Traffic Detection Method and System Based on Spiking Neural-Bidirectional LSTM Network

Abstract

This invention relates to a traffic detection method based on a spiking neural network-bidirectional LSTM network. It introduces a temporal modeling module, a spiking neural network module, and a self-attention mechanism module to construct a network to be trained. The network is then trained using various sample traffic data to obtain a traffic anomaly detection model. By combining the dynamic characteristic modeling capability of the spiking neural network with the temporal dependency feature capture capability of the bidirectional long short-term memory network, the temporal features and behavioral patterns of encrypted traffic can be extracted more accurately. Furthermore, by optimizing parameters through global average pooling and fully connected layers, the classification performance and generalization ability are significantly improved, enabling efficient detection of traffic from various encrypted protocols. This invention also designs a corresponding system with a modular design for the network structure, enabling modular application of each stage of the detection method and further improving the efficiency of anomaly traffic detection in practical applications.

Description

Technical Field

[0001] This invention relates to a traffic detection method and system based on a spiking neural-bidirectional LSTM network, belonging to the field of abnormal traffic detection technology. Background Technology

[0002] With users and businesses placing increasing emphasis on internet communication security, protecting the security of communication information has become a core requirement. Therefore, encrypting traffic during communication has become a mainstream security measure. Among these, HTTPS (Hypertext Transfer Protocol Secure) is currently the most widely used encryption protocol. HTTPS builds upon the traditional Hypertext Transfer Protocol (HTTP) by combining SSL (Secure Sockets Layer) and TLS (Transport Layer Security), effectively ensuring the security of data transmission.

[0003] While encryption of ordinary internet traffic can protect the confidentiality and integrity of private information to some extent, it also provides cover for malicious activities on the network, allowing them to carry out destructive acts more covertly. Traditional traffic inspection and analysis techniques mainly rely on examining plaintext data packets, classifying traffic, detecting anomalies, and analyzing threats by parsing transmission content, protocol fields, and behavioral patterns. However, as data traffic becomes increasingly encrypted, traditional methods can no longer directly access the data content, severely impacting the accuracy and efficiency of traffic inspection.

[0004] Malicious traffic detection is an important research area in cybersecurity, aiming to identify and block malicious activities that may threaten users, enterprises, and critical infrastructure. Existing technologies include feature-based matching methods that detect known attack behaviors through rules or feature libraries, but have limited ability to address unknown threats; behavioral analysis methods utilize the dynamic characteristics of traffic for anomaly detection, suitable for analyzing encrypted traffic, but face a high false positive rate.

[0005] With the development of machine learning technology, traffic classification methods based on statistical features have been widely used. Traditional machine learning algorithms such as support vector machines and random forests perform well in capturing complex patterns, while deep learning methods further improve detection accuracy by modeling the multidimensional features of traffic. However, the high computational resource requirements and interpretability issues of deep learning models limit their practical application. Despite the progress made in existing technologies, challenges remain in the accuracy, efficiency, and adaptability of encrypted traffic detection.

[0006] (1) The detection lag of new attacks: traditional methods based on rules and feature matching have limited ability to respond to unknown threats, while machine learning models may require a large amount of new data to be trained to adapt to new attacks.

[0007] (2) The false positive and false negative rates are high. Behavioral analysis and machine learning methods are easily affected by normal behavior when judging traffic anomalies, which may result in a large number of false positives. At the same time, these methods may not be able to effectively identify well-disguised malicious traffic, leading to false negatives. Summary of the Invention

[0008] The technical problem to be solved by this invention is to provide a traffic detection method based on a spiking neural-bidirectional LSTM network, which is designed with a novel model structure to effectively improve the detection efficiency of abnormal traffic.

[0009] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: The present invention designs a traffic detection method based on a spiking neural network-bidirectional LSTM network, performs the following steps A to C to obtain a traffic anomaly detection model, and then applies the traffic anomaly detection model to detect anomalies in the traffic to be detected;

[0010] Step A. Obtain a preset number of sample traffic samples, each with a known corresponding abnormal traffic label or non-abnormal traffic label, and then proceed to Step B;

[0011] Step B. Concatenate the feature input module, temporal modeling module, max pooling layer, spiking neural network module, self-attention mechanism module, global average pooling layer, fully connected layer, and classification output module sequentially from input to output to construct the network to be trained, and then proceed to step C;

[0012] Step C. Based on the traffic flow of each sample, with the sample traffic flow as input and the label corresponding to the sample traffic flow as output, train the network to be trained to obtain the traffic anomaly detection model.

[0013] As a preferred technical solution of the present invention: the feature input module is used to receive traffic. First, for each data packet in the traffic, the feature values ​​corresponding to each preset feature category of the data packet are extracted. Then, the feature values ​​corresponding to each data packet are normalized and updated to form the feature vector corresponding to each data packet, and output.

[0014] As a preferred technical solution of the present invention: the timing modeling module includes a forward LSTM group and a backward LSTM group. Each of the forward LSTM group and the backward LSTM group includes three LSTM modules connected in series from the input end to the output end. The input ends of each sequential LSTM module in the backward LSTM group are respectively connected to the input ends of each reverse LSTM module in the forward LSTM group, forming the three input ends of the timing modeling module. The output ends of each sequential LSTM module in the backward LSTM group are respectively connected to the output ends of each reverse LSTM module in the forward LSTM group, forming the three output ends of the timing modeling module.

[0015] Based on the fact that the first and last data packets in the sequential data packets in the traffic are connected, the three input terminals of the time series modeling module sequentially receive the feature vectors corresponding to each data packet output by the feature input module. For each feature vector under the LSTM module in the forward LSTM group and the LSTM module in the reverse LSTM group, the following steps a1 to a3 are executed respectively to obtain the forward hidden state and reverse hidden state of the data packet. Then, step a4 is executed to obtain the high-dimensional feature vector corresponding to the data packet, that is, to obtain the high-dimensional feature vector corresponding to each data packet and output it.

