High-dimensional heterogeneous traffic dynamic feature optimization method based on double-track coevolution

Abstract

The invention discloses a high-dimensional heterogeneous traffic dynamic feature optimization method based on double-track coevolution, and aims to solve the problems of slow convergence and poor local optimization in high-dimensional data of a traditional algorithm. According to the method, through cooperative work of a global exploration orbit and a local enhancement orbit, a dynamic parameter adjustment and information interaction mechanism is combined, and efficient search and fine adjustment of a feature space are achieved. Performing wide feature combination search on the global orbit by adopting an adaptive crossover rate, a disturbance rate and a structured recombination strategy; the local rail dynamically adjusts the feature weight through gradient driving optimization and time sequence sliding window constraint. Coevolution between double tracks is realized through feature vector mapping and gradient feedback, and a nonlinear balance factor is introduced to dynamically fuse global and local optimization results. Finally, an integrated detection model is constructed in combination with DNN, LightGBM and SVM, and the accuracy and robustness of malicious traffic detection in a complex network environment are improved. The global exploration and local optimization capabilities are effectively balanced, and the feature selection precision and the convergence efficiency are remarkably improved.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and in particular relates to a high-dimensional heterogeneous traffic dynamic feature optimization method based on dual-track collaborative evolution. Background Art

[0002] Traffic detection faces highly dynamic and complex network traffic data. These data are not only high-dimensional and heterogeneous in time and space, but also accompanied by frequently changing attack patterns. Therefore, how to effectively optimize the features of traffic data has become one of the most challenging tasks in traffic detection. Although existing feature optimization algorithms have improved feature selection and data processing capabilities to a certain extent, they are still difficult to implement in the context of high-dimensional and heterogeneous traffic data due to the explosion of solution space dimensions (e.g., 512-dimensional features correspond to 2 512 Its random search mechanism is difficult to effectively cover key areas. The specific manifestations are as follows:

[0003] Slow convergence: Genetic algorithms have strong global search capabilities in high-dimensional spaces, but as the feature dimension increases, the optimization process is prone to falling into local optima, resulting in slower convergence. Traffic data typically has large-scale and high-dimensional feature spaces. Existing optimization algorithms struggle to complete global searches within a reasonable timeframe and are computationally complex.

[0004] Poor local optimization capabilities: Although the particle swarm optimization algorithm has strong local search capabilities, it is prone to rapid swarm convergence in high-dimensional feature spaces, resulting in a loss of diversity in the search process and an inability to effectively explore the global optimal solution. This is particularly true when the amount of malicious traffic data is small or changes rapidly. The algorithm often fails to capture key features, resulting in reduced detection accuracy.

[0005] Therefore, existing feature optimization algorithms struggle to cope with high-dimensional, heterogeneous traffic data in complex network environments. To overcome these problems, a new optimization algorithm is urgently needed. Through innovative mechanisms, it can address the shortcomings of traditional feature optimization methods, such as slow convergence, poor local optimization, and poor adaptability, and improve the accuracy of the feature optimization process. Summary of the Invention

[0006] The purpose of the present invention is to solve the problems of slow convergence, high feature redundancy and poor local optimization capability of traditional algorithms in high-dimensional heterogeneous network traffic data.

[0007] In order to achieve the above-mentioned purpose, the present invention adopts the following technical means:

[0008] The present invention provides a high-dimensional heterogeneous traffic dynamic feature optimization method based on dual-track co-evolution, comprising the following steps:

[0009] Step s1: Initialization step: preprocess the traffic data and initialize the global exploration track and local enhancement track respectively. The global exploration track explores the feature space by randomly generating binary feature selection vectors, and the local enhancement track realizes feature selection probability conversion through dynamic weight vector generation and Sigmoid mapping;

[0010] Step s2: Dual-track optimization step: Dynamic parameter adjustment and structured reorganization strategies are implemented in the global exploration track, balancing global search and local exploitation through a nonlinear attenuation mechanism of the crossover rate and perturbation rate; in the local enhancement track, a gradient-driven optimization method combined with a temporal sliding window constraint is used to dynamically update feature weights;

[0011] Step s3: Co-evolution step: Establish a dual-track information interaction mechanism, map the high-fitness feature vectors of the global exploration track to the initial weights of the local enhancement track, and reversely update the search probability distribution of the global exploration track with the significant feature weights. Dynamic fusion of the dual-track weights is achieved through a nonlinear logarithmic decay balance factor.

[0012] Step s4: Multi-model integration step: Build an integrated detection model including deep neural network, LightGBM and support vector machine, and use the weighted voting mechanism to perform collaborative detection of malicious traffic on the optimized feature subset.

[0013] In the above solution, the initialization step of step s1 includes:

[0014] s101: Preprocess traffic data by converting non-numeric categorical features into numeric vectors using one-hot encoding. Then, use the min-max normalization algorithm to map numeric features to the [0, 1] interval. At the same time, perform sliding aggregation on the time series traffic data using a preset time window to generate time series features.

[0015] s102: Initialize the global exploration track and the local enhancement track, where:

[0016] Generate a preset number N of global exploration tracks global The binary feature selection vectors are each of which has a dimension equal to the total number of features M. i ∈{0, 1} represents the feature F i whether it is selected;

[0017] Generate a preset number N of local enhancement tracks local The dynamic weight vector, the weight value is generated by Xavier uniform distribution and limited to the interval [0, 1]. Each weight w j Represents feature F i the importance of

[0018] The weight of the local enhancement track is mapped to the feature selection probability through the Sigmoid function:

[0019]

[0020] And binarize according to the probability threshold:

[0021]

[0022] s103: Construct a multi-objective fitness function, whose expression is:

[0023]

[0024] Its S(w ij ) represents the probability of selecting the jth feature of the i-th sample, Acc is the classification accuracy of the detection model for malicious traffic; F1 is the comprehensive ability of traffic detection; Corr is the redundancy index in the feature subset; Diversity is the variance of the local enhanced track population, λ is the preset weight coefficient.

[0025] In the above solution, the dual-track optimization step of step s2 includes:

[0026] s201: Dynamic evolution of the global exploration track, performing the following operations:

[0027] a) Dynamically adjust the crossover rate Pr and disturbance rate Pd, the calculation formula is:

[0028]

[0029] Among them, X and Y are preset range parameters, g is the current evolutionary generation, and G is the total evolutionary generation, so that the crossover rate and perturbation rate decay nonlinearly with the iteration process;

[0030] b) Structured recombination strategy: The global population is divided into k subgroups. The top 20% of individuals in each subgroup undergo directed crossover to generate new feature combinations. After crossover, random flipping perturbations are applied to the individuals. The perturbation formula is:

[0031]

[0032] s202: Gradient-driven optimization of the local enhancement track, which performs the following operations:

[0033] a) Dynamically update feature weights based on the gradient back propagation of the classification model. The update formula is:

[0034]

[0035] Among them, w j (t) is the feature F j The weight at the tth iteration; η is the learning rate, which controls the step size of the weight update; Is the loss function L relative to the feature F j The gradient of F j Impact on model error; ΔR is the performance gain after the previous round of optimization, calculated based on the fitness function:

[0036] ΔR=Fitness (t) -Fitness (t-1)

[0037] b) A time series sliding window constraint is introduced to update the weights only based on the traffic data of the most recent T batches, and the window size T is adaptively adjusted according to the classification performance index.

[0038] In the above scheme, the dual-track co-evolution step of step s3 includes:

[0039] Step 3.1: Perform iterative feature combination update processing on the initial feature selection population in the global track. Based on the individual fitness score results, perform structural reorganization and perturbation operations on the individuals in the population to generate a new generation of feature selection population and screen out feature subsets with higher fitness.

[0040] Step 3.2: Filter the top several optimal individuals in the feature subset set obtained in step 3.1 and convert them into initial high-weight vectors in the local enhancement track to guide the fine optimization of feature weights;

[0041] Step 3.3: Perform an iterative update process on the feature weight vector in the local enhancement track based on model gradient feedback. By calculating the gradient response and performance improvement coefficient of each feature, the weight is dynamically adjusted to obtain the optimized significant feature weight vector.

[0042] Step 3.4: Extract the features with significant gradients from the weight vector obtained in step 3.3 and feed them back to the global track to guide the global track to prioritize retaining or combining these key features in the next round of population generation, thereby improving the directionality of the global search.

[0043] Step 3.5: Dynamically adjust the balance factor between the global track and the local enhancement track according to the iteration round, perform weighted fusion on the optimization results of the two tracks, and form an updated comprehensive feature weight or selection vector as the starting point for the next iteration round;

[0044] Step 3.6: Repeat steps 3.1 to 3.5 until the optimization termination condition is met, and output the optimal feature subset as the final feature optimization result.

[0045] The dual-track co-evolution mechanism and its feature optimization method proposed in this paper show significant advantages in processing high-dimensional heterogeneous traffic data in complex network environments. Its core beneficial effects are reflected in the following aspects:

[0046] 1. Efficient synergy between global and local optimization

[0047] Through a dual-track collaborative architecture consisting of a global exploration track and a local enhancement track, a dynamic balance is achieved between extensive search and refined adjustments in the feature space. The global exploration mechanism effectively explores potential high-quality feature combinations, preventing traditional algorithms from falling into local optima due to premature convergence. The local enhancement mechanism, based on gradient-driven weight optimization, significantly improves the discriminative accuracy of feature selection. The information interaction and dynamic fusion mechanism between the two tracks ensures that the global search direction is guided by local optimization results, while the local optimization starting point inherits the high-quality solutions from global exploration, creating a synergistic effect of two-way gain.

[0048] 2. Dynamic balance of adaptive optimization

[0049] The introduction of a nonlinear decaying balancing factor and a dynamic parameter adjustment strategy enables the algorithm to focus on global exploration to cover diverse feature combinations in the early stages of evolution, while gradually enhancing its ability to fine-tune local adjustments over the iterative process. This mechanism effectively overcomes the search rigidity caused by fixed parameters in traditional methods, adaptively matching the feature space characteristics at different optimization stages, and significantly improving the algorithm's convergence efficiency and stability for high-dimensional data.

[0050] 3. Feature Optimization Capabilities Driven by Multi-Dimensional Evaluation

[0051] The designed multi-objective fitness function comprehensively considers classification performance, feature redundancy, and population diversity, overcoming the limitations of a single accuracy-based approach. By suppressing redundant feature interference and maintaining population diversity, the algorithm improves the discriminative power of feature subsets while enhancing its noise immunity, ensuring robustness in complex traffic patterns and adversarial attack scenarios.

[0052] 4. Efficient processing of heterogeneous data

[0053] Combining dynamic weight mapping with a structured reorganization strategy effectively addresses the problems of mixed feature types and the curse of dimensionality in high-dimensional, heterogeneous traffic data. The global track's binary encoding mechanism adapts to discrete feature selection, while the local track's continuous weight optimization accurately captures subtle differences in numerical features. The two are seamlessly integrated through sigmoid mapping, significantly improving optimization adaptability in mixed-feature scenarios.

[0054] 5. Collaborative decision-making advantages of model integration

[0055] A multi-model ensemble architecture is constructed based on optimized feature subsets, leveraging the complementary strengths of deep neural networks, gradient boosting trees, and support vector machines. DNN captures temporal correlations in traffic, LightGBM processes large-scale sparse data, and SVM enhances robustness in small-sample classification. These three models collaborate through a dynamic weighting mechanism to achieve coordinated decision-making, comprehensively improving the real-time detection accuracy and generalization capabilities of complex network attacks.

[0056] 6. Fast response characteristics in dynamic environment

[0057] Through time-series sliding window constraints and a gradient sensitivity update mechanism, the local optimization process closely tracks evolving traffic patterns. Dynamic adjustment of feature weights based on recent data ensures the algorithm quickly adapts to sudden changes in the network environment or escalating attack methods, effectively avoiding the detection lag caused by traditional methods' reliance on historical data. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 This is a diagram of the method architecture of the present invention.

