Incremental updating method and device for flow detection model

Abstract

The embodiment of the invention provides an incremental updating method and device for a traffic detection model, and the method comprises the steps: obtaining a historical feature mean value, inputting new traffic data into the traffic detection model, extracting a new traffic feature corresponding to the new traffic data, calculating a new feature mean value, and carrying out the incremental updating of the traffic detection model according to a data distribution relation between the historical traffic feature and the new traffic feature. And based on the historical feature mean value and the new feature mean value, generating a pseudo historical traffic feature with the same data size as the new traffic feature, constructing a balanced data set comprising the new traffic feature and the pseudo historical traffic feature, and training a classifier of a traffic detection model by using the balanced data set to obtain an updated traffic detection model. According to the incremental updating method, the space-time complexity is low, the updating speed is high, few resources are occupied, meanwhile, the stability and plasticity of the model can be guaranteed, and the accuracy of flow detection is guaranteed.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of artificial intelligence technology, and in particular to a method and device for incrementally updating a traffic detection model. Background Art

[0002] In traffic detection scenarios, pre-built traffic detection models can be deployed on edge devices close to users, ensuring real-time traffic detection while reducing data processing pressure on the cloud. Since traffic is constantly changing, the model needs to be updated promptly to ensure accurate traffic detection. Since it is deployed on edge devices, model updates must consider both the limited resources of the devices and the balance between new and historical traffic to ensure model stability and flexibility. Summary of the Invention

[0003] In view of this, the purpose of the embodiments of the present application is to propose a method and device for incremental updating of a traffic detection model to solve the problem of incremental updating of the model.

[0004] Based on the above objectives, an embodiment of the present application provides a method for incrementally updating a traffic detection model, including:

[0005] Obtaining a historical feature mean; wherein the historical feature mean is calculated based on the historical traffic features extracted from the historical traffic data;

[0006] Input the new flow data into the flow detection model, and extract the new flow features corresponding to the new flow data by the feature extraction module of the flow detection model;

[0007] Calculating a new feature mean based on the new traffic feature;

[0008] According to the data distribution relationship between the historical traffic feature and the new traffic feature, a pseudo historical traffic feature having the same data volume as the new traffic feature is generated based on the historical feature mean and the new feature mean;

[0009] constructing a balanced data set based on the new traffic characteristics and the pseudo historical traffic characteristics;

[0010] The balanced data set is used to train the classifier of the traffic detection model, and an updated traffic detection model is obtained after training.

[0011] Optionally, the distribution of the historical traffic feature and the new traffic feature follows Gaussian approximation, and the mean of the historical feature and the mean of the new feature have the same spherical homoscedasticity;

[0012] Generating a pseudo historical traffic feature having the same data volume as the new traffic feature based on the data distribution relationship between the historical traffic feature and the new traffic feature and based on the historical feature mean and the new feature mean, including:

[0013] Calculating an orthogonal matrix based on the historical feature mean and the new feature mean;

[0014] According to the orthogonal matrix and the data sample in the new traffic feature, a pseudo historical traffic feature sample corresponding to the data sample is generated.

[0015] Optionally, a method for calculating an orthogonal matrix based on the historical feature mean and the new feature mean is:

[0016]

[0017]

[0018] Among them, A is an orthogonal matrix, μ1 is the new feature mean, μ2 is the historical feature mean, and α is the rotation angle between the new feature mean and the historical feature mean.

[0019] Optionally, based on the orthogonal matrix and the data sample in the new traffic feature, a pseudo historical traffic feature corresponding to the data sample is generated by:

[0020]

[0021] Among them, x1 is the data sample in the new traffic feature, is the pseudo historical traffic feature sample corresponding to the data sample.

[0022] Optionally, calculating a new feature mean based on the new traffic feature includes:

[0023] The feature values ​​of the corresponding rows and columns of the new traffic feature are added together and divided by the number of new traffic features to obtain the new feature mean.

[0024] The present application also provides an incremental update device for a traffic detection model, including:

[0025] An acquisition module, configured to acquire a historical feature mean; wherein the historical feature mean is calculated based on historical traffic features extracted from historical traffic data;

[0026] An extraction module, configured to input new flow data into a flow detection model, and extract new flow features corresponding to the new flow data by a feature extraction module of the flow detection model;

[0027] A calculation module, configured to calculate a new feature mean based on the new traffic feature;

[0028] a regeneration module, configured to generate a pseudo historical traffic feature having the same data volume as the new traffic feature based on a data distribution relationship between the historical traffic feature and the new traffic feature, and based on a mean value of the historical feature and a mean value of the new feature;

[0029] A construction module, configured to construct a balanced data set based on the new traffic features and the pseudo historical traffic features;

[0030] An updating module is used to train the classifier of the traffic detection model using the balanced data set, and obtain an updated traffic detection model after training.

[0031] Optionally, the distribution of the historical traffic feature and the new traffic feature follows Gaussian approximation, and the mean of the historical feature and the mean of the new feature have the same spherical homoscedasticity;

[0032] The regeneration module is used to calculate an orthogonal matrix based on the historical feature mean and the new feature mean; and generate a pseudo historical traffic feature sample corresponding to the data sample based on the orthogonal matrix and the data sample in the new traffic feature.

[0033] Optionally, the regeneration module calculates the orthogonal matrix by:

[0034]

[0035]

[0036] Among them, A is an orthogonal matrix, μ1 is the new feature mean, μ2 is the historical feature mean, and α is the rotation angle between the new feature mean and the historical feature mean.

[0037] Optionally, the method for the regeneration module to generate the pseudo historical traffic features is:

[0038]

[0039] Among them, x1 is the data sample in the new traffic feature, is the pseudo historical traffic feature sample corresponding to the data sample.

[0040] Optionally, the calculation module is used to add the characteristic values ​​of corresponding rows and columns of the new traffic feature, and divide the sum by the number of new traffic features to obtain a new feature mean.

[0041] As can be seen from the above, the incremental update method and device of the traffic detection model provided by the embodiment of the present application obtains the mean of historical features, inputs new traffic data into the traffic detection model, extracts new traffic features corresponding to the new traffic data, and calculates the mean of the new features. According to the data distribution relationship between the historical traffic features and the new traffic features, based on the historical feature mean and the new feature mean, a pseudo-historical traffic feature with the same data volume as the new traffic feature is generated, and a balanced data set including the new traffic features and the pseudo-historical traffic features is constructed. The balanced data set is used to train the classifier of the traffic detection model to obtain an updated traffic detection model. The incremental update method of the present application has low time and space complexity, fast update speed, and takes up fewer resources. At the same time, it can ensure the stability and plasticity of the model and the accuracy of traffic detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0043] Figure 1 This is a schematic diagram of the method flow of an embodiment of the present application;

[0044] Figure 2 This is a schematic diagram of the model updating principle of an embodiment of the present application;

[0045] Figure 3 Schematic diagram of characteristic distribution of an embodiment of the present application;

[0046] Figure 4 This is a schematic diagram of feature transformation in an embodiment of the present application;

[0047] Figure 5 This is a block diagram of the device structure of an embodiment of the present application;

[0048] Figure 6 This is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0049] In order to make the objectives, technical solutions and advantages of the present disclosure more clearly understood, the present disclosure is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

[0050] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should have the usual meanings understood by people with ordinary skills in the field to which this disclosure belongs. The "first", "second" and similar words used in the embodiments of the present application do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0051] As described in the background technology section, in order to ensure the accuracy of traffic detection, the traffic detection model deployed on the edge device needs to be updated regularly. Due to the limited computing, storage and other resources of the edge device, it is not suitable to adopt a full update method, that is, to retrain the traffic detection model based on all data samples consisting of new traffic and historical traffic. It is an effective method to update the existing model using an incremental update method. The relevant incremental update methods include methods based on extended model structure, methods based on data playback and methods based on knowledge distillation. Among them, the method based on extended model structure has high time and space complexity. As the number of new traffic categories increases, the number of model parameters and training time will increase. It is not suitable for traffic detection scenarios that require fast response; the methods based on data playback and knowledge distillation require a certain amount of storage resources to save data samples of historical traffic, and the amount of saved data has a great impact on the performance of the method. The saved data samples will consume a lot of time to repeatedly learn in the subsequent incremental stage. Therefore, the incremental update methods in the relevant technology have problems such as high time and space complexity and high resource consumption. It is still not suitable for traffic detection model updates of edge devices.

[0052] In view of this, an embodiment of the present application provides an incremental update method for a traffic detection model. For historical traffic features identified based on historical traffic data, only the mean of the historical features is retained. A feature regeneration method is adopted to generate pseudo-historical traffic features with the same data volume as the new traffic features based on the mean of the historical features. The classifier of the model is retrained based on the pseudo-historical traffic features and the new traffic features, thereby obtaining an updated traffic detection model. The method has low time and space complexity, fast model update speed, can ensure the accuracy of traffic detection, and is suitable for incremental model updates on edge devices.

[0053] The technical solution of the present application is further described in detail below through specific examples.

[0054] like Figure 1 As shown, the embodiment of the present application provides a method for incrementally updating a traffic detection model, including:

[0055] S101: Obtaining a historical feature mean; wherein the historical feature mean is calculated based on historical traffic features extracted from historical traffic data;

[0056] In this embodiment, after the constructed traffic detection model is trained using the initial traffic data sample, it is deployed on the edge device for traffic detection. Traffic detection includes identifying the type of traffic. The types of traffic include normal traffic, abnormal traffic, encrypted traffic, etc. Each type of traffic can be divided into multiple subtypes. For example, abnormal traffic can be divided according to attack type, threat type, etc., and normal traffic can be divided according to traffic content type (for example, video, audio, image, etc.), protocol type, etc. The traffic detection model can detect and identify traffic results that can be determined according to application requirements and model structure. The specific function and structure of the model are not specifically limited.

[0057] During the use of the traffic detection model, since the actual traffic is constantly changing, the historical traffic used in the training phase may appear, and new types of traffic may also appear. To ensure the detection accuracy of the model, the model needs to be updated regularly so that the model can not only recognize the historical traffic that has been learned, but also detect new types of traffic. For the traffic detection model deployed on the edge device, the existing traffic detection model is updated using an incremental update method. To ensure that the updated model can learn the characteristics of the new type of traffic without forgetting the characteristics of the historical traffic, and considering the limited storage resources of the edge device, for the trained model, it is not necessary to store all the historical traffic data and historical traffic features. Instead, the historical feature mean based on the historical traffic features extracted from the historical traffic data is saved. This can not only retain the feature information of the historical traffic and prevent the model from forgetting the historical traffic features, but also does not take up too many storage resources.

[0058] In some embodiments, the traffic detection model includes a feature extraction module for extracting traffic features from traffic data samples input into the model. After inputting historical traffic data into the model, the feature extraction module can extract corresponding historical traffic features from the historical traffic data, and then calculate the feature mean of the historical traffic features to obtain the historical feature mean. The feature extraction module extracts multiple historical traffic features, and each historical traffic feature has the same row and column dimensions. The method for calculating the historical feature mean is: adding the feature values ​​of the corresponding rows and columns of each historical traffic feature and dividing it by the number of historical traffic features to obtain the historical feature mean; for example, 100 historical traffic features with 1 row and 20 columns are extracted. During calculation, the feature values ​​of each column of the 100 features are correspondingly added to obtain a total feature with 1 row and 20 columns, and then the total feature of each column is divided by 100 to obtain the feature mean.

[0059] S102: Input the new traffic data into the traffic detection model, and extract the new traffic features corresponding to the new traffic data by the feature extraction module of the traffic detection model;

[0060] S103: Calculate a new feature mean based on the new traffic feature;

[0061] In this embodiment, when updating the model, the newly acquired traffic data is input into the current traffic detection model. The model's feature extraction module extracts corresponding new traffic features from the new traffic data, and then calculates the new feature mean based on the new traffic features. The method for calculating the new feature mean is the same as the method for calculating the historical feature mean: the feature values ​​of the corresponding rows and columns of the extracted new traffic features are added together and divided by the number of new traffic features to obtain the new feature mean.

[0062] S104: Generate a pseudo historical traffic feature with the same data volume as the new traffic feature based on the data distribution relationship between the historical traffic feature and the new traffic feature, based on the historical feature mean and the new feature mean;

[0063] In this embodiment, after model training, since only the mean of historical features is retained and not all historical traffic data and historical traffic features are retained, there is an obvious difference in data volume between the extracted new traffic features and the retained mean of historical features. In order to ensure that the model can fully learn the features of new traffic and historical traffic and maintain the stability of the model, when updating the model, it is necessary to construct a training data set for updating the model based on the new traffic features and the mean of historical features.

[0064] like Figure 3As shown, the historical traffic features extracted from the historical traffic data by the feature extraction model and the new traffic features extracted from the new traffic data are both normalized features. The normalized features are scaled to the same scale and then confined to the surface of a hypersphere. Therefore, this embodiment proposes the assumption that the distribution of historical traffic features and new traffic features follows Gaussian approximation, and the traffic feature distributions of different types of traffic have different mean values, but have common covariance eigenvalues, that is, spherical homoscedasticity. Geometrically speaking, based on the above assumption, if the distribution of historical traffic features and new traffic features is spherical homoscedasticity, then the relationship between the mean of the historical features and the mean of the new features can be used to construct corresponding pseudo features in the feature representation space associated with the historical traffic features based on the feature samples in the new traffic features, thereby achieving the purpose of expanding the number of historical traffic features.

[0065] Among them, spherical homoscedasticity is a property that describes the distribution relationship of a set of data on a sphere. The definition of spherical homoscedasticity uses Gaussian approximation. The definitions of Gaussian approximation and spherical homoscedasticity are given below.

[0066] The Gaussian approximation is defined as: Assume x i is the i-th sample of the spherical distribution, and the Gaussian approximation is N(E(x i ),Var(x i )), where E(.) and Var(.) are functions of the expectation and variance.

[0067] Spherical homoscedasticity is defined as follows: Assume that the distribution N1(μ,Σ) is a Gaussian approximation of the spherical distribution F1, A is an orthogonal matrix, A is composed of an eigenvector of μ and Σ, N2(Aμ,A T ΣA) is a Gaussian approximation of the spherical distribution F2, then N1 and N2 (i.e., F1 and F2) are spherically homoscedastic.

[0068] like Figure 4 As shown, the spherical feature transformation algorithm is defined as follows: if the Gaussian approximations of the two feature distributions are N1(μ1,Σ1) and N2(μ2,Σ2), μ1 is the mean of the first feature and μ2 is the mean of the second feature. Given a data sample x1 sampled from N1, a pseudo data sample of the second feature can be obtained. Expressed as:

[0069]

[0070] It can be seen that for two types of features that follow the Gaussian approximate distribution, if the data samples of one type of feature and the orthogonal matrix between the two types of features are known, the pseudo data samples of the other type of feature can be constructed according to the spherical feature transformation algorithm.

[0071] In some implementations, Schmidt orthogonalization is performed on the calculated new feature mean μ1 and the obtained historical feature mean μ2 to obtain n1 and n2, and the calculation method is:

[0072]

[0073] Use the Rodrigues rotation formula to calculate the rotation matrix (orthogonal matrix) as follows:

[0074]

[0075] Where I is the identity matrix and α is the rotation angle between μ1 and μ2.

[0076] The rotation angle is the minimum angle at which one of the vectors (in this embodiment, the corresponding new feature mean vector μ1) rotates counterclockwise to the same direction as the other vector (in this embodiment, the corresponding historical feature mean vector μ2), which can be calculated by the dot product and cross product of the two vectors. The specific process is as follows: First, the dot product of the two vectors is calculated to obtain the cosine of the angle between the two. Since the angle corresponding to the cosine of the angle has no directionality and ranges from 0 to π, the angle is not equivalent to the rotation angle; then, the positional relationship between the two is determined by the cross product of the two. The result of the cross product is a vector whose modulus represents the sine of the angle between the two vectors, and the direction determines the relative rotation direction of the two vectors; finally, the cosine of the angle obtained by the dot product and the modulus obtained by the cross product are combined to calculate the rotation angle between the two vectors using the inverse tangent function. This embodiment does not provide a detailed description of the specific formula and method for calculating the rotation angle.

[0077] In some embodiments, based on the data distribution relationship between the historical traffic features and the new traffic features on a spherical surface, a pseudo historical traffic feature having the same data volume as the new traffic feature can be generated according to a spherical feature transformation algorithm based on data samples in the new traffic feature. The method includes:

[0078] Calculate the orthogonal matrix based on the historical feature mean and the new feature mean;

[0079] According to the orthogonal matrix and the data sample in the new traffic feature, a pseudo historical traffic feature sample corresponding to the data sample is generated.

[0080] In this embodiment, the retained historical feature mean is obtained, the new traffic feature is extracted from the new traffic data, and the new feature mean is calculated. Then, the orthogonal matrix A is calculated according to formulas (2) and (3), where μ1 is the new feature mean and μ2 is the historical feature mean. Then, each data sample is selected from the new traffic feature in turn, and the pseudo historical traffic feature sample corresponding to each data sample x1 is calculated according to formula (1). After all data samples are calculated, a pseudo historical traffic feature consisting of all pseudo historical traffic feature samples is obtained. The pseudo historical traffic feature has the same data volume as the new traffic feature.

[0081] S105: constructing a balanced data set based on the new traffic features and the pseudo historical traffic features;

[0082] S106: Using the balanced data set, training the classifier of the traffic detection model, and obtaining an updated traffic detection model after training.

[0083] In this embodiment, after extracting new traffic features from new traffic data and generating pseudo-historical traffic features, a balanced data set including new traffic features and historical traffic features is constructed. Since the pseudo-historical traffic features have the same data volume as the new traffic features and the pseudo-historical traffic features retain the characteristics of historical traffic, the balance of historical traffic features and new traffic features in the balanced data set can be guaranteed. On this basis, the classifier of the traffic detection model is retrained using the balanced data set to obtain an updated traffic detection model after training. The updated model can detect both historical traffic data and new traffic data, can quickly respond to the detection of new traffic, and ensure the accuracy of detection.

[0084] In some implementations, the classifier in the traffic detection model is used to identify and classify traffic features extracted by the feature extraction module. To reduce the complexity of model updates while ensuring detection accuracy, the feature extraction module is decoupled from the classifier. After the model is initially trained, the feature extraction module does not need to be retrained or updated. During incremental updates, only the classifier is updated. This allows only the classifier parameters to be relearned and updated during incremental updates, significantly reducing the overall model structural adjustments and parameter modifications, expediting updates, and improving the model's real-time responsiveness.

[0085] like Figure 2 As shown, in some embodiments, the traffic detection model includes a feature extraction module F, a classifier L, and a regeneration module G. In the initial training phase, the model is trained using three categories of traffic data X1, Z2, and Z3. After training, the feature extraction module F and the classifier L1 are obtained. The feature extraction module extracts three categories of traffic features f(C1), f(C2), and f(C3), as well as three types of classification weights w(C1), w(C2), and w(C3). The feature means μ(C1), μ(C2), and μ(C3) of the three categories of traffic features are saved, where C i represents the i-th category.

[0086] When the model is incrementally updated, the feature extraction module F is kept unchanged to ensure the stability of the feature space during the incremental process. The new type of traffic data X4 is obtained, and the traffic feature f(C4) is extracted from the traffic data X4 using the feature extraction module F, and its feature mean μ(C4) is calculated. The regeneration module G is used to calculate the corresponding orthogonal matrices A1, A2, and A3 according to the feature means μ(C1), μ(C2), and μ(C3) of the three categories and the feature mean μ(C4) of the new traffic. In order to generate the pseudo historical traffic features of each type, each data sample is extracted from the traffic features of the new type. According to formula (1), the pseudo historical traffic feature samples of the corresponding category are calculated based on the data samples and the orthogonal matrix of the corresponding category. After calculation, the pseudo historical traffic features of the three categories are obtained. Constructing pseudo-historical traffic features and a balanced data set of new types of traffic features f(C4), and use the balanced data set to train the classifier of the traffic detection model. After training, a new classifier L2 is obtained, thereby obtaining a traffic detection model including the new classifier, which is the incrementally updated model.

[0087] The incremental update method of the traffic detection model provided in the embodiment of the present application retains only the mean of historical features after model training, without retaining all historical traffic data and historical traffic features, which can reduce the occupied storage space; in the incremental update stage, according to the data distribution relationship between historical traffic features and new traffic features, pseudo-historical traffic features with the same data volume as the new traffic features are regenerated, and a balanced data set including new traffic features and pseudo-historical traffic features is constructed. The model is updated and trained using the balanced data set, which can ensure the stability and plasticity of the model; the feature extraction module and classifier of the model are decoupled, and only the classifier is retrained during incremental update, which can reduce the overall structure and parameter modifications of the model, reduce the spatiotemporal calculation complexity, and have a fast update speed and a fast traffic detection response, which is suitable for model updates applied to edge devices.

[0088] It should be noted that the method of the embodiment of the present application can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied in a distributed scenario and performed by multiple devices working together. In such a distributed scenario, one of the multiple devices may only perform one or more steps of the method of the embodiment of the present application, and the multiple devices will interact with each other to complete the method.

[0089] It should be noted that the foregoing description of this specification is based on specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0090] like Figure 5 As shown, the embodiment of the present application also provides an incremental update device for a traffic detection model, including:

[0091] An acquisition module, configured to acquire a historical feature mean; wherein the historical feature mean is calculated based on historical traffic features extracted from historical traffic data;

[0092] The extraction module is used to input the new flow data into the flow detection model, and the feature extraction module of the flow detection model extracts the new flow features corresponding to the new flow data;

[0093] A calculation module, used for calculating a new feature mean based on the new traffic feature;

[0094] a regeneration module, configured to generate a pseudo historical traffic feature having the same data volume as the new traffic feature based on a data distribution relationship between the historical traffic feature and the new traffic feature, and based on a mean value of the historical feature and a mean value of the new feature;

[0095] A construction module, used to construct a balanced data set based on new traffic features and pseudo historical traffic features;

[0096] The updating module is used to train the classifier of the traffic detection model using the balanced data set, and obtain an updated traffic detection model after training.

[0097] For the convenience of description, the above devices are described as being functionally divided into various modules. Of course, when implementing the embodiments of the present application, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0098] The apparatus of the above embodiment is used to implement the corresponding method in the above embodiment and has the beneficial effects of the corresponding method embodiment, which will not be described in detail here.

[0099] Figure 610 is a schematic diagram showing a more specific hardware structure of an electronic device provided in this embodiment. The device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are communicatively connected to each other within the device via the bus 1050.

[0100] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0101] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage devices, dynamic storage devices, etc. The memory 1020 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.

[0102] The input / output interface 1030 is used to connect input / output modules to implement information input and output. The input / output modules can be configured as components within the device (not shown in the figure) or can be externally connected to the device to provide corresponding functions. Input devices may include a keyboard, mouse, touch screen, microphone, various sensors, etc., and output devices may include a display, speaker, vibrator, indicator light, etc.

[0103] The communication interface 1040 is used to connect to a communication module (not shown) to enable communication between the device and other devices. The communication module can communicate via a wired method (such as USB, network cable, etc.) or a wireless method (such as mobile network, WiFi, Bluetooth, etc.).

[0104] The bus 1050 comprises a pathway for transmitting information between the various components of the device (eg, the processor 1010 , the memory 1020 , the input / output interface 1030 , and the communication interface 1040 ).

[0105] It should be noted that although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040, and the bus 1050, in a specific implementation, the device may also include other components necessary for normal operation. In addition, it will be understood by those skilled in the art that the above device may only include the components necessary to implement the embodiments of this specification, and does not necessarily include all the components shown in the figure.

[0106] The electronic devices of the above embodiments are used to implement the corresponding methods in the above embodiments and have the beneficial effects of the corresponding method embodiments, which will not be described in detail here.

[0107] The computer-readable media of this embodiment include permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0108] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present disclosure (including the claims) is limited to these examples. Within the scope of the present disclosure, the above embodiments or technical features in different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0109] In addition, to simplify the description and discussion, and in order not to make the embodiment of the present application difficult to understand, the known power supply / ground connection with the integrated circuit (IC) chip and other components may or may not be shown in the accompanying drawings provided. In addition, the device can be shown in the form of a block diagram to avoid making the embodiment of the present application difficult to understand, and this also takes into account the following fact, that is, the details of the implementation method of these block diagram devices are highly dependent on the platform to be implemented in the embodiment of the present application (that is, these details should be fully within the scope of understanding of those skilled in the art). When specific details (for example, circuits) are set forth to describe exemplary embodiments of the present disclosure, it will be apparent to those skilled in the art that the embodiment of the present application can be implemented without these specific details or when these specific details are changed. Therefore, these descriptions should be considered to be illustrative rather than restrictive.

