An intelligent large model driven heterogeneous traffic analysis method, device and system

Abstract

The application relates to the technical field of heterogeneous traffic analysis, in particular to a heterogeneous traffic analysis method, device and system driven by an intelligent large model, which comprises the following steps: collecting side channel features of encrypted traffic, correcting a static position coding mode of a Transform model based on the length of each data packet in a single session, the traffic direction and the arrival time stamp relative to the session start time, dynamically coding the side channel features to obtain a first feature vector of each data packet; constructing a second feature vector, a third feature vector and a fourth feature vector; assigning a learnable bias vector to each feature vector to form a modal bias matrix as a learnable parameter in the training process of the Transform model and correcting the attention mechanism in the Transform model; obtaining a fusion feature vector of all feature vectors to perform attack detection on the input traffic. Therefore, the accuracy of traffic detection is improved.

Description

Technical Field

[0001] This application relates to the field of heterogeneous flow analysis technology, specifically to a method, device, and system for heterogeneous flow analysis driven by an intelligent large model. Background Technology

[0002] In the context of digital transformation, network traffic exhibits significant heterogeneity, encompassing multiple protocols, diverse data formats, and diverse sources, resulting in significant structural semantic differences and complex dynamic relationships. Traditional analysis relies on manually designed features, making it difficult to capture the deep semantic relationships hidden within traffic data and exhibiting poor adaptability to new protocols or attack patterns. In contrast, large-scale models, such as Transformer, possess powerful contextual semantic modeling capabilities. They can automatically learn long-range dependencies between cross-protocol and cross-modal features through self-attention mechanisms, without requiring pre-set fixed feature templates.

[0003] Existing heterogeneous traffic analysis methods often require decryption of traffic before analysis. Large models cannot directly parse encrypted payloads and rely solely on traffic meta-features for indirect inference. They cannot effectively extract and fuse heterogeneous side-channel features of traffic for attack detection. Furthermore, relying on only a single side-channel feature results in semantic gaps, leading to a decrease in traffic detection accuracy. Summary of the Invention

[0004] To address the aforementioned technical problems, the purpose of this application is to provide a method, device, and system for heterogeneous traffic analysis driven by an intelligent large model. The specific technical solution adopted is as follows:

[0005] In a first aspect, embodiments of this application provide a method for heterogeneous traffic analysis driven by an intelligent large model, the method comprising the following steps:

[0006] The side-channel characteristics of encrypted traffic are collected, wherein the side-channel characteristics include timing characteristics and structural characteristics;

[0007] Based on the length, flow direction, and arrival timestamp relative to the session start time of each data packet in a single session, the static position encoding method of the Transformer model is modified, and the side channel features are dynamically encoded to obtain the first feature vector of each data packet.

[0008] The second feature vector is constructed based on the network layer IP and transport layer port number in the quintuple; the third feature vector is constructed using digital certificates and encryption suites at the application layer; and the fourth feature vector is constructed based on the user ID and access path in the business system logs of the computer network.

[0009] Assign learnable bias vectors to each feature vector to dynamically adjust the association weights of different modal features; combine the bias vectors of all feature vectors into a modal bias matrix, which serves as a learnable parameter during the Transformer model training process, and correct the expression of the attention mechanism in the Transformer model; use the corrected attention mechanism to obtain the fused feature vector of all feature vectors.

[0010] A lightweight classifier is used to detect attacks on the input traffic from the fused feature vector.

[0011] In one embodiment, the side-channel features include:

[0012] The session duration of a single session, the timestamp interval of each packet, the length of each packet, and the traffic direction identifier for each packet.

[0013] In one embodiment, the modified static position encoding method of the Transformer model includes:

[0014] The position encoding formula for the i-th data packet is: ,in, Let be the arrival timestamp of the i-th data packet relative to the session start time. The basic timing code for the i-th data packet, Let be the length of the i-th data packet. The preset weighting coefficients are between 0 and 1. Symbol encoding for the traffic direction of the i-th data packet;

[0015] in, In the formula, Let be the session start time corresponding to the i-th data packet. Let be the average timestamp interval of all data packets in the session corresponding to the i-th data packet, and j be the index of the hidden layer dimension of the Transformer model. C represents the hidden layer dimension of the Transformer model, where C is a preset value. The frequency scaling factor is represented by sin(), which is the trigonometric sine function, and cos() is the trigonometric cosine function.

