer, and a ReLU layer. ; Input features Then pass through a CA attention module to obtain input features ; Input features Then, the input features are obtained by passing through a deep convolution layer DWConv with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 32, a BN layer, and a Relu layer. ; Input features Then, the input features are obtained by passing through a convolution layer with a convolution kernel size of 1, a step size of 1, no padding, and a channel number of 64, a BN layer, and a Relu layer. ; Input features Then pass through a maximum pooling layer with a pooling window of 2 to obtain the input features ; Input features Then pass through a CA attention module to obtain input features ; Input features Then, the input features are obtained by passing through a deep convolution layer DWConv with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 64, a BN layer, and a Relu layer. ; Input features Then, the input features are obtained by passing through a convolution layer with a convolution kernel size of 1, a step size of 1, no padding, and a channel number of 128, a BN layer, and a ReLU layer. ; Input features Then pass through a maximum pooling layer with a pooling window of 2 to obtain the input features ; Input features Then pass through a CA attention module to obtain input features ; Input features Then, the input features are obtained by passing through a deep convolution layer DWConv with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 128, a BN layer, and a Relu layer. ; Input features Then pass through a convolution layer with a convolution kernel size of 1, a step size of 1, no padding, and a channel number of 256, a BN layer, and a Relu layer to obtain the input features ; Input features Then it goes through a global average pooling layer, a fully connected layer, and a Softmax activation function layer in sequence to obtain the output result of whether it is benign traffic or malicious traffic.

[0032] Beneficial effects:

[0033] In the lightweight traffic detection method based on transfer active learning provided by the embodiment of the present application, a selection sample set and a test sample set are constructed based on the target domain Pcap traffic packet, and a plurality of training samples are randomly selected from the selection sample set to construct a first labeled sample set. , the remaining samples form an unlabeled sample set In the first training cycle, the malicious traffic detection model generated by pre-training the source domain Pcap traffic packet and migrated to the target domain is trained cyclically. , until the malicious traffic detection model The model index on the test sample set meets the first condition, and the first labeled sample set The training samples in are transferred to the second labeled sample set ; In a single cycle of the first training cycle: based on the first labeled sample set Malicious traffic detection model after training (Malicious traffic detection model Lightweight model) from unlabeled sample set Obtain a batch of unlabeled samples for the first labeled sample set by entropy sampling and unlabeled sample sets Update them separately and use the updated first labeled sample set Training a malicious durian detection model In the second training cycle, the malicious traffic detection model trained in the first training cycle is trained. The model parameters are updated cyclically until the malicious traffic detection model The model indicators on the test sample set meet the second condition, and the malicious traffic detection model is trained. Perform malicious traffic detection; in a single cycle of the second training cycle: based on the malicious traffic detection model From the updated unlabeled sample set Obtain a batch of unlabeled samples for the second labeled sample set by confidence sampling Update and use the updated second labeled sample set Training a malicious traffic detection model .

[0034] Therefore, by pre-training the malicious traffic detection model B outside the target domain and learning the universal feature representation of traffic, the learning process of the malicious traffic detection model B generated by pre-training in the target domain is made more efficient, effectively reducing the dependence on large-scale labeled data during the training process; after selecting some samples for labeling based on the active learning strategy of the lightweight model of the malicious traffic detection model B (malicious traffic detection model A), these samples are used to label the malicious traffic detection model generated by pre-training and migrated to the target domain. Adjust the pre-training parameters to effectively avoid malicious traffic detection models Overfitting problem during training.

[0035] Active learning of the lightweight model of malicious traffic detection model B (malicious traffic detection model A) is used to select high-information samples, and the model parameters of the pre-trained malicious traffic detection model B that is migrated to the target domain are cyclically updated, so that the malicious traffic detection model B can quickly adapt to the detection tasks in the target domain.

