Network traffic data verification method and device, equipment, storage medium and computer program product

Abstract

The invention relates to the technical field of data verification, and discloses a network traffic data verification method, device and equipment, a storage medium and a computer program product, and the method comprises the steps: carrying out the multi-dimensional feature extraction of obtained current network traffic data, obtaining a current multi-dimensional feature, and obtaining a current feature vector according to the current multi-dimensional feature; determining a current data exception probability corresponding to the current network flow data based on preset feature association and the current feature vector; and verifying the current network flow data according to the current data exception probability. The data verification method and device not only depend on the routing information, but extract the multi-dimensional features which comprehensively describe the network traffic from the network traffic data to perform data verification, so that the data verification accuracy is improved.

Description

Technical Field

[0001] The present application relates to the field of data verification technology, and in particular to a network traffic data verification method, apparatus, device, storage medium and computer program product. Background Art

[0002] With the rapid development of network technology and the increasing complexity and diversity of network application scenarios, network threats and attack types are also showing a rapid growth trend. From simple malware distribution to complex distributed denial of service (DDoS) attacks, from phishing targeting individual users to advanced persistent threats (APTs) targeting enterprises, network attack methods are constantly evolving, and the scale and frequency of attacks are significantly increasing. In this context, how to effectively verify massive amounts of network data, promptly identify and prevent malicious attacks, and simultaneously ensure the smooth operation of normal business has become a critical issue that needs to be addressed in the field of network security.

[0003] The existing data verification method is the source Internet Protocol (IP) verification method. That is, when responding to distributed denial of service attacks, the reachability of the source network address is verified based on routing information. However, when attackers use devices in legitimate networks to launch network attacks, it is difficult to distinguish between normal traffic and attack traffic, resulting in low data verification accuracy. Summary of the Invention

[0004] The main purpose of this application is to provide a network traffic data verification method, aiming to solve the technical problem of how to improve the accuracy of data verification.

[0005] To achieve the above objectives, the present application proposes a network traffic data verification method, which includes: Performing multi-dimensional feature extraction on the acquired current network traffic data to obtain current multi-dimensional features, and obtaining a current feature vector based on the current multi-dimensional features; Determine the current data anomaly probability corresponding to the current network traffic data based on the preset feature association and the current feature vector; The current network traffic data is verified according to the current data abnormality probability.

[0006] In one embodiment, the step of extracting multi-dimensional features from the acquired current network traffic data to obtain current multi-dimensional features includes: Performing protocol analysis on the acquired current network traffic data to determine protocol header information and payload content corresponding to the current network traffic data; Perform feature extraction based on the protocol header information to obtain the source address, destination address, port number, and protocol type, and perform feature extraction based on the payload content to obtain the data size, timestamp, and connection establishment frequency; The source address, the destination address, the port number, the protocol type, the data size, the timestamp, and the connection establishment frequency are used as current multi-dimensional features.

[0007] In one embodiment, the step of obtaining a current feature vector according to the current multi-dimensional feature includes: Normalizing the current multi-dimensional features, and performing depth-wise convolution on the normalized current multi-dimensional features through a preset depth-separable convolution layer to obtain a multi-dimensional feature map; Performing maximum pooling on the multi-dimensional feature map, performing average pooling on the multi-dimensional feature map after maximum pooling, and obtaining a current feature vector based on the average pooling result.

[0008] In one embodiment, the step of determining the current data anomaly probability corresponding to the current network traffic data based on the preset feature association and the current feature vector includes: Obtaining a data dimension corresponding to the current feature vector, and generating adversarial data based on a preset generative adversarial network and the data dimension; Classify the current feature vector based on the preset feature association and the adversarial data to determine the feature category corresponding to the current feature vector; The current data anomaly probability corresponding to the current network traffic data is determined according to a preset activation function and the feature category.

[0009] In one embodiment, the step of verifying the current network traffic data according to the current data anomaly probability includes: Determine the abnormal probability of the current data based on a preset probability threshold; When the abnormal probability of the current data is higher than the preset probability threshold, the current network traffic data is determined to be abnormal data.

[0010] In one embodiment, after the step of determining that the current network traffic data is abnormal data, the method further includes: Performing anomaly analysis on the current network traffic data to determine attack information; Obtaining a current association weight corresponding to the preset feature association, and adjusting the current association weight based on the attack information to obtain a target association weight; The preset feature association is updated based on the target association weight to obtain a new preset feature association.

[0011] In addition, to achieve the above-mentioned purpose, the present application also proposes a network traffic data verification device, the device comprising: A feature acquisition module is used to extract multi-dimensional features from the acquired current network traffic data to obtain current multi-dimensional features, and obtain a current feature vector based on the current multi-dimensional features; A probability acquisition module, configured to determine a current data anomaly probability corresponding to the current network traffic data based on a preset feature association and the current feature vector; The data verification module is used to verify the current network traffic data according to the current data abnormality probability.