[0016] In one embodiment, determining the second feature vector includes:

[0017] A fixed-length hash value is generated for the IP address of the network layer using a hash algorithm. The transport layer port number is one-hot encoded to generate a sparse vector. The hash value and the sparse vector are concatenated and linearly mapped to the hidden layer dimension of the Transformer model to obtain the second feature vector.

[0018] In one embodiment, determining the third feature vector includes:

[0019] Using the digital certificate at the application layer, a hash algorithm is used to obtain the certificate hash. The certificate hash is then concatenated with the application layer's cipher suite encoding and linearly mapped to the hidden layer dimension of the Transformer model to obtain the third feature vector.

[0020] In one embodiment, determining the fourth feature vector includes:

[0021] The user ID is used to generate a fixed-length hash value using a hash algorithm. The access path is segmented and then used to generate a numerical sequence through word embedding. The hash value generated by the user ID and the numerical sequence are linearly mapped to the hidden layer dimension of the Transformer model to obtain the fourth feature vector.

[0022] In one embodiment, the expression for modifying the attention mechanism in the Transformer model includes:

[0023] In the formula, Q represents the query vector, specifically the first feature vector, and K represents the key vector, specifically any one of the second, third, and fourth feature vectors. Let V be the transpose of the key vector, and let V be the value vector. Indicates the scaling factor. Let be the dimension of the key vector. The modal deviation matrix is... This represents the activation function.

[0024] In one embodiment, the step of using a lightweight classifier to perform attack detection on the fused feature vector of the input traffic includes:

[0025] Using the MobileNetV3 network architecture, the fused feature vector is taken as input and the output is an attack probability value, which represents the confidence level of the input traffic as an attack.

[0026] Secondly, embodiments of this application also provide a heterogeneous traffic analysis device driven by an intelligent large model. The heterogeneous traffic analysis device includes a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the heterogeneous traffic analysis method described above.

[0027] Thirdly, embodiments of this application also provide an intelligent large-model driven heterogeneous traffic analysis system, including a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor executes the computer program to implement the steps of any of the methods described above.

[0028] This application has at least the following beneficial effects:

[0029] This application collects side-channel features of encrypted traffic, including temporal and structural features. Based on the length, traffic direction, and arrival timestamp relative to the session start time of each data packet in a single session, the static positional encoding method of the Transformer model is modified to dynamically encode the side-channel features, obtaining the first feature vector of each data packet. This enhances the model's dynamic perception of the temporal behavior of encrypted traffic. The fixed sinusoidal positional encoding of traditional Transformers is difficult to adapt to the non-uniform temporal characteristics of network traffic. This application introduces traffic direction weights and timestamp relative offsets, enabling the model to accurately capture the spatiotemporal correlation patterns of data packets within a session. This avoids the over-reliance on the assumption of network traffic continuity in traditional methods and solves the problem of feature scarcity caused by the invisible payload of encrypted traffic. Through dynamic encoding, the Transformer model can more accurately capture the stable patterns of normal traffic and the abrupt changes of abnormal traffic, improving the accuracy and robustness of subsequent traffic attack identification. A second feature vector is constructed based on the network layer IP and transport layer port number in the quintuple. The application layer's digital... Certificates and encryption suites are used to construct a third feature vector; user IDs and access paths from business system logs in computer networks are used to construct a fourth feature vector; the depth of feature representation is improved through hierarchical fusion of multimodal features; learnable bias vectors are assigned to each feature vector to form a modal bias matrix, which serves as a learnable parameter in the Transformer model training process and corrects the expression of the attention mechanism in the Transformer model; the rigidity of weight allocation in traditional multimodal fusion is overcome, achieving deep correlation between time-sensitive side-channel features and contextual semantic features, solving the cross-modal semantic confusion problem in traditional fusion methods, providing high-value inputs containing multi-dimensional correlation information for subsequent detection models, and improving the model's decision robustness in hybrid attack scenarios; the fused feature vector of all feature vectors is obtained using the corrected attention mechanism; the fused feature vector integrates the temporal dependency of side-channel features, traffic structure information, and protocol semantics and business context of multimodal features, and is used for subsequent traffic attack detection and classification, improving the model's sensitivity to detecting hidden threats in encrypted traffic and increasing the accuracy of traffic detection. Attached Figure Description