[0036] Furthermore, by training the malicious traffic detection model outside the target domain And migrated to the target domain, the samples selected by active learning of the lightweight model of malicious traffic detection model B (malicious traffic detection model A) are used to cyclically update the model parameters of the malicious traffic detection model B migrated to the target domain. A small number of samples are selected for labeling by combining transfer learning, deep learning, and active learning. This effectively solves the problems of difficult sample labeling during the training process of malicious traffic detection model B and easy and fast fitting during training on small sample data sets, effectively improving the detection accuracy of malicious traffic detection model B for malicious traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The drawings and descriptions that constitute part of this application are intended to provide a further understanding of this application. The exemplary embodiments and descriptions of this application are intended to explain this application and do not constitute an improper limitation on this application. Among them:

[0038] Figure 1 A schematic flow chart of a lightweight traffic detection method based on transfer active learning according to some embodiments of the present application;

[0039] Figure 2 A schematic diagram of sample selection for a malicious traffic detection model provided according to some embodiments of the present application;

[0040] Figure 3 A schematic diagram of the network structure of a malicious traffic detection model A provided according to some embodiments of the present application;

[0041] Figure 4 A schematic diagram of the network structure of a malicious traffic detection model B provided according to some embodiments of the present application;

[0042] Figure 5 The prediction accuracy of the malicious traffic detection model B provided according to an embodiment of the present application is Schematic diagram of;

[0043] Figure 6 The F1 score of the malicious traffic detection model B provided according to an embodiment of the present application is Schematic diagram of . DETAILED DESCRIPTION

[0044] The present application will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments. Each example is provided by way of explanation of the present application and does not limit the present application. In fact, it will be clear to those skilled in the art that modifications and variations can be made in the present application without departing from the scope or spirit of the present application. For example, a feature shown or described as part of one embodiment can be used in another embodiment to produce yet another embodiment. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present invention should fall within the scope of protection of the embodiments of the present invention.

[0045] In the existing IoT malicious traffic detection process, the cost of sample labeling in a real IoT environment is extremely high, and deep learning model training requires a large number of labeled samples. It is very difficult to train a high-performance detection model with a small number of labeled samples. In addition, deep learning models with a large number of model parameters are prone to rapid overfitting when trained on a dataset with a small number of labeled samples, resulting in poor detection results.

[0046] Based on this, the embodiment of the present application provides a lightweight traffic detection method based on transfer active learning, such as Figures 1 to 6 As shown, the method includes:

[0047] Step S101: construct a selection sample set and a test sample set based on the target domain Pcap traffic package, and randomly select multiple training samples from the selection sample set to construct a first labeled sample set. , the remaining samples form an unlabeled sample set .

[0048] The target domain Pcap traffic packets contain malicious traffic packets and benign traffic packets. The pre-processed target domain Pcap traffic packets are converted into grayscale images, and the grayscale images are divided into a selection sample set and a test sample set at a ratio of 9:1. In the selection sample set, multiple grayscale images of each malicious traffic type and benign traffic type are randomly selected and labeled to construct the first labeled sample set. ; In the selected sample set, the grayscale images of the remaining malicious traffic types and benign traffic types are used to construct an unlabeled sample set .

[0049] Specifically, when preprocessing the target domain Pcap traffic packet, the target domain Pcap traffic packet is divided into multiple session data according to IP, source port, destination IP, destination port and transport layer protocol, duplicate data and blank data in the session data are deleted, and information that affects the traffic classification results (such as mac address) is deleted, thereby obtaining the preprocessed traffic data.

[0050] After the preprocessing of the Pacp traffic packet, the traffic data is obtained. The traffic data is intercepted according to a fixed length of 784 bytes, and each byte of the intercepted traffic data is converted into a decimal number; then, the converted 784 decimal numbers are converted into a two-dimensional array; then, the two-dimensional array is converted into a size of grayscale image; finally, the grayscale image is divided into a selection sample set and a test sample set in a ratio of 9:1.

[0051] Step S102: In the first training cycle, the malicious traffic detection model generated by pre-training the source domain Pcap traffic packet and migrated to the target domain is cyclically trained. , until the malicious traffic detection model The model index on the test sample set meets the first condition, and the first labeled sample set The training samples in are transferred to the second labeled sample set .

[0052] In this application, malicious traffic detection model A and malicious traffic detection model B are built based on the same network architecture, and the malicious traffic detection model Malicious traffic detection model The lightweight model of malicious traffic detection model A and malicious traffic detection model B can both detect malicious traffic. They both include convolution layer, batch normalization layer (BatchNormalization, referred to as BN), rectified linear unit layer (Rectified Linear Unit, referred to as Relu), attention mechanism module (CA), deep convolution layer DWConv (Depthwise Convolution), maximum pooling layer, global average pooling layer, fully connected layer and softmax activation function.