[0012] In addition, to achieve the above-mentioned purpose, the present application also proposes a network traffic data verification device, which includes: a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the computer program is configured to implement the steps of the network traffic data verification method as described above.

[0013] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the network traffic data verification method described above are implemented.

[0014] In addition, in order to achieve the above-mentioned purpose, the present application also proposes a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the steps of the network traffic data verification method as described above.

[0015] The present application proposes a network traffic data verification method, apparatus, device, storage medium and computer program product, the method comprising: extracting multi-dimensional features from the acquired current network traffic data to obtain current multi-dimensional features, and obtaining a current feature vector based on the current multi-dimensional features; determining the current data anomaly probability corresponding to the current network traffic data based on preset feature associations and the current feature vector; and verifying the current network traffic data based on the current data anomaly probability. Because the present application extracts multi-dimensional features of the network traffic data and constructs feature vectors when verifying the network traffic data to comprehensively characterize the network traffic data within a specific time period, and analyzes the correlation between different features in the current network traffic data based on preset feature associations and feature vectors, the degree of abnormality of the data can be more accurately judged. This improves the accuracy of data verification. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0017] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0018] Figure 1 This is a flowchart of the first embodiment of the network traffic data verification method proposed in the embodiments of the present application; Figure 2 This is a flowchart of a second embodiment of the network traffic data verification method proposed in an embodiment of the present application; Figure 3 This is a flowchart of a third embodiment of the network traffic data verification method proposed in an embodiment of the present application; Figure 4 A diagram of a network traffic data verification device provided in an embodiment of the present application; Figure 5 A schematic diagram of the structure of a network traffic data verification device suitable for implementing an embodiment of the present application.

[0019] The realization of the objectives, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0020] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not intended to limit the present application.

[0021] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments of this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0022] It should be noted that all directional indications in the embodiments of the present application (such as up, down, left, right, front, back, etc.) are only used to explain the relative position relationship, movement status, etc. between the various components under a certain specific posture (as shown in the accompanying drawings). If the specific posture changes, the directional indication will also change accordingly.

[0023] Understandably, with the rapid development of network technology and the increasing complexity and diversity of network application scenarios, network threats and attack types are also showing a rapid growth trend. From simple malware distribution to complex distributed denial of service (DDoS) attacks, from phishing targeting individual users to advanced persistent threats (APTs) targeting enterprises, network attack methods are constantly evolving, and the scale and frequency of attacks are significantly increasing. Against this backdrop, how to effectively verify massive amounts of network data, promptly identify and prevent malicious attacks, and simultaneously ensure the smooth operation of normal business operations has become a critical issue that needs to be addressed in the field of network security.

[0024] Existing data verification methods primarily focus on verifying the source network address. For example, when combating distributed denial of service (DDoS) attacks, techniques such as reverse path forwarding (RPF) checks are often used to verify the reachability of the source network address based on routing information. However, these traditional methods have exposed numerous limitations in the face of increasingly complex network attacks. When attackers exploit devices on legitimate networks to launch reflection attacks or amplification attacks, traditional source network address verification methods often struggle to distinguish legitimate traffic from attack traffic. This is because attack traffic may originate from legitimate network addresses and have similar characteristics to legitimate traffic, making existing verification techniques ineffective.

[0025] Therefore, in order to solve the technical problem of how to improve the accuracy of data verification, this embodiment proposes a network traffic data verification method, which includes: extracting multi-dimensional features of the acquired current network traffic data to obtain the current multi-dimensional features, and obtaining the current feature vector based on the current multi-dimensional features; determining the current data anomaly probability corresponding to the current network traffic data based on the preset feature association and the current feature vector; and verifying the current network traffic data based on the current data anomaly probability. Because this embodiment extracts the multi-dimensional features of the network traffic data and constructs a feature vector when verifying the network traffic data to comprehensively characterize the network traffic data within a specific time period, and analyzes the correlation between different features in the current network traffic data based on the preset feature association and the feature vector, it can more accurately judge the degree of data anomaly. This improves the accuracy of data verification.

[0026] For ease of understanding, the following Figures 1 to 5 The network traffic data verification method provided in the embodiments of the present application and the network traffic data verification method, device, equipment, storage medium and computer program product provided in the following embodiments are introduced in detail.

[0027] The present invention provides a method for verifying network traffic data. Figure 1 , Figure 1This is a flowchart of the first embodiment of the network traffic data verification method proposed in the embodiments of the present application.

[0028] like Figure 1 As shown, the method includes: Step S10: performing multi-dimensional feature extraction on the acquired current network traffic data to obtain current multi-dimensional features, and obtaining a current feature vector based on the current multi-dimensional features.