[0016] Step a1. For the first Feature vectors corresponding to each data packet According to the following formula:

[0017] ;

[0018] ;

[0019] ;

[0020] ;

[0021] Obtain the Each data packet corresponds to the output of the forget gate. , No. Each data packet corresponds to the output of the input gate. , No. Each data packet corresponds to the output of the output gate. and the The result of combining the output of the forget gate and the output of the input gate for each data packet. Corresponding candidate memory content ,in, , Indicates the number of data packets in the traffic. This represents the Sigmoid activation function. Represents the hyperbolic tangent function. Indicates the first The one-way hidden state of each data packet, This indicates the weight corresponding to the forget gate. This represents the offset corresponding to the forget gate. This represents the weights corresponding to the input gates. This represents the offset corresponding to the input gate. This indicates the weights corresponding to the output gates. This represents the offset corresponding to the output gate. This represents the weight corresponding to the candidate memory. This indicates the offset corresponding to the candidate memory, and then proceeds to step a2;

[0022] Step a2. Use the following formula:

[0023] ;

[0024] Obtain the The result of combining the output of the forget gate and the output of the input gate for each data packet. ,in, Indicates the first The data packets are combined with the output of the forget gate and the output of the input gate, and then proceed to step a3;

[0025] Step a3. Use the following formula:

[0026] ;

[0027] Obtain the One-way hidden state of each data packet ;

[0028] Step a4. Use the following formula:

[0029] ;

[0030] Obtain the Hidden state of data packets That is, the first The high-dimensional feature vector corresponding to each data packet ;in, Indicates the first The forward hidden state of the nth data packet, i.e., the nth... The data packets are processed by the LSTM module in the forward LSTM group to obtain the one-way hidden state through steps a1 to a3. , Indicates the first The reverse hidden state of the nth data packet, i.e., the nth packet The data packets are processed by the LSTM module in the reverse LSTM group to obtain the one-way hidden state through steps a1 to a3. .

[0031] As a preferred embodiment of the present invention: the max pooling layer performs pooling updates on the high-dimensional feature vectors corresponding to each data packet output by the temporal modeling module, and further feeds them to the spiking neural network module. The spiking neural network module performs steps b1 to b4 on each feature value in the high-dimensional feature vector corresponding to each data packet to obtain the activation state of the input pulse signal of each neuron corresponding to each data packet. This constitutes the activation state matrix. and output;

[0032] Step b1. The pulse coding layer in the spiking neural network module is processed according to the following formula:

[0033] ;

[0034] Obtain the The high-dimensional feature vector corresponding to the data packet is the first one. Pulse firing rate corresponding to each feature , , Indicates the number of preset feature categories. Indicates the first The high-dimensional feature vector corresponding to the data packet is the first one. 1 eigenvalue, This represents the weights corresponding to the pulse coding layer. This indicates the offset corresponding to the pulse coding layer, and then proceeds to step b2;

[0035] Step b2. For the first The data packet corresponds to the th high-dimensional feature vector. eigenvalues Randomly activated generation The corresponding input pulse signal, i.e. Regarding the activation state of its corresponding input pulse signal And the input pulse signal is at a corresponding pulse firing rate To launch, or to activate without generating. The corresponding input pulse signal, i.e. Regarding the activation state of its corresponding input pulse signal Then proceed to step b3;

[0036] Step b3. Use the following formula:

[0037] ;

[0038] Obtain the The data packet corresponds to the first Membrane potential of a neuron ,in, This indicates the preset leakage coefficient. Indicates the first The data packet corresponds to the first The membrane potential of a neuron Indicates the first The first feature to the first Synaptic weights of individual neurons This indicates that the preset reset attenuation factor has been set, and then proceeds to step b4;

[0039] Step b4. Use the following formula:

[0040] ;

[0041] Obtain the The data packet corresponds to the first The activation state of the input pulse signal of a neuron , Indicates activation to generate the first The data packet corresponds to the first The input pulse signal of each neuron Indicates activation without generating the first The data packet corresponds to the first The input pulse signal of each neuron This indicates the preset membrane potential threshold.

[0042] As a preferred embodiment of the present invention: the self-attention mechanism module receives the activation state matrix from the spiking neural network module. Then, perform steps c1 to c2 to obtain the high-dimensional feature matrix and output it.

[0043] Step c1. For the activation state matrix According to the following formula:

[0044] ;

[0045] Obtain the corresponding query vector matrix Key vector matrix Value vector matrix ,in, The weight matrix represents the query vector. The weight matrix represents the key vector. The weight matrix represents the value vector; then proceed to step c2;

[0046] Step c2. Use the following formula:

[0047] ;

[0048] Obtain the corresponding attention score Then according to That is, to obtain the high-dimensional feature matrix. ,in, Indicates the scaling factor. The dimension of the key vector. This represents the normalized attention function.

[0049] As a preferred embodiment of the present invention: the global average pooling layer targets the high-dimensional feature matrix output by the self-attention mechanism module. Dimensionality reduction is performed using the following formula;

[0050] ;

[0051] Obtain the average value corresponding to each feature. , forming global feature vectors and output; where, Representing a high-dimensional feature matrix The Middle The data packet corresponds to the first The activation states of a high-dimensional feature;

[0052] The fully connected layer targets the global feature vector output by the global average pooling layer. According to the following formula:

[0053] ;

[0054] Obtain the output result ,in, This represents the weight matrix of the fully connected layer. This represents the offset matrix of the fully connected layer;

[0055] The classification output module outputs results for the fully connected layer. According to the following formula:

[0056] ;

[0057] The probability of obtaining traffic anomaly tags corresponding to traffic. , This indicates the weight of the classification output module. This represents the offset of the classification output module, where... .

[0058] Corresponding to the above, the technical problem that this invention also needs to solve is to provide a system for a traffic detection method based on a spiking neural-bidirectional LSTM network, with a modular network structure design to improve the network's efficiency in abnormal traffic detection applications.

[0059] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: The present invention designs a system for a traffic detection method based on a spiking neural network-bidirectional LSTM network. The feature input module includes a traffic reading module, a traffic feature extraction module, and a data normalization and standardization module connected in series from the input end to the output end. The system sequentially realizes traffic reading, extracts feature values ​​corresponding to preset feature categories of data packets, and normalizes and updates the feature values ​​corresponding to each data packet to form feature vectors corresponding to each data packet.

[0060] The time series modeling module includes a bidirectional sequence modeling module, a feature sequence extraction module, and a time feature representation module, which are connected in series from the input end to the output end. The bidirectional sequence modeling module realizes the construction of the forward LSTM group and the reverse LSTM group. The feature sequence extraction module executes steps a1 to a3, and the time feature representation module executes step a4.