[0053] For malicious traffic detection models , input features (Traffic to be detected) passes through a convolution layer with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 16, a BN layer, and a ReLU layer to obtain the output features ; Output features Then pass through a CA attention module to obtain the output features ; Output features Then, it passes through a deep convolution layer DWConv with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 16, a BN layer, and a Relu layer to obtain the output features. ; Output features Then, it passes through a convolution layer with a convolution kernel size of 1, a step size of 1, no padding, and a channel number of 32, a BN layer, and a Relu layer to obtain the output features. ; Output features Then pass through a CA attention module to obtain the output features ; Output features Then, it passes through a deep convolution layer DWConv with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 32, a BN layer, and a Relu layer to obtain the output features. ; Output features Then, it passes through a convolution layer with a convolution kernel size of 1, a step size of 1, no padding, and a channel number of 64, a BN layer, and a Relu layer to obtain the output features. ; Output features Then pass through a maximum pooling layer with a pooling window of 2 to obtain the output features ; Output features Then it goes through a global average pooling layer, a fully connected layer, and a Softmax activation function layer in sequence to obtain the output result of whether it is benign traffic or malicious traffic.

[0054] For malicious traffic detection models , input features (Traffic to be detected) passes through a convolution layer with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 16, a BN layer, and a ReLU layer to obtain the input features. ; Input features Then pass through a CA attention module to obtain input features ; Input features Then, the input features are obtained by passing through a deep convolution layer DWConv with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 16, a BN layer, and a Relu layer. ; Input features Then, the input features are obtained by passing through a convolution layer with a convolution kernel size of 1, a step size of 1, no padding, and a channel number of 32, a BN layer, and a ReLU layer. ; Input features Then pass through a CA attention module to obtain input features ; Input features Then, the input features are obtained by passing through a deep convolution layer DWConv with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 32, a BN layer, and a Relu layer. ; Input features Then, the input features are obtained by passing through a convolution layer with a convolution kernel size of 1, a step size of 1, no padding, and a channel number of 64, a BN layer, and a Relu layer. ; Input features Then pass through a maximum pooling layer with a pooling window of 2 to obtain the input features ; Input features Then pass through a CA attention module to obtain input features ; Input features Then, the input features are obtained by passing through a deep convolution layer DWConv with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 64, a BN layer, and a Relu layer. ; Input features Then, the input features are obtained by passing through a convolution layer with a convolution kernel size of 1, a step size of 1, no padding, and a channel number of 128, a BN layer, and a ReLU layer. ; Input features Then pass through a maximum pooling layer with a pooling window of 2 to obtain the input features ; Input features Then pass through a CA attention module to obtain input features ; Input features Then, the input features are obtained by passing through a deep convolution layer DWConv with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 128, a BN layer, and a Relu layer. ; Input features Then pass through a convolution layer with a convolution kernel size of 1, a step size of 1, no padding, and a channel number of 256, a BN layer, and a Relu layer to obtain the input features ; Input features Then it goes through a global average pooling layer, a fully connected layer, and a Softmax activation function layer in sequence to obtain the output result of whether it is benign traffic or malicious traffic.

[0055] In this application, the malicious traffic and benign traffic contained in the pre-processed source domain Pcap traffic packets are converted into grayscale images to construct a source domain training set. Among them, according to the same method as the target domain Pcap traffic packets, the pre-processed source domain Pcap traffic packets are converted into grayscale images to construct a source domain training set. Then, in the source domain, the constructed malicious traffic detection model is tested by the source domain training set. Perform pre-training to obtain a malicious traffic detection model with pre-trained weight parameters By pre-training the malicious traffic detection model B outside the target domain and learning the universal feature representation of traffic, the learning process of the pre-trained malicious traffic detection model B in the target domain is made more efficient, effectively reducing the reliance on large-scale labeled data during the training process.

[0056] Malicious traffic detection model with pre-trained weight parameters After being transferred to the target domain, the lightweight model of malicious traffic detection model B (malicious traffic detection model A) selects some samples for annotation based on the active learning strategy, and uses the annotated samples to identify the malicious traffic detection model with pre-trained weight parameters. Perform initial model parameter adjustments to effectively prevent malicious traffic detection models Overfitting during training. In a single cycle of the first training cycle: based on the first labeled sample set Malicious traffic detection model after training From unlabeled sample set Obtain a batch of unlabeled samples for the first labeled sample set by entropy sampling and unlabeled sample sets Update them separately and use the updated first labeled sample set Training a malicious traffic detection model .

[0057] Specifically, first, in the target domain, the first labeled sample set is trained through active learning of the malicious traffic detection model A. Update. Based on the first labeled sample set Malicious traffic detection model Training; based on the first labeled sample set Malicious traffic detection model after training Calculate the unlabeled sample set The entropy value of each sample prediction result in the , and the entropy value of each sample prediction result is sorted in descending order, and the entropy value of the sample prediction result is greater than the preset entropy value (i.e., the first threshold) Label the samples and add them to the first labeled sample set , to the first labeled sample set Here, it should be noted that, when updating the first labeled sample set Synchronize untagged sample sets when updating Subtract the corresponding samples to identify unlabeled samples to update.

[0058] Then, use the updated first labeled sample set Malicious traffic detection model with pre-trained weight parameters Train and calculate the model index on the test sample set. That is, use the updated first labeled sample set Malicious traffic detection model with pre-trained weight parameters The model parameters are adjusted for the first time, and the malicious traffic detection model after the initial adjustment of the model parameters is tested through the test sample set. , that is, the malicious traffic detection model after the initial adjustment of the calculation model parameters Model metrics on the test sample set.

[0059] In a specific example, the unlabeled sample set Unlabeled samples in Input malicious traffic detection model A, and use malicious traffic detection model A to predict unlabeled samples For category The probability of ; According to the formula:

[0060]

[0061] Calculate unlabeled samples Entropy of the prediction results .in, A sequence number indicating the traffic type. is a positive integer, Indicates that unlabeled samples are predicted by malicious traffic detection model A For the traffic types. For example, Indicates that unlabeled samples are predicted by malicious traffic detection model A For the traffic types (benign), Indicates that unlabeled samples are predicted by malicious traffic detection model A For the It should be noted that in this application, malicious traffic can be divided into multiple different types, that is, there can be multiple malicious traffic types, but only one benign traffic type.

[0062] In another specific example, the malicious traffic detection model after the initial adjustment of the model parameters is tested using the test sample set. , calculate its prediction accuracy and F1 score , when the prediction accuracy and F1 score At least one of them is less than or equal to 50%, then the updated first labeled sample set is passed Update the model parameters of the malicious traffic detection model A. That is, when the malicious traffic detection model with pre-trained weight parameters When the model index on the test sample set does not meet the first condition, the updated first labeled sample set is used Malicious traffic detection model The model parameters are updated.

[0063] Then, the malicious traffic detection model based on the updated model parameters From the updated unlabeled sample set In the process, we obtain a batch of unlabeled samples again through entropy sampling to update the first labeled sample set Update again and pass the first labeled sample set after the update Malicious traffic detection model with pre-trained weight parameters Retrain and calculate the model index on the test sample set. That is, the first labeled sample set after updating again Malicious traffic detection model with pre-trained weight parameters The model parameters are adjusted again for the first time, and the malicious traffic detection model after the initial adjustment is calculated Prediction accuracy on the test sample set and F1 score , and repeat this cycle until the prediction accuracy reaches and F1 score Both are greater than 50%, for the malicious traffic detection model with pre-trained weight parameters migrated to the target domain The initial adjustment of the model parameters is completed.

[0064] Here, it should be noted that in the first training cycle, each time the updated first labeled sample set Malicious traffic detection model The adjustment of model parameters is based on the malicious traffic detection model with pre-trained weight parameters migrated to the target domain. That is, the first labeled sample set of the previous time is not retained. Malicious traffic detection model Instead of adjusting the model parameters, the malicious traffic detection model with pre-trained weight parameters is migrated to the target domain. The pre-training parameters of are used for initial adjustment.

[0065] Therefore, the lightweight model of malicious traffic detection model B (malicious traffic detection model A) selects some samples for annotation based on the active learning strategy, and uses these samples to analyze the malicious traffic detection model generated by pre-training and migrated to the target domain. The pre-training parameters are adjusted for the first time to effectively avoid malicious traffic detection models Overfitting problem during training.

[0066] Step S103: In the second training cycle, the malicious traffic detection model trained in the first training cycle is trained. The model parameters are updated cyclically until the model indicators of the malicious traffic detection model B on the test sample set meet the second condition, and malicious traffic detection is performed using the trained malicious traffic detection model B.

