Network data concept drift self-supervision detection classification method and system

Abstract

The invention relates to the cross technical field of artificial intelligence and network data analysis, in particular to a network data concept drift self-supervision detection classification method and system.The network data concept drift self-supervision detection classification method comprises the steps that label-free network data is obtained from a data stream, and a positive sample pair is constructed through a mixed data enhancement strategy; performing feature extraction on the positive sample pair and the negative sample pair by using a Vision Transform feature extraction network of a double-branch fusion hybrid expert model, and optimizing the model through an InfoNCE loss function; in the downstream task stage, a classification branch and a confidence coefficient branch are added in parallel on the basis of the pre-trained Vision Transform feature extraction network fused with the hybrid expert model, and the category prediction probability and the confidence coefficient are output respectively; calculating a confidence coefficient threshold value by utilizing samples which are correctly classified and wrongly classified in the verification set and combining a grid search method; and judging whether the sample data has concept drift or not according to a confidence coefficient threshold value. According to the method, the detection and classification performance of network data concept drift is remarkably improved in a few-label scene.

Description

Technical Field

[0001] The present invention relates to the technical field of intersection of artificial intelligence and network data analysis, and in particular to a method and system for self-supervised detection and classification of network data concept drift, which is suitable for detection and classification of network data concept drift in the case of insufficient label data. Background Art

[0002] In a constantly changing data stream, network data is subject to factors such as hardware environment changes, network structure adjustments, user behavior evolution, communication protocol iterations, and escalating attack methods. This dynamic change in data distribution and characteristics leads to the occurrence of concept drift. The existence of concept drift poses a severe challenge to model classification performance. Traditional classification algorithms typically assume that data distribution is static, meaning that training and test data follow the same distribution. However, due to concept drift, data distributions often change over time, making the knowledge learned during model training ineffective in applying to new data distributions, resulting in a significant decline in classification performance.

[0003] In the classification problem under the concept drift context, the goal is to train a classifier f:X that can dynamically adapt to the new distribution t →y t , where X is the data instance and y is the label. Its goal is to minimize the expected risk:

[0004]

[0005] Where L(·) is the loss function.

[0006] Concept drift detection is to determine whether concept drift has occurred at time t. The specific description is as follows:

[0007] First, define a concept drift detection function h(X t )→{0,1}. If concept drift occurs at time t, then h(X t )=1; if concept drift does not occur at time t, then h(X t )=0.

[0008] The confidence value c(X t ), the confidence value can be defined as the confidence of the classifier in the prediction result of the data instance at time t:

[0009] c(X t )=maxP(y t |X t )

[0010] Among them, P(y t |X t) is the category probability distribution output by the classifier.

[0011] With the above description of the detection function and confidence value, how to determine whether concept drift has occurred requires setting a confidence threshold δ as the critical value for judging whether concept drift has occurred. In summary, the concept drift detection function can be further described as:

[0012]

[0013] The basic process of concept drift detection is divided into four stages: data collection, model construction, threshold calculation, and detection. The basic framework is as follows: Figure 1 As shown in the figure, data collection primarily involves obtaining data blocks from the data stream. Because a single data point cannot fully reflect the overall distribution, multiple data points need to be combined into data blocks. Model building primarily involves extracting data features from each time period, particularly modeling the features that have the greatest impact on concept drift detection. Threshold calculation primarily involves quantifying data from different time periods to derive a threshold estimate of the degree of concept drift. Detection primarily involves using threshold evaluation to measure the quantitative state of data within different time periods, thereby determining the extent of concept drift.