[0029] It should be noted that the execution subject of this embodiment can be a multifunctional machine device capable of network traffic data verification, such as a network traffic data verification device, or a device capable of performing the above functions. This embodiment uses a network traffic data verification device (hereinafter referred to as the device) for illustration.

[0030] It should also be noted that the current network traffic data described above can be a collection of data packets currently being transmitted on the network, including data from various communication protocols. For example, the current network traffic data can be a set of data packets captured through a network interface at a specific moment, including Session Initiation Protocol (SIP) registration messages, Domain Name System (DNS) query responses, etc. The multi-dimensional features described above can be multiple key attributes describing network traffic data, used to comprehensively reflect the characteristics of the traffic. For example, multi-dimensional features can include source IP, destination IP, port number, protocol type, packet size, timestamp, connection establishment frequency, etc. The feature vector described above can be a vector composed of multi-dimensional features arranged in a certain order, used to represent the key characteristics of network traffic.

[0031] In practice, the device captures network traffic packets in real time through a network interface and then performs protocol parsing on these packets, extracting protocol header information such as IP, Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and SIP, as well as the packet payload. From these parsed packets, the device extracts multi-dimensional features, such as source IP address 192.168.1.1, destination IP address 20.0.0.5, port number 8080, protocol type TCP, packet size 1500 bytes, timestamp 2024-09-26-12:00:00, and connection establishment frequency 10 times per second. These features are then arranged in a specific order to form the current feature vector.

[0032] Furthermore, in order to achieve accurate network traffic data verification, the step of extracting multi-dimensional features from the acquired current network traffic data to obtain the current multi-dimensional features includes: Step S11: performing protocol analysis on the acquired current network traffic data to determine protocol header information and payload content corresponding to the current network traffic data.

[0033] It should be noted that the current network traffic data mentioned above can be a collection of data packets currently being transmitted on the network, including data from various communication protocols. For example, the current network traffic data can be a set of data packets captured at a specific moment through a network interface, including SIP registration messages, DNS query responses, etc. Protocol parsing can be the process of parsing captured data packets according to different protocol formats to extract protocol header information and payload content. For example, protocol parsing can decompose a data packet into an IP header, a TCP header, and application layer payload content. The protocol header information can be key fields in the data packet that identify the protocol, including source IP address, destination IP address, port number, protocol type, etc. For example, an IP packet header includes source IP address, destination IP address, protocol version, etc. The payload content can be the actual data transmitted in the data packet, excluding the protocol header, and includes specific application layer information. For example, the payload content can be the content of an HTTP request or a DNS query.

[0034] In a specific implementation, the device captures network traffic packets in real time through a network interface and then processes these packets using a protocol parsing module. For example, for a SIP registration message, the protocol parsing module can identify the IP header information, including the source IP address 192.168.1.100, the destination IP address 20.0.0.50, the protocol type UDP, and the port number 5060; it also extracts the payload content, which contains the specific information of the SIP registration request, such as the username and the registration server address. For a DNS query response packet, the protocol parsing module can extract the IP header information, including the source IP address 8.8.8.8, the destination IP address 192.168.1.100, the protocol type UDP, and the port number 53; the payload content contains the queried domain name and the corresponding IP address resolution result. This protocol header information and payload content will serve as the basis for subsequent feature extraction and analysis, helping the device accurately determine the nature and source of network traffic.

[0035] Step S12: Perform feature extraction based on the protocol header information to obtain the source address, destination address, port number and protocol type, and perform feature extraction based on the payload content to obtain the data size, timestamp and connection establishment frequency.

[0036] Step S13: taking the source address, the destination address, the port number, the protocol type, the data size, the timestamp, and the connection establishment frequency as current multi-dimensional features.

[0037] It should be noted that the source address can be the IP address of the packet sender. For example, in an IP packet, the source address is 192.168.1.100. The destination address can be the IP address of the packet receiver. For example, in an IP packet, the destination address is 20.0.0.50. The port number can be a number used to identify the sender and receiver application processes. For example, the source port number is 39328 and the destination port number is 80. The protocol type can be a number that identifies the transport layer protocol used by the packet. For example, the protocol type is TCP or UDP. The data size can be the number of bytes in the payload content of the packet. For example, the payload content size of a packet is 1500 bytes. The timestamp can be the time when the packet is sent or received. For example, the timestamp of a packet is 2024-09-26 12:00:00. The timestamp can be the time when the packet is sent or received. For example, the timestamp of a packet is 2024-09-26 12:00:00.

[0038] In specific implementations, the device first parses the protocol header information, extracting the source IP address of 192.168.1.100, the destination IP address of 20.0.0.50, the source port number of 39328, the destination port number of 80, and the protocol type of TCP. The device also parses the payload content, obtaining a data size of 1500B, a timestamp of 2024-09-26-12:00:00, and a connection establishment frequency of 10 times per second. This characteristic information will serve as basic data for subsequent analysis and judgment of the nature of network traffic, helping the device accurately identify normal traffic and attack traffic. The source address, destination address, port number, protocol type, data size, timestamp, and connection establishment frequency are used as the current multi-dimensional features.