[0061] The spiking neural network module comprises, sequentially connected from input to output, a model parameter reading module, a spiking neuron modeling module, a signal conversion module, and a spiking processing and feature enhancement module. The model parameter reading module reads the feature values ​​from the high-dimensional feature vectors corresponding to each data packet output by the max-pooling layer. The spiking neuron modeling module executes steps b1 and b3. The signal conversion module executes steps b2 and b4 to obtain the activation state of the input spiking signals of each neuron corresponding to each data packet. The spiking processing and feature enhancement module integrates features based on the activation states of the input spiking signals of each neuron corresponding to each data packet, constructing an activation state matrix. ;

[0062] The self-attention mechanism module includes an attention weight calculation module and a weighted feature generation module connected in series from the input end to the output end. The attention weight calculation module is used to execute steps c1 and c2, and the weighted feature generation module is used to execute step c3.

[0063] The traffic detection method and system based on spiking neural-bidirectional LSTM networks described in this invention have the following technical advantages compared with existing technologies:

[0064] This invention designs a traffic detection method based on a spiking neural network-bidirectional LSTM network. It introduces a temporal modeling module, a spiking neural network module, and a self-attention mechanism module to construct a network to be trained. The network is then trained using various sample traffic data to obtain a traffic anomaly detection model. By combining the dynamic characteristic modeling capability of the spiking neural network with the temporal dependency feature capture capability of the bidirectional long short-term memory network, the temporal features and behavioral patterns of encrypted traffic can be extracted more accurately. Furthermore, by optimizing parameters through global average pooling and fully connected layers, the classification performance and generalization ability are significantly improved, enabling efficient detection of traffic from various encrypted protocols. This invention also designs a corresponding system with a modular design for the network structure, enabling modular application of each stage of the detection method and further improving the efficiency of anomaly traffic detection in practical applications. Attached Figure Description

[0065] Figure 1 This is a schematic diagram of the data processing flow of the traffic anomaly detection model in this invention.

[0066] Figure 2 This is a schematic diagram of the system architecture for implementing the encrypted traffic detection method in this invention.

[0067] Figure 3 This is a flowchart illustrating the application of the feature input module in this invention.

[0068] Figure 4 This is a flowchart illustrating the application of model training in the design of this invention;

[0069] Figure 5 This is a flowchart illustrating the application of traffic classification in the design of this invention. Detailed Implementation

[0070] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0071] This invention designs a traffic detection method based on a spiking neural network-bidirectional LSTM network. In practical applications, the specific design executes the following steps A to C to obtain a traffic anomaly detection model, and then applies the traffic anomaly detection model to detect anomalies in the traffic to be detected.

[0072] Step A. Obtain a preset number of sample traffic samples, each with a known corresponding traffic anomaly label or traffic non-anomaly label, and then proceed to Step B.

[0073] Step B. As Figure 1As shown, the feature input module, temporal modeling module (BiLSTM module), max pooling layer, spiking neural network module (SNN module), self-attention mechanism module (Self-Attention Block), global average pooling layer, fully connected layer, and classification output module are sequentially connected from the input end to the output end to construct the network to be trained, and then proceed to step C.

[0074] Step C. Based on the traffic flow of each sample, with the sample traffic flow as input and the label corresponding to the sample traffic flow as output, train the network to be trained to obtain the traffic anomaly detection model.

[0075] In terms of specific data processing, the network structure described above has a feature input module for receiving traffic. First, it extracts the feature values ​​of each data packet corresponding to a preset feature category. Then, it normalizes and updates the feature values ​​corresponding to each data packet to form the feature vector corresponding to each data packet, and outputs it.

[0076] Regarding the preset feature categories, in practical applications, since content layer information cannot be directly extracted from encrypted traffic data, the design mainly obtains effective information from the temporal behavior characteristics and statistical features of the traffic, such as the packet size. Arrival Time , Package Direction In practical applications, the normalization process is performed and updated according to the following formula.

[0077]

[0078] in, Indicates the first The corresponding data packet Feature values ​​of each feature category Indicates the first The average feature value of each feature category for each data packet. Indicates the first The standard deviation of the feature values ​​of each feature category with respect to each data packet.

[0079] In practical applications, assuming that each data packet corresponds to 5 feature categories and the temporal length of each data packet is 100, the input shape is (batch_size, 100, 5).

[0080] Considering that network traffic is a dynamic process, after the feature vectors corresponding to each data packet output by the feature input module are processed, the temporal modeling module extracts the temporal dependencies of traffic features based on a bidirectional long short-term memory network (BiLSTM). It generates high-dimensional temporal features by simultaneously capturing forward and backward contextual information. Specifically, the temporal modeling module includes a forward LSTM group and a backward LSTM group. The forward LSTM group extracts dependencies from the past to the future, while the backward LSTM group captures temporal features from the future to the past. Both the forward and backward LSTM groups include three LSTM modules connected in series from the input to the output. Each LSTM module dynamically updates the hidden state and memory unit through a forget gate, an input gate, and an output gate. The inputs of the sequential LSTM modules in the backward LSTM group are connected one-to-one to the inputs of the reverse-order LSTM modules in the forward LSTM group, forming the three inputs of the temporal modeling module. The outputs of the sequential LSTM modules in the backward LSTM group are connected one-to-one to the outputs of the reverse-order LSTM modules in the forward LSTM group, forming the three outputs of the temporal modeling module.

[0081] Based on the fact that the first and last data packets in the sequential data packets in the traffic are connected, the three input terminals of the time series modeling module sequentially receive the feature vectors corresponding to each data packet output by the feature input module. For each feature vector under the LSTM module in the forward LSTM group and the LSTM module in the reverse LSTM group, the following steps a1 to a3 are executed respectively to obtain the forward hidden state and reverse hidden state of the data packet. Then, step a4 is executed to obtain the high-dimensional feature vector corresponding to the data packet, that is, to obtain the high-dimensional feature vector corresponding to each data packet and output it.

[0082] Step a1. For the first Feature vectors corresponding to each data packet According to the following formula:

[0083] ;

[0084] ;

[0085] ;

[0086] ;

[0087] Obtain the Each data packet corresponds to the output of the forget gate. , No. Each data packet corresponds to the output of the input gate. , No. Each data packet corresponds to the output of the output gate. and the The result of combining the output of the forget gate and the output of the input gate for each data packet. Corresponding candidate memory content ,in, , Indicates the number of data packets in the traffic. This represents the Sigmoid activation function. Represents the hyperbolic tangent function. Indicates the first The one-way hidden state of each data packet, This indicates the weight corresponding to the forget gate. This represents the offset corresponding to the forget gate. This represents the weights corresponding to the input gates. This represents the offset corresponding to the input gate. This indicates the weights corresponding to the output gates. This represents the offset corresponding to the output gate. This represents the weight corresponding to the candidate memory. This indicates the offset corresponding to the candidate memory, and then proceeds to step a2.

