A network behavior representation learning method and system based on cross-modal alignment

Abstract

The application discloses a network behavior representation learning method and system based on cross-modal alignment, and belongs to the field of artificial intelligence and network security. The method comprises the following steps: extracting statistical features, packet length sequences and load sequences from network behaviors; designing independent feature extraction networks for each mode and mapping them to a unified shared semantic space; introducing a double contrast constraint mechanism for cross-modal alignment learning, and optimizing through a composite loss function: on the one hand, the distance between different modal features of the same sample is minimized to realize intra-group aggregation; on the other hand, the corresponding modal features of different samples are pulled away by a preset interval to realize inter-group differentiation; the learning of accidental patterns by the model is effectively inhibited, and the ability to capture essential attack features is enhanced. The method can explicitly model the cross-modal structural relationship and mine essential attack patterns to improve the generalization ability of IoT attack detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of artificial intelligence and network security, in particular to a network behavior representation learning method and system based on cross-modal alignment. BACKGROUND

[0002] With the wide popularity of Internet of Things (IoT) devices and the continuous evolution of network attack means, IoT attack detection technology has become a core link to ensure the security of cyberspace. Once such attacks are successfully implemented, they will lead to device paralysis, data leakage, and uncontrolled key infrastructure, and other serious consequences. Therefore, developing an efficient and accurate IoT attack detection method is of great significance to maintaining personal privacy, enterprise operation safety, and the stability of critical information infrastructure.

[0003] The current mainstream method of IoT attack detection mainly falls into two categories: one is a single-modal independent modeling method, which focuses on a single feature flow (such as data packet statistical features STATS, data packet length sequence PKT, or payload PYL) for attack behavior analysis. This method is effective in specific scenarios, but it ignores the correlation between multiple modalities, making it difficult to fully capture the cross-modal features of complex attack behaviors, resulting in significant detection blind spots. The other is a shallow multi-modal fusion method, which simply concatenates or averages the multi-modal features, but the fusion process lacks explicit modeling of the structural relationship between modalities, essentially treating multi-source features as independent and equal-weight inputs, resulting in the loss of key cross-modal correlation information and the inability to mine the essential patterns of attack behavior.

[0004] Further analysis shows that due to the characteristics of IoT attack samples, existing methods generally have the problem of "accidental pattern" learning - that is, the model overfits to non-essential features in the training set (such as accidental differences in the collection environment, attack tools, or network background), while ignoring the consistent essential attack patterns in cross-modalities. Such features are difficult to reproduce in unknown scenarios, directly leading to a significant decline in model generalization ability. Real attack behaviors often exhibit internal semantic and behavioral consistency in multiple modalities such as PKT, PYL, and STATS, while existing shallow fusion strategies fail to effectively align multi-modal features due to the neglect of this cross-modal consistency, becoming a fundamental bottleneck to improving detection performance.

[0005] Therefore, the core technical difficulty of current IoT attack detection lies in how to achieve deep alignment of cross-modal features and mining of essential patterns. Existing technologies attempt to improve detection capability through multi-modal fusion, but due to the shallowness of the fusion strategy, they still cannot break through the dilemma of loss of correlation information between modalities and accidental pattern learning. Therefore, there is an urgent need to develop a new representation learning method that can explicitly model the structural relationship between cross-modalities and mine essential attack patterns to improve the generalization ability of IoT attack detection. SUMMARY

[0006] The application provides a network behavior representation learning method and system based on cross-modal alignment to solve the challenges of insufficient multi-modal fusion, fragmented modal correlation and excessive learning of accidental patterns in existing IoT attack detection technologies.

[0007] In a first aspect, the application provides a network behavior representation learning method based on cross-modal alignment, comprising the following steps:

[0008] Obtaining network behavior samples and extracting statistical feature data, packet length sequence data and payload byte sequence data from the network behavior samples;

[0009] Using independent feature extraction networks to map the statistical feature data, the packet length sequence data and the payload byte sequence data into first modal feature vectors, second modal feature vectors and third modal feature vectors in a shared semantic space, respectively;

[0010] Training the independent feature extraction networks based on a joint loss function, wherein the training process applies modal alignment, which is based on a sample repulsion constraint to minimize the distance between the first modal feature vectors, the second modal feature vectors and the third modal feature vectors derived from the same network behavior sample, and to maximize the distance between corresponding modal feature vectors derived from different network behavior samples;

[0011] Fusing the trained first modal feature vectors, second modal feature vectors and third modal feature vