Multi-view network traffic anomaly detection method based on multi-layer perception and tensor decomposition

Abstract

The application discloses a multi-view network traffic anomaly detection method based on multilayer perception and tensor decomposition, extracts a coefficient matrix from a traffic data matrix of each view and constructs a third-order tensor through self-representation learning; applies CP decomposition to encode a forward slice of each self-representation tensor and generates a consensus matrix code by using a factor matrix; encodes the consensus matrix by learning a nonlinear interaction relationship between the factor matrices through multilayer perception CP decomposition; adopts a two-layer multilayer perception neural network to perform nonlinear feature extraction on a splicing vector of each factor matrix of the tensor to obtain a reconstructed column vector of the forward slice, constructs a loss function with a joint factor matrix and a neural network parameter norm constraint, realizes collaborative optimization of the factor matrix and multilayer perception weights, and then trains each factor matrix; finally, normal traffic and abnormal traffic are classified through Kmeans clustering on the consensus matrix. The application realizes high-precision detection of network traffic anomalies.

Description

TECHNICAL FIELD

[0001] The application relates to the field of network traffic anomaly detection, and in particular to a multi-view network traffic anomaly detection method based on multilayer perception and tensor decomposition. BACKGROUND

[0002] With the continuous expansion of network scale and the improvement of business complexity, the data generated in the network environment presents the characteristics of high dimension, multi-source and time-varying, and the network traffic anomaly detection faces the challenges of complex data structure, high dimension, various views and concealed abnormal patterns. Traditional anomaly detection methods, such as rule matching, statistical threshold or shallow machine learning model-based methods, often have difficulty in capturing the deep association between multi-views, and show poor generalization ability and scalability when facing large-scale data. In contrast, multi-view anomaly detection utilizes complementary information from multiple views to improve detection accuracy. SUMMARY

[0003] The application aims to provide a multi-view network traffic anomaly detection method based on multilayer perception and tensor decomposition.

[0004] The technical scheme adopted by the application is as follows:

[0005] The multi-view network traffic anomaly detection method based on multilayer perception and tensor decomposition comprises the following steps:

[0006] S1: extracting a coefficient matrix from a traffic data matrix of each view through self-representation learning, and constructing a third-order tensor; then, applying CP decomposition to encode the forward slice of each self-representation tensor, and generating the encoding of the consensus matrix by using the factor matrix wherein, is a diagonal matrix with the diagonal elements being is a consensus representation, is the i-th row vector of the factor matrix C, is the total number of views;

[0007] S2: encoding the consensus matrix by learning the nonlinear interaction relationship between the factor matrices through multilayer perception CP decomposition; adopting a two-layer multilayer perception neural network to perform nonlinear feature extraction on the splicing vector of each factor matrix of the tensor, wherein, is the r-th column vector of the factor matrix A, represents the element of the i-th row and r-th column of the factor matrix C, represents the element of the j-th row and r-th column of the factor matrix B; and further obtaining the reconstructed column vector of the forward slice ​​and construct a loss function with joint factor matrix and neural network parameter norm constraint, so as to realize the collaborative optimization of the factor matrix and the multi-layer perception weight, and then train each factor matrix;

[0008] S3: classifying normal traffic and abnormal traffic by Kmeans clustering of the consensus matrix.

[0009] Further, S1 specifically comprises the following steps:

[0010] S101, let denote the network traffic data matrix of the mth view, where m = 1, 2, …, M, represent the feature vector dimension of the mth view, N is the sample number, and M is the total number of views; through self-representation learning , the coefficient matrix is derived, so as to effectively explore the low-dimensional subspace structure in high-dimensional data; each is spliced along the third dimension to form a three-order tensor , the CP decomposition is applied to the self-representation tensor

[0011]

[0012]

[0013]

[0014] (1)

[0015] wherein, is a hyperparameter, , is a new representation of multi-view data in the latent space, can measure the contribution of different views, R is the CP rank, and I is the unit matrix, denotes matrix transposition, is an error tensor , the mth forward slice, each column of which corresponds to a reconstruction error vector of different views, denotes the F norm, denotes the 2,1 norm, denotes the reconstruction error, denotes splicing the matrix in the brackets into a tensor along the third dimension;

[0016] S102. Each self-representation tensor The forward slice of the tensor corresponds to a self-representation matrix of each view. According to the CP decomposition, the data of each forward slice can be encoded by a factor matrix, and the i-th slice matrix The decomposition of the tensor is expressed as

[0017] (2)

[0018] wherein, is the r-th column vector of the factor matrix A, is the r-th column vector of the factor matrix B, is the element of the i-th row and r-th column of the factor matrix C, is the i-th row vector of the factor matrix C, is a diagonal matrix whose diagonal elements are ;

[0019] S103. According to formula (2), the consensus matrix ,

[0020] (3)

[0021] In combination with formula (3), the final objective function is expressed as

[0022]

[0023]

[0024]

[0025] (4)

[0026] wherein, and are hyperparameters, is the consensus representation.