[0014] The research of Hendrycks et al. is based on the premise of sufficient labeled data and uses the idea of ​​supervised training. However, no research is conducted on the situation where the number of labels is insufficient. In addition, more research is done on image and natural language tasks compared to tasks involving network data, and there is no effective way to construct positive samples for network data. Most concept drift detection algorithms based on deep learning use the softmax output threshold method. Although it is simple to implement, the detection effect is not ideal in some scenarios. The problem of selecting the detection threshold also needs to be solved urgently. Existing algorithms usually require additional labels or obtain category concept drift samples in advance to calculate the detection threshold, which is difficult to achieve or has a high cost in practical applications. Summary of the Invention

[0015] The present invention aims to solve the problems in the prior art such as the decline in detection and classification performance when labels are insufficient, the lack of effective methods for constructing positive sample pairs in network data through contrastive learning, the unsatisfactory detection effect of softmax output threshold, and the dependence of threshold calculation on additional labels or samples. A self-supervised detection and classification method and system for concept drift in network data are proposed. Through the Vision Transformer feature extraction network of a dual-branch fusion hybrid expert model, a hybrid data enhancement strategy, and a grid search threshold calculation method, the detection and classification performance of concept drift in network data is significantly improved in low-label scenarios.

[0016] In order to achieve the above purpose, the technical solutions adopted are:

[0017] The present invention provides a method for self-supervised detection and classification of network data concept drift, comprising the following steps:

[0018] Obtain unlabeled network data from the data stream and construct positive sample pairs through a hybrid data augmentation strategy;

[0019] Use the Vision Transformer feature extraction network with a dual-branch fusion hybrid expert model to extract features from positive and negative sample pairs, and optimize the model using the InfoNCE loss function;

[0020] In the downstream task stage, a classification branch and a confidence branch are added in parallel based on the pre-trained Vision Transformer feature extraction network of the fusion hybrid expert model to output the category prediction probability and confidence respectively;

[0021] The confidence threshold is calculated using the correctly and incorrectly classified samples in the validation set and the grid search method;

[0022] Determine whether concept drift occurs in sample data based on the confidence threshold.

[0023] According to the network data concept drift self-supervised detection and classification method of the present invention, further, the hybrid data enhancement strategy is a combined operation of adding Gaussian noise, adding uniform noise, random masking and data flipping.

[0024] According to the network data concept drift self-supervised detection and classification method of the present invention, further, the Vision Transformer feature extraction network fused with the hybrid expert model includes:

[0025] A multi-layer MoE-Transformer encoder is used for feature extraction. The MoE-Transformer encoder introduces a sparse MoE layer to replace the feedforward neural network layer based on the standard Transformer encoder. The MoE layer dynamically selects experts to process different input tokens.

[0026] According to the network data concept drift self-supervised detection and classification method of the present invention, further, the calculation formula of the InfoNCE loss function is:

[0027]

[0028] Where, sim(·) is the cosine similarity, (z i ,z j ) is the feature vector pair of positive sample pairs, (z i ,z k ) is the eigenvector pair of negative sample pairs, and τ is the temperature coefficient.

[0029] According to the network data concept drift self-supervised detection and classification method of the present invention, further, in the downstream task stage, the classification branch outputs the category prediction probability p through the softmax function, and the confidence branch outputs the confidence c through the sigmoid function; the classification branch and the confidence branch both adopt a network structure including three fully connected layers; and the confidence c is used to correct the category prediction probability p during the training process.

[0030] According to the network data concept drift self-supervised detection and classification method of the present invention, the formula for correcting the category prediction probability p using the confidence c is:

[0031] p i ′=c·p i +(1-c)y i

[0032] Where p i ′ represents the corrected predicted probability of each category, p i Represents the original predicted probability of the category, y i is the target probability distribution, and c is the confidence level.

[0033] According to the network data concept drift self-supervised detection and classification method of the present invention, further, the total loss function of the network model in the downstream task stage is:

[0034] The classification task loss uses negative log-likelihood loss, which is calculated based on the corrected category prediction probability;

[0035] The confidence loss adopts logarithmic loss;

[0036] The total loss function is the weighted sum of the classification task loss and the confidence loss.

[0037] According to the network data concept drift self-supervised detection and classification method of the present invention, further, the calculation process of the confidence threshold includes:

[0038] First, the SMOTE algorithm is used to oversample the samples with incorrect classification in the validation set to balance the number of samples with the number of correctly classified samples;

[0039] Then calculate the confidence of correctly classified samples and incorrectly classified samples respectively;

[0040] Based on the grid search method, the confidence level that minimizes the detection error rate is selected as the threshold.

