Network traffic anomaly detection method and device, equipment and storage medium

Abstract

The embodiment of the invention discloses a network traffic anomaly detection method and device, equipment and a storage medium. The method comprises the following steps: acquiring historical traffic data in an earth-moon space network; performing feature extraction on the historical flow data to obtain corresponding target feature data; for each piece of feature data in the target feature data, performing sample labeling according to a preset positive and negative sample selection mode and a weight configuration mode corresponding to each piece of feature data in each piece of target feature data to form a training sample set; training the anomaly detection model by using the training sample set to obtain a trained optimal anomaly detection model; and obtaining to-be-detected traffic data, and detecting the to-be-detected traffic data based on the optimal anomaly detection model to obtain a detection result. According to the technical scheme, the abnormal traffic can be accurately detected and processed, and reliable communication guarantee is provided for future earth-moon space exploration tasks.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of traffic anomaly detection, and in particular to a network traffic anomaly detection method, device, equipment and storage medium. BACKGROUND

[0002] With the deepening of human space exploration activities, the Earth-Moon space network is gradually becoming the core infrastructure for building deep space communication and space data transmission. The Earth-Moon space network refers to the space-based information network built to support communication, navigation, remote sensing and scientific exploration between the Earth and the Moon, as well as within the Earth-Moon space. The network aims to achieve seamless coverage and efficient management of spacecraft, lunar facilities, manned missions, etc. within the Earth-Moon space range, and is a key infrastructure for future deep space exploration and lunar base construction. Due to the complex characteristics of the Earth-Moon space network, such as high delay, large bandwidth fluctuation, and frequent link interruption, these characteristics are different from traditional ground networks, posing new challenges to network stability and security. In particular, the presence of abnormal traffic not only affects normal communication quality, but also can cause the interruption of critical tasks, and even can cause network security problems.

[0003] Traditional abnormal traffic detection methods are mainly designed based on the characteristics of ground network environment, and usually rely on low delay and high stability communication conditions, which are difficult to adapt to the unique needs of the Earth-Moon space network. In addition, existing methods lack targeted strategies when facing abnormal traffic, and cannot accurately distinguish between traffic fluctuations caused by network environment characteristics and potential malicious attack behaviors. SUMMARY

[0004] Therefore, the present application provides a network traffic anomaly detection method, device, equipment and storage medium, which can realize accurate detection and processing of abnormal traffic, and provide reliable communication guarantee for future Earth-Moon space exploration tasks.

[0005] According to an aspect of the present application, the present application embodiment provides a network traffic anomaly detection method, which comprises:

[0006] Obtaining historical traffic data in the Earth-Moon space network; wherein the historical traffic data is expressed as data packet frame formats under different frequency bands;

[0007] Performing feature extraction on each of the historical traffic data to obtain corresponding target feature data;

[0008] For each feature data in the target feature data, a sample label is configured according to a preset positive and negative sample selection mode, and a weight configuration mode corresponding to each feature data in each target feature data, to form a training sample set;

[0009] The training sample set is used to train an anomaly detection model to obtain a trained optimal anomaly detection model.

[0010] Obtaining to-be-detected traffic data, and detecting the to-be-detected traffic data based on the optimal anomaly detection model to obtain a detection result.

[0011] According to another aspect of the present application, the embodiments of the present application further provide a network traffic anomaly detection device, which comprises:

[0012] A traffic data obtaining module is configured to obtain historical traffic data in a lunar-spatial network, wherein the historical traffic data is in the form of data packet frames in different frequency bands.

[0013] A feature extraction module is configured to extract features from the historical traffic data to obtain corresponding target feature data.

[0014] A label module is configured to label each feature data in the target feature data according to a preset positive-negative sample selection manner and a weight configuration manner corresponding to each feature data in each target feature data to form a training sample set.

[0015] A model training module is configured to train an anomaly detection model using the training sample set to obtain a trained optimal anomaly detection model.

[0016] A detection module is configured to obtain to-be-detected traffic data, and detect the to-be-detected traffic data based on the optimal anomaly detection model to obtain a detection result.

[0017] According to another aspect of the present application, the embodiments of the present application further provide an electronic device, which comprises:

[0018] at least one processor; and

[0019] a memory connected with the at least one processor; wherein

[0020] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the network traffic anomaly detection method according to any one of the embodiments of the present application.

[0021] According to another aspect of the present application, the embodiments of the present application further provide a computer readable storage medium, which stores computer instructions for enabling a processor to execute the network traffic anomaly detection method according to any one of the embodiments of the present application.

[0022] The technical scheme of the embodiment of the present application is characterized in that: the target feature data corresponding to each historical traffic data is obtained by feature extraction; for each target feature data, the sample label is configured according to the preset positive and negative sample selection mode and the weight configuration mode corresponding to each feature data in each target feature data, so as to form a training sample set; and the trained optimal anomaly detection model is obtained by training the anomaly detection model using the training sample set, which can accurately select positive and negative samples and reduce the complexity of model training; and the detection result is obtained by detecting the to-be-detected traffic data based on the optimal anomaly detection model, so that accurate detection and processing of abnormal traffic can be realized, and reliable communication guarantee can be provided for future lunar-space exploration tasks.

[0023] It should be understood that the content described in this part is not intended to identify key or important features of the embodiments of the present application, nor is it used to limit the scope of the present application. Other features of the present application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0025] Figure 1 A flowchart of a network traffic anomaly detection method provided by an embodiment of the present application is shown in FIG. 1.