[0039] Step S20: determining the current data anomaly probability corresponding to the current network traffic data based on the preset feature association and the current feature vector.

[0040] It should be noted that the aforementioned preset feature associations may be pre-defined association rules or models between features and data anomalies, used to assess the probability of data anomalies. The aforementioned current feature vector may be a vector composed of the current multi-dimensional features arranged in a certain order, used to represent the key characteristics of the current network traffic. The aforementioned current data anomaly probability may be the likelihood of an anomaly in the current network traffic data, typically represented by a value between 0 and 1.

[0041] In practice, the device first compares the characteristic values ​​in the current feature vector (such as source address, destination address, port number, protocol type, data size, timestamp, and connection establishment frequency) with known abnormal patterns based on a pre-set feature association model. For example, if the connection establishment frequency in the current feature vector is significantly higher than the normal range, or if the source address appears in a list of known attack sources, the device will increase the estimated probability of the current data being abnormal. Assuming that the model calculates a probability of 0.85 for the current data being abnormal, this indicates that the current network traffic data is highly likely to be abnormal.

[0042] Step S30: verifying the current network traffic data according to the current data abnormality probability.

[0043] In a specific implementation, the above-mentioned device compares the calculated anomaly probability of the current data with the preset threshold to determine whether the current network traffic data is abnormal traffic. For example, assuming that the preset anomaly probability threshold is 0.7, and the current data anomaly probability is 0.85, the device determines that the network traffic data is abnormal traffic. At this time, the device will take corresponding defensive measures, such as banning the source IP address, limiting the traffic rate of the IP, or blocking the connection with the IP. If the current data anomaly probability is lower than the preset threshold, the traffic is determined to be normal traffic and is allowed to pass through the network normally. This verification process helps the device effectively identify and defend against DDoS attacks, ensuring the security and stability of network communications.

[0044] When verifying network traffic data, this embodiment extracts multi-dimensional features from the acquired current network traffic data to obtain the current multi-dimensional features, and obtains the current feature vector based on the current multi-dimensional features; determines the current data anomaly probability corresponding to the current network traffic data based on the preset feature association and the current feature vector; and verifies the current network traffic data based on the current data anomaly probability. Because this embodiment extracts multi-dimensional features from the network traffic data and constructs a feature vector to comprehensively characterize the network traffic data within a specific time period when verifying network traffic data, and analyzes the correlation between different features in the current network traffic data based on the preset feature association and the feature vector, it can more accurately judge the degree of data anomaly, thereby improving the accuracy of data verification.

[0045] Based on the first embodiment, in the second embodiment, the same or similar contents as those in the above embodiment 1 can be referred to the above introduction and will not be described in detail later. Figure 2 , Figure 2 This is a flowchart of a second embodiment of the network traffic data verification method proposed in an embodiment of the present application. Further, in order to achieve more accurate network traffic data verification, the step of obtaining the current feature vector based on the current multi-dimensional feature includes: Step S14: normalize the current multi-dimensional features, and perform depth-wise convolution on the normalized current multi-dimensional features through a preset depth-separable convolution layer to obtain a multi-dimensional feature map.

[0046] It should be noted that the aforementioned current multi-dimensional features may be multiple key attributes describing the current network traffic data, such as source address, destination address, port number, protocol type, data size, timestamp, and connection establishment frequency. The aforementioned normalization may be the process of scaling feature values ​​to a preset range (e.g., 0, 1). The aforementioned preset depth-separable convolutional layer may be a pre-defined convolutional neural network layer used for feature extraction. The aforementioned multi-dimensional feature map may be a feature map generated after a convolution operation.

[0047] In its implementation, the device first normalizes the current multi-dimensional features (such as source address and destination address), mapping the feature values ​​to the range of 0 and 1. For example, the connection establishment frequency is normalized from 0, 100 to 0, 1. The device then convolves the normalized features using a preset depthwise separable convolution layer. The depthwise separable convolution layer first performs depthwise convolution on each input channel to extract local information about each feature. It then fuses information from different channels through pointwise convolution to generate a new multi-dimensional feature map. Assuming the input feature is a tensor of shape 7×7×3, the depthwise convolution kernel is 3×3, and the pointwise convolution kernel is 1×1, the output multi-dimensional feature map might have a shape of 5×5×6. This process helps the device extract higher-level, more abstract features, providing a basis for subsequent classification and judgment.

[0048] Step S15: performing maximum pooling on the multi-dimensional feature map, performing average pooling on the multi-dimensional feature map after maximum pooling, and obtaining a current feature vector based on the average pooling result.

[0049] It should be noted that the aforementioned maximum pooling can be an operation that reduces the dimensionality of a feature map, selecting the maximum value within each subregion as the output to retain the most significant features. The aforementioned average pooling can be an operation that reduces the dimensionality of a feature map, calculating the average value within each subregion as the output to obtain an average representation of the overall features. The aforementioned feature vector can be a vector composed of multi-dimensional features arranged in order, used to represent key characteristics of network traffic.

[0050] In a specific implementation, the above-mentioned device first performs a maximum pooling operation on the multi-dimensional feature map. For example, a 2×2 pooling window with a step size of 2 is used to select the maximum value of each 2×2 sub-region from the feature map as the output to generate a new feature map. Next, the device performs an average pooling operation on the feature map after maximum pooling, also using a 2×2 pooling window with a step size of 2, calculates the average value of each sub-region, and generates a feature map after average pooling. Finally, the device flattens the feature map after average pooling to form a one-dimensional vector as the current feature vector for subsequent classification and judgment. For example, assuming that the shape of the feature map after maximum pooling is 14×14×64, after average pooling, the shape of the feature map is still 14×14×64, and then it is flattened into a vector with a length of 14×14×64=12544 as the current feature vector.

[0051] Furthermore, the step of determining the current data anomaly probability corresponding to the current network traffic data based on the preset feature association and the current feature vector includes: Step S21: Obtain the data dimension corresponding to the current feature vector, and generate adversarial data based on a preset generative adversarial network and the data dimension.

[0052] It should be noted that the aforementioned data dimensions can be the range or order of magnitude of values ​​across different features of the data, used to describe the scale and complexity of the data. The aforementioned preset generative adversarial network can be a pre-set and trained generative adversarial network used to generate adversarial data. The aforementioned adversarial data can be data generated by the generative adversarial network to enhance model robustness and detection capabilities.

[0053] In its implementation, the device first determines the data dimensions of the current feature vector. For example, if the feature vector is [192.168.1.100, 20.0.0.50, 39328, 80, TCP, 1500B, 2024-09-26 12:00:00, 10 / s], its data dimension is 8. The device then uses a pre-defined generative adversarial network (GAN) to input random noise and data dimension information to generate adversarial data with a distribution similar to real data. The generator and discriminator in the GAN are trained against each other, with the generator continuously learning to generate more realistic adversarial data while the discriminator strives to distinguish between real and generated data. After multiple rounds of training, the generator is able to generate high-quality adversarial data, enhancing the model's robustness and detection capabilities.

[0054] Step S22: Classify the current feature vector based on the preset feature association and the adversarial data to determine the feature category corresponding to the current feature vector.

[0055] It should be noted that the above-mentioned feature categories may be different categories into which data is divided according to the characteristics of the feature vector, and are used to represent the nature or type of the data.

[0056] In the specific implementation, the device first uses the preset feature association model, combined with the robustness of the adversarial data enhancement model, to analyze the current feature vector. For example, the preset feature association model may have already learned the characteristic patterns of normal traffic and attack traffic. The device inputs the current feature vector into the model, and the model calculates the probability that the current feature vector belongs to each preset feature category based on the preset feature association rules and the additional context information provided by the adversarial data. Assuming that the preset feature categories include "normal traffic" and "attack traffic", the model outputs that the probability that the current feature vector belongs to "normal traffic" is 0.9, and the probability that it belongs to "attack traffic" is 0.1. Based on these probability values, the device determines that the feature category corresponding to the current feature vector is "normal traffic".

[0057] Step S23: determining the current data anomaly probability corresponding to the current network traffic data according to a preset activation function and the feature category.

[0058] It should be noted that the preset activation function may be an activation function pre-set and used in a neural network to perform a nonlinear transformation on an input signal. The current data anomaly probability may be the probability of an anomaly in the current network traffic data, and is typically represented by a value between 0 and 1.

[0059] In a specific implementation, the device first inputs the current feature vector into the fully connected layer of the neural network, performs a linear transformation through the second weight parameter and the second base value parameter, and obtains the feature to be activated. Then, the feature to be activated is processed by a preset activation function to obtain the abnormal probability of the feature segment. The preset activation function can be a Softmax function or a Sigmoid function, etc. Assuming that the preset activation function is the Softmax function, the current feature vector is multiplied by the second weight parameter and then added to the second base value parameter to obtain the feature to be activated. After processing by the Softmax function, the probability value corresponding to each feature category is obtained, thereby determining the abnormal probability of the current network traffic data. If the feature categories are "normal traffic" and "attack traffic", the Softmax function outputs the probability that the current feature vector belongs to "attack traffic", which is the abnormal probability of the current data.