[0041] Furthermore, the present invention also provides a network data concept drift self-supervised detection and classification system for implementing the above-mentioned network data concept drift self-supervised detection and classification method, the system comprising:

[0042] The data augmentation module is used to obtain unlabeled network data from the data stream and construct positive sample pairs through a hybrid data augmentation strategy;

[0043] The feature extraction module is used to extract features from positive and negative sample pairs using the Vision Transformer feature extraction network of the dual-branch fusion hybrid expert model, and optimize the model using the InfoNCE loss function;

[0044] The classification module is used to add a classification branch and a confidence branch in parallel to the pre-trained VisionTransformer feature extraction network of the fusion hybrid expert model in the downstream task stage, outputting the category prediction probability and confidence respectively;

[0045] The confidence threshold module is used to calculate the confidence threshold using the correctly and incorrectly classified samples in the validation set combined with the grid search method;

[0046] The drift detection module is used to determine whether concept drift occurs in sample data based on the confidence threshold.

[0047] The beneficial effects achieved by adopting the above technical solution are:

[0048] 1. Dual-branch network enhances feature extraction and task adaptation: The Vision Transformer feature extraction network uses a dual-branch fusion mixture of experts (MoE) model to improve the feature expression ability of high-dimensional network data through dynamic expert selection and contrastive learning pre-training. The classification and confidence branches are optimized in parallel, and the confidence is used to correct the category prediction probability, enhancing classification robustness and detection reliability.

[0049] 2. Hybrid data augmentation improves contrastive learning: We design a combined data augmentation strategy, such as Gaussian noise and random masking, to construct positive sample pairs, maximizing feature consistency across different views of the same data. Experiments have shown that hybrid strategies improve classification accuracy by over 10% compared to single strategies, effectively capturing the intrinsic characteristics of network data.

[0050] 3. Grid search method to optimize threshold calculation: Using SMOTE to balance the validation set data, grid search is used to traverse the confidence range to obtain the optimal threshold. Compared with the traditional mean method, the detection error rate is reduced by 21.3% when the label ratio is 1%, reducing outlier interference and improving threshold reliability.

[0051] 4. Significant performance advantages in low-label scenarios: Compared with the baseline algorithm, the detection error rate dropped from 13.69% to 8.80%; compared with models such as ResNet50 and ViT, MoE-Transformer achieved the lowest detection error rate (9.43%) and the highest classification accuracy (96.04%). It only required 1% of the labels to achieve a classification accuracy of 95.52%, significantly reducing reliance on manual labeling. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings of the embodiments of the present invention. The drawings are only used to illustrate some embodiments of the present invention, but not to limit all embodiments of the present invention thereto.

[0053] Figure 1 This is the basic framework diagram of the existing concept drift detection;

[0054] Figure 2 This is an overall network structure diagram of the network data concept drift self-supervised detection and classification method according to an embodiment of the present invention;

[0055] Figure 3 1 is a diagram of the MoE-Transformer encoder network structure according to an embodiment of the present invention;

[0056] Figure 4 It is a parallel structure of the classification branch and the confidence branch of the embodiment of the present invention;

[0057] Figure 5 1 is a schematic diagram of a confidence threshold calculation process based on a grid search method according to an embodiment of the present invention;

[0058] Figure 6 It is the linear evaluation result of constructing positive samples using different data enhancement strategies in the embodiment of the present invention. DETAILED DESCRIPTION

[0059] The following will be combined with the accompanying drawings of specific embodiments of the present invention to clearly and completely describe the exemplary embodiments of the present invention. Unless otherwise defined, technical or scientific terms used in the present invention should be given the common meanings understood by people with ordinary skills in the relevant field.

[0060] This embodiment discloses a self-supervised detection and classification method for network data concept drift, including the following steps:

[0061] Step S1: Obtain unlabeled network data from the data stream, and construct positive sample pairs through a hybrid data enhancement strategy, and improve the model's learning ability to represent information through the hybrid data enhancement set.

[0062] In the contrastive learning phase, the construction of sample pairs is one of the core links, which directly affects the learning effect and representation ability of the model. Different augmented views from the same data can be represented as:

[0063]

[0064] Where T(·) is the data augmentation function.