[0026] Figure 2 A flowchart of another network traffic anomaly detection method provided by an embodiment of the present application is shown in FIG. 2.

[0027] Figure 3 An architectural schematic diagram of a lunar-space network traffic collection point provided by an embodiment of the present application is shown in FIG. 3.

[0028] Figure 4 A structural block diagram of a network traffic anomaly detection device provided by an embodiment of the present application is shown in FIG. 4.

[0029] Figure 5 A structural schematic diagram of an electronic device provided by an embodiment of the present application is shown in FIG. 5. DETAILED DESCRIPTION

[0030] In the following, the technical solutions in the embodiments of the present application will be described clearly and completely with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of embodiments of the present application, rather than all embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work should fall within the protection scope of the present application.

[0031] It should be noted that the terms "first", "second", and the like in the specification of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not necessarily have to include only those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to the process, method, product or device.

[0032] In an embodiment, Figure 1 A flowchart of a network traffic anomaly detection method provided by an embodiment of the present application. The embodiment can be applied to the case of detecting network traffic anomalies. The method can be executed by a network traffic anomaly detection device, which can be realized in the form of hardware and / or software, and can be configured in an electronic device. As shown in the figure, the method comprises: Figure 1 S110, obtaining historical traffic data in a moon-earth space network; wherein the historical traffic data is in the form of data packet frames in different frequency bands.

[0033] S110, obtaining historical traffic data in a moon-earth space network; wherein the historical traffic data is in the form of data packet frames in different frequency bands.

[0034] The moon-earth space network refers to a space-based information network built to support communication, navigation, remote sensing and scientific exploration between the earth and the moon, and in the moon-earth space. The historical traffic data is real original traffic data generated in history.

[0035] In the embodiment, the earth-moon space network mainly involves multiple hierarchies, including five core parts: ground segment (tracking station, data processing center), earth orbit segment (relay satellite constellation, low-orbit Internet constellation), earth-moon transfer orbit segment (relay satellite group deployed in DRO and other special orbits), moon orbit segment (circumlunar satellite providing full-coverage communication and navigation), and lunar surface segment (lunar surface base station, gateway node, and positioning system). The network realizes earth-moon communication, navigation, and data transmission through multi-orbit cooperation, and the key technologies include laser communication, delay-tolerant network (DTN), autonomous networking, and resource scheduling, supporting future deep space exploration and lunar base operation.

[0036] In the embodiment, different ways can be used to obtain different original communication flows in the earth-moon space. In the embodiment, since there are star-star communication flows, lunar surface-satellite communication flows, and satellite-ground communication flows in the earth-moon space network, the ground / moon surface flow probes and satellite terminal collection payloads are used to collect communication flows for different scenarios. The historical flow data is in the form of data packet frames in different frequency bands, which can be understood as historical flow data in the form of packet frames. The packet frame format can include a transmission frame header, an insertion field, a transmission frame data field, an error control field, and the like, which are not limited in the embodiment.

[0037] S120, extracting features from the historical flow data to obtain corresponding target feature data.

[0038] Among the target feature data, there are multiple feature data.

[0039] The target feature data refers to the feature data obtained after feature extraction, that is, the key data after feature extraction. Since the historical flow data includes multiple data, the target feature data can also include multiple feature data. For example, the key data can include but is not limited to timestamp, time delay, jitter time, retransmission rate, signal strength, and the like.

[0040] In the embodiment, the original data flow can be parsed by setting the parsing rules of the original flow to obtain the target feature data. Specifically, the valid data field can be extracted according to the byte bit in the data packet frame format, the valid data content can be extracted from the valid data field, the timestamp can be extracted from the time field bit in the data packet frame format, and the valid data content and the timestamp can be combined to form the corresponding target feature data. In some embodiments, a corresponding feature extraction model can be set to extract features from the historical flow data to obtain corresponding feature data. Of course, there are many ways to extract features, which are not limited in the embodiment.

[0041] S130, for each feature data in the target feature data, sample labels are configured according to a preset positive and negative sample selection mode and a weight configuration mode corresponding to each target feature data, to form a training sample set.

[0042] The preset positive and negative sample selection mode is a selection mode of selecting positive samples and negative samples pre-set by a user. The selection of the positive and negative samples can be performed according to a user demand and a weight level corresponding to each target feature data, to select a positive sample number and a negative sample number respectively corresponding to each positive sample feature and negative sample feature.

[0043] In this embodiment, since the target feature data is a plurality of target feature data, each feature data is taken as sample data, and then each sample data is labeled according to a certain sample labeling rule. Of course, the sample data can include positive sample data (i.e., normal traffic data) or negative sample data (i.e., abnormal traffic data). Therefore, when labeling the sample data, i.e., labeling the samples, the positive and negative samples can be labeled by a human, or can be labeled by keyword matching, regular expression, or the like, or can be labeled by a labeling tool. This embodiment does not make specific limitations. For example, the label of a negative sample of a certain feature is 1, indicating abnormality; and the label of a positive sample of the feature is 0, indicating normality.

[0044] In this embodiment, for the negative sample features respectively corresponding to the negative sample data, a weight coefficient corresponding to each negative sample feature can be determined according to a sample feature level importance degree and a feature change condition respectively corresponding to each negative sample feature. Based on this, the number of negative samples selected for each negative sample feature is dynamically adjusted according to the weight coefficient. In order to avoid class imbalance leading to model biasing to the majority class, after obtaining the number of negative samples selected for each negative sample feature, the number of positive sample features corresponding to each negative sample feature and the number of positive samples respectively corresponding to each positive sample feature are selected according to the number of negative samples selected for each negative sample feature, so as to form a training sample set by using the selected each positive sample feature, label and corresponding positive sample number, and the selected negative sample feature, label and corresponding negative sample number.

[0045] S140, using the training sample set to train an anomaly detection model to obtain a trained optimal anomaly detection model.

[0046] The anomaly detection model can be a support vector machine (SVM) model, and a kernel function of the SVM model is a radial basis function (RBF).

[0047] In the embodiment, the trained optimal anomaly detection model is obtained by training the anomaly detection model using the training sample set. The training process can be: taking each positive sample feature and negative sample feature as a feature vector respectively, normalizing all feature vectors, forming a feature matrix from the normalized feature vectors, inputting the feature matrix into the anomaly detection model to optimize the model parameters, and stopping until the loss function of the anomaly detection model reaches the optimum. In other embodiments, the model can also be optimized by dividing the training set / validation set (maintaining the proportion of abnormal samples), using cross-entropy, F1-score, etc. as the objective function, and training the model by mean square error as the loss function until the model converges.

[0048] In S150, the to-be-detected traffic data is obtained, and the to-be-detected traffic data is detected based on the optimal anomaly detection model to obtain a detection result.

[0049] The to-be-detected traffic data is traffic data that needs to be detected for traffic anomaly from the real-time acquisition of the earth-moon space network.

[0050] In the embodiment, the to-be-detected traffic data is obtained from the earth-moon space network, and the to-be-detected traffic data is extracted using certain rules to obtain feature data after feature extraction. The extracted feature data is input into the optimal anomaly detection model to output a corresponding detection result, which can be represented as a probability of anomaly.

[0051] The above technical solution of the embodiment of the application extracts corresponding target feature data from historical traffic data. For each feature data in the target feature data, the sample label is labeled according to the preset positive and negative sample selection mode and the weight configuration mode corresponding to each feature data in the target feature data, to form a training sample set. The trained optimal anomaly detection model is obtained by training the anomaly detection model using the training sample set, which can accurately select positive and negative samples and reduce the complexity of model training. The detection result is obtained by detecting the to-be-detected traffic data based on the optimal anomaly detection model, which can accurately detect and process abnormal traffic and provide reliable communication support for future earth-moon space exploration tasks.

[0052] In an embodiment, Figure 2The flowchart of another network traffic anomaly detection method provided by an embodiment of the present application is based on the above-mentioned embodiments. In this embodiment, historical traffic data in the Earth-Moon space network is acquired. Feature extraction is performed on the historical traffic data to obtain corresponding target feature data. For each feature data in the target feature data, a sample label is configured according to a preset positive-negative sample selection manner and a weight configuration manner corresponding to each feature data in each target feature data, to form a training sample set. The training sample set is used to train an anomaly detection model to obtain a trained optimal anomaly detection model. The optimal anomaly detection model is used to detect to-be-detected traffic data to obtain a detection result for further refinement.

[0053] As shown in Figure 2 , the network traffic anomaly detection method in this embodiment can specifically include the following steps:

[0054] S210, capturing lunar surface original communication traffic and ground original communication traffic through a traffic probe.

[0055] In this embodiment, the original communication traffic of the lunar surface and / or the ground in the Earth-Moon space network can be acquired through a traffic probe. The original communication traffic is also a data packet frame format in a certain frequency band. The traffic probe is a device or software tool for capturing and analyzing network data packets. It can monitor real-time traffic in the network and record detailed information of the data packets, including source IP address, destination IP address, port number, protocol type and data load, etc. The main functions of the traffic probe include data packet capture, data packet decoding, traffic filtering, real-time monitoring, etc.

[0056] S220, capturing inter-satellite original communication traffic transmitted between inter-satellite links through a terminal device on a satellite.

[0057] In this embodiment, the inter-satellite original communication traffic transmitted between inter-satellite links can be captured through a terminal device on a satellite. Similarly, the inter-satellite original communication traffic is also a data packet frame format in a certain frequency band.

[0058] For better understanding of the traffic collection points of the Earth-Moon space network, Figure 3 An architecture schematic diagram of a traffic collection point of the Earth-Moon space network is provided by an embodiment of the present application. As shown in Figure 3As shown, the earth-moon space network mainly involves multiple hierarchies, including five core parts: the ground segment (the tracking station, the data processing center), the earth orbit segment (the relay satellite constellation, the low-orbit Internet constellation), the earth-moon transfer orbit segment (the relay satellite group deployed in the DRO and other special orbits), the moon orbit segment (the circumlunar satellite providing full-coverage communication and navigation), and the lunar surface segment (the lunar surface base station, the gateway node, and the positioning system). The network realizes earth-moon communication, navigation, and data transmission through multi-orbit cooperation, and the key technologies include laser communication, delay-tolerant network (DTN), autonomous networking, and resource scheduling, supporting future deep space exploration and lunar base operation. Since the earth-moon space network has star-star communication traffic, moon surface-satellite communication traffic, and star-ground communication traffic, it is necessary to collect communication traffic through the earth / moon surface traffic probe and the satellite terminal payload for the three scenarios.

[0059] S230, identifying the data message frame format corresponding to the historical traffic data under different frequency bands.

[0060] The different frequency bands in this embodiment can include but are not limited to the S frequency band and the Ka frequency band. For the traffic raw data collected by each collection unit, the traffic data can be parsed according to the preset parsing rule, and the traffic data is extracted to aggregate the data to form feature data.