[0060] Based on the first and second embodiments, in the third embodiment, the same or similar contents as those in the first and second embodiments can be referred to above and will not be described in detail. Figure 3 , Figure 3This is a flowchart of a third embodiment of the network traffic data verification method proposed in an embodiment of the present application. Further, the step of verifying the current network traffic data based on the abnormal probability of the current data includes: Step S31: judging the abnormal probability of the current data based on a preset probability threshold.

[0061] Step S32: When the abnormal probability of the current data is higher than the preset probability threshold, the current network traffic data is determined to be abnormal data.

[0062] It should be noted that the preset probability threshold may be a pre-set probability value for determining whether data is abnormal, and is typically a value between 0 and 1. The abnormal data may be data that does not conform to normal patterns or rules, and may indicate an attack or other abnormal situation.

[0063] In a specific implementation, the device first obtains a preset probability threshold, such as 0.7. The device then compares the calculated probability of the current data being abnormal with the preset probability threshold. For example, if the current data abnormality probability is 0.85, which is higher than the preset probability threshold of 0.7, the device determines that the current network traffic data is abnormal data. This determination result will trigger the device to take corresponding defensive measures, such as blocking the source IP address, limiting the traffic rate, or blocking the connection, to deal with possible DDoS attacks. If the current data abnormality probability is lower than or equal to the preset probability threshold, the current network traffic data is determined to be normal data and is allowed to pass through the network normally.

[0064] Furthermore, after the step of determining that the current network traffic data is abnormal data, the method further includes: Step S40: performing an anomaly analysis on the current network traffic data to determine attack information.

[0065] It should be noted that the above-mentioned anomaly analysis can be the process of identifying whether there is abnormal behavior by analyzing the characteristics of the data. The above-mentioned attack information can be detailed data about the network attack, including the attack type, attack source, attack target, etc.

[0066] In its implementation, the device first extracts multi-dimensional features from the current network traffic data, obtaining characteristics such as the source address, destination address, port number, protocol type, data size, timestamp, and connection establishment frequency. The device then analyzes these features using a pre-set feature association model to calculate the probability of an anomaly in the current data. If the anomaly probability exceeds a pre-set probability threshold, the device determines the current network traffic data as abnormal and further analyzes it to determine attack information, such as the attack type being a DDoS attack, the source IP address being 192.168.1.100, and the target IP address being 20.0.0.50.

[0067] Step S50: obtaining a current association weight corresponding to the preset feature association, and adjusting the current association weight based on the attack information to obtain a target association weight.

[0068] It should be noted that the preset feature associations described above may be pre-defined mappings or models between features and categories, used to guide feature classification. The current association weights described above may be the importance coefficients of the current feature associations in the model, used to measure the influence of the features on the classification results. The attack information described above may be detailed data regarding network attacks, including attack types, attack sources, and attack targets. The target association weights described above may be feature association weights adjusted based on the attack information, used to more accurately reflect the importance of the features in the current attack scenario.

[0069] In its implementation, the device first obtains the current association weights corresponding to the preset feature associations. These weights reflect the importance of the features under normal circumstances. Upon detecting attack information, the device dynamically adjusts the current association weights based on information such as the attack type, source IP address, and target IP address. For example, if the attack information indicates an abnormal increase in traffic on a specific port, the device will increase the weights of the features associated with that port. This adjustment can be done using a gray correlation method, which calculates the correlation between the attack information and each feature and then reallocates the weights. Assuming the original weights are [0.2, 0.3, 0.5], the adjusted target association weights might be [0.1, 0.4, 0.5], where the weights of attack-related features are appropriately increased to more accurately reflect their importance in the current attack scenario.

[0070] Step S60: updating the preset feature association based on the target association weight to obtain a new preset feature association.

[0071] In specific implementations, the device first obtains target association weights, which are dynamically adjusted based on attack information. The device then uses the target association weights to update the preset feature associations. Specifically, this can be done by replacing the original weight coefficients in the preset feature associations with the target association weights. For example, if the weight coefficients in the original preset feature association are [0.2, 0.3, 0.5] and the target association weights are [0.1, 0.4, 0.5], the weight coefficients in the new preset feature associations are updated to [0.1, 0.4, 0.5]. The updated preset feature associations better reflect the importance of each feature in the current attack scenario, thereby improving the model's ability to identify attack traffic and its defense effectiveness.

[0072] Subsequently, when a new current feature vector is generated, the current data anomaly probability corresponding to the new current network traffic data is determined based on the new preset feature association and the new current feature vector, and the new current network traffic data is verified according to the current data anomaly probability.