[0067] In the first training cycle, by actively learning the lightweight model of malicious traffic detection model B (malicious traffic detection model A) to select high-information samples, the model parameters of the pre-trained malicious traffic detection model B that is migrated to the target domain are initially updated (i.e., initially adjusted), so that the malicious traffic detection model B can quickly adapt to the detection tasks of the target domain.

[0068] Then, the first labeled sample set The training samples in are transferred to the constructed empty sample set to generate the second labeled sample set , through the second labeled sample set The cyclic update realizes the malicious traffic detection model trained in the first training cycle The model parameters are cyclically adjusted (i.e., cyclically updated). In the second training cycle, the malicious traffic detection model B is trained on the updated unlabeled sample set. Obtain a batch of unlabeled samples for the second labeled sample set by confidence sampling Update and use the updated second labeled sample set Training a malicious traffic detection model .

[0069] Specifically, in a single cycle of the second training cycle, the second labeled sample set Malicious traffic detection model obtained from the first training cycle Train and detect malicious traffic based on the obtained model Calculate the unlabeled sample set The confidence of each sample prediction result in , and select the one with confidence less than the second threshold Label the samples and add them to the second labeled sample set , to the second labeled sample set Then, use the updated second labeled sample set Malicious traffic detection model Retrain and calculate the model index on the test sample set. When updating, synchronize the updated unlabeled sample set Subtract the corresponding samples to update the unlabeled sample set Update again.

[0070] That is, use the updated second labeled sample set For the second labeled sample set before updating Trained malicious traffic detection model The model parameters are adjusted twice, and the malicious traffic detection model after the model parameters are adjusted twice is tested through the test sample set. , that is, the malicious traffic detection model after the calculation model parameters are adjusted twice Model metrics on the test sample set.

[0071] In a specific example, the unlabeled sample set Unlabeled samples in Input the malicious traffic detection model B and use the malicious traffic detection model B to predict the unlabeled samples For the Traffic categories The probability of According to the formula:

[0072]

[0073] Calculate unlabeled samples The traffic category predicted to have the highest probability by malicious traffic detection model B Probability .in, Indicates that unlabeled samples are predicted by malicious traffic detection model B For the For example, there are three types of malicious traffic, so there are three types of malicious traffic. hour, , represents the sample The probability of being classified as the first type of malicious traffic is 0.1; when hour, , represents the sample The probability of being classified as the second type of malicious traffic is 0.7; when hour, , represents the sample The probability of being classified as the third type of malicious traffic is 0.2. Therefore, the probability of sample x being predicted as the second type of malicious traffic is the largest. For the second type of malicious traffic,

[0074]

[0075] In another specific example, the malicious traffic detection model after the model parameters are adjusted is tested using a test sample set. , calculate its prediction accuracy and F1 score , when the prediction accuracy and F1 score At least one of them is less than or equal to 99%, then the updated second labeled sample set is passed For the second labeled sample set before updating Trained malicious traffic detection model That is, when the malicious traffic detection model The model index on the test sample set does not meet the second condition, and the updated second labeled sample set Malicious traffic detection model The model parameters are updated.

[0076] Then, the malicious traffic detection model based on the updated model parameters From the updated unlabeled sample set In the process, a batch of unlabeled samples is obtained again through confidence sampling to update the second labeled sample set Update again and pass the updated second labeled sample set Malicious traffic detection model Retrain and calculate the model metrics on the test sample set.

[0077] That is, the second labeled sample set after updating again Malicious traffic detection model with updated model parameters The model parameters are adjusted again, and the malicious traffic detection model after the model parameters are adjusted again is calculated Prediction accuracy on the test sample set and F1 score , and repeat this cycle until the prediction accuracy reaches and F1 score Are greater than 99% or unlabeled sample set All samples in are labeled, and the final malicious traffic detection model is output Used for malicious traffic detection in IoT.

[0078] Therefore, by training the malicious traffic detection model outside the target domain And migrated to the target domain, the samples selected by active learning of the lightweight model of malicious traffic detection model B (malicious traffic detection model A) are used to cyclically update the model parameters of the malicious traffic detection model B migrated to the target domain. A small number of samples are selected for labeling by combining transfer learning, deep learning, and active learning. This effectively solves the problems of difficult sample labeling during the training process of malicious traffic detection model B and easy and fast fitting during training on small sample data sets, effectively improving the detection accuracy of malicious traffic detection model B for malicious traffic.