[0061] For example, in order to better understand the data message frame format corresponding to the historical traffic data, Table 1 is a schematic table of the telemetry data frame format under the S frequency band provided by the embodiment of the application.

[0062] Table 1: Telemetry data frame format under the S frequency band

[0063]

[0064]

[0065] S240, extracting the valid data field according to the byte bit in the data message frame format, and extracting the valid data content from the valid data field.

[0066] In this embodiment, the data message under different frequency bands can be extracted for valid data according to the byte bit in the frame format. Specifically, the data integrity check bit can be extracted through the synchronization byte, the timestamp can be extracted through the 80th to 128th bit, and the valid content in the valid data can be read through the 256th to 1792th bit.

[0067] In this embodiment, the timestamp is extracted from the time field bit in the data message frame format. The time field bit can correspond to the 80th to 128th bit, i.e., the timestamp is extracted through the 80th to 128th bit.

[0068] S250, taking the effective data content as target feature data.

[0069] In this embodiment, the extracted effective data content and timestamp are taken as target feature data together, wherein the target feature data includes: timestamp, traffic type, application type, uplink traffic, downlink traffic, uplink packet number, downlink packet number, packet size distribution, flow duration, protocol type and version, port number, TCP flag bit, round-trip delay, delay jitter time, retransmission rate, signal strength.

[0070] In this embodiment, in order to better understand the target feature data, Table 2 is a schematic table of target feature data provided by the embodiment of the application.

[0071] Table 2: Schematic table of target feature data

[0072]

[0073]

[0074] S260, taking each feature data in the target feature data as a sample data respectively, and labeling positive samples and negative samples for each sample data according to a sample labeling rule to obtain classified positive sample data and negative sample data.

[0075] In this embodiment, each feature data in the target feature data is taken as a sample data respectively, and for example, the timestamp, port number, TCP flag bit, round-trip delay, delay jitter time, retransmission rate, and signal strength are taken as a sample data respectively.

[0076] Wherein, the positive sample is a normal sample, and the label is 0; the negative sample is an abnormal sample, and the label is 1.

[0077] In this embodiment, for each sample data, positive samples and negative samples are labeled for each sample data according to a sample labeling rule to obtain classified positive sample data and negative sample data. In this embodiment, for each feature data, corresponding positive samples and negative samples can be labeled to obtain corresponding classified positive sample data and negative sample data. For example, the timestamp feature will label corresponding positive samples and negative samples, and the round-trip delay, delay jitter time, retransmission rate, signal strength, and the like will also label corresponding positive samples and negative samples respectively.

[0078] Specifically, for each sample data, positive samples and negative samples are labeled for each sample data according to a sample labeling rule to obtain classified positive sample data and negative sample data, including:

[0079] Positive samples are marked as meeting the positive sample labeling conditions; the positive sample labeling conditions include at least one of the following: the communication protocol conforms to the Earth-Moon space network communication protocol; the signal-to-noise ratio (SNR) is greater than or equal to the preset strength threshold; the retransmission rate is less than or equal to the preset retransmission percentage; the round-trip delay (RTT) is less than or equal to the preset delay threshold; the delay jitter time (Jitter) does not exceed the preset jitter threshold; data packets are sent within the preset time range according to a fixed period; the traffic peak meets the uplink / downlink traffic size matching the mission requirements;

[0080] The samples that meet the negative sample labeling conditions are labeled as negative samples; among them, the negative sample conditions include at least: the protocol of the data packet of the non-delay-tolerant network DTN / Licklider transmission protocol LTP; the abnormal TCP flag combination of the synchronization sequence number SYN and the end FIN in the TCP protocol; the traffic surge in a short period of time after data transmission; the SNR drops suddenly or the retransmission rate increases abnormally; the unregistered port number; the sending of a large number of small packets in a short period of time, which is consistent with the distributed denial of service attack DDoS attack mode traffic.

[0081] Positive samples can be considered as follows: compliance with the Earth-Moon space network communication protocol, including the S-band telemetry frame format, DTN, LTP, and CCSDS specifications, ensuring no protocol violations; signal quality, including fluctuations within historical statistical ranges, such as signal strength (SNR) ≥ 15dB and retransmission rate ≤ 3%; latency and jitter, including RTT ≤ 3000ms and jitter within normal thresholds; regular transmission of telemetry packets within normal timeframes; and peak traffic volume of attitude adjustment commands, ensuring that uplink / downlink traffic volumes match mission requirements. Negative samples can be considered as follows: protocol violations for packets not in the DTN / LTP protocol; abnormal TCP flag combinations with simultaneous SYN+FIN; a sudden, short-term traffic surge of 800KB / s after image transmission; a sudden drop in SNR (e.g., below 10dB) or an abnormally high retransmission rate (e.g., >10%); unregistered port numbers; and traffic consistent with DDoS attack patterns, such as sending a large number of small packets in a short period of time.

[0082] S270 , determining a corresponding weight coefficient for each negative sample data according to the importance of the sample feature level corresponding to each negative sample data and the feature change situation.

[0083] Among them, the higher the importance of the sample feature level, the higher the weight coefficient.

[0084] In the embodiment, after the positive and negative sample labeling and classification according to the sample labeling rules, the number of samples needs to be allocated, that is, the number of negative samples and the number of positive samples is allocated. It can be understood that the number of negative samples corresponding to each negative sample feature is selected, and then the number of positive samples corresponding to the number of negative samples is selected. For example, assuming that there are m features, and the number of negative sample features to be selected is N, then N / m can be selected in each feature, and the number of positive samples selected in each feature can be at least 10 times the number of each feature in the corresponding negative sample.