[0073] This embodiment also provides a first embodiment of a network traffic data verification device, please refer to Figure 4 , Figure 4 A diagram of a network traffic data verification device provided in an embodiment of the present application, wherein the network traffic data verification device includes: A feature acquisition module is used to extract multi-dimensional features from the acquired current network traffic data to obtain current multi-dimensional features, and obtain a current feature vector based on the current multi-dimensional features; A probability acquisition module, configured to determine a current data anomaly probability corresponding to the current network traffic data based on a preset feature association and the current feature vector; A data verification module, configured to verify the current network traffic data according to the current data anomaly probability; The feature acquisition module is also used to perform protocol analysis on the acquired current network traffic data to determine the protocol header information and payload content corresponding to the current network traffic data; perform feature extraction based on the protocol header information to obtain the source address, destination address, port number and protocol type, and perform feature extraction based on the payload content to obtain the data size, timestamp and connection establishment frequency; and use the source address, the destination address, the port number, the protocol type, the data size, the timestamp and the connection establishment frequency as the current multi-dimensional features.

[0074] With reference to the first embodiment of the network flow data verification device, this embodiment also proposes a second embodiment of the network flow data verification device. The same or similar contents as those of the first embodiment of the network flow data verification device can be referred to the above introduction and will not be repeated later.

[0075] The feature acquisition module is further configured to normalize the current multidimensional features, perform depthwise convolution on the normalized current multidimensional features through a preset depthwise separable convolution layer, and obtain a multidimensional feature map; perform maximum pooling on the multidimensional feature map, perform average pooling on the multidimensional feature map after maximum pooling, and obtain a current feature vector based on the average pooling result; The probability acquisition module is also used to obtain the data dimension corresponding to the current feature vector, and generate adversarial data based on a preset generative adversarial network and the data dimension; classify the current feature vector based on the preset feature association and the adversarial data to determine the feature category corresponding to the current feature vector; and determine the current data anomaly probability corresponding to the current network traffic data based on a preset activation function and the feature category.

[0076] With reference to the first embodiment of the network flow data verification device and the second embodiment of the network flow data verification device, this embodiment also proposes a third embodiment of the network flow data verification device. The same or similar contents as those of the first embodiment of the network flow data verification device and the second embodiment of the network flow data verification device can be referred to the above introduction and will not be repeated later.

[0077] The data verification module is further configured to determine the abnormal probability of the current data based on a preset probability threshold; when the abnormal probability of the current data is higher than the preset probability threshold, determine that the current network traffic data is abnormal data; The data verification module is also used to perform anomaly analysis on the current network traffic data to determine attack information; obtain the current association weight corresponding to the preset feature association, and adjust the current association weight based on the attack information to obtain the target association weight; update the preset feature association based on the target association weight to obtain a new preset feature association.

[0078] The network flow data verification device provided in this embodiment employs the network flow data verification method in the above-described embodiment, thereby solving the technical problem of improving data verification accuracy. Compared to the prior art, the network flow data verification device provided in this embodiment has the same beneficial effects as the network flow data verification method provided in the above-described embodiment. Other technical features of the network flow data verification device are the same as those disclosed in the above-described embodiment and are not further elaborated here.

[0079] This embodiment provides a network traffic data verification device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the network traffic data verification method in the above-mentioned embodiment one.

[0080] Reference below Figure 5 , Figure 5The figure is a schematic diagram of a network traffic data verification device suitable for implementing an embodiment of the present application. The network traffic data verification device in the embodiment of the present application may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 5 The network traffic data verification device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0081] like Figure 5 As shown, the network traffic data verification device may include a processing device 1001 (e.g., a central processing unit, graphics processing unit, etc.), which can perform various appropriate actions and processes based on programs stored in a read-only memory (ROM) 1002 or programs loaded from a storage device 1003 into a random access memory (RAM) 1004. RAM 1004 also stores various programs and data required for the operation of the network traffic data verification device. Processing device 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems may be connected to I / O interface 1006: input devices 1007, such as a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008, such as a liquid crystal display (LCD), speaker, vibrator, etc.; storage device 1003, such as a magnetic tape or hard disk; and communication devices 1009. The communication device 1009 can allow the network flow data verification device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows a network flow data verification device with various systems, it should be understood that it is not required to implement or have all of the systems shown. More or fewer systems can be implemented or have alternatively.

[0082] In particular, according to this embodiment, the process described above with reference to the flowchart can be implemented as a computer software program. For example, this embodiment includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via a communication device, or installed from the storage device 1003, or installed from the ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in this embodiment are performed.

[0083] The network flow data verification device provided in this embodiment employs the network flow data verification method in the above-described embodiment, solving the technical problem of improving data verification accuracy. Compared to the prior art, the network flow data verification device provided in this embodiment has the same beneficial effects as the network flow data verification method provided in the above-described embodiment. Other technical features of the network flow data verification device are the same as those disclosed in the above-described embodiment and are not further elaborated here.

[0084] It should be understood that the various parts disclosed in this embodiment can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any one or more embodiments or examples in an appropriate manner.

[0085] The above description is merely a specific implementation of this embodiment, but the scope of protection of this embodiment is not limited thereto. Any modifications or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this embodiment should be included within the scope of protection of this embodiment. Therefore, the scope of protection of this embodiment should be based on the scope of protection of the claims.