[0088] Step a2. Use the following formula:

[0089] ;

[0090] Obtain the The result of combining the output of the forget gate and the output of the input gate for each data packet. ,in, Indicates the first The data packets are combined with the output of the forget gate and the output of the input gate, and then proceed to step a3.

[0091] Step a3. Use the following formula:

[0092] ;

[0093] Obtain the One-way hidden state of each data packet .

[0094] Step a4. Use the following formula:

[0095] ;

[0096] Obtain the Hidden state of data packets That is, the first The high-dimensional feature vector corresponding to each data packet ;in, Indicates the first The forward hidden state of the nth data packet, i.e., the nth... The data packets are processed by the LSTM module in the forward LSTM group to obtain the one-way hidden state through steps a1 to a3. , Indicates the first The reverse hidden state of the nth data packet, i.e., the nth packet The data packets are processed by the LSTM module in the reverse LSTM group to obtain the one-way hidden state through steps a1 to a3. .

[0097] The high-dimensional feature vectors corresponding to each data packet form a matrix. The input contains global context features of the time series, with a shape of (batch_size, seq_length, feature_size), i.e., (batch_size, 100, 5). The output dimension of BiLSTM is 2 * hidden_size. Assuming hidden_size=64, the output shape is (batch_size, seq_length, 128). A max-pooling layer is then applied to reduce the time series length and retain the most salient features. Specifically, the max-pooling layer updates the high-dimensional feature vectors corresponding to each data packet output by the time series modeling module through pooling, and then feeds them to the spiking neural network module. In practical applications, the pooling window size of the max-pooling layer can be 2, with a stride of 2, which reduces the time series length by half. The feature tensor shape after pooling is (batch_size, 50, 128).

[0098] The Spiking Neural Network (SNN) module is a computational model of biological neural networks, mimicking the pulse firing mechanism of neurons and possessing strong spatiotemporal characteristics. The SNN module in this invention is primarily used to capture the temporal and dynamic characteristics of encrypted traffic data, thereby providing higher-quality feature input for subsequent processing. The SNN module further models the temporal features extracted by BiLSTM to capture the bursty behavior of malicious traffic. Specifically, the SNN is based on the Leaky Integrate-and-Fire (LIF) model to model the temporal dynamics of the input signal.

[0099] The spiking neural network module performs steps b1 to b4 for each feature value in the high-dimensional feature vector corresponding to each data packet, to obtain the activation state of the input spiking signal of each neuron corresponding to each data packet. This constitutes the activation state matrix. , and output.

[0100] Spiking neural networks take discrete events (pulses) as input, therefore the feature values ​​at each time step need to be encoded. Common encoding methods include: Threshold Coding: generating a pulse when the feature value exceeds a certain threshold; Rate Coding: generating pulse signals of different frequencies according to the magnitude of the feature value; Temporal Coding: expressing the feature value through the time interval of the pulses.

[0101] Step b1. The pulse coding layer in the spiking neural network module uses frequency coding as follows:

[0102] ;

[0103] Obtain the The high-dimensional feature vector corresponding to the data packet is the first one. Pulse firing rate corresponding to each feature , , Indicates the number of preset feature categories. Indicates the first The high-dimensional feature vector corresponding to the data packet is the first one. 1 eigenvalue, This represents the weights corresponding to the pulse coding layer. This indicates the offset corresponding to the pulse coding layer, and then proceeds to step b2.

[0104] Step b2. For the first The data packet corresponds to the th high-dimensional feature vector. eigenvalues Randomly activated generation The corresponding input pulse signal, i.e. Regarding the activation state of its corresponding input pulse signal And the input pulse signal is at a corresponding pulse firing rate To launch, or to activate without generating. The corresponding input pulse signal, i.e. Regarding the activation state of its corresponding input pulse signal Then proceed to step b3.

[0105] Step b3. Use the following formula:

[0106] ;

[0107] Obtain the The data packet corresponds to the first Membrane potential of a neuron ,in, This indicates the preset leakage coefficient. Indicates the first The data packet corresponds to the first The membrane potential of a neuron Indicates the first The first feature to the first Synaptic weights of individual neurons This indicates that the preset reset attenuation factor has been set, and then the process proceeds to step b4.

[0108] Step b4. Use the following formula:

[0109] ;

[0110] Obtain the The data packet corresponds to the first The activation state of the input pulse signal of a neuron , Indicates activation to generate the first The data packet corresponds to the first The input pulse signal of each neuron Indicates activation without generating the first The data packet corresponds to the first The input pulse signal of each neuron This indicates the preset membrane potential threshold.

[0111] The spiking neural network module effectively enhances the ability to model time-sensitive malicious traffic behavior by capturing burst signals. With a time step count of t_steps=10, meaning each time step simulates neuron activity, and assuming pool_size=2 and stride=2, the pooled feature dimension is (batch_size, seq_length / / 4, 128). The output feature of the pooled spiking neural network module has a shape of (batch_size, 25, 128).

[0112] The self-attention mechanism module enhances the model's focusing ability by calculating the relationships between different features, enabling the model to capture important temporal patterns in traffic data. The self-attention mechanism module dynamically weights each time step by calculating the correlation between input features. This module uses attention weights to weight the features extracted by the spiking neural network module, highlighting the key features of malicious traffic, thereby improving classification accuracy.

[0113] The self-attention mechanism module receives the activation state matrix from the spiking neural network module. Then, perform steps c1 to c2 to obtain the high-dimensional feature matrix and output it.

[0114] Step c1. For the activation state matrix According to the following formula:

[0115] ;

[0116] Obtain the corresponding query vector matrix Key vector matrix Value vector matrix ,in, The weight matrix represents the query vector. The weight matrix represents the key vector. This represents the weight matrix of the value vector; then proceed to step c2.

[0117] Step c2. Use the following formula:

[0118] ;

[0119] Obtain the corresponding attention score Then according to That is, to obtain the high-dimensional feature matrix. ,in, Indicates the scaling factor. The dimension of the key vector. This represents the normalized attention function.