[0030] To more clearly illustrate the technical solutions and advantages in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0031] Figure 1 A flowchart illustrating the steps of a smart large model-driven heterogeneous traffic analysis method provided in one embodiment of this application;

[0032] Figure 2 A flowchart is defined for fusing feature vectors. Detailed Implementation

[0033] To further illustrate the technical means and effects adopted by this application to achieve the intended inventive purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, details the specific implementation, structure, features, and effects of a smart large-model driven heterogeneous flow analysis method, device, and system proposed in this application. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics in one or more embodiments can be combined in any suitable form.

[0034] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0035] The following description, in conjunction with the accompanying drawings, details the specific scheme of the intelligent large-model driven heterogeneous flow analysis method, device, and system provided in this application.

[0036] Please see Figure 1 The diagram illustrates a flowchart of a method for heterogeneous traffic analysis driven by a smart large model, according to an embodiment of this application. The method includes the following steps:

[0037] S1, collect the side-channel characteristics of the encrypted traffic, wherein the side-channel characteristics include timing characteristics and structural characteristics.

[0038] This embodiment uses an eBPF kernel probe to collect side-channel characteristics of encrypted traffic, including timing and structural characteristics. The eBPF kernel probe is a kernel-level dynamic monitoring mechanism based on Extended Berkeley Packet Filter (eBPF) technology. It captures kernel-mode data in real time by attaching lightweight programs to the operating system kernel's network protocol stack, system call interfaces, or performance event points, and efficiently transfers the data to user space using zero-copy technology.

[0039] The core features of the eBPF kernel probe are that it does not require modification of the kernel source code or loading of kernel modules, can be dynamically injected and securely isolated, supports nanosecond-level precision time-series data acquisition and protocol-independent traffic feature extraction, and is especially suitable for side-channel analysis scenarios of encrypted traffic. By capturing metadata such as the five-tuple, timestamp, and packet length of data packets, it can achieve fine-grained monitoring of network behavior with low performance loss, providing underlying data support for subsequent feature modeling and security detection.

[0040] Specifically, the eBPF kernel probe obtains structured side-channel feature data for a single session based on all raw data packets and kernel-mode skb buffer pointers. The temporal features consist of a time interval sequence composed of timestamps for each data packet and the session duration; the structural features consist of a packet length sequence composed of the lengths of each data packet and a traffic direction identifier. The side-channel feature data is in binary format.

[0041] S2, based on the length, flow direction, and arrival timestamp relative to the session start time of each data packet in a single session, the static position encoding method of the Transformer model is modified, and the side channel features are dynamically encoded to obtain the first feature vector of each data packet.

[0042] Traditional Transformer models rely solely on fixed position indices for static location encoding, failing to capture dynamically changing time intervals within encrypted traffic. This includes differences between bursty and periodic communication, packet length characteristics (e.g., large packets may carry malicious payloads), and traffic direction (e.g., client-initiated attacks). Consequently, Transformer models lack sufficient semantic representation capabilities for temporal patterns and traffic structure. Since encrypted traffic parsing depends on side-channel characteristics, this embodiment constructs a dynamic encoding method that integrates time, structure, and direction information to enhance the Transformer model's sensitivity to anomalous patterns in encrypted traffic.

[0043] This application improves the position encoding formula of the traditional Transformer model by introducing a side-channel feature weighting term. The specific improved position encoding formula is as follows: ;in, Let be the location encoding formula for the i-th data packet, denoted as the dynamic location encoding vector. The basic timing code for the i-th data packet uses a sine / cosine function to encode the time interval sequence, replacing the static position index. The expression is: ,in, Let be the session start time corresponding to the i-th data packet. Let be the average timestamp interval of all data packets in the session corresponding to the i-th data packet, and j be the index of the hidden layer dimension of the Transformer model. This represents the hidden layer dimension of the Transformer model, which is 512 in this embodiment. The frequency scaling factor increases exponentially with increasing dimension j, allowing lower dimensions to correspond to lower frequencies (long intervals) and higher dimensions to correspond to higher frequencies (short intervals), thus achieving multi-resolution encoding of time intervals. Essentially, it defines a frequency range. C is a preset value, ranging from 1000 to 1e6. In this embodiment, C is 10000. sin() is the trigonometric sine function, and cos() is the trigonometric cosine function. Let be the length of the i-th data packet. The preset weighting coefficients are between 0 and 1. Symbol encoding for the traffic direction of the i-th data packet.

