Multi-view network traffic anomaly detection method based on multi-layer perception and tensor decomposition

Abstract

The invention discloses a multi-view network traffic anomaly detection method based on multilayer perception and tensor decomposition. The method comprises the following steps: extracting a coefficient matrix from a traffic data matrix of each view angle through self-representation learning, and constructing a third-order tensor; cP decomposition is applied to encode the forward slice of each self-representation tensor, and a consensus matrix code is generated by using a factor matrix; coding the consensus matrix through a nonlinear interaction relationship between multilayer perception CP decomposition learning factor matrixes; a two-layer multi-layer perceptron neural network is adopted to carry out non-linear feature extraction on a splicing vector of each factor matrix of a tensor to obtain a reconstructed column vector of a forward slice, and a loss function of a joint factor matrix and a neural network parameter norm constraint is constructed to realize collaborative optimization of the factor matrix and a multi-layer perceptron weight. Training to obtain each factor matrix; and finally, performing Kmeans clustering on the consensus matrix to classify normal traffic and abnormal traffic. According to the invention, high-precision detection of network traffic abnormity is realized.

Description

Technical Field

[0001] The present invention relates to the field of network traffic anomaly detection, and in particular to a multi-view network traffic anomaly detection method based on multi-layer perception and tensor decomposition. Background Art

[0002] As networks continue to expand and business complexity increases, the data generated in network environments exhibits high-dimensionality, multi-source, and time-varying characteristics. Network traffic anomaly detection faces challenges such as complex data structures, high dimensionality, diverse views, and hidden anomaly patterns. Traditional anomaly detection methods, such as those based on rule matching, statistical thresholds, or shallow machine learning models, often struggle to capture deep connections between multiple views and exhibit poor generalization and scalability when faced with large-scale data. In contrast, multi-view anomaly detection leverages complementary information from multiple viewpoints to improve detection accuracy. Summary of the Invention

[0003] The purpose of the present invention is to provide a multi-view network traffic anomaly detection method based on multi-layer perception and tensor decomposition.

[0004] The technical solution adopted in the present invention is:

[0005] The multi-view network traffic anomaly detection method based on multi-layer perception and tensor decomposition includes the following steps:

[0006] S1: Extract the coefficient matrix from the traffic data matrix of each view through self-representation learning and construct a third-order tensor; then, apply CP decomposition to encode the forward slice of each self-representation tensor and use the factor matrix To generate the encoding of the consensus matrix ,in, It means extraction is a diagonal matrix with diagonal elements; It is a consensus statement. is the i-th row vector of the factor matrix C, is the total number of viewing angles;

[0007] S2: Encode the consensus matrix by decomposing the nonlinear interaction between the learning factor matrices through the multi-layer perceptron CP; adopt a two-layer multi-layer perceptron neural network The concatenation vector of each factor matrix of the tensor Perform nonlinear feature extraction, where is the rth column vector of the factor matrix A, represents the element in the i-th row and r-th column of the factor matrix C, Represents the element in the jth row and rth column of the factor matrix B; further obtain the reconstructed column vector of the forward slice , and construct a loss function that combines the factor matrix and the norm constraint of the neural network parameters, so as to achieve the coordinated optimization of the factor matrix and the multi-layer perceptron weights, and then train each factor matrix;

[0008] S3: Classify normal traffic and abnormal traffic by performing Kmeans clustering on the consensus matrix.

[0009] Furthermore, S1 specifically includes the following steps:

[0010] S101, order represents the network traffic data matrix of the mth perspective, where m=1,2,...,M, Represents the dimension of the feature vector of the mth perspective, N is the number of samples, and M is the total number of perspectives; through self-representation learning The coefficient matrix is ​​derived from , so as to effectively explore the low-dimensional subspace structure in high-dimensional data; Splice along the third dimension to form a third-order tensor , applying CP decomposition to self-representing tensors , by considering the differences between different viewpoints to determine the low-rank representation,

[0011]

[0012]

[0013]

[0014] (1)

[0015] in, is a hyperparameter, , is a new representation of multi-view data in latent space, The contribution of different perspectives can be measured, R is the CP rank, I is the unit matrix, represents the matrix transpose, is the error tensor The mth forward slice, Each column of corresponds to the reconstruction error vector of different perspectives, represents the F norm, represents the 2,1 norm, represents the reconstruction error, Indicates that the matrices in the brackets are concatenated into a tensor along the third dimension;