[0085] In the embodiment, the importance degree of the sample feature and the feature change of the negative sample data are used to determine the corresponding weight coefficient of each negative sample data. The higher the importance degree of the sample feature, the higher the weight coefficient. In the embodiment, the importance degree of the sample feature can be a grade divided by the user according to the need, and the higher the grade of the feature, the higher the corresponding weight coefficient. The feature change is the abnormal change of the feature, and the greater the abnormal change of the feature, the higher the corresponding weight coefficient. In the embodiment, some features have large abnormal change or high importance, and more samples can be selected. For features with small change or low importance, fewer samples can be selected. It can be understood that the weight of sample selection is adjusted according to the change of the feature and the importance of the feature.

[0086] For example, in order to better understand the classification of weights, Table 3 provides an example of weight assignment of high weight features and low weight features respectively.

[0087] Table 3: Weight assignment of high weight features and low weight features respectively

[0088]

[0089] S280, dynamically adjusting the number of negative samples selected for each negative sample data according to the preset negative sample demand and / or weight coefficient.

[0090] In the embodiment, the preset negative sample demand is a demand defined by the user according to the demand. The number of negative samples selected for each negative sample feature can be dynamically adjusted according to the negative sample demand and / or weight coefficient. For example, the number of samples is dynamically adjusted according to the feature weight, and each feature covers at least the maximum and minimum range. For example, if the RTT weight is 0.3, 30% of the negative samples are allocated, and the RTT related samples are allocated according to the proportion of 1000 total negative samples and 300 RTT related samples. At the same time, since the normal range of RTT is 500-3000 ms, samples containing 500 ms and 3000 ms are required.

[0091] S290, selecting positive sample data corresponding to the feature according to the number of negative samples selected for each negative sample data, and the number of positive samples corresponding to each positive sample data.

[0092] The number of positive samples corresponding to each positive sample data is a preset multiple of the number of negative samples corresponding to the negative sample data. The preset multiple includes: increasing the sampling ratio of the number of positive samples corresponding to the positive sample data for the negative sample data with a high weight coefficient, and reducing the sampling ratio of the number of positive samples corresponding to the positive sample data for the negative sample data with a low weight coefficient.

[0093] In this embodiment, selecting positive sample data corresponding to the feature according to the number of negative samples selected for each negative sample data, and the number of positive samples corresponding to each positive sample data can be understood as follows: in order to avoid class imbalance leading to model bias towards the majority class, the number of positive samples is a preset multiple of the number of negative samples, which can be defined by the user according to the demand; at the same time, the positive samples are extracted according to the hourly time interval to avoid time bias. For example, 5 positive samples and 0.5 negative samples are selected per hour, and according to the coverage of all communication scenarios (star-star, lunar surface-star, and star-ground) with 40% star-star communication, 30% lunar surface-star communication, and 30% star-ground communication, the sample diversity is ensured. According to RTT>Jitter>retransmission rate, the features are arranged in descending order of weight, the sampling ratio is increased for high-weight features, and the sampling ratio is reduced for low-weight features, and finally the positive and negative sample data are selected.

[0094] S2100, forming a training sample set by using the selected each positive sample data, the label and the number of positive samples corresponding to each positive sample data, and the selected negative sample data, the label and the number of negative samples corresponding to each negative sample data.

[0095] In this embodiment, the selected each positive sample data, the label and the number of positive samples corresponding to each positive sample data, and the selected negative sample data, the label and the number of negative samples corresponding to each negative sample data are used to form a sample set and a training sample set, which represents the uniform distribution of each feature in the entire definition domain space in the normal data set, and ensures the spatiotemporal correlation of the data, that is, the positive and negative samples of various features can be extracted, and the independent and identically distributed training data is ensured.

[0096] S2110, taking each positive sample feature and negative sample feature in the training sample set as a feature vector respectively, normalizing all feature vectors, and forming a feature matrix by using the normalized feature vectors.

[0097] In the embodiment, each positive sample feature and negative sample feature is taken as a feature vector respectively, all the feature vectors are normalized, and the normalized feature vectors form a feature matrix. It can be understood that after the positive and negative samples are selected, the numerical range of all the feature vectors is normalized to the uniform interval of [0, 1], so as to eliminate the difference in different feature dimensions and orders of magnitude as the model input.

[0098] In the embodiment, the feature matrix is input into the anomaly detection model to optimize the model parameters until the loss function of the anomaly detection model reaches the optimum, and a trained optimal anomaly detection model is obtained.

[0099] In the embodiment, the feature matrix is input into the anomaly detection model to optimize the model parameters until the loss function of the anomaly detection model reaches the optimum, and a trained optimal anomaly detection model is obtained.

[0100] In the embodiment, considering that the earth-moon space network data is usually a small sample, the number of samples is only 10000 positive samples + 1000 negative samples, and the feature dimension is high, the model input feature vector and state label: 0 (normal), 1 (abnormal) are used after the training starts, the SVM-RBF kernel is used, the initialization parameters are C=1.0 and γ=0.1, the model parameters are adjusted according to the loss gradient during the training, the change of the loss function with the number of iterations is observed, the training set loss is reduced from 0.8 to 0.1, if the validation set loss does not decrease for three times in succession, the training is terminated in advance, the above steps are repeated until the model converges, the F1-Score of the validation set reaches 0.93, and the AUC-ROC=0.98. After the model converges, the abnormal flow classification model is obtained, and the model file svm_model.pkl is output. Subsequently, when a flow data needs to be judged, only the feature vector of the flow data needs to be calculated and input into the model to end the judgment. The final output of the support vector machine model is a possibility size, which represents the result of abnormal flow.