[0044] It should be understood that the absolute time interval of the i-th data packet relative to the session start time directly reflects the temporal distribution of traffic. Eliminate time unit differences between different sessions to ensure consistent encoding scale. The formula represents a sine / cosine orthogonal basis, where sine and cosine components of the same frequency form a two-dimensional vector, and are separated by phase difference. It provides orthogonal temporal direction information to enhance the spatial discriminativeness of positional encoding. Sine / cosine functions are used to periodically encode the arrival time intervals of data packets, reflecting the temporal distribution patterns of traffic; for example, abrupt changes in intervals may indicate an attack. Mapping continuous time intervals to a periodic space of [-1, 1] allows the Transformer model to capture cyclical patterns. By defining frequency components of different dimensions j, the Transformer model is allowed to learn multi-timescale dependencies through cross-dimensional feature interactions. Furthermore, the additive property of trigonometric functions enables the Transformer model to generalize to untrained time intervals, a capability lacking in static index-based absolute positional encoding.

[0045] This represents the packet length weighting factor, which is applied to the length of the i-th data packet. Power-law scaling is performed to adjust the strength of the timing code. This represents the weighting coefficient, with a value range of 0 to 1. In this embodiment... A value of 0.3 makes the timing variations of long packets have a greater impact on the encoding, since malicious payloads often contain large packets. Symbolic encoding indicating the direction of traffic is used to distinguish the temporal importance of requests and responses, since attacks are usually initiated by the client.

[0046] The computational method enables the encoded vector to simultaneously incorporate temporal dependencies and traffic structure, providing the Transformer model with richer input features and addressing the feature scarcity problem caused by the invisible payload of encrypted traffic. Through dynamic encoding, the Transformer model can more accurately capture the stable patterns of normal traffic and the abrupt changes of abnormal traffic, improving the accuracy and robustness of subsequent traffic attack identification.

[0047] Based on this, this embodiment utilizes The location coding method encodes the side-channel feature data of a single session, including temporal and structural features. It obtains the dynamic location coding vector for each data packet in the session. Let be the first feature vector, and let its dimension be the same as the hidden layer of the Transformer model. Consistent, each dimension is generated by fusing time interval, packet length, and direction information, and is used as the input encoding for the Transformer model for subsequent temporal dependency modeling and feature extraction.

[0048] S3. Construct a second feature vector based on the network layer IP and transport layer port number in the 5-tuple; construct a third feature vector using digital certificates and encryption suites at the application layer; and construct a fourth feature vector based on the user ID and access path in the business system logs of the computer network.

[0049] While location encoding of side-channel features can capture the temporal dependencies and structural characteristics of traffic sequences, such as packet length variations and time interval patterns, it lacks specific business semantics and cross-layer correlation information, such as the identities of the communicating parties, protocol types, and business operation intentions. Location encoding of packet length sequences alone cannot determine whether traffic belongs to a malicious encrypted tunnel. Multimodal features such as IP reputation at the network layer, TLS certificate fingerprints at the application layer, and abnormal access frequencies in business logs can provide crucial semantic support for the Transformer model. This embodiment dynamically associates location encoding with multimodal features through a cross-modal attention mechanism. This allows the Transformer model to not only perceive temporal anomalies in traffic, such as high-frequency small packet transmissions within a short period, but also combine semantic features such as suspicious IPs at the network layer and unfamiliar certificates at the application layer to achieve accurate semantic parsing and threat assessment of encrypted traffic. This compensates for the semantic deficiencies of single-side-channel features and improves the accuracy and generalization ability of traffic detection in complex scenarios.