[0120] The high-dimensional feature matrix generated by the self-attention mechanism module by the global average pooling layer The main function of dimensionality reduction is to integrate information from the time and channel dimensions, thereby reducing data dimensionality, avoiding parameter redundancy, and preserving global feature information. Specifically, a global average pooling layer is designed to handle the high-dimensional feature matrix output by the self-attention mechanism module. Dimensionality reduction is performed using the following formula;

[0121] ;

[0122] Obtain the average value corresponding to each feature. , forming global feature vectors The global average pooling layer, through dimensionality reduction, not only effectively reduces the number of parameters and avoids overfitting, but also improves computational efficiency. Representing a high-dimensional feature matrix The Middle The data packet corresponds to the first The activation state of a high-dimensional feature.

[0123] The fully connected layer further maps the low-dimensional features after the global average pooling layer into a hidden layer representation, which is used for non-linear combination of features. Specifically, the fully connected layer is designed to work with the global feature vector output by the global average pooling layer. According to the following formula:

[0124] ;

[0125] Obtain the output result ,in, This represents the weight matrix of the fully connected layer. This represents the offset matrix of the fully connected layer.

[0126] Fully connected layers introduce non-linear expressive power while avoiding the gradient vanishing problem. The output of a fully connected layer... It is a low-dimensional feature representation that fully captures the feature information required for classification tasks. The first fully connected layer has an output dimension of 64 and uses ReLU activation; the second fully connected layer has an output dimension of 32 and also uses ReLU activation. For classification tasks, the output shape is (batch_size, num_classes), where num_classes is the number of classes.

[0127] The classification output module is responsible for mapping the hidden features generated by the fully connected layer to the classification results. This is done through a fully connected mapping and activation function. Specifically, the classification output module considers the output results of the fully connected layer. According to the following formula:

[0128] ;

[0129] The probability of obtaining traffic anomaly tags corresponding to traffic. Furthermore, based on a preset classification threshold such as 0.5, the probability value is converted into a specific detection result, thereby achieving anomaly detection in traffic. This indicates the weight of the classification output module. This represents the offset of the classification output module, where... .

[0130] In practical applications, the specific implementation of the above-mentioned network design is carried out using a modular design approach, such as... Figure 2 As shown, the various modules work together to form a complete malicious encrypted traffic detection system. The feature input module preprocesses the data and generates feature representations, the temporal modeling module captures the long-term and short-term temporal dependencies of the traffic, the spiking neural network module further enhances the temporal dynamic characteristics of the traffic, the self-attention mechanism module highlights key features, and the classification output module finally detects and classifies the traffic.

[0131] The feature input module is the input module of the entire system. Its function is to extract core features from the original encrypted network traffic data. These features are mainly statistical and are unrelated to the encrypted content. They can provide the model with necessary contextual information to help distinguish different types of encrypted traffic patterns. The feature input module is designed to include a traffic reading module, a traffic feature extraction module, and a data normalization and standardization module, which are connected in series from the input end to the output end. They sequentially realize traffic reading, extract feature values ​​corresponding to each preset feature category of data packets, and normalize and update the feature values ​​corresponding to each data packet to form the feature vector corresponding to each data packet. The actual application of the feature input module is as follows.

[0132] Input: Raw encrypted traffic data (e.g., a Pcap format file or traffic log) containing a sequence of encrypted packets.

[0133] Traffic data reading: Parse the raw traffic file and extract key information from the traffic session (source / destination IP address, port number, protocol type, etc.).

[0134] Data stream parsing: Statistics are performed on traffic session data, such as traffic duration, number of forward / backward packets, packet length statistics (such as maximum, minimum, mean, standard deviation), number of bytes and packets per second, traffic arrival time interval statistics (such as mean, standard deviation, maximum, minimum), and TCP flags (such as FIN, SYN, ACK, etc.).

[0135] Traffic characteristic statistics: The above statistical results are combined into a fixed-dimensional feature vector to represent the overall characteristics of each traffic session.

[0136] Output: Feature vector During the training phase, these statistical features are normalized to the same numerical range (e.g., through z-score normalization) to ensure that the features have equal weights in the model. Subsequently, these feature vectors are used as input to subsequent deep learning modules.

[0137] The temporal modeling module aims to model the time-series information of traffic features using BiLSTM (Bidirectional Long Short-Term Memory) network, capturing the temporal dependencies of encrypted traffic features to identify the changing trends of traffic patterns. The module comprises a bidirectional sequence modeling module, a feature sequence extraction module, and a temporal feature representation module, sequentially connected from input to output. The bidirectional sequence modeling module constructs the forward and backward LSTM groups. The feature sequence extraction module executes steps a1 to a3, and the temporal feature representation module executes step a4. In practical applications, the parameters of the temporal modeling module (BiLSTM network) are optimized through backpropagation. The model updates the LSTM weights in both directions by calculating the prediction error of time-series features (e.g., cross-entropy loss in classification tasks), thereby gradually learning the temporal dependency patterns in the features.

[0138] The neuromorphic feature enhancement module is one of the core modules of the system. It aims to further enhance the dynamic and temporal information in traffic features by simulating the behavior of biological neural networks (SNNs). Unlike traditional neural networks, the spiking neural network (SNN) module processes data in an event-driven manner, efficiently capturing sparse and dynamic feature patterns, making it particularly suitable for analyzing key burst characteristics in time series data. The introduction of this module further enhances the modeling capability for complex encrypted traffic patterns.

[0139] The spiking neural network module is specifically designed to include a model parameter reading module, a spiking neuron modeling module, a signal conversion module, and a spiking processing and feature enhancement module, which are sequentially connected from the input to the output. The model parameter reading module reads the feature values ​​from the high-dimensional feature vectors corresponding to each data packet output by the max-pooling layer. The spiking neuron modeling module executes steps b1 and b3. The signal conversion module executes steps b2 and b4 to obtain the activation state of the input spiking signals of each neuron corresponding to each data packet. The spiking processing and feature enhancement module integrates features based on the activation states of the input spiking signals of each neuron corresponding to each data packet, constructing an activation state matrix. .

[0140] The dynamic feature sequence enhanced by the spiking neural network (SNN) module places greater emphasis on the dynamic and bursty characteristics of the traffic pattern in the feature representation at each time step. Through this module, the system can not only model static features, but also analyze the time series dynamics in encrypted traffic more accurately, thereby providing more reliable feature representations for subsequent attention mechanisms and classification modules.

[0141] The self-attention mechanism module includes an attention weight calculation module and a weighted feature generation module connected in series from the input end to the output end. The attention weight calculation module is used to execute steps c1 and c2, and the weighted feature generation module is used to execute step c3.