[0065] In the field of image contrast learning, data enhancement is performed by using methods such as random cropping, flipping, color distortion, and adding Gaussian blur. In the field of natural language processing contrast learning, data enhancement is performed by using methods such as sentence segmentation and adjusting the order of the front and back. These methods have one thing in common, that is, the construction of positive sample pairs needs to be as similar as possible in semantics, that is, sim(z i ,z j ) should be as large as possible. Similarly, in the task of constructing positive sample pairs of network data, T(·) should keep the semantic information of network data unchanged. Usually comes from different data samples, and its construction can be expressed as:

[0066]

[0067] Where D k≠i is the distribution of negative samples. The construction of negative sample pairs needs to be as different as possible in semantics, that is, sim(z i ,z k ) should be as small as possible. In summary, the optimization goal of sample pair construction can be written as:

[0068]

[0069] To achieve the goals of network data contrastive learning tasks, we referenced data augmentation strategies commonly used in the field of image contrastive learning. From an image processing perspective, adding Gaussian noise and color distortion simulates noise by adjusting pixel values. Cropping parts of an image is equivalent to randomly masking some features from a data feature perspective. Image flipping is more intuitively manifested as mirroring the data sequence. This example uses a combination of adding Gaussian noise, adding uniform noise, random masking, and data flipping to construct positive sample pairs to enhance the effectiveness of contrastive learning tasks.

[0070] Step S2: Use the VisionTransformer feature extraction network, a dual-branch fusion mixture of experts (MoE) model, to extract features from positive and negative sample pairs. The model is optimized using the InfoNCE loss function. The MoE-ViT feature extraction network extracts useful representation information from unlabeled high-dimensional network data during the contrastive learning phase and, combined with the InfoNCE loss function, maximizes the consistency between different enhancement results for the same network data to train the network model.

[0071] Due to the different training objectives in the contrastive learning phase and the downstream task fine-tuning phase, there are certain differences in the network model design, which are specifically reflected in the design of the head branch and the overall network design. Figure 2 shown.

[0072] In the contrastive learning phase, the unlabeled data x is first generated into positive sample pairs through two different data augmentation strategies. Each enhanced sample then undergoes linear projection, category embedding, and position embedding to complete feature transformation. Next, the sample pair is fed into a Transformer encoder containing a six-layer fused mixture of experts model (MoE-Transformer encoder) for feature extraction. After feature extraction, the category embedding vector is extracted from the sample pair and optimized using the InfoNCE loss function:

[0073]

[0074] Where, sim(·) is the cosine similarity, (z i ,z j ) is the feature vector pair of positive sample pairs, (z i ,z k ) is the eigenvector pair of negative sample pairs, and τ is the temperature coefficient.

[0075] The MoE-Transformer encoder network structure is as follows Figure 3 As shown in Figure 1, the MoE-Transformer encoder introduces a sparse MoE layer on top of the standard Transformer encoder to replace the traditional feedforward neural network layer. The MoE layer dynamically selects different experts to process different input tokens, thereby increasing the expressive power of the model while maintaining computational efficiency.

[0076] Step S3: In the downstream task stage, a classification branch and a confidence branch are added in parallel based on the pre-trained VisionTransformer feature extraction network of the fusion hybrid expert model, and the category prediction probability and confidence are output respectively to complete the classification task and concept drift detection task.

[0077] In the downstream task stage, the network model pre-trained in the comparative learning stage is migrated, and the classification branch and confidence branch are added on its basis. The classification branch and the confidence branch both use a network structure containing three layers of fully connected layers to achieve classification and detection functions. Figure 4 shown.

[0078] In the downstream task stage, the model calculates the input data based on the basic feature extraction module f(·) through the classification branch module f Classification head (·) and confidence branch module f Confidence head (·), the output of the classification branch module is converted into the category prediction probability p through the softmax function, and the output of the confidence branch module is calculated through the sigmoid function to obtain a single-valued confidence c between 0 and 1:

[0079] p=g softmax (f Classification head (f(x)))

[0080] c=g sigmoid (f Confidence head (f(x)))

[0081] Where p i ,c∈[0,1],

[0082] In order to use the confidence level c to evaluate the reliability of classification predictions during training, the category prediction probability is corrected. The correction formula is as follows:

[0083] p i ′=c·p i +(1-c)y i

[0084] Where p i ′ represents the corrected predicted probability of each category, p i Represents the original predicted probability of the category, y i is the target probability distribution, and c is the corresponding confidence level.