[0016] S102. Each self-representing tensor The forward slice of corresponds to the self-representation matrix of each perspective. According to the CP decomposition, the data of each forward slice can be encoded by the factor matrix. The i-th slice matrix The decomposition of

[0017] (2)

[0018] in, is the rth column vector of the factor matrix A, is the rth column vector of the factor matrix B, is the element in the i-th row and r-th column of the factor matrix C, is the i-th row vector of the factor matrix C, is a diagonal matrix whose diagonal elements are ;

[0019] S103. According to formula (2), the consensus matrix can be obtained ,

[0020] (3)

[0021] Combined with formula (3), the final objective function is expressed as

[0022]

[0023]

[0024]

[0025] (4)

[0026] in, and is a hyperparameter, It is a consensus statement.

[0027] Furthermore, S2 specifically includes the following steps:

[0028] S201. A multi-layer perceptron CP decomposition is proposed. The goal of the multi-layer perceptron CP decomposition is to learn a set of factor matrices and a set of neural networks. , to reconstruct the tensor Column vector of forward slices of , the specific expression is:

[0029] (5)

[0030] Among them, the splicing vector Learn the nonlinear interactions between the elements in the 𝑟th component through a 2-layer multilayer perceptron;

[0031] The first layer is represented as follows:

[0032] (6)

[0033] in, represents the output vector of the first layer, represents the first layer weight matrix, represents the first layer offset vector, is the ReLU activation function:

[0034] The second layer is represented as,

[0035] (7)

[0036] in, represents the second layer weight matrix, represents the second layer offset vector;

[0037] S202. Constructing loss function , the specific expression is:

[0038] (8)

[0039] in, represents the learnable parameters, factor matrices, and weights of the multilayer perceptron in the rth group of neural networks, represents the weight matrix of the kth layer in the rth neural network, and k=1,2; and Represent the observed value and reconstructed value corresponding to each column, and Represents the weight decay coefficient.

[0040] Furthermore, S3 is specifically as follows: taking the above consensus matrix as input, performing a binary classification operation through the KMeans clustering method to obtain the final cluster label, and setting the number of cluster centers to K=2, corresponding to the normal class and the abnormal class respectively. According to the final KMeans output label, the abnormal traffic cluster is determined by combining the labels to realize automatic classification and anomaly detection of network traffic samples.

[0041] The present invention adopts the above technical solution and encodes the consensus matrix for multi-view network traffic anomaly detection based on low-rank tensor decomposition driven by multi-layer perceptron. The present invention introduces multi-layer perceptron to solve the factor matrix of tensor CP decomposition and learn the nonlinear relationship of the factor matrix. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments;

[0043] Figure 1The figure is a flow chart of the multi-view network traffic anomaly detection method based on multi-layer perception and tensor decomposition of the present invention. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0045] like Figure 1 As shown, the present invention discloses a multi-view network traffic anomaly detection method based on multi-layer perception and tensor decomposition, which includes the following steps:

[0046] S1: Extract the coefficient matrix from the traffic data matrix of each view through self-representation learning and construct a third-order tensor; then, apply CP decomposition to encode the forward slice of each self-representation tensor and use the factor matrix To generate the encoding of the consensus matrix ,in, It means extraction is a diagonal matrix with diagonal elements; It is a consensus statement. is the i-th row vector of the factor matrix C, is the total number of viewing angles;

[0047] S2: Encode the consensus matrix by decomposing the nonlinear interaction between the learning factor matrices through the multi-layer perceptron CP; adopt a two-layer multi-layer perceptron neural network The concatenation vector of each factor matrix of the tensor Perform nonlinear feature extraction, where is the rth column vector of the factor matrix A, represents the element in the i-th row and r-th column of the factor matrix C, Represents the element in the jth row and rth column of the factor matrix B; further obtain the reconstructed column vector of the forward slice , and construct a loss function that combines the factor matrix and the norm constraint of the neural network parameters, so as to achieve the coordinated optimization of the factor matrix and the multi-layer perceptron weights, and then train each factor matrix;

[0048] S3: Classify normal traffic and abnormal traffic by performing Kmeans clustering on the consensus matrix.