[0101] S2130, feature extraction is performed on the to-be-detected flow data to obtain feature data after feature extraction.

[0102] In the embodiment, the feature extraction method is the same as the feature extraction method of the historical flow data described above, and will not be described in detail in the embodiment.

[0103] S2140, the feature data is input into the optimal anomaly detection model to obtain an anomaly detection result.

[0104] In the embodiment, the feature data is input into the optimal anomaly detection model to obtain an anomaly detection result, which represents the size of the anomaly probability.

[0105] The technical solution in the embodiment can extract key data, which provides convenience for subsequent processes. Each feature data in the target feature data is taken as a sample data, and each sample data is labeled as a positive sample and a negative sample according to a sample labeling rule, to obtain classified positive sample data and negative sample data. A weight coefficient is determined for each negative sample data according to a sample feature level importance degree and a feature change condition corresponding to the negative sample data. The number of negative samples selected for each negative sample data is dynamically adjusted according to a preset negative sample requirement and / or the weight coefficient. The positive sample data corresponding to each selected negative sample data is selected according to the number of negative samples selected for each negative sample data. Each positive sample data is labeled with a positive sample number corresponding to the positive sample data. The selected positive sample data, labels, and positive sample numbers corresponding to the positive sample data, and the selected negative sample data, labels, and negative sample numbers corresponding to the negative sample data form a training sample set. The detection model is trained using the training sample set, which can accurately select positive and negative samples and reduce the complexity of model training. Feature data obtained by feature extraction on to-be-detected traffic data is input into the optimal anomaly detection model, to obtain an anomaly detection result, thereby further achieving accurate detection and processing of abnormal traffic and providing reliable communication support for future lunar space exploration missions.

[0106] In an embodiment, Figure 4 A structural block diagram of a network traffic anomaly detection device is provided for an embodiment of the present application. The device is suitable for the case of detecting network traffic anomalies. The device can be implemented by hardware / software. The device can be configured in an electronic device to implement a network traffic anomaly detection method in an embodiment of the present application. As shown in the figure, the device includes a traffic data acquisition module 410, a feature extraction module 420, a label module 430, a model training module 440, and a detection module 450. Figure 4

[0107] The traffic data acquisition module 410 is configured to acquire historical traffic data in a lunar-space network. The historical traffic data is in the form of data message frame formats in different frequency bands.

[0108] The feature extraction module 420 is configured to perform feature extraction on the historical traffic data to obtain corresponding target feature data.

[0109] ​The labeling module 430 is used to perform sample labeling for each feature data in the target feature data according to a preset positive and negative sample selection method and a weight configuration method corresponding to each feature data in each target feature data to form a training sample set;

[0110] A model training module 440 is configured to train an anomaly detection model using the training sample set to obtain a trained optimal anomaly detection model;

[0111] The detection module 450 is used to obtain the traffic data to be detected, and detect the traffic data to be detected based on the optimal anomaly detection model to obtain a detection result.

[0112] In an embodiment of the present invention, a feature extraction module obtains corresponding target feature data by extracting features from each historical traffic data; a labeling module performs sample labeling on each feature data in the target feature data according to a preset positive and negative sample selection method and a weight configuration method corresponding to each feature data in each target feature data to form a training sample set, thereby a model training module uses the training sample set to train an anomaly detection model to obtain a trained optimal anomaly detection model, which can accurately select positive and negative samples and reduce the complexity of model training; a detection module obtains a detection result by detecting the traffic data to be detected based on the optimal anomaly detection model, which can achieve accurate detection and processing of abnormal traffic and provide reliable communication guarantee for future Earth-Moon space exploration missions.

[0113] In one embodiment, the traffic data acquisition module 410 includes:

[0114] A first communication traffic acquisition unit is used to capture the original communication traffic on the lunar surface and the original communication traffic on the ground through a traffic probe;

[0115] The second communication traffic acquisition unit is configured to capture the inter-satellite original communication traffic transmitted between the inter-satellite links through a terminal device on the satellite.

[0116] In one embodiment, the feature extraction module 420 includes:

[0117] A format identification unit, configured to identify data message frame formats corresponding to the historical traffic data in different frequency bands;

[0118] A valid content identification unit, configured to extract a valid data field according to the byte positions in the data message frame format, and extract valid data content from the valid data field;

[0119] The feature data determination unit is configured to determine the effective data content as target feature data, wherein the target feature data comprises a timestamp, a traffic type, an application type, uplink traffic, downlink traffic, uplink packet quantity, downlink packet quantity, packet size distribution, flow duration, protocol type and version, port number, TCP flag bit, round-trip delay, delay jitter time, retransmission rate, signal strength.

[0120] In an embodiment, the label module 430 comprises:

[0121] The labeling unit is configured to take each feature data in the target feature data as a sample data, and label positive samples and negative samples for each sample data according to a sample labeling rule, to obtain classified positive sample data and negative sample data.

[0122] The weight coefficient determination unit is configured to determine a corresponding weight coefficient for each negative sample data according to a sample feature level importance and a feature change of the negative sample data, wherein the higher the sample feature level importance, the higher the weight coefficient.

[0123] The negative sample quantity selection unit is configured to dynamically adjust a selected negative sample quantity of each negative sample data according to a preset negative sample demand quantity and / or a weight coefficient.