[0110] Although the present disclosure has been described in conjunction with specific embodiments thereof, many alternatives, modifications, and variations of these embodiments will be apparent to those skilled in the art based on the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0111] The embodiments of the present application are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application should be included in the scope of protection of this disclosure.

Claims

1. A method for incremental updating of a traffic detection model, characterized in that: include: Obtaining a historical feature mean; wherein the historical feature mean is calculated based on historical traffic features extracted from historical traffic data; Input the new flow data into the flow detection model, and extract the new flow features corresponding to the new flow data by the feature extraction module of the flow detection model; Calculating a new feature mean based on the new traffic feature; According to the data distribution relationship between the historical traffic feature and the new traffic feature, a pseudo historical traffic feature having the same data volume as the new traffic feature is generated based on the historical feature mean and the new feature mean; constructing a balanced data set based on the new traffic characteristics and the pseudo historical traffic characteristics; The balanced data set is used to train the classifier of the traffic detection model, and an updated traffic detection model is obtained after training.

2. The method according to claim 1, characterized in that The distribution of the historical traffic feature and the new traffic feature follows Gaussian approximation, and the mean of the historical feature and the mean of the new feature have the same spherical homoscedasticity; Generating a pseudo historical traffic feature having the same data volume as the new traffic feature based on the data distribution relationship between the historical traffic feature and the new traffic feature and based on the historical feature mean and the new feature mean, including: Calculating an orthogonal matrix based on the historical feature mean and the new feature mean; According to the orthogonal matrix and the data sample in the new traffic feature, a pseudo historical traffic feature sample corresponding to the data sample is generated.

3. The method according to claim 2, characterized in that According to the historical feature mean and the new feature mean, the method for calculating the orthogonal matrix is: Among them, A is an orthogonal matrix, μ1 is the new feature mean, μ2 is the historical feature mean, and α is the rotation angle between the new feature mean and the historical feature mean.

4. The method according to claim 3, characterized in that According to the orthogonal matrix and the data sample in the new traffic feature, a pseudo historical traffic feature corresponding to the data sample is generated by: Among them, x1 is the data sample in the new traffic feature, is the pseudo historical traffic feature sample corresponding to the data sample.

5. The method according to claim 1, wherein Calculating a new feature mean based on the new traffic feature includes: The feature values ​​of the corresponding rows and columns of the new traffic feature are added together and divided by the number of new traffic features to obtain the new feature mean.

6. A device for incrementally updating a flow detection model, characterized in that: include: An acquisition module, configured to acquire a historical feature mean value; wherein the historical feature mean value is calculated based on historical traffic features extracted from historical traffic data; An extraction module, configured to input new flow data into a flow detection model, and extract new flow features corresponding to the new flow data by a feature extraction module of the flow detection model; A calculation module, configured to calculate a new feature mean based on the new traffic feature; a regeneration module, configured to generate a pseudo historical traffic feature having the same data volume as the new traffic feature based on a data distribution relationship between the historical traffic feature and the new traffic feature, and based on a mean value of the historical feature and a mean value of the new feature; A construction module, configured to construct a balanced data set based on the new traffic features and the pseudo historical traffic features; An updating module is used to train the classifier of the traffic detection model using the balanced data set, and obtain an updated traffic detection model after training.

7. The device according to claim 6, characterized in that The distribution of the historical traffic feature and the new traffic feature follows Gaussian approximation, and the mean of the historical feature and the mean of the new feature have the same spherical homoscedasticity; The regeneration module is used to calculate an orthogonal matrix based on the historical feature mean and the new feature mean; and generate a pseudo historical traffic feature sample corresponding to the data sample based on the orthogonal matrix and the data sample in the new traffic feature.

8. The device according to claim 7, characterized in that The method for calculating the orthogonal matrix of the regeneration module is: Among them, A is an orthogonal matrix, μ1 is the new feature mean, μ2 is the historical feature mean, and α is the rotation angle between the new feature mean and the historical feature mean.

9. The device according to claim 8, characterized in that The method for the regeneration module to generate pseudo historical traffic features is: Among them, x1 is the data sample in the new traffic feature, is the pseudo historical traffic feature sample corresponding to the data sample.

10. The device according to claim 6, characterized in that The calculation module is used to add the characteristic values ​​of the corresponding rows and columns of the new traffic feature and divide the sum by the number of new traffic features to obtain a new feature mean.

Images