[0049] Furthermore, S1 specifically includes the following steps:

[0050] S101, order represents the network traffic data matrix of the mth perspective, where m=1,2,...,M, Represents the dimension of the feature vector of the mth perspective, N is the number of samples, and M is the total number of perspectives; through self-representation learning The coefficient matrix is ​​derived from , so as to effectively explore the low-dimensional subspace structure in high-dimensional data; Splice along the third dimension to form a third-order tensor , applying CP decomposition to self-representing tensors , by considering the differences between different viewpoints to determine the low-rank representation,

[0051]

[0052]

[0053]

[0054] (1)

[0055] in, is a hyperparameter, , is a new representation of multi-view data in latent space, The contribution of different perspectives can be measured, R is the CP rank, I is the unit matrix, represents the matrix transpose, is the error tensor The mth forward slice, Each column of corresponds to the reconstruction error vector of different perspectives, represents the F norm, represents the 2,1 norm; represents the reconstruction error, Indicates that the matrices in the brackets are concatenated into a tensor along the third dimension;

[0056] S102. Each self-representing tensor The forward slice of corresponds to the self-representation matrix of each perspective. According to the CP decomposition, the data of each forward slice can be encoded by the factor matrix. The i-th slice matrix The decomposition of

[0057] (2)

[0058] in, is the rth column vector of the factor matrix A, is the rth column vector of the factor matrix B, is the element in the i-th row and r-th column of the factor matrix C, is the i-th row vector of the factor matrix C, is a diagonal matrix whose diagonal elements are ;

[0059] S103. According to formula (2), the consensus matrix can be obtained ,

[0060] (3)

[0061] Combined with formula (3), the final objective function is expressed as

[0062]

[0063]

[0064]

[0065] (4)

[0066] in, and is a hyperparameter, It is a consensus statement.

[0067] Furthermore, S2 specifically includes the following steps:

[0068] S201. A multi-layer perceptron CP decomposition is proposed. The goal of the multi-layer perceptron CP decomposition is to learn a set of factor matrices and a set of neural networks. , to reconstruct the tensor Column vector of forward slices of , the specific expression is:

[0069] (5)

[0070] Among them, the splicing vector Learn the nonlinear interactions between the elements in the 𝑟th component through a 2-layer multilayer perceptron;

[0071] The first layer is represented as follows:

[0072] (6)

[0073] in, represents the output vector of the first layer, represents the first layer weight matrix, represents the first layer offset vector, is the ReLU activation function:

[0074] The second layer is represented as,

[0075] (7)

[0076] in, represents the second layer weight matrix, represents the second layer offset vector;

[0077] S202. Constructing loss function , the specific expression is:

[0078] (8)

[0079] in, represents the learnable parameters, factor matrices, and weights of the multilayer perceptron in the rth group of neural networks, represents the weight matrix of the kth layer in the rth group of neural networks, and k=1,2; it should be noted that, and Represent the observed value and reconstructed value corresponding to each column, , Represents the weight decay coefficient; based on the Adam optimizer optimization formula (8), the back propagation technology is used to train the factor matrix and the multilayer perceptron at the same time.

[0080] Furthermore, S3 is specifically as follows: taking the above consensus matrix as input, performing a binary classification operation through the KMeans clustering method to obtain the final cluster label, and setting the number of cluster centers to K=2, corresponding to the normal class and the abnormal class respectively. According to the final KMeans output label, the abnormal traffic cluster is determined by combining the labels to realize automatic classification and anomaly detection of network traffic samples.

[0081] The present invention adopts the above technical solution and encodes the consensus matrix for multi-view network traffic anomaly detection based on low-rank tensor decomposition driven by multi-layer perceptron. The present invention introduces multi-layer perceptron to solve the factor matrix of tensor CP decomposition and learn the nonlinear relationship of the factor matrix.