[0124] The positive sample quantity selection unit is configured to select positive sample data corresponding to a feature and a positive sample quantity corresponding to each positive sample data according to a selected negative sample quantity of each negative sample data, wherein the positive sample quantity corresponding to each positive sample data is a preset multiple of the negative sample quantity of the corresponding negative sample data, and wherein the preset multiple comprises increasing a positive sample quantity sampling ratio of the corresponding positive sample data for a negative sample data with a high weight coefficient and decreasing the positive sample quantity sampling ratio of the corresponding positive sample data for a negative sample data with a low weight coefficient.

[0125] The sample set determination unit is configured to form a training sample set by using each selected positive sample data, a label, and a positive sample quantity corresponding to each positive sample data, and using each selected negative sample data, a label, and a negative sample quantity corresponding to each negative sample data.

[0126] In an embodiment, the labeling unit comprises:

[0127] A positive sample labeling unit is configured to label samples that meet the positive sample labeling conditions as positive samples; wherein the positive sample labeling conditions include at least one of the following: the communication protocol complies with the Earth-Moon space network communication protocol; the signal-to-noise ratio (SNR) is greater than or equal to a preset strength threshold; the retransmission rate is less than or equal to a preset retransmission percentage; the round-trip delay (RTT) is less than or equal to a preset delay threshold; the delay jitter time (Jitter) does not exceed a preset jitter threshold; data packets are sent within a preset time range according to a fixed period; and the traffic peak meets the uplink / downlink traffic size matching task requirements.

[0128] A negative sample labeling unit is used to label samples that meet the negative sample labeling conditions as negative samples; wherein, the negative sample conditions include at least: the protocol of the data packet of the non-delay tolerant network DTN / Licklider transmission protocol LTP; the abnormal TCP flag bit combination of the synchronization sequence number SYN and the end FIN in the TCP protocol; the traffic surge in a short period of time after data transmission; the SNR drops suddenly or the retransmission rate increases abnormally; the unregistered port number; the sending of a large number of small packets in a short period of time, which conforms to the distributed denial of service attack DDoS attack mode traffic.

[0129] In one embodiment, the anomaly detection model is a support vector machine (SVM) model, and the kernel function of the support vector machine (SVM) model is a radial basis function (RBF);

[0130] Accordingly, the model training module 440 includes:

[0131] a processing unit, configured to treat each positive sample feature and each negative sample feature in the training sample set as a feature vector, normalize all the feature vectors, and form a feature matrix from the normalized feature vectors;

[0132] The model training unit is used to input the feature matrix into the anomaly detection model to optimize the model parameters until the loss function of the anomaly detection model reaches the optimal value, thereby obtaining a trained optimal anomaly detection model.

[0133] In one embodiment, the detection module 450 includes:

[0134] A feature extraction unit, configured to extract features from the flow data to be detected to obtain feature data after feature extraction;

[0135] The detection unit is used to input the feature data into the optimal anomaly detection model to obtain an anomaly detection result.

[0136] The network traffic anomaly detection device provided in the embodiment of the present invention can execute the network traffic anomaly detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0137] In an embodiment, Figure 5 A block diagram of an electronic device in accordance with an embodiment of the present application is provided. The electronic device 10 is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smartphones, wearable devices (e.g., headsets, glasses, watches, etc.), and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be examples only, and are not meant to limit implementations of the applications described and / or claimed in this document.

[0138] As shown in Figure 5 The electronic device 10 includes at least one processor 11, and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., connected to the at least one processor 11, where the memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes according to the computer programs stored in the read-only memory (ROM) 12 or loaded into the random access memory (RAM) 13 from the storage unit 18. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0139] Various components in the electronic device 10 are connected to the I / O interface 15, including an input unit 16, such as a keyboard, a mouse, etc., an output unit 17, such as various types of displays, a speaker, etc., a storage unit 18, such as a magnetic disk, an optical disk, etc., and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0140] The processor 11 can be various general and / or special purpose processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs various methods and processes described above, such as the network traffic anomaly detection method.

[0141] In some embodiments, the network traffic anomaly detection method can be implemented as a computer program tangibly embodied in a computer readable storage medium, e.g., storage unit 18. In some embodiments, parts or all of the computer program can be loaded and / or installed onto electronic device 10 via, e.g., ROM 12 and / or communication unit 19. When the computer program is loaded onto RAM 13 and executed by processor 11, one or more steps of the network traffic anomaly detection method described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to perform the network traffic anomaly detection method by other means, e.g., with the aid of firmware.

[0142] Various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a programmable logic device (PLD), a computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0143] Computer programs used to implement the methods of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the computer program, when executed by the processor of the computer, produces a means for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks. The computer program can be executed entirely on a machine, partially on a machine, partially on a machine as part of a standalone software package, or entirely on a remote machine or server.

[0144] In the context of the present invention, computer-readable storage media can be tangible media that can contain or store a computer program for use with an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Computer-readable storage media can include but are not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, computer-readable storage media can be machine-readable signal media. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0145] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0146] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0147] A computing system may include clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.

[0148] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the present invention can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of the present invention can be achieved. This is not limited herein.

[0149] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. A method for detecting anomaly in network traffic, characterized in that: The method comprises: Obtaining historical traffic data in the Earth-Moon space network; wherein the historical traffic data is expressed in data message frame formats under different frequency bands; Extracting features from the historical traffic data to obtain corresponding target feature data; For each feature data in the target feature data, sample labeling is performed according to a preset positive and negative sample selection method and a weight configuration method corresponding to each feature data in each target feature data to form a training sample set; Using the training sample set to train the anomaly detection model to obtain a trained optimal anomaly detection model; The flow data to be detected is acquired, and the flow data to be detected is detected based on the optimal anomaly detection model to obtain a detection result.