[0059] Figure 2 Flow chart of the method of the present invention. DETAILED DESCRIPTION

[0060] The following is a detailed description of the embodiments of the present invention. Although the present invention will be described and illustrated in conjunction with certain specific embodiments, it should be noted that the present invention is not limited to these embodiments. On the contrary, modifications or equivalent substitutions of the present invention are intended to fall within the scope of the claims of the present invention.

[0061] In addition, in order to better illustrate the present invention, numerous specific details are given in the following detailed description. It will be understood by those skilled in the art that the present invention can also be implemented without these specific details.

[0062] The purpose of this invention is to propose a dynamic feature optimization method for high-dimensional heterogeneous traffic based on dual-track co-evolution, aiming to address the limitations of traditional feature optimization algorithms in high-dimensional, heterogeneous traffic data. Unlike the existing technology, this invention innovatively designs a dual-track co-evolution method for global exploration and local refinement optimization, combining an improved global search mechanism with a local search strategy, to achieve efficient optimization of high-dimensional traffic features in complex network environments. Through dynamic parameter adjustment and information interaction mechanisms, this method achieves an optimal balance between global and local optimization, greatly improving the accuracy, convergence speed, and robustness of feature optimization.

[0063] In order to achieve the above objectives, the present invention mainly balances the global search capability and the local optimization capability through dynamic adjustment of parameters and interaction of population information, thereby overcoming the problems of slow convergence speed and poor local optimization capability of existing methods in high-dimensional traffic data.

[0064] In order to achieve the above objectives, the present invention optimizes the flow characteristics through the following steps:

[0065] S1: Initialization

[0066] S101 data preprocessing

[0067] Use one-hot encoding to convert non-numeric categorical features into numerical form. Use the min-max normalization algorithm to map all feature values ​​to the interval 0,1.

[0068] S102 dual-track initialization and feature state encoding

[0069] Through a dual-track mechanism of global and local optimization, we balance extensive search and fine-tuning of the feature space. The global exploration track is responsible for exploring potential high-quality feature subsets, while the local enhancement track fine-tunes selected features to improve classification performance.

[0070] Global Exploration Track: In the global exploration track, a set of binary feature selection vectors are randomly generated. The dimension of these vectors is equal to the total number of features M, and the value of each bit is x i Represents feature F i Is it selected, x i =1 means the feature is selected, xi=0 means the feature is not selected. The initial feature selection vector is formed, and the initial population size is set to N global .

[0071] Local enhancement track: When the local enhancement track is initialized, a set of dynamic weight vectors are generated. The weight range is between [0, 1]. Each weight represents the importance of the feature in the classification task. The initial value of the weight is generated by Xavier uniform distribution to ensure that the initial weight distribution of different features is reasonable and does not cause some features to be over-emphasized or ignored prematurely. The initial population size is N local .

[0072] Sigmoid mapping and binarization: To convert the weight of each feature into a state for feature selection, a Sigmoid function is used to map the individual weights to obtain the probability of feature selection. Through this mapping, the feature weight is converted into a selection probability, and the threshold is used to determine whether the feature is selected.

[0073]

[0074] S103 Multi-objective Collaborative Fitness Evaluation

[0075] To comprehensively evaluate the quality of feature subsets, this paper designs a multi-objective fitness function that comprehensively considers classification performance, feature redundancy, and diversity. This fitness function not only improves the discriminative power of feature subsets, but also mitigates the negative impact of feature redundancy on optimization results and prevents the algorithm from falling into local optimal solutions. The function expression is as follows:

[0076]

[0077] Among them, Acc is the classification accuracy of the detection model for malicious traffic; F1 is the comprehensive ability of traffic detection; Corr is the redundancy index in the feature subset; Diversity is the variance of the local enhanced track population, which is used to measure population diversity and prevent premature convergence.