[0079] In the description of the present invention, the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of the technical features indicated. Therefore, a feature specified as "first" or "second" may explicitly or implicitly include at least one of such features. In the description of the present invention, "plurality" means at least two, for example, two, three, etc., unless otherwise specifically defined.

[0080] In the present invention, the terms "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" mean that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0081] The foregoing description is merely a preferred embodiment of the present application and is not intended to limit the present application. Various modifications and variations are readily apparent to those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present application shall be included within the scope of protection of the present application.

Claims

1. A lightweight traffic detection method based on transfer active learning, characterized in that: include: A selection sample set and a test sample set are constructed based on the target domain Pcap traffic package, and multiple training samples are randomly selected from the selection sample set to construct the first labeled sample set. , the remaining samples form an unlabeled sample set ; In the first training cycle, the malicious traffic detection model generated by pre-training the source domain Pcap traffic packet and migrated to the target domain is trained cyclically. , until the malicious traffic detection model The model index on the test sample set meets the first condition, and the first labeled sample set The training samples in are transferred to the second labeled sample set ; In a single cycle of the first training cycle: based on the first labeled sample set Malicious traffic detection model after training From unlabeled sample set Obtain a batch of unlabeled samples for the first labeled sample set by entropy sampling and unlabeled sample sets Update them separately and use the updated first labeled sample set Training a malicious traffic detection model ; Among them, the malicious traffic detection model It is a malicious traffic detection model Lightweight model; In the second training cycle, the malicious traffic detection model trained in the first training cycle is trained. The model parameters are updated cyclically until the malicious traffic detection model The model indicators on the test sample set meet the second condition, and the malicious traffic detection model is trained. Conduct malicious traffic detection; In a single cycle of the second training cycle: Based on the malicious traffic detection model From the updated unlabeled sample set Obtain a batch of unlabeled samples for the second labeled sample set by confidence sampling Update and use the updated second labeled sample set Training a malicious traffic detection model .

2. The lightweight traffic detection method based on transfer active learning according to claim 1 is characterized in that: The malicious traffic and benign traffic contained in the preprocessed target domain Pcap traffic package are converted into grayscale images and divided into a selection sample set and a test sample set. Multiple grayscale images are randomly selected from the selection sample set to construct the first labeled sample set. , select the remaining grayscale images in the sample set to construct the unlabeled sample set .

3. The lightweight traffic detection method based on transfer active learning according to claim 1 is characterized in that: The malicious and benign traffic contained in the pre-processed source domain Pcap traffic packets are converted into grayscale images to construct the source domain training set; In the source domain, the malicious traffic detection model is trained using the source domain training set. Perform pre-training and obtain a malicious traffic detection model with pre-trained weight parameters Migrate to the target domain.

4. The lightweight traffic detection method based on transfer active learning according to claim 1 is characterized in that: In a single cycle of the first training epoch, in the target domain, Based on the first labeled sample set Malicious traffic detection model after training Calculate the unlabeled sample set The entropy value of each sample prediction result in , and select the one with entropy value greater than the first threshold Label the samples and add them to the first labeled sample set , to the first labeled sample set Make updates; Use the updated first labeled sample set Malicious traffic detection model with pre-trained weight parameters Perform training and calculate the model indicators on the test sample set.

5. The lightweight traffic detection method based on transfer active learning according to claim 4 is characterized in that: During a single cycle of the first training cycle: For the first labeled sample set Synchronize untagged sample sets when updating Subtract the corresponding samples to identify unlabeled samples Make updates; Responding to a malicious traffic detection model with pre-trained weight parameters The model index on the test sample set does not meet the first condition, and the updated first labeled sample set Malicious traffic detection model Update the model parameters; Malicious traffic detection model based on updated model parameters From the updated unlabeled sample set In the process, we obtain a batch of unlabeled samples again through entropy sampling to update the first labeled sample set Update again and pass the first labeled sample set after the update Malicious traffic detection model with pre-trained weight parameters Retrain and calculate the model metrics on the test sample set.

6. The lightweight traffic detection method based on transfer active learning according to claim 1 is characterized in that: During a single cycle of the second training cycle: Through the second labeled sample set Malicious traffic detection model Train and detect malicious traffic based on the obtained model Calculate the updated unlabeled sample set The confidence of each sample prediction result in , and select the one with confidence less than the second threshold Label the samples and add them to the second labeled sample set , to the second labeled sample set Make updates; Use the updated second labeled sample set Malicious traffic detection model Retrain and calculate the model metrics on the test sample set.