[0085] During training, the corrected class prediction probabilities are used to calculate the classification task loss. In the experiment, negative log-likelihood loss is used:

[0086]

[0087] At the same time, to prevent the network from always choosing c=0, make p i ′Receiving the true target probability y i , to minimize the classification task loss, introduce confidence loss, and adopt the logarithmic loss form to achieve the penalty effect on the total loss. The formula is as follows:

[0088] L 置信度损失 = -log(c)

[0089] Where c is the confidence level.

[0090] The final total loss function is the weighted sum of the classification task loss and the confidence loss:

[0091]

[0092] Where: λ is the weight hyperparameter of the loss function, which is used to balance the proportion of classification task loss and confidence loss. The value selected in the experiment is 0.2.

[0093] Step S4: Calculate the confidence threshold using the correctly and incorrectly classified samples in the validation set in combination with the grid search method.

[0094] Through training, the confidence branch can output the confidence value of the sample. In order to use the confidence value to determine whether the sample has or has not experienced category concept drift, a confidence threshold needs to be set. The judgment function is:

[0095]

[0096] Where: X is the sample data, δ is the confidence threshold, and c is the sample confidence.

[0097] Ideally, this threshold should be determined based on the confidence distribution of drifted and non-drifted data. However, in actual training, concept drift data is not available. Therefore, the confidence threshold is estimated using the samples in the validation set that are misclassified and correctly classified. It should be noted that in most cases, there is an imbalance in the number of misclassified samples and correctly classified samples. To address the data imbalance, the SMOTE algorithm (Synthetic Minority Oversampling Technique) is introduced to oversample the misclassified samples to achieve data balance with the correctly classified samples:

[0098]

[0099] Will and Input into the network model to calculate the confidence value:

[0100]

[0101] Further calculate the confidence threshold δ:

[0102] δ=m(c correct ,c error )

[0103] Where m(·) is the calculation function based on the grid search method. The specific algorithm flow is as follows: Figure 5 shown.

[0104] Step S5: Determine whether concept drift occurs in the sample data according to the confidence threshold. If c<δ, it means that concept drift occurs in the network data; otherwise, concept drift does not occur.

[0105] Corresponding to the above method, this embodiment also discloses a network data concept drift self-supervision detection and classification system, including:

[0106] The data augmentation module is used to obtain unlabeled network data from the data stream and construct positive sample pairs through a hybrid data augmentation strategy;

[0107] The feature extraction module is used to extract features from positive and negative sample pairs using the Vision Transformer feature extraction network of the dual-branch fusion hybrid expert model, and optimize the model using the InfoNCE loss function;

[0108] The classification module is used to add a classification branch and a confidence branch in parallel to the pre-trained VisionTransformer feature extraction network of the fusion hybrid expert model in the downstream task stage, outputting the category prediction probability and confidence respectively;

[0109] The confidence threshold module is used to calculate the confidence threshold using the correctly and incorrectly classified samples in the validation set combined with the grid search method;

[0110] The drift detection module is used to determine whether concept drift occurs in sample data based on the confidence threshold.

[0111] To verify the effectiveness of this scheme, further explanation is given below in combination with experiments.

[0112] (1) Experimental data

[0113] This experiment uses the Moore dataset, a classic dataset collected by the University of Cambridge and designed for network traffic analysis, specifically for research tasks such as network traffic identification and classification. The dataset covers a variety of network traffic types, providing support for model evaluation in various scenarios.

[0114] In the experimental design, three types of data were selected as known data without concept drift, and one additional type of data was selected as data with category concept drift. For feature selection, the method developed by Li Linlin et al. was used to select representative features from each dataset. These features not only contain basic traffic statistics but also capture specific patterns related to network behavior, thereby enhancing the algorithm's ability to identify traffic. See Table 1 for details on feature selection.