[0078] S2 dual-track optimization process

[0079] Dynamic evolution of the S201 global exploration track

[0080] The goal of the global exploration track is to conduct a broad search in the feature space to identify potential high-quality feature combinations. As iterations progress, the global search strategy is dynamically adjusted based on the fitness distribution of the current population, allowing the optimization process to conduct a broad exploration in the early stages and to conduct refined development in the later stages.

[0081] Parameter adaptive adjustment: By adaptively adjusting key parameters in the search strategy (such as the crossover rate Pr and the perturbation rate Pd) according to the current iteration round g and the total evolution generation G, the breadth of the global search can be increased in the early stage, and the global search intensity can be reduced in the later stage for fine-tuning.

[0082] Dynamic adjustment formula of crossover rate and disturbance rate:

[0083]

[0084] Among them, X and Y are range parameters; g is the current evolutionary generation; G is the total evolutionary generation of the algorithm.

[0085] As evolution progresses, the crossover rate p r and the disturbance rate p d This mechanism ensures that the algorithm has a strong global search capability (high crossover rate and perturbation rate) in the early stage of evolution, enhances the local search capability (low crossover rate and perturbation rate) in the later stage of evolution, and reduces the risk of premature convergence.

[0086] Structured Recombination Strategy: To increase the diversity of feature combinations and enhance the effectiveness of global search, this paper introduces a structured recombination strategy. In this strategy, the population is divided into k subgroups. Within each subgroup, individuals with the top 20% fitness undergo directed crossover to generate new feature combinations. After crossover, perturbations are applied to the individuals, randomly flipping some feature bits to break local optima and enhance diversity.

[0087] Gradient-driven optimization of the S202 local enhancement track

[0088] The main goal of the local enhancement track is to refine the feature selection process by optimizing the weights of feature selection, thereby improving the accuracy and efficiency of feature optimization. By combining gradient-driven optimization and dynamic weight adjustment, we ensure that feature selection can adapt to changes in different attack patterns and traffic characteristics.

[0089] Dynamic Weight Adjustment: In the local enhancement track, feature optimization is based on the gradient backpropagation method of the classification model. By calculating the sensitivity of each feature weight to the loss function, the weight of each feature is dynamically updated to ensure that the feature selection process can effectively reflect the contribution of different features to model performance.

[0090]

[0091] Among them, w j (t) is the feature F j The weight at the tth iteration; η is the learning rate, which controls the step size of the weight update; Is the loss function L relative to the feature F j The gradient of F j Impact on model error; ΔR is the performance gain after the previous round of optimization, calculated based on the fitness function, ΔR = Fitness (t) -Fitness (t-1) .

[0092] Temporal sliding window constraint: Local optimization updates feature weights based only on the most recent T batches of traffic data to ensure that the optimization process can quickly respond to changes in traffic patterns and avoid model lag.

[0093] S3 dual-track co-evolution process

[0094] The dual-track co-evolution process uses the interactive collaboration of the global exploration track and the local enhancement track to enable feature optimization to both widely explore the feature space and fine-tune the selected features.

[0095] S301 Global Exploration Track to Local Enhancement Track: Information Transfer and Optimization Starting Point

[0096] The top K eigenvectors with the highest fitness are selected from the global trajectory. These eigenvectors represent the most promising feature combinations in the current search space. These highly fit eigenvectors are mapped as initial high weights for the local trajectory, providing a good starting point for local optimization. This allows for more efficient feature optimization in the local trajectory and avoids starting from a random initial state, thereby improving optimization speed and accuracy.

[0097] S302 Local Enhancement Track to Global Exploration Track: Information Feedback and Optimization Direction Adjustment

[0098] Feature weights with significant gradients are extracted from local trajectories. These feature weights have a significant impact on model performance. After each iteration, these feature weights are used to inversely update the search probability distribution of the global trajectory, prioritizing exploration of important areas with potential optimization space. This feedback mechanism allows the global search to benefit from the successful experience of local optimization, focusing more on key areas during the global search, thereby improving global search efficiency.