[0082] Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other. The components of the embodiments of the present application generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the detailed description of the embodiments of the present application is not intended to limit the scope of the application for protection, but merely represents the selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

Claims

1. A multi-view network traffic anomaly detection method based on multi-layer perception and tensor decomposition, characterized by: It includes the following steps: S1: Extract the coefficient matrix from the traffic data matrix of each view through self-representation learning and construct a third-order tensor; then, apply CP decomposition to encode the forward slice of each self-representation tensor and use the factor matrix Generate the code for the consensus matrix ,in, It means extraction is a diagonal matrix with diagonal elements; It is a consensus statement. is the i-th row vector of the factor matrix C, is the total number of viewing angles; S2: Encode the consensus matrix by decomposing the nonlinear interaction between the learning factor matrices through the multi-layer perceptron CP; adopt a two-layer multi-layer perceptron neural network The concatenation vector of each factor matrix of the tensor Perform nonlinear feature extraction to obtain the reconstructed column vector of the forward slice , and construct a loss function that combines the factor matrix and the neural network parameter norm constraint to achieve collaborative optimization of the factor matrix and the multi-layer perceptron weights in order to train each factor matrix; is the rth column vector of the factor matrix A, represents the element in the i-th row and r-th column of the factor matrix C, Represents the element in the jth row and rth column of the factor matrix B; S3: Kmeans clustering is performed on the consensus matrix to classify normal traffic and abnormal traffic.

2. The multi-view network traffic anomaly detection method based on multi-layer perception and tensor decomposition according to claim 1 is characterized by: S1 specifically includes the following steps: S101, order represents the network traffic data matrix of the mth perspective, where m=1,2,...,M; Represents the dimension of the feature vector of the mth perspective, N is the number of samples; through self-representation learning The coefficient matrix is ​​derived from ; Each Splice along the third dimension to form a third-order tensor , applying CP decomposition to self-representing tensors , determine the low-rank representation by the difference between different perspectives, （1） in, is a hyperparameter, , is a new representation of multi-view data in latent space, Measure the contribution of different perspectives, R is the CP rank, I is the identity matrix, represents the matrix transpose, is the error tensor The mth forward slice, Each column of corresponds to the reconstruction error vector of different perspectives, represents the F norm, represents the 2,1 norm, represents the reconstruction error, Indicates that the matrices in the brackets are concatenated into a tensor along the third dimension; S102. Each self-representing tensor The forward slice of corresponds to the self-representation matrix of each perspective. According to the CP decomposition, the data of each forward slice is encoded by the factor matrix. The i-th slice matrix The decomposition of is expressed as: （2） in, is the rth column vector of the factor matrix A, is the rth column vector of the factor matrix B, is the element in the i-th row and r-th column of the factor matrix C, is a diagonal matrix whose diagonal elements are ; S103. Calculate the consensus matrix based on the slice matrix , （3） Combined with the consensus matrix, the final objective function is expressed as: （4） in, and is a hyperparameter, It is a consensus statement.

3. The multi-view network traffic anomaly detection method based on multi-layer perception and tensor decomposition according to claim 2 is characterized by: S2 specifically includes the following steps: S201. A multi-layer perceptron CP decomposition is proposed. The goal of the multi-layer perceptron CP decomposition is to learn a set of factor matrices and a set of neural networks. , to reconstruct the tensor Column vector of the forward slice of , the specific expression is: （5） Among them, the splicing vector Learn the nonlinear interactions between the elements in the 𝑟th component through a 2-layer multilayer perceptron; The first layer is represented as follows: （6） in, represents the output vector of the first layer, represents the first layer weight matrix, represents the first layer offset vector, is the ReLU activation function: The second layer is represented as, （7） in, represents the second layer weight matrix, represents the second layer offset vector; S202. Constructing loss function , the specific expression is: （8） in, represents the learnable parameters, factor matrices, and weights of the multilayer perceptron in the rth group of neural networks, represents the weight matrix of the kth layer in the rth neural network, and k=1,2; and Represent the observed value and reconstructed value corresponding to each column, and Represents the weight decay coefficient.

4. The multi-view network traffic anomaly detection method based on multi-layer perception and tensor decomposition according to claim 3 is characterized by: In S202, based on the Adam optimizer loss function, the back propagation technique is used to simultaneously train the factor matrix and the multilayer perceptron.

5. The multi-view network traffic anomaly detection method based on multi-layer perception and tensor decomposition according to claim 1 is characterized by: S3 specifically involves: using the consensus matrix as input to perform binary classification operations through the KMeans clustering method to obtain the final cluster labels. Based on the labels output by the final KMeans, the abnormal traffic clusters are determined by combining the labels to achieve automatic classification and anomaly detection of network traffic samples.

6. The multi-view network traffic anomaly detection method based on multi-layer perception and tensor decomposition according to claim 5 is characterized by: The number of cluster centers corresponding to the cluster labels is set to K = 2, corresponding to the normal class and the abnormal class respectively.

Images