[0115] Table 1 Datasets used in the experiment

[0116]

[0117] (2) Evaluation indicators

[0118] The evaluation indicators of this experiment include classification accuracy and detection error, which are used to evaluate the classification performance of the classifier on data without concept drift and the detection ability of the classifier on data with category concept drift, respectively.

[0119] Accuracy: Accuracy is used to measure the proportion of correctly classified samples in which concept drift has not occurred. It can intuitively reflect the performance of the model when processing data without concept drift and is an important indicator for evaluating classifier performance.

[0120] Detection Error Rate: The detection error rate is used to measure the error rate of a classifier when detecting category concept drift data. It can intuitively reflect the strength of the model's adaptability to new concepts and is an important reference indicator for evaluating the classifier's ability to handle concept drift data.

[0121] The corresponding calculation formula is as follows:

[0122]

[0123] Where TP represents the number of true positive cases, TN represents the number of true negative cases, FP represents the number of false positive cases, and FN represents the number of false negative cases.

[0124] (3) The impact of different data augmentation strategies on contrastive learning tasks

[0125] This section primarily examines the effectiveness of using a single data augmentation strategy or a combination of data augmentation strategies in the feature extraction process for network data contrastive learning tasks. The data augmentation strategies are as described above: Gaussian noise with a mean of 0 and a variance of 0.1 is added to 80% of the data; uniform noise with a range of (-0.05, 0.05) is added to 20% of the data; random flipping is mirrored on 50% of the data; and random masking is used to randomly set 20% of the features in 20% of the data to zero. To better validate the effectiveness of different data augmentation strategies on feature extraction network training, a linear evaluation method is used, and the experimental process is designed as follows:

[0126] In the first stage, after data augmentation for the three categories of data (www, mail, and bulk) in the Moore dataset, the feature extraction network was trained using the process of the contrastive learning stage. The training cycle was 100 epochs, and the parameters of the network model with the best performance were saved. In the second stage, the saved optimal network model parameters were frozen, and an additional linear classifier was added. The linear classifier was simply trained using a small amount of labeled data. In the third stage, the classification performance of the model was tested using the above three categories of data, and the accuracy was used as the evaluation indicator. The experimental results are as follows: Figure 6 shown.

[0127] The horizontal and vertical axes in the figure represent the application of different data augmentation strategies to the original sample data. For example, when both the horizontal and vertical axes are Gaussian noise, it indicates that positive sample pairs are generated from the original sample using only Gaussian noise; when the horizontal axis is Gaussian noise and the vertical axis is random flipping, it indicates that positive sample pairs are generated using both Gaussian noise and random flipping; when the horizontal axis is Gaussian noise and the vertical axis is random flipping + random masking, it indicates that positive sample pairs are generated using three strategies: Gaussian noise, random flipping, and random masking; when the horizontal axis is Gaussian noise + uniform noise and the vertical axis is random flipping + random masking, it indicates that positive sample pairs are generated using four strategies: Gaussian noise, uniform noise, random flipping, and random masking. Experimental results show that when only one data augmentation strategy is used, the random masking strategy performs best; when two augmentation strategies are used, the mixed strategy with random masking outperforms other combinations. Further comparison of different permutations and combinations of the four strategies shows that the model performance reaches the best level when all four strategies are used together.

[0128] (4) The impact of different proportions of labeled data on algorithm performance

[0129] This section primarily validates the performance of concept drift detection and classification in the context of missing labels. We use www, mail, and bulk data as known category data, and database as category concept drift data. Pre-training is performed using a fixed amount of unlabeled known category data in the contrastive learning phase. Fine-tuning is performed using labeled known category data with varying proportions (1%, 5%, 10%, 20%, 30%, and 50%) in the supervised fine-tuning phase. Validation is performed using a mixed dataset containing known category data and concept drift data in the detection and classification phase. Concept drift detection is verified using the detection error rate, while classification performance on known category data is verified using the accuracy rate. The experimental results are shown in Table 2.