[0099] S303 γ Dynamic Fusion

[0100] In order to more finely control the distribution of forces between global exploration and local optimization, a nonlinear logarithmic decay balancing factor is introduced in this embodiment, which is defined as follows:

[0101]

[0102] Among them, γ min is the minimum value of the balance factor, set to 0.1; γ max is the initial value of the balance factor, which is set to 0.9; g is the current evolutionary generation; G is the maximum evolutionary generation; α is the acceleration factor that controls the nonlinear attenuation rate.

[0103] In the early stages, the global track plays a stronger role, but as the optimization process progresses, the feedback of the local track becomes more important, and the balance factor gradually tends to local optimization. The final fusion formula is as follows:

[0104] w j final =γ·w j global +(1-γ)·w j local

[0105] where w j global represents the final fusion weight of the j-th feature, w j global represents the weight of the jth feature in the global exploration track, w j localCalculated by the weight update formula in step S202, w j local represents the weight of the jth feature in the local enhancement track.

[0106] Assume that the last generation population of the global trajectory is {X (1) , X (2) ,...,X (N)}, each X i ∈{0, 1} is a binary selection vector, and the importance of each feature in the global track is w j global , it does not simply count the frequency of its occurrence in individuals, but introduces a fitness weighting mechanism, then the weight of the j-th feature is defined as:

[0107]

[0108] Where f(X (i) ) represents individual X (i) The fitness score of This fitness-weighted frequency modeling can highlight the importance of high-contribution features in high-quality individuals and provide a more discriminative global perspective for the fusion mechanism.

[0109] Finally, the weights are mapped to feature selection to obtain the optimal feature subset.

[0110] S4: Multi-model ensemble detection architecture

[0111] Based on dual-track co-evolution, this paper constructs an integrated detection model, integrating the advantages of multiple models to achieve collaborative decision-making and dynamic optimization, improving the real-time performance, accuracy, and robustness of the detection system in complex network environments. Model integration is performed using DNN, LightGBM, and SVM.

[0112] DNN can capture temporal patterns in complex protocol interactions; LightGBM can quickly process large-scale data and mine nonlinear boundaries between category features; SVM has strong robustness and high classification accuracy for small samples of malicious traffic.

[0113] Example 1

[0114] To clarify the objectives, technical solutions, and advantages of the present invention, the present invention will be described in detail below with reference to the accompanying drawings and specific steps. This example uses an industrial water treatment system (SWaT, Secure Water Treatment) as the experimental environment. The system involves subsystems such as pump station control, valve regulation, and water quality sensor data acquisition. The experimental system is deployed on an internal enterprise industrial Ethernet network to collect real-time flow data from the industrial control network and verify the detection performance and application effect of the high-dimensional heterogeneous flow feature optimization method proposed in this invention in actual network scenarios.

[0115] S1 initialization

[0116] S101 data preprocessing

[0117] One-hot encoding of categorical features: Convert the protocol type (Modbus / TCP, EtherNet / IP, etc.) into a binary vector and add a new 12-dimensional feature.

[0118] Normalization of numerical features: Use min-max normalization to map sensor readings, packet sizes, etc. to the 0.1 interval.

[0119] Time series alignment: Perform sliding window aggregation on traffic data with a window of 1 second to generate time series features (such as packet rate mean and variance).

[0120] The preprocessed data matrix X∈R N×512 , where N is the number of samples.

[0121] S102 dual-track initialization

[0122] Global exploration track: randomly generate N global = 100 binary feature selection vectors (dimension = 512), each of which randomly activates a feature with 50% probability.

[0123] Local enhancement track: Initialize N local = 50 dynamic weight vectors (dimension = 512), weights are generated by Xavier uniform distribution (range 0, 1).

[0124] S103 Multi-objective Fitness Evaluation

[0125] Construct a fitness function:

[0126] Fitness=0.7·(Acc+F1)+0.2·(1-Corr)+0.1·Diversity

[0127] Acc and F1 are calculated using the LightGBM classifier; Corr is the mean of the Pearson correlation coefficient between features; and it is calculated by the Hamming distance variance of the population vector.