[0086] This embodiment provides a computer-readable storage medium having computer-readable program instructions (ie, computer program) stored thereon, and the computer-readable program instructions are used to execute the network traffic data verification method in the above embodiment.

[0087] The computer-readable storage medium provided in this embodiment may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems, or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0088] The above-mentioned computer-readable storage medium may be included in the network flow data verification device; or it may exist independently without being assembled into the network flow data verification device.

[0089] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the network flow data verification device, the network flow data verification device is enabled to perform network flow data verification.

[0090] The computer program code for performing the operations of the present embodiment can be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0091] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present embodiment. In this regard, each box in the flow chart or block diagram can represent a module, program segment or part of code, and the module, program segment or part of code contains one or more executable instructions for realizing the prescribed logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart, can be implemented by a dedicated hardware-based system that performs the prescribed function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0092] The modules described in this embodiment may be implemented in software or hardware, wherein the name of a module does not necessarily limit the unit itself.

[0093] The computer-readable storage medium provided in this embodiment stores computer-readable program instructions (i.e., a computer program) for executing the aforementioned network traffic data verification method. This computer-readable storage medium can address the technical problem of improving data verification accuracy. Compared to the prior art, the computer-readable storage medium provided in this embodiment offers the same beneficial effects as the network traffic data verification method provided in the aforementioned embodiment, and therefore will not be further elaborated upon here.

[0094] The above descriptions are only some embodiments and do not limit the patent scope of this embodiment. All equivalent structural transformations made using the contents of the description and drawings of this application under the technical concept of this application, or direct / indirect application in other related technical fields are included in the patent protection scope of this application.

Claims

1. A network traffic data verification method, characterized in that: The method comprises: Performing multi-dimensional feature extraction on the acquired current network traffic data to obtain current multi-dimensional features, and obtaining a current feature vector based on the current multi-dimensional features; Determine the current data anomaly probability corresponding to the current network traffic data based on the preset feature association and the current feature vector; The current network traffic data is verified according to the current data abnormality probability.

2. The method according to claim 1, wherein The step of extracting multi-dimensional features from the acquired current network traffic data to obtain current multi-dimensional features includes: Performing protocol analysis on the acquired current network traffic data to determine protocol header information and payload content corresponding to the current network traffic data; Perform feature extraction based on the protocol header information to obtain the source address, destination address, port number, and protocol type, and perform feature extraction based on the payload content to obtain the data size, timestamp, and connection establishment frequency; The source address, the destination address, the port number, the protocol type, the data size, the timestamp, and the connection establishment frequency are used as current multi-dimensional features.

3. The method according to claim 1, wherein The step of obtaining a current feature vector according to the current multi-dimensional feature includes: Normalizing the current multi-dimensional features, and performing depth-wise convolution on the normalized current multi-dimensional features through a preset depth-separable convolution layer to obtain a multi-dimensional feature map; Performing maximum pooling on the multi-dimensional feature map, performing average pooling on the multi-dimensional feature map after maximum pooling, and obtaining a current feature vector based on the average pooling result.

4. The method according to claim 1, wherein The step of determining the current data anomaly probability corresponding to the current network traffic data based on the preset feature association and the current feature vector includes: Obtaining a data dimension corresponding to the current feature vector, and generating adversarial data based on a preset generative adversarial network and the data dimension; Classify the current feature vector based on the preset feature association and the adversarial data to determine the feature category corresponding to the current feature vector; The current data anomaly probability corresponding to the current network traffic data is determined according to a preset activation function and the feature category.

5. The method according to claim 1, wherein The step of verifying the current network traffic data according to the current data abnormality probability includes: Determine the abnormal probability of the current data based on a preset probability threshold; When the abnormal probability of the current data is higher than the preset probability threshold, the current network traffic data is determined to be abnormal data.

6. The method according to claim 5, wherein After the step of determining that the current network traffic data is abnormal data, the method further includes: Performing anomaly analysis on the current network traffic data to determine attack information; Obtaining a current association weight corresponding to the preset feature association, and adjusting the current association weight based on the attack information to obtain a target association weight; The preset feature association is updated based on the target association weight to obtain a new preset feature association.

7. A network traffic data verification device, characterized in that: The device comprises: A feature acquisition module is used to extract multi-dimensional features from the acquired current network traffic data to obtain current multi-dimensional features, and obtain a current feature vector based on the current multi-dimensional features; A probability acquisition module, configured to determine a current data anomaly probability corresponding to the current network traffic data based on a preset feature association and the current feature vector; The data verification module is used to verify the current network traffic data according to the current data abnormality probability.

8. A network traffic data verification device, characterized in that: The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the network traffic data verification method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the network traffic data verification method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the network traffic data verification method according to any one of claims 1 to 6 are implemented.

Images