[0050] Based on the above analysis, this embodiment first obtains the network layer IP address and transport layer port number based on the IP 5-tuple. This embodiment uses the packet parsing tool Scapy to extract the IP address, performs SHA-256 hashing on the IP address, and generates a fixed-length (256-bit) hash value. Secondly, it performs one-hot encoding on the transport layer port number to generate a sparse vector. Each port number is mapped to a binary vector, where only the position corresponding to the port number is 1, and the rest are 0. This preserves the classification independence of the port numbers and prevents the Transformer model from mistakenly treating them as continuous values. Assuming the maximum value of the port number is N, the dimension of the one-hot vector corresponding to each port number p is N, and only the p-th bit is 1, with the rest being 0. Finally, the hash value and the sparse vector are concatenated and mapped through the linear layer of the Transformer model to... Dimension, construct a quintuple feature vector, denoted as the second feature vector.

[0051] Furthermore, a third feature vector is constructed using the digital certificate and cipher suite at the application layer. The application layer features are the certificate hash and the cipher suite. Specifically, the digital certificate is processed using the same method as the IP address to obtain its corresponding hash value, which serves as the certificate hash. Next, the cipher suite encoding is obtained through an embedding layer mapping. The certificate hash and the cipher suite encoding are concatenated and mapped through a linear layer of the Transformer model to... Dimension, construct the application layer feature vector, denoted as the third feature vector.

[0052] Retrieve user IDs and access paths from the business system log files of the computer network. Process the user ID using the same method as the IP address to obtain its corresponding hash value, denoted as the user ID hash. Tokenize the access path and generate a numerical sequence using BERT word embedding. Then, concatenate the user ID hash with the numerical sequence and map it through a linear layer of the Transformer model. Dimension, construct the business log feature vector, denoted as the fourth feature vector.

[0053] S4 assigns learnable bias vectors to each feature vector to form a modal bias matrix, which serves as a learnable parameter during the Transformer model training process, and corrects the expression of the attention mechanism in the Transformer model; using the corrected attention mechanism, the fused feature vector of all feature vectors is obtained.

[0054] Traditional multimodal fusion methods ignore the semantic gaps and distributional differences between different modalities, leading to modality confusion when associating cross-modal features. This means that the Transformer model struggles to distinguish the source of features, mistakenly introducing noise from irrelevant modalities into its decision-making. For example, when directly concatenating IP address hashes with TLS cipher suite encoding, the Transformer model may incorrectly amplify the weights of irrelevant features. Therefore, a mechanism is needed to explicitly encode modal differences, guiding the attention mechanism in the Transformer model to focus on effective associations within the same modality and suppressing cross-modal noise interference.

[0055] Based on the above analysis, this embodiment constructs a modality bias matrix, assigning a learnable bias vector to each modality. Specifically, a learnable bias vector is assigned to each of the side channel, quintuple, application layer, and business system logs. The modality bias matrix is ​​then composed of these bias vectors. These bias vectors are injected into the attention score matrix during multi-head attention computation to dynamically adjust the association weights of different modal features. By explicitly modeling modal identities, attention preference for features within the same modality is enhanced. For example, when calculating the association between network layer IP features and side channel packet length sequences, the modality bias matrix adds a positive bias to the key-value pairs corresponding to the quintuple modality, making the attention mechanism more inclined to focus on feature associations within the network layer, while applying a negative adjustment to weakly correlated features across modalities. This bias is dynamically optimized through backpropagation to adapt to modal interaction patterns in different scenarios.

[0056] Specifically, in this embodiment, the dynamic position encoding vectors of all data packets in a single session are first compressed into a 512-dimensional representation vector using average pooling. Then, this representation vector is used as the query vector Q. The feature vectors of other modalities are then linearly transformed through the key matrix and value matrix to obtain the key vector K and value vector V, respectively. Linear transformation is a well-known technique, and the key matrix and value matrix are parameters obtained during the training of the Transformer model. The specific steps are not detailed here.

[0057] A learnable bias vector is assigned to each modality, initialized with random values, to encode the unique semantic features of each modality. The dimension of the bias vector is the key vector dimension of a single head in a multi-head attention mechanism, i.e., the ratio of the hidden layer dimension of the Transformer model to the number of attention heads. The bias vector serves as a parameter of the Transformer model and is optimized during training along with attention weights, linear layer weights, and other parameters through backpropagation. The bias vectors of all modalities are concatenated row-wise to form a matrix, i.e., the modality bias matrix. When calculating the attention score, the modality bias matrix is ​​added to the original attention score to form a score matrix with modality preference, denoted as the cross-modal attention mechanism.