[0128] S2 dual-track optimization process

[0129] Dynamic evolution of the S201 global exploration track

[0130] Dynamic parameter adjustment: the crossover rate and perturbation rate decay linearly with the number of iterations:

[0131]

[0132] Among them, g is the current generation, and G=100 is the total number of iterations.

[0133] Structured recombination: The population is divided into 5 subgroups, and the individuals with the top 10% fitness in each subgroup undergo directed crossover to generate new feature combinations.

[0134] In the crossover operation, the two individuals with higher fitness will exchange their feature bits. Specifically, if there are two individuals X1 = [x 1,1, x 1,2, …, x 1，M ] and X2=[x 2，1 , x 2，2 ,…,x 2，M ], their characteristic bits will be combined according to a certain crossover strategy to generate new individuals X3 and X4. For example, a single-point crossover:

[0135] X3=[x 1，1 , x 1，2 ,…,x 1，i , x 2，i+1 ,…,x 2，M ]

[0136] X4=[x 2，1 ,x 2，2 ,…,x 2，i ,x 1，i+1 ,…,x 1，M ]

[0137] Here, i is the chosen location of the intersection.

[0138] After the crossover, the newly generated individuals are perturbed. Specifically, some feature bits are randomly selected and flipped. This step introduces perturbations to break the local optimum that may exist in the population, enhance diversity, and enable the algorithm to escape the dilemma of local solutions. For each feature bit x ij , if the flip occurs with the perturbation probability, then:

[0139]

[0140] Gradient-driven optimization of the S202 local enhancement track

[0141] Weight update: Use momentum optimization strategy to update weights:

[0142]

[0143] Temporal sliding window: Gradients are calculated based only on the data of the most recent T = 10 batches, and the window size is adaptively adjusted as the F1 score fluctuates.

[0144] S3 dual-track co-evolution process

[0145] Global → Local: Every 10 iterations, the binary vectors of the top 10% of global track fitness are mapped to local track weights (the activation feature weight is set to 0.9).

[0146] Local→Global: Extract the top 50 features of the absolute value of the gradient in the local track and increase their selection probability in the global track.

[0147] Weight fusion:

[0148]

[0149] w j final =0.4·w j global +0.6·w j local

[0150] Finally, the weights are mapped to feature selection to obtain the optimal feature subset.

[0151] S4 multi-model integration and real-time detection

[0152] Model architecture: DNN: 3-layer fully connected network (256-128-64) to capture temporal interaction patterns; LightGBM: 100 decision trees to mine nonlinear boundaries of category features; SVM: RBF kernel function to handle small sample malicious traffic.

[0153] Collaborative decision-making: The outputs of the three models are integrated through weighted voting, with the weight being the F1 score of each model on the validation set (DNN: 0.4, LightGBM: 0.5, SVM: 0.1).

Claims

1. A high-dimensional heterogeneous traffic dynamic feature optimization method based on dual-track co-evolution, characterized by: The following steps are involved: Step s1: Initialization step: pre-process the traffic data and initialize the global exploration track and local enhancement track respectively. The global exploration track explores the feature space by randomly generating binary feature selection vectors, and the local enhancement track realizes feature selection probability conversion through dynamic weight vector generation and Sigmoid mapping; Step s2: Dual-track optimization step: Dynamic parameter adjustment and structured reorganization strategies are implemented in the global exploration track, balancing global search and local exploitation through a nonlinear attenuation mechanism of the crossover rate and perturbation rate; in the local enhancement track, a gradient-driven optimization method combined with a temporal sliding window constraint is used to dynamically update feature weights; Step s3: Co-evolution step: Establish a dual-track information interaction mechanism, map the high-fitness feature vectors of the global exploration track to the initial weights of the local enhancement track, and reversely update the search probability distribution of the global exploration track with the significant feature weights. Dynamic fusion of the dual-track weights is achieved through a nonlinear logarithmic decay balance factor. Step s4: Multi-model integration step: Build an integrated detection model including deep neural network, LightGBM and support vector machine, and use the weighted voting mechanism to perform collaborative detection of malicious traffic on the optimized feature subset.