[0130] Table 2 The impact of different proportions of labeled data on detection and classification

[0131]

[0132] As can be seen from the table, during the fine-tuning phase, as the proportion of labeled data increases, the classification performance of known-category data and the concept drift detection performance generally show an upward trend. When the proportion of labeled data is only 1%, the detection error rate is high. This may be due to the fact that the confidence threshold calculation during the verification phase was too small due to the small amount of data, causing the threshold to deviate from the correct direction. When the proportion of labeled data is less than 10%, the detection error rate decreases significantly with increasing data volume. When the proportion of labeled data exceeds 10%, the detection error rate still decreases with increasing data volume, but the downward trend gradually becomes more gradual.

[0133] (5) Confidence-based concept drift detection performance analysis

[0134] The Baseline algorithm proposed by Dan Hendrycks et al. uses the model's softmax output under supervised conditions to determine whether concept drift has occurred. This section conducts supervised comparative experiments with this algorithm and designs two sets of models. The first set of models, without a confidence branch, evaluates the performance of the Baseline algorithm; the second set of models, including a confidence branch, represents the current algorithm. Both models utilize the same basic feature extraction network; the differences lie in the configuration of the confidence branch and the rules for determining concept drift data.

[0135] The performance of detecting whether category concept drift has occurred is evaluated by the detection error rate. The experimental results are shown in Table 3. The experimental results show that the proposed algorithm has significant advantages over the baseline.

[0136] Table 3 Performance comparison with the Baseline algorithm

[0137]

[0138] (6) Performance comparison analysis of confidence threshold calculation methods based on grid search method

[0139] This section compares the advantages and disadvantages of the mean method and the grid search method. The experiment focuses on the case of a small amount of labeled data, selecting labeling ratios of 1%, 2%, 3%, 4%, and 5% for the study. When the amount of labeled data is small, outliers have a more significant impact on the experimental results.

[0140] The entire training process remains consistent. When calculating the confidence threshold using the validation set, the mean method and the grid search method are used to calculate the threshold of the confidence values ​​of the same batch to evaluate the performance difference between the two methods:

[0141] δ 均值法 =m 均值法 (c correct ,c error )

[0142] δ 网格搜索法 =m 网格搜索法 (c correct ,c error )

[0143] During the testing phase, two thresholds were used to determine whether concept drift had occurred. Other experimental settings remained consistent with the previous section. The experimental results, using detection error rate as the evaluation metric to assess the performance differences between different threshold calculation methods, are shown in Table 4.

[0144] Table 4 Comparison of different confidence threshold calculation methods

[0145]

[0146] As can be seen from the table, when the amount of labeled data is small, the confidence threshold calculation is more likely to deviate from the reasonable range due to the overall small amount of data in the verification phase. In particular, outliers have a more significant impact on the mean method. As the amount of labeled data gradually increases, the detection error rate shows an overall downward trend, but the performance of the mean method still lags behind the grid search-based method designed in this paper.

[0147] (7) Performance analysis of different network models in contrastive learning tasks

[0148] This section primarily examines the performance of the network model designed in this paper in data concept drift detection and classification tasks within a contrastive learning framework. Specifically, we compared the proposed network model, MoE-Transformer, with the ResNet50, Transformer Encoder, and ViT network models. The experimental dataset used remained consistent with the previous one, with labeled data accounting for 10% of the unlabeled data. The experimental results are shown in Table 5.

[0149] Table 5 Impact of different network models on detection and classification

[0150]

[0151]

[0152] Experimental results show that the network model proposed in the present invention has better detection and classification performance than other comparison models in the case of few labels. The performance of Transformer Encoder is relatively poor, with the lowest accuracy (86.88%) and the highest detection error rate (21.56%). This may be because Transformer Encoder fails to fully capture the local features of the data when processing network data, resulting in its poor performance in classification and detection tasks. The performance of ResNet50 and ViT are relatively close, with accuracy rates of 95.52% and 95.81% respectively, and detection error rates of 19.01% and 14.79% respectively, indicating that these two models have certain advantages in processing network data, but are still inferior to the proposed model. By combining contrastive learning and the network framework design used in the present invention, the proposed model can better extract the features of the data, thereby achieving better results in classification and detection tasks.