[0142] Applying the encrypted traffic detection method and system designed in this invention to practical applications, such as... Figure 3 As shown, the feature input module is the foundation of the entire encrypted traffic detection system, responsible for transforming raw network traffic data into structured, analyzable data. This module eliminates redundancy and noise through key steps such as traffic segmentation, deduplication filtering, reassembly, and feature extraction, extracting important features related to encrypted traffic behavior and providing high-quality input data for subsequent feature enhancement and classification modules.

[0143] First, during the traffic data segmentation phase, raw network packets can be divided into independent flows based on a five-tuple (source IP, destination IP, source port, destination port, protocol type), ensuring the uniqueness of each traffic flow. Simultaneously, data can also be segmented based on time windows, breaking continuous network traffic into smaller time segments to facilitate subsequent processing. Through segmentation, the system can effectively process long-term network traffic and transform it into smaller traffic units.

[0144] Next, in the traffic deduplication and filtering stage, it is necessary to remove network packets irrelevant to the analysis, such as broadcast traffic and multicast traffic, while filtering out protocol traffic that does not conform to the scope of the analysis (such as IPv6, ARP, etc.). In scenarios involving the analysis of encrypted traffic, typically only data from common encrypted protocols such as TLS, SSH, and IPSec is retained, while unencrypted traffic is discarded, thereby ensuring the validity and relevance of the input data.

[0145] During the traffic reassembly phase, the system reassembles multiple data packets belonging to the same class using 5-tuples and timestamps to restore a complete traffic session. Especially when processing TCP traffic, the system sorts data packets according to sequence numbers to ensure the logical integrity of the reassembled data. Furthermore, the system can distinguish between forward traffic (client-to-server) and backward traffic (server-to-client), and can even comprehensively process bidirectional traffic to further enrich its characteristic information.

[0146] Finally, the traffic processed through the above steps enters the feature extraction stage. Since the content of encrypted traffic cannot be directly decoded, the focus of feature extraction is on extracting traffic behavior and pattern features, including traffic temporal features (such as traffic duration, packet interval, etc.), distribution features (such as the number of forward / backward packets, number of bytes, etc.), protocol features (such as the statistical distribution of TCP flags), and statistical features (such as packet length statistics, bytes per second, etc.). These features can effectively reflect the behavioral patterns of encrypted traffic, providing rich information input for subsequent classification models.

[0147] The feature input module takes raw, encrypted network traffic data as input, containing unsegmented, continuous streams of data packets, and outputs preprocessed, structured traffic data, including complete traffic sessions within a time window and their statistical characteristics. This output data lays a solid foundation for subsequent feature enhancement and classification modules.

[0148] Through the raw traffic data preprocessing process, the system can not only remove irrelevant data and noise, but also extract multi-dimensional features, providing comprehensive and standardized input for the classification of encrypted traffic, which significantly improves the training and prediction effects of subsequent models.

[0149] Regarding the actual training processing of the network to be trained, such as Figure 4 As shown, the first stage of encrypted traffic detection is the modeling and feature extraction of time-series information. First, the raw traffic features (such as traffic duration, packet length, and arrival time interval) are input into the time-series modeling module, namely the Bidirectional Long Short-Term Memory (BiLSTM) network. The bidirectional structure of BiLSTM can extract time-series information of traffic features from both forward and reverse directions, fully preserving the contextual relevance of the data. Internally, it uses a gating mechanism to filter features at different time steps, highlighting key features and filtering out irrelevant data.

[0150] Next, the system utilizes a spiking neural network (SNN) module for dynamic encoding and deep mining of temporal features. The SNN module is a crucial component of the entire system, designed to capture time-series features in encrypted traffic data by simulating the dynamic characteristics of biological neurons. The module's workflow primarily includes spiking encoding, SNN model construction, model training, model prediction, and model validation. Through these steps, the SNN module effectively processes the input encrypted traffic data, providing strong support for subsequent classification and detection.

[0151] In the pulse coding stage, the original encrypted traffic characteristics (such as packet length, traffic duration, arrival time interval, etc.) are converted into a pulse sequence (spike train) to adapt to the input requirements of the SNN. The encoding methods mainly include pulse frequency coding and time coding. Pulse frequency coding generates pulses of corresponding frequencies based on the magnitude of the feature values, while time coding controls the pulse firing time interval through the feature value magnitude. The encoded pulse sequence can effectively express the temporal pattern of the data, providing input signals for the subsequent spiking neural network module.

[0152] In the SNN model construction phase, a LIF (Leaky Integrate-and-Fire) model is used to simulate the dynamic behavior of neurons, constructing a spiking neural network module including an input layer, hidden layers, and an output layer. The input layer receives pulse sequence signals, the hidden layer extracts and fuses temporal features through neuronal connections, and the output layer generates feature signals. Through this structure, the SNN can simulate the response characteristics of biological neurons to dynamic pulse signals, effectively extracting time-series information from traffic flow characteristics.

[0153] During the model training phase, the SNN model was optimized using spike sequence data and traffic label data. The STDP (Spike-Timing-Dependent Plasticity) rule was used to adjust the weights between neurons during training, and multiple rounds of iterative training were conducted to gradually converge the model's loss function, ultimately resulting in a stable SNN model with temporal feature extraction capabilities.

[0154] During the model prediction and testing phases, the model performs end-to-end inference on the preprocessed traffic data: BiLSTM and SNN extract spatiotemporal features, a self-attention module focuses on key nodes, and finally, a classifier outputs the detection results. The validation phase comprehensively evaluates performance using metrics such as accuracy, false positive rate, and false negative rate, generating a visual report to provide a basis for model optimization. This process ensures the reliability and adaptability of the detection system in actual deployments.

[0155] Overall, the SNN module, with its powerful time series processing capabilities, provides an efficient and accurate solution for encrypted traffic detection tasks. Furthermore, by combining with the subsequent BiLSTM module, it further enhances the system's detection performance and robustness.

[0156] After temporal feature extraction and dynamic encoding are completed, the features of BiLSTM and SNN are further fused to form a comprehensive feature representation that has both temporal dependence and dynamic expressive ability. These fused features can fully characterize the complex patterns of encrypted traffic, laying a solid foundation for subsequent classification or other tasks.

[0157] Through phased system design, the model achieves in-depth modeling of encrypted traffic characteristics while taking into account both time dependence and dynamic response capabilities, significantly improving the accuracy and robustness of the detection task.