2. The method according to claim 1, characterized in that The initialization step of step s1 includes: s101: Preprocess traffic data by converting non-numeric categorical features into numeric vectors using one-hot encoding. Then, use the min-max normalization algorithm to map numeric features to the [0, 1] interval. Sliding aggregation is performed on the time series traffic data using a preset time window to generate time series features. s102: Initialize the global exploration track and the local enhancement track, where: Generate a preset number N of global exploration tracks global The binary feature selection vectors are each of which has a dimension equal to the total number of features M. i ∈{0, 1} represents the feature F i whether it is selected; Generate a preset number N of local enhancement tracks local The dynamic weight vector, the weight value is generated by Xavier uniform distribution and limited to the interval [0, 1]. Each weight w j Represents feature F i the importance of The weight of the local enhancement track is mapped to the feature selection probability through the Sigmoid function: And binarize according to the probability threshold: s103: Construct a multi-objective fitness function, whose expression is: Its S(w ij ) represents the probability of selecting the jth feature of the i-th sample, Acc is the classification accuracy of the detection model for malicious traffic; F1 is the comprehensive ability of traffic detection; Corr is the redundancy index in the feature subset; Diversity is the variance of the local enhanced track population, λ is the preset weight coefficient.

3. The method according to claim 1, characterized in that The dual-track optimization step of step s2 includes: s201: Dynamic evolution of the global exploration track, performing the following operations: a) Dynamically adjust the crossover rate Pr and disturbance rate Pd, the calculation formula is: Among them, X and Y are preset range parameters, g is the current evolutionary generation, and G is the total evolutionary generation, so that the crossover rate and perturbation rate decay nonlinearly with the iteration process; b) Structured recombination strategy: The global population is divided into k subgroups. The top 20% of individuals in each subgroup undergo directed crossover to generate new feature combinations. After crossover, random flipping perturbations are applied to the individuals. The perturbation formula is: s202: Gradient-driven optimization of the local enhancement track, which performs the following operations: a) Dynamically update feature weights based on the gradient back propagation of the classification model. The update formula is: Among them, w j (t) is the feature F j The weight at the tth iteration; η is the learning rate, which controls the step size of the weight update; Is the loss function L relative to the feature F j The gradient of F j Impact on model error; ΔR is the performance gain after the previous round of optimization, calculated based on the fitness function: ΔR=Fitness (t) -Fitness (t-1) b) A time series sliding window constraint is introduced to update the weights only based on the traffic data of the most recent T batches, and the window size T is adaptively adjusted according to the classification performance index.

4. The method according to claim 1, wherein The dual-track co-evolution step of step s3 includes: Step 3.1: Perform iterative feature combination update processing on the initial feature selection population in the global track. Based on the individual fitness score results, perform structural reorganization and perturbation operations on the individuals in the population to generate a new generation of feature selection population and screen out feature subsets with higher fitness. Step 3.2: Filter the top several optimal individuals in the feature subset set obtained in step 3.1 and convert them into initial high-weight vectors in the local enhancement track to guide the fine optimization of feature weights; Step 3.3: Perform an iterative update process on the feature weight vector in the local enhancement track based on model gradient feedback. By calculating the gradient response and performance improvement coefficient of each feature, the weight is dynamically adjusted to obtain the optimized significant feature weight vector. Step 3.4: Extract the features with significant gradients from the weight vector obtained in step 3.3 and feed them back to the global track to guide the global track to prioritize retaining or combining these key features in the next round of population generation, thereby improving the directionality of the global search. Step 3.5: Dynamically adjust the balance factor between the global track and the local enhancement track according to the iteration round, perform weighted fusion on the optimization results of the two tracks, and form an updated comprehensive feature weight or selection vector as the starting point for the next iteration round; Step 3.6: Repeat steps 3.1 to 3.5 until the optimization termination condition is met, and output the optimal feature subset as the final feature optimization result.

Images