[0027] Further, S2 specifically comprises the following steps:

[0028] S201. A multi-layer perceptron CP decomposition is proposed, and the objective of the multi-layer perceptron CP decomposition is to reconstruct the column vectors of the forward slice of the tensor by learning a set of factor matrices and a set of neural networks , and the specific expression is:

[0029] (5)

[0030] wherein, the spliced vector learns the nonlinear interaction between each element in the r-th component through a 2-layer multi-layer perceptron; ​

[0031] The first layer is represented as follows:

[0032] (6)

[0033] wherein, represents an output vector of the first layer, represents a first layer weight matrix, represents a first layer offset vector, is a ReLU activation function:

[0034] The second layer is represented as,

[0035] (7)

[0036] wherein, represents a second layer weight matrix, represents a second layer offset vector;

[0037] S202. Constructing a loss function , and the specific expression is:

[0038] (8)

[0039] wherein, represents a learnable parameter, a factor matrix and a weight of a multi-layer perceptron in the rth group of neural networks, represents a weight matrix of the kth layer in the rth group of neural networks, and k=1, 2; and respectively represent an observation value and a reconstruction value corresponding to each column, and represents a weight decay coefficient.

[0040] Further, S3 is specifically: taking the above consensus matrix as input, performing binary classification operation through KMeans clustering method to obtain a final clustering label, the number of clustering centers is set as K=2, corresponding to a normal class and an abnormal class respectively, according to the label output by the final KMeans, the abnormal traffic cluster is determined by combining the label, and automatic classification and abnormal detection of network traffic samples are realized.

[0041] The above technical scheme is adopted in the application, and a consensus matrix is encoded based on a multi-layer perceptron driven low-rank tensor decomposition for multi-view network traffic anomaly detection. The application introduces a multi-layer perceptron to solve a factor matrix of tensor CP decomposition and learn a nonlinear relationship of the factor matrix. BRIEF DESCRIPTION OF DRAWINGS

[0042] The application will be further described in detail below in combination with the drawings and specific embodiments;

[0043] Figure 1A flowchart of a multi-view network traffic anomaly detection method based on multi-layer perception and tensor decomposition. DETAILED DESCRIPTION

[0044] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application.

[0045] As shown in Figure 1 , the present application discloses a multi-view network traffic anomaly detection method based on multi-layer perception and tensor decomposition, which comprises the following steps:

[0046] S1: extracting a coefficient matrix from a traffic data matrix of each view angle through self-representation learning, and constructing a third-order tensor; then, applying CP decomposition to encode a forward slice of each self-representation tensor, and generating an encoding of a consensus matrix by using a factor matrix . , wherein, is a diagonal matrix representing the extraction of a diagonal element; is a consensus representation, is an i-th row vector of the factor matrix C, , and M is the total number of view angles.

[0047] S2: encoding the consensus matrix by learning a nonlinear interaction relationship between the factor matrices through multi-layer perception CP decomposition; adopting a two-layer multi-layer perception neural network to perform nonlinear feature extraction on a splicing vector of each factor matrix of the tensor, wherein, is an r-th column vector of the factor matrix A, represents an element of an i-th row and r-th column of the factor matrix C, represents an element of a j-th row and r-th column of the factor matrix B; further obtaining a reconstructed column vector of the forward slice, and constructing a loss function with a joint factor matrix and a neural network parameter norm constraint, so as to realize a collaborative optimization of the factor matrix and the multi-layer perception weight, and then train to obtain each factor matrix.

[0048] S3: classifying normal traffic and abnormal traffic by Kmeans clustering on the consensus matrix.