[0158] Traffic classification is also crucial to the entire system, responsible for the final classification and judgment of encrypted traffic data. For example... Figure 5 As shown, this module combines the functions of Global Average Pooling (GAP) and Fully Connected Layer (FC) to complete the entire process from feature extraction to classification output through dimensionality reduction, feature integration, and classification mapping.

[0159] The primary function of the global average pooling layer is to reduce the dimensionality and integrate information from the high-dimensional temporal features output by the BiLSTM network. While the features generated by the BiLSTM model contain rich temporal information, directly using these high-dimensional features leads to excessive computational complexity and increases the risk of overfitting. The global average pooling layer compresses these complex temporal features into a fixed-dimensional global feature representation by averaging the features along the time axis. This not only preserves the global information of the features but also significantly reduces feature dimensionality and computational cost, preparing the system for subsequent classification tasks.

[0160] The dimensionality-reduced features are fed into a fully connected layer for further feature integration and classification. The fully connected layer maps the features to predicted values ​​for each class through linear transformations and non-linear activation functions. These predicted values ​​are then transformed into a class probability distribution using a softmax function, and the class with the highest probability is ultimately used as the classification result. The fully connected layer not only integrates features but also plays a crucial role in the classification task, supporting the final model performance.

[0161] In summary, the encrypted traffic classification module extracts global information through a global average pooling layer, reducing feature dimensionality and avoiding overfitting. Meanwhile, the fully connected layer completes the crucial mapping from features to classification results, providing a basis for evaluating system performance (such as accuracy and false alarm rate). The combination of these two elements ensures the efficiency and accuracy of the classification module throughout the system, providing a reliable guarantee for encrypted traffic detection.

[0162] The above technical solution is based on a traffic detection method using a spiking neural network-bidirectional LSTM network. It introduces a temporal modeling module, a spiking neural network module, and a self-attention mechanism module to construct a network to be trained. This network is then trained using various sample traffic data to obtain a traffic anomaly detection model. By combining the dynamic characteristic modeling capability of the spiking neural network with the temporal dependency feature capture capability of the bidirectional long short-term memory network, it can more accurately extract the temporal features and behavioral patterns of encrypted traffic. Furthermore, by optimizing parameters through global average pooling and fully connected layers, the classification performance and generalization ability are significantly improved, enabling efficient detection of traffic from various encrypted protocols. This invention also designs a corresponding system with a modular design for the network structure, enabling modular application of each stage of the detection method and further improving the efficiency of anomaly traffic detection in practical applications.

[0163] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited to the above embodiments. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of the present invention.

Claims

1. A traffic detection method based on spiking neural-bidirectional LSTM network, characterized in that: Perform steps A through C to obtain a traffic anomaly detection model, and then apply the traffic anomaly detection model to detect anomalies in the traffic to be detected. Step A. Obtain a preset number of sample traffic samples with known corresponding abnormal traffic labels or non-abnormal traffic labels, and then proceed to Step B; Step B. Connect the feature input module, temporal modeling module, max pooling layer, spiking neural network module, self-attention mechanism module, global average pooling layer, fully connected layer, and classification output module in sequence from input to output to construct the network to be trained, and then proceed to step C; The feature input module receives traffic, processes it to obtain the feature vectors corresponding to each data packet, and outputs them to the temporal modeling module. The temporal modeling module processes the traffic to obtain the high-dimensional feature vectors corresponding to each data packet, then outputs them to the max pooling layer for pooling updates, and finally outputs them to the spiking neural network module. The spiking neural network module performs steps b1 to b4 for each feature value in the high-dimensional feature vector corresponding to each data packet to obtain the activation state S of the input pulse signal of each neuron corresponding to each data packet. n (i) form the activation state matrix S and output it; Step b1. The pulse coding layer in the spiking neural network module is processed according to the following formula: l i,j =σ1(W encode g i,j +b encode ) Obtain the pulse firing rate λ corresponding to the j-th feature in the high-dimensional feature vector corresponding to the i-th data packet. i,j , 1≤j≤J, where J represents the number of preset feature categories, g i,j W represents the j-th eigenvalue in the high-dimensional eigenvector corresponding to the i-th data packet. encode b represents the weights corresponding to the pulse coding layer. encode This represents the offset corresponding to the pulse coding layer, and σ1() represents the activation function. Then proceed to step b2. Step b2. For the j-th feature value g in the high-dimensional feature vector corresponding to the i-th data packet... i,j Randomly activate and generate g i,j The corresponding input pulse signal, i.e., g i,j Regarding the activation state S of its corresponding input pulse signal j (i) = 1, and the input pulse signal has a corresponding pulse firing rate λ i,j To launch, or to activate without generating g. i,j The corresponding input pulse signal, i.e., g i,j Regarding the activation state S of its corresponding input pulse signal j (i) = 0, then proceed to step b3; Step b3. Use the following formula: Obtain the membrane potential U of the nth neuron corresponding to the i-th data packet. n (i), where α represents the preset leakage coefficient, U n (i-1) represents the membrane potential of the nth neuron corresponding to the (i-1)th data packet, W nj This represents the synaptic weight from the j-th feature to the n-th neuron, and β represents the preset reset decay factor. Then proceed to step b4. Step b4. Use the following formula: Obtain the activation state S of the input pulse signal of the nth neuron corresponding to the i-th data packet. n (i), S n (i) = 1 indicates that the input pulse signal corresponding to the nth neuron is activated and generated for the i-th data packet, S n (i) = 0 indicates that the input pulse signal corresponding to the nth neuron is not generated when the i-th data packet is activated. th Indicates the preset membrane potential threshold; Step C. Based on the traffic flow of each sample, with the sample traffic flow as input and the label corresponding to the sample traffic flow as output, train the network to be trained to obtain the traffic anomaly detection model.

2. The traffic detection method based on spiking neural-bidirectional LSTM network according to claim 1, characterized in that: The feature input module is used to receive traffic. First, it extracts the feature values ​​of each preset feature category corresponding to each data packet in the traffic in sequence. Then, it performs normalization processing on the feature values ​​corresponding to each data packet to update them, thereby forming the feature vector corresponding to each data packet, and outputting it.