[0153] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the above-described embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily conceive of changes to the technical solutions described in the above-described embodiments within the technical scope disclosed by the present invention, or replace some of the technical features therein with equivalents. Such modifications, changes, or replacements do not deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. A self-supervised detection and classification method for concept drift in network data, characterized by: The following steps are involved: Obtain unlabeled network data from the data stream and construct positive sample pairs through a hybrid data augmentation strategy; Use the Vision Transformer feature extraction network with a dual-branch fusion hybrid expert model to extract features from positive and negative sample pairs, and optimize the model using the InfoNCE loss function; In the downstream task stage, a classification branch and a confidence branch are added in parallel based on the pre-trained Vision Transformer feature extraction network of the fusion hybrid expert model to output the category prediction probability and confidence respectively; The confidence threshold is calculated using the correctly and incorrectly classified samples in the validation set and the grid search method; Determine whether concept drift occurs in sample data based on the confidence threshold.

2. The self-supervised detection and classification method for network data concept drift according to claim 1 is characterized in that: The hybrid data enhancement strategy is a combination of adding Gaussian noise, adding uniform noise, random masking and data flipping.

3. The self-supervised detection and classification method for network data concept drift according to claim 1 is characterized in that: The Vision Transformer feature extraction network of the fusion hybrid expert model includes: A multi-layer MoE-Transformer encoder is used for feature extraction. The MoE-Transformer encoder introduces a sparse MoE layer to replace the feedforward neural network layer based on the standard Transformer encoder. The MoE layer dynamically selects experts to process different input tokens.

4. The self-supervised detection and classification method for network data concept drift according to claim 1 is characterized in that: The calculation formula of the InfoNCE loss function is: Where, sim(·) is the cosine similarity, (z i ,z j ) is the feature vector pair of positive sample pairs, (z i ,z k ) is the eigenvector pair of negative sample pairs, and τ is the temperature coefficient.

5. The self-supervised detection and classification method for network data concept drift according to claim 1 is characterized in that: In the downstream task stage, the classification branch outputs the category prediction probability p through the softmax function, and the confidence branch outputs the confidence c through the sigmoid function; both the classification branch and the confidence branch adopt a network structure containing three fully connected layers; during the training process, the confidence c is used to correct the category prediction probability p.

6. The self-supervised detection and classification method for network data concept drift according to claim 5 is characterized in that: The formula for correcting the category prediction probability p using the confidence level c is: p i ′=c·p i +(1-c)y i Where p i ′ represents the corrected predicted probability of each category, p i Represents the original predicted probability of the category, y i is the target probability distribution, and c is the confidence level.

7. The self-supervised detection and classification method for network data concept drift according to claim 6 is characterized in that: The total loss function of the network model in the downstream task stage is: The classification task loss uses negative log-likelihood loss, which is calculated based on the corrected category prediction probability; The confidence loss adopts logarithmic loss; The total loss function is the weighted sum of the classification task loss and the confidence loss.

8. The self-supervised detection and classification method for network data concept drift according to claim 1 is characterized in that: The calculation process of the confidence threshold includes: First, the SMOTE algorithm is used to oversample the samples with incorrect classification in the validation set to balance the number of samples with the number of correctly classified samples; Then calculate the confidence of correctly classified samples and incorrectly classified samples respectively; Based on the grid search method, the confidence level that minimizes the detection error rate is selected as the threshold.

9. A network data concept drift self-supervised detection and classification system, characterized by: The system is used to implement the network data concept drift self-supervised detection and classification method according to any one of claims 1 to 8, comprising: The data augmentation module is used to obtain unlabeled network data from the data stream and construct positive sample pairs through a hybrid data augmentation strategy; The feature extraction module is used to extract features from positive and negative sample pairs using the Vision Transformer feature extraction network of the dual-branch fusion hybrid expert model, and optimize the model using the InfoNCE loss function; The classification module is used to add a classification branch and a confidence branch in parallel to the pre-trained VisionTransformer feature extraction network of the fusion hybrid expert model in the downstream task stage, outputting the category prediction probability and confidence respectively; The confidence threshold module is used to calculate the confidence threshold using the correctly and incorrectly classified samples in the validation set combined with the grid search method; The drift detection module is used to determine whether concept drift occurs in sample data based on the confidence threshold.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images