[0049] Further, S1 specifically comprises the following steps:

[0050] S101, let represent a network traffic data matrix of an m-th view angle, wherein m=1, 2, …, M, dimension of feature vector representing the mth view, N is the number of samples, and M is the total number of views; the coefficient matrix is derived through self-representation learning , so as to effectively explore the low-dimensional subspace structure in high-dimensional data; each is spliced along the third dimension to form a three-order tensor , the CP decomposition is applied to the self-representation tensor , the low-rank representation is determined by considering the difference between different views,

[0051]

[0052]

[0053]

[0054] (1)

[0055] wherein, is a hyperparameter, , is a new representation of multi-view data in a latent space, can measure the contribution of different views, R is the CP rank, and I is the unit matrix, represents matrix transposition, is an error tensor the mth forward slice, each column of the matrix corresponds to a reconstruction error vector of different views, represents the F norm, represents the 2,1 norm; represents the reconstruction error, represents splicing the matrix in the parentheses into a tensor along the third dimension;

[0056] S102. Each self-representation tensor is spliced into a tensor along the third dimension, and each forward slice of the self-representation tensor corresponds to a self-representation matrix of each view. According to the CP decomposition, the data of each forward slice can be encoded by the factor matrix, and the decomposition of the ith slice matrix is expressed as

[0057] (2)

[0058] wherein, is the rth column vector of the factor matrix A, is the rth column vector of the factor matrix B, is the element of the ith row and rth column of the factor matrix C, is the ith row vector of the factor matrix C, is a diagonal matrix, and the diagonal elements are​ ;

[0059] S103. According to formula (2), the consensus matrix can be obtained ,

[0060] (3)

[0061] In combination with formula (3), the final objective function is expressed as

[0062]

[0063]

[0064]

[0065] (4)

[0066] wherein, and are hyperparameters, is the consensus representation.

[0067] Further, S2 specifically comprises the following steps:

[0068] S201. A multi-layer perceptron CP decomposition is proposed, and the objective of the multi-layer perceptron CP decomposition is to reconstruct the column vector of the forward slice of the tensor by learning a set of factor matrices and a set of neural networks , and the specific expression is:

[0069] (5) wherein, the spliced vector

[0070] learns the nonlinear interaction between each element in the 𝑟th component through a 2-layer multi-layer perceptron;

[0071] The first layer is expressed as follows:

[0072] (6)

[0073] wherein, represents the output vector of the first layer, represents the first layer weight matrix, represents the first layer offset vector, is a ReLU activation function:

[0074] The second layer is expressed as,

[0075] (7)

[0076] wherein,​ denotes a second layer weight matrix, denotes a second layer offset vector;

[0077] S202. Constructing a loss function , the specific expression is:

[0078] (8)

[0079] wherein, denotes a learnable parameter in the rth group of neural networks, a factor matrix and a weight of a multi-layer perceptron, denotes a weight matrix of the kth layer in the rth group of neural networks, and k=1,2; it should be noted that, and denote observation values and reconstruction values corresponding to each column respectively, , denotes a weight decay coefficient; based on the Adam optimizer optimization formula (8), the factor matrix and the multi-layer perceptron are trained simultaneously by using the back propagation technology.

[0080] Further, S3 is specifically: taking the above consensus matrix as input, performing two-class operation through the KMeans clustering method to obtain a final clustering label, the number of clustering centers is set as K=2, corresponding to a normal class and an abnormal class respectively, and according to the label output by the final KMeans, the abnormal traffic cluster is determined by combining the label, so that automatic classification and abnormal detection of network traffic samples are realized.

[0081] The application adopts the above technical scheme, and encodes the consensus matrix based on a multi-layer perceptron driven low-rank tensor decomposition for multi-view network traffic anomaly detection. The application introduces a multi-layer perceptron to solve a factor matrix of tensor CP decomposition and learn a nonlinear relationship of the factor matrix.