7. The lightweight traffic detection method based on transfer active learning according to claim 6 is characterized in that: During a single cycle of the second training cycle: For the second labeled sample set When updating, synchronize the updated unlabeled sample set Subtract the corresponding samples to update the unlabeled sample set to update again; Responding to Malicious Traffic Detection Model The model index on the test sample set does not meet the second condition, and the updated second labeled sample set Malicious traffic detection model Update the model parameters; Malicious traffic detection model based on updated model parameters From the updated unlabeled sample set In the process, a batch of unlabeled samples is obtained again through confidence sampling to update the second labeled sample set Update again and pass the updated second labeled sample set Malicious traffic detection model Retrain and calculate the model metrics on the test sample set.

8. The lightweight traffic detection method based on transfer active learning according to any one of claims 1 to 7, characterized in that: Malicious traffic detection model , Malicious Traffic Detection Model They are built based on the same network architecture and include: convolutional layer, batch normalization layer, rectified linear unit layer, attention mechanism module, deep convolutional layer DWConv, maximum pooling layer, global average pooling layer, fully connected layer and Softmax activation function.

9. The lightweight traffic detection method based on transfer active learning according to claim 8 is characterized in that: Malicious traffic detection model In the input feature The output features are obtained by sequentially passing through a convolution layer with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 16, a BN layer, and a Relu layer. ; Output features Then pass through a CA attention module to obtain the output features ; Output features Then, it passes through a deep convolution layer DWConv with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 16, a BN layer, and a Relu layer to obtain the output features. ; Output features Then, it passes through a convolution layer with a convolution kernel size of 1, a step size of 1, no padding, and a channel number of 32, a BN layer, and a Relu layer to obtain the output features. ; Output features Then pass through a CA attention module to obtain the output features ; Output features Then, it passes through a deep convolution layer DWConv with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 32, a BN layer, and a Relu layer to obtain the output features. ; Output features Then, it passes through a convolution layer with a convolution kernel size of 1, a step size of 1, no padding, and a channel number of 64, a BN layer, and a Relu layer to obtain the output features. ; Output features Then pass through a maximum pooling layer with a pooling window of 2 to obtain the output features ; Output features Then it goes through a global average pooling layer, a fully connected layer, and a Softmax activation function layer in sequence to obtain the output result of whether it is benign traffic or malicious traffic.

10. The lightweight traffic detection method based on transfer active learning according to claim 8, characterized in that: Malicious traffic detection model In the input feature The input features are obtained by sequentially passing through a convolution layer with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 16, a BN layer, and a Relu layer. ; Input features Then pass through a CA attention module to obtain the input features ; Input features Then, the input features are obtained by passing through a deep convolution layer DWConv with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 16, a BN layer, and a Relu layer. ; Input features Then, the input features are obtained by passing through a convolution layer with a convolution kernel size of 1, a step size of 1, no padding, and a channel number of 32, a BN layer, and a ReLU layer. ; Input features Then pass through a CA attention module to obtain input features ; Input features Then, the input features are obtained by passing through a deep convolution layer DWConv with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 32, a BN layer, and a Relu layer. ; Input features Then, the input features are obtained by passing through a convolution layer with a convolution kernel size of 1, a step size of 1, no padding, and a channel number of 64, a BN layer, and a Relu layer. ; Input features Then pass through a maximum pooling layer with a pooling window of 2 to obtain the input features ; Input features Then pass through a CA attention module to obtain input features ; Input features Then, the input features are obtained by passing through a deep convolution layer DWConv with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 64, a BN layer, and a Relu layer. ; Input features Then, the input features are obtained by passing through a convolution layer with a convolution kernel size of 1, a step size of 1, no padding, and a channel number of 128, a BN layer, and a ReLU layer. ; Input features Then pass through a maximum pooling layer with a pooling window of 2 to obtain the input features ; Input features Then pass through a CA attention module to obtain input features ; Input features Then, the input features are obtained by passing through a deep convolution layer DWConv with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 128, a BN layer, and a Relu layer. ; Input features Then pass through a convolution layer with a convolution kernel size of 1, a step size of 1, no padding, and a channel number of 256, a BN layer, and a Relu layer to obtain the input features ; Input features Then it goes through a global average pooling layer, a fully connected layer, and a Softmax activation function layer in sequence to obtain the output result of whether it is benign traffic or malicious traffic.

Images