[0058] The single-head attention expression for the cross-modal attention mechanism is: Where Q represents the query vector, specifically the first feature vector, which is the vector generated after the side-channel features are dynamically position-encoded. This represents the target information that needs attention. It is used to calculate the similarity with the key vector K of other modalities to determine the attention weight. K represents the key vector, namely the feature vector of the quintuple, application layer, and business system logs. It calculates the similarity with the query vector to represent the content that needs attention. V represents the transpose of the key vector, and V represents the value vector, which is the feature vector from the same modality as the key vector. The feature vectors are weighted and summed according to the attention weights to generate the final output. This represents a scaling factor used to scale the dot product similarity and prevent gradient vanishing. Specifically, the dimension of the key vector. This represents the modality bias matrix, explicitly encoding the semantic differences between different modalities, namely side channels, quintuples, application layers, and business system logs, thus solving the information confusion problem of traditional attention mechanisms in cross-modal scenarios. This represents the activation function.

[0059] After parallel computation via a multi-head attention mechanism, the outputs of each head are concatenated and residually connected with the original side-channel representation (i.e., the representation vector), and then normalized to generate a fused feature vector. This process achieves a deep correlation between time-sensitive side-channel features and contextual semantic features, solving the cross-modal semantic confusion problem in traditional fusion methods and providing high-value input containing multi-dimensional correlation information for subsequent detection models. The fused feature vector integrates the temporal dependencies of side-channel features, traffic structure information, and the protocol semantics and business context of multi-modal features, and is used for subsequent traffic attack detection and classification. The flowchart for determining the fused feature vector is shown below. Figure 2 As shown.

[0060] S5, a lightweight classifier is used to perform attack detection on the input traffic of the fused feature vector.

[0061] Furthermore, a lightweight classifier is employed to detect attacks on the fused feature vectors. This lightweight classifier uses depthwise separable convolution technology, decomposing standard convolution into depthwise convolution and pointwise convolution, significantly reducing computational cost while maintaining feature representation capabilities. Specifically:

[0062] This embodiment uses MobileNetV3 as the basic network architecture. First, the fused feature vector output by the cross-modal attention mechanism is adjusted to a tensor format suitable for the input, for example, by adding a batch dimension to form [1, 512]. After normalization, it is input into the first fully connected layer and mapped to the dimension matching the inverted residual block. Subsequently, feature extraction is performed through multiple inverted residual blocks. Within each inverted residual block, the number of channels is first expanded by 1x1 point convolution, and then local features are extracted channel by channel by depthwise separable convolution. The Swish activation function is combined to enhance the nonlinear expression. Finally, the channels are compressed by 1x1 point convolution and connected to the Squeeze-and-Excitation module, which dynamically adjusts the channel weights according to the global context to focus on key features. After multi-layer feature extraction, the fused feature vector is input into the average pooling layer to reduce the dimensionality to 128 dimensions, and then mapped to the classification dimension through the fully connected layer. Finally, the Sigmoid function outputs an attack probability value of 0 to 1, representing the confidence that the input traffic is an attack. The MobileNetV3 network structure is a well-known existing technology, and the specific process is not described in detail.

[0063] Based on the same inventive concept as the above method, this application embodiment also provides a heterogeneous traffic analysis device driven by an intelligent large model. The heterogeneous traffic analysis device includes a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the heterogeneous traffic analysis method described in any of the above claims.

[0064] Based on the same inventive concept as the above methods, this application also provides an intelligent large model-driven heterogeneous traffic analysis system, including a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, it implements the steps of any one of the above-described intelligent large model-driven heterogeneous traffic analysis methods.

[0065] It should be noted that the order of the embodiments described above is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. Furthermore, specific embodiments of this specification have been described above. Additionally, the processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired results. In some implementations, multitasking and parallel processing are possible or may be advantageous.

[0066] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0067] The above description is only a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the principles of this application should be included within the protection scope of this application.