[0082] Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. The embodiments in the present application and the features in the embodiments can be combined with each other without conflict. The components of the embodiments of the present application described and shown in the drawings can be arranged and designed in various different configurations. Therefore, the detailed description of the embodiments of the present application is not intended to limit the scope of the claimed application, but only represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

Claims

1. A multi-view network traffic anomaly detection method based on multi-layer perception and tensor decomposition, characterized by: It includes the following steps: S1: Extract the coefficient matrix from the traffic data matrix of each view through self-representation learning and construct a third-order tensor; then, apply CP decomposition to encode the forward slice of each self-representation tensor and use the factor matrix Generate the code for the consensus matrix ,in, It means extraction is a diagonal matrix with diagonal elements; It is a consensus statement. is the i-th row vector of the factor matrix C, is the total number of viewing angles; Among them, S1 specifically includes the following steps: S101, order represents the network traffic data matrix of the mth perspective, where m=1,2,...,M; Represents the dimension of the feature vector of the mth perspective, N is the number of samples; through self-representation learning The coefficient matrix is ​​derived from ; Each Splice along the third dimension to form a third-order tensor , applying CP decomposition to self-representing tensors , determine the low-rank representation by the difference between different perspectives, （1） in, is a hyperparameter, , is a new representation of multi-view data in latent space, Measure the contribution of different perspectives, R is the CP rank, I is the identity matrix, represents the matrix transpose, is the error tensor The mth forward slice, Each column of corresponds to the reconstruction error vector of different perspectives, represents the F norm, represents the 2,1 norm, represents the reconstruction error, Indicates that the matrices in the brackets are concatenated into a tensor along the third dimension; S102. Each self-representing tensor The forward slice of corresponds to the self-representation matrix of each perspective. According to the CP decomposition, the data of each forward slice is encoded by the factor matrix. The i-th slice matrix The decomposition of is expressed as: （2） in, is the rth column vector of the factor matrix A, is the rth column vector of the factor matrix B, is the element in the i-th row and r-th column of the factor matrix C, is a diagonal matrix whose diagonal elements are ; S103. Calculate the consensus matrix based on the slice matrix , （3） Combined with the consensus matrix, the final objective function is expressed as: （4） in, and is a hyperparameter, It is a consensus statement; S2: Encode the consensus matrix by decomposing the nonlinear interaction between the learning factor matrices through the multi-layer perceptron CP; adopt a two-layer multi-layer perceptron neural network The concatenation vector of each factor matrix of the tensor Perform nonlinear feature extraction to obtain the reconstructed column vector of the forward slice , and construct a loss function that combines the factor matrix and the neural network parameter norm constraint to achieve collaborative optimization of the factor matrix and the multi-layer perceptron weights in order to train each factor matrix; is the rth column vector of the factor matrix A, represents the element in the i-th row and r-th column of the factor matrix C, Represents the element in the jth row and rth column of the factor matrix B; S3: Kmeans clustering is performed on the consensus matrix to classify normal traffic and abnormal traffic.

2. The multi-view network traffic anomaly detection method based on multi-layer perception and tensor decomposition according to claim 1 is characterized by: S2 specifically includes the following steps: S201. A multi-layer perceptron CP decomposition is proposed. The goal of the multi-layer perceptron CP decomposition is to learn a set of factor matrices and a set of neural networks. , to reconstruct the tensor Column vector of the forward slice of , the specific expression is: （5） Among them, the splicing vector Learn the nonlinear interactions between the elements in the 𝑟th component through a 2-layer multilayer perceptron; The first layer is represented as follows: （6） in, represents the output vector of the first layer, represents the first layer weight matrix, represents the first layer offset vector, is the ReLU activation function: The second layer is represented as, （7） in, represents the second layer weight matrix, represents the second layer offset vector; S202. Constructing loss function , the specific expression is: （8） in, represents the learnable parameters, factor matrices, and weights of the multilayer perceptron in the rth group of neural networks, represents the weight matrix of the kth layer in the rth neural network, and k=1,2; and Represent the observed value and reconstructed value corresponding to each column, and Represents the weight decay coefficient.

3. The multi-view network traffic anomaly detection method based on multi-layer perception and tensor decomposition according to claim 2 is characterized by: In S202, based on the Adam optimizer loss function, the back propagation technique is used to simultaneously train the factor matrix and the multilayer perceptron.

4. The multi-view network traffic anomaly detection method based on multi-layer perception and tensor decomposition according to claim 1 is characterized by: S3 specifically involves: using the consensus matrix as input to perform binary classification operations through the KMeans clustering method to obtain the final cluster labels. Based on the labels output by the final KMeans, the abnormal traffic clusters are determined by combining the labels to achieve automatic classification and anomaly detection of network traffic samples.

5. The multi-view network traffic anomaly detection method based on multi-layer perception and tensor decomposition according to claim 4 is characterized by: The number of cluster centers corresponding to the cluster labels is set to K = 2, corresponding to the normal class and the abnormal class respectively.

Images