3. The traffic detection method based on spiking neural-bidirectional LSTM network according to claim 2, characterized in that: The timing modeling module includes a forward LSTM group and a backward LSTM group. Each forward LSTM group and backward LSTM group includes three LSTM modules connected in series from the input to the output. The inputs of the sequential LSTM modules in the backward LSTM group are connected one-to-one with the inputs of the reverse LSTM modules in the forward LSTM group, forming the three inputs of the timing modeling module. The outputs of the sequential LSTM modules in the backward LSTM group are connected one-to-one with the outputs of the reverse LSTM modules in the forward LSTM group, forming the three outputs of the timing modeling module. Based on the fact that the first and last data packets in the sequential data packets in the traffic are connected, the three input terminals of the time series modeling module sequentially receive the feature vectors corresponding to each data packet output by the feature input module. For each feature vector under the LSTM module in the forward LSTM group and the LSTM module in the reverse LSTM group, the following steps a1 to a3 are executed respectively to obtain the forward hidden state and reverse hidden state of the data packet. Then, step a4 is executed to obtain the high-dimensional feature vector corresponding to the data packet, that is, to obtain the high-dimensional feature vector corresponding to each data packet and output it. Step a1. For the feature vector x corresponding to the i-th data packet i According to the following formula: f i =σ2(W f ·[g’ i-1 ,xi]+b f ) r i =σ2(W r ·[g’ i-1 ,x i ]+b r ) o i =σ2(W o ·[g’ i-1 ,x i ]+b o ) Obtain the output f of the forget gate corresponding to the i-th data packet. i The output r of the input gate corresponding to the i-th data packet i The output o of the output gate corresponding to the i-th data packet i The result c of combining the output of the forget gate and the output of the input gate for the i-th data packet. i Corresponding candidate memory content Where 1≤i≤I, I represents the number of data packets in the traffic, σ2() represents the Sigmoid activation function in the LSTM module, tanh() represents the hyperbolic tangent function, and g' i-1 W represents the one-way hidden state of the (i-1)th data packet. f b represents the weight corresponding to the forget gate. f W represents the offset corresponding to the forget gate. r b represents the weights corresponding to the input gates. r W represents the offset corresponding to the input gate. o b represents the weight corresponding to the output gate. o W represents the offset corresponding to the output gate. C b represents the weight corresponding to the candidate memory. C This indicates the offset corresponding to the candidate memory, and then proceeds to step a2; Step a2. Use the following formula: Obtain the result c of combining the output of the forget gate and the output of the input gate for the i-th data packet. i , where c i-1 This indicates the result of combining the output of the forget gate and the output of the input gate for the (i-1)th data packet, and then proceeding to step a3; Step a3. Use the following formula: g′ i =o i ⊙tanh(c i ) Obtain the one-way hidden state g' of the i-th data packet i ; Step a4. Use the following formula: Obtain the hidden state g of the i-th data packet i That is, the high-dimensional feature vector g corresponding to the i-th data packet i ;in, This represents the forward hidden state of the i-th data packet, that is, the one-way hidden state g' obtained by the i-th data packet after performing steps a1 to a3 under the LSTM module in the forward LSTM group. i , This represents the reverse hidden state of the i-th data packet, that is, the one-way hidden state g' obtained by the i-th data packet after performing steps a1 to a3 under the LSTM module in the reverse LSTM group. i .

4. The traffic detection method based on spiking neural-bidirectional LSTM network according to claim 1, characterized in that: The self-attention mechanism module receives the activation state matrix S from the spiking neural network module and executes the following steps c1 to c2 to obtain a high-dimensional feature matrix and output it. Step c1. For the activation state matrix S, use the following formula: Q=SW Q ;K=SW K ;V=SW V Obtain the corresponding query vector matrix Q, key vector matrix K, and value vector matrix V, where W Q W represents the weight matrix of the query vector. K W represents the weight matrix of the key vectors. V The weight matrix represents the value vector; then proceed to step c2; Step c2. Use the following formula: Once the corresponding attention score Attention(Q,K,V) is obtained, the high-dimensional feature matrix O is obtained by setting O = Attention(Q,K,V). d represents the scaling factor. k The dimension of the key vector is represented by Softmax(), which represents the normalized attention function.

5. The traffic detection method based on spiking neural-bidirectional LSTM network according to claim 4, characterized in that: The global average pooling layer reduces the dimensionality of the high-dimensional feature matrix O output by the self-attention mechanism module according to the following formula; Obtain the average value z corresponding to each feature. j This forms the global feature vector z and is output. Among them, O i,j This represents the activation state of the j-th high-dimensional feature corresponding to the i-th data packet in the high-dimensional feature matrix O; The fully connected layer uses the following formula to process the global feature vector z output by the global average pooling layer: h=ReLU(W fc ·z+b fc ) Obtain the output result h, where W fc Let b represent the weight matrix of the fully connected layer. fc This represents the offset matrix of the fully connected layer; The classification output module calculates the output result h of the fully connected layer according to the following formula: The probability of obtaining traffic anomaly tags corresponding to traffic. W cls b represents the weight of the classification output module. cls This represents the offset of the classification output module, where...

6. The traffic detection method based on spiking neural-bidirectional LSTM network according to claim 5, characterized in that: The feature input module includes a traffic reading module, a traffic feature extraction module, and a data normalization and standardization module connected in series from the input end to the output end. These modules sequentially read traffic, extract feature values ​​corresponding to preset feature categories of data packets, and normalize and update the feature values ​​corresponding to each data packet to form feature vectors corresponding to each data packet. The time series modeling module includes a bidirectional sequence modeling module, a feature sequence extraction module, and a time feature representation module, which are connected in series from the input end to the output end. The bidirectional sequence modeling module realizes the construction of the forward LSTM group and the reverse LSTM group. The feature sequence extraction module executes steps a1 to a3, and the time feature representation module executes step a4. The spiking neural network module includes a model parameter reading module, a spiking neuron modeling module, a signal conversion module, and a spiking processing and feature enhancement module, which are connected in series from the input end to the output end. The model parameter reading module is used to read the feature values ​​in the high-dimensional feature vector corresponding to each data packet output by the max pooling layer. The spiking neuron modeling module is used to execute steps b1 and b3. The signal conversion module is used to execute steps b2 and b4 to obtain the activation state of the input spiking signal of each neuron corresponding to each data packet. The spiking processing and feature enhancement module is used to perform feature integration on the activation state of the input spiking signal of each neuron corresponding to each data packet to construct the activation state matrix S. The self-attention mechanism module includes an attention weight calculation module and a weighted feature generation module connected in series from the input end to the output end. The attention weight calculation module is used to execute steps c1 and c2, and the weighted feature generation module is used to execute step c3.

Images