Claims

1. A method for intelligent large model driven heterogeneous traffic analysis, characterized in that, The method comprises the following steps: Collecting side channel features of encrypted traffic, wherein the side channel features include timing features and structural features; Based on the length of each data packet, the traffic direction, and the arrival timestamp relative to the session start time in a single session, the static position encoding method of the Transformer model is corrected, and the side channel features are dynamically position encoded to obtain a first feature vector of each data packet; Based on the network layer IP and the transport layer port number in the five-tuple, a second feature vector is constructed; based on the digital certificate and the encryption suite of the application layer, a third feature vector is constructed; based on the user ID and the access path in the service system log of the computer network, a fourth feature vector is constructed; A learnable bias vector is assigned to each feature vector for dynamically adjusting the correlation weight of different modal features; the bias vectors of all feature vectors are combined to form a modal bias matrix as a learnable parameter in the training process of the Transformer model, and the expression of the attention mechanism in the Transformer model is corrected; using the corrected attention mechanism, a fusion feature vector of all feature vectors is obtained; A lightweight classifier is used to detect attacks on the input traffic based on the fusion feature vector; The expression of the attention mechanism in the corrected Transformer model comprises: ; wherein Q represents a query vector, specifically the first feature vector, K represents a key vector, specifically any one of the second feature vector, the third feature vector, the fourth feature vector, is a transpose of the key vector, and V is a value vector, represents a scaling factor, is a dimension of the key vector, is a modal bias matrix, used to explicitly encode semantic differences between different modalities to solve the information confusion problem in the cross-modal scene, represents an activation function.

2. The intelligent large model-driven heterogeneous traffic analysis method of claim 1, wherein, The side channel features include: The session duration of a single session, the timestamp interval of each data packet, the length of each data packet, and the traffic direction identifier of each data packet.

3. The intelligent large model-driven heterogeneous traffic analysis method of claim 1, wherein, The static position encoding method of the corrected Transformer model comprises: The position encoding formula of the ith data packet is wherein, is the arrival timestamp of the ith data packet relative to the session start time, is the base timing encoding of the ith data packet, is the length of the ith data packet, is a preset weight coefficient with a value between 0 and 1, is the symbol encoding of the traffic direction of the ith data packet; wherein, ; in the formula, is a session start time of a session corresponding to the i th data packet, is a mean value of timestamp intervals of all data packets in the session corresponding to the i th data packet, j is a hidden layer dimension index of the Transformer model, is a hidden layer dimension of the Transformer model, and C is a preset value, represents a frequency scaling factor, sin() is a trigonometric sine function, and cos() is a trigonometric cosine function.

4. The intelligent large model-driven heterogeneous traffic analysis method of claim 1, wherein, The determination of the second feature vector comprises: The IP address of the network layer is hashed to generate a fixed-length hash value, the transport layer port number is one-hot encoded to generate a sparse vector, and the hash value and the sparse vector are spliced and linearly mapped to the hidden layer dimension of the Transformer model to obtain the second feature vector.

5. The intelligent large model-driven heterogeneous traffic analysis method of claim 1, wherein, The determination of the third feature vector comprises: Through the digital certificate of the application layer, a certificate hash is obtained using a hash algorithm, and the certificate hash and the encryption suite of the application layer are spliced and linearly mapped to the hidden layer dimension of the Transformer model to obtain the third feature vector.

6. The intelligent large model-driven heterogeneous traffic analysis method of claim 1, wherein, The determination of the fourth feature vector comprises: The user ID is hashed to generate a fixed-length hash value, and the access path is tokenized to generate a numerical sequence through word embedding, and the hash value of the user ID and the numerical sequence are linearly mapped to the hidden layer dimension of the Transformer model to obtain the fourth feature vector.

7. The intelligent large model-driven heterogeneous traffic analysis method of claim 1, wherein, The detection of attacks on the input traffic based on the fusion feature vector using a lightweight classifier comprises: Using the MobileNetV3 network architecture, the fusion feature vector is taken as input, and the output is an attack probability value representing the confidence of the input traffic being an attack.

8. An intelligent large model-driven heterogeneous traffic analysis device, characterized in that, The heterogeneous traffic analysis device comprises a processor, a memory, and a computer program stored in the memory and executable on the processor, the processor implementing the method of heterogeneous traffic analysis according to any one of claims 1-7 when executing the computer program.

9. An intelligent large model driven heterogeneous traffic analysis system, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, The processor implements the steps of the method according to any one of claims 1-7 when executing the computer program.

Images