2. The method according to claim 1, characterized in that The obtaining of historical traffic data in the Earth-Moon space network includes: Capture the original lunar communication traffic and the original ground communication traffic through traffic probes; The original inter-satellite communication traffic transmitted between inter-satellite links is captured by the terminal equipment on the satellite.

3. The method according to claim 1, characterized in that The extracting features of the historical traffic data to obtain corresponding target feature data includes: Identify data message frame formats corresponding to the historical traffic data in different frequency bands; Extracting a valid data field according to the byte position in the data message frame format, and extracting valid data content from the valid data field; The valid data content is used as target characteristic data; wherein, the target characteristic data includes: timestamp, traffic type, application type, upstream traffic, downstream traffic, number of upstream messages, number of downstream messages, packet size distribution, flow duration, protocol type and version, port number, Transmission Control Protocol TCP flag, round-trip delay, delay jitter time, retransmission rate, and signal strength.

4. The method according to claim 1, wherein The method of labeling each feature data in the target feature data according to a preset positive and negative sample selection method and a weight configuration method corresponding to each feature data in each target feature data to form a training sample set includes: Each feature data in the target feature data is taken as a sample data, and for each sample data, each sample data is labeled as a positive sample and a negative sample according to the sample labeling rule to obtain classified positive sample data and negative sample data; Determine a corresponding weight coefficient for each negative sample data according to the importance of the sample feature level and the feature change situation corresponding to the negative sample data; wherein, the higher the importance of the sample feature level, the higher the weight coefficient; Dynamically adjust the number of negative samples selected for each negative sample data according to a preset negative sample requirement and / or weight coefficient; Selecting positive sample data corresponding to the features according to the number of negative samples selected for each of the negative sample data, and the number of positive samples corresponding to each of the positive sample data; wherein the number of positive samples corresponding to the positive sample data is a preset multiple of the number of negative samples under the corresponding negative sample data; wherein the preset multiple includes: increasing the sampling ratio of the number of positive samples of the corresponding positive sample data for negative sample data with a high weight coefficient, and reducing the sampling ratio of the number of positive samples of the corresponding positive sample data for negative sample data with a low weight coefficient; The selected positive sample data, labels and the number of positive samples corresponding to each positive sample data, as well as the selected negative sample data, labels and the number of negative samples corresponding to each negative sample data, form a training sample set.

5. The method according to claim 4, characterized in that For each sample data, labeling each sample data as a positive sample and a negative sample according to the sample labeling rules to obtain classified positive sample data and negative sample data includes: The samples that meet the positive sample labeling conditions are marked as positive samples; wherein, the positive sample labeling conditions include at least one of the following: the communication protocol conforms to the Earth-Moon space network communication protocol; the signal-to-noise ratio (SNR) is greater than or equal to the preset strength threshold; the retransmission rate is less than or equal to the preset retransmission percentage; the round-trip delay (RTT) is less than or equal to the preset delay threshold; the delay jitter time (Jitter) does not exceed the preset jitter threshold; the data packets are sent within the preset time range according to a fixed period; the traffic peak meets the uplink / downlink traffic size matching the task requirements; The samples that meet the negative sample labeling conditions are marked as negative samples; wherein, the negative sample conditions include at least: the protocol of the data packet of the non-delay tolerant network DTN / Licklider transmission protocol LTP; the abnormal TCP flag combination of the synchronization sequence number SYN and the end FIN in the TCP protocol; the traffic surge in a short period of time after data transmission; the SNR drops suddenly or the retransmission rate increases abnormally; the unregistered port number; the sending of a large number of small packets in a short period of time, which conforms to the distributed denial of service attack DDoS attack mode traffic.

6. The method according to claim 1, characterized in that The anomaly detection model is a support vector machine (SVM) model, and the kernel function of the support vector machine (SVM) model is a radial basis function (RBF); Accordingly, the use of the training sample set to train the anomaly detection model to obtain a trained optimal anomaly detection model includes: Each positive sample feature and each negative sample feature in the training sample set is respectively regarded as a feature vector, all the feature vectors are normalized, and the normalized feature vectors are formed into a feature matrix; The feature matrix is ​​input into the anomaly detection model to optimize the model parameters until the loss function of the anomaly detection model reaches the optimal value, thereby obtaining a trained optimal anomaly detection model.

7. The method according to claim 1, wherein Detecting the network traffic data to be detected based on the optimal anomaly detection model includes: Performing feature extraction on the flow data to be detected to obtain feature data after feature extraction; The feature data is input into the optimal anomaly detection model to obtain an anomaly detection result.

8. A network traffic anomaly detection device, characterized in that: The device comprises: A traffic data acquisition module is used to acquire multiple historical traffic data in the Earth-Moon space network; wherein each of the historical traffic data is expressed in a data message frame format under different frequency bands; A feature extraction module is used to extract features from the historical traffic data to obtain corresponding target feature data; a labeling module for labeling each feature data in the target feature data according to a preset positive and negative sample selection method and a weight configuration method corresponding to each feature data in each target feature data to form a training sample set; A model training module, configured to train an anomaly detection model using the training sample set to obtain a trained optimal anomaly detection model; The detection module is used to obtain the flow data to be detected, and detect the flow data to be detected based on the optimal anomaly detection model to obtain a detection result.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network traffic anomaly detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network traffic anomaly detection method according to any one of claims 1 to 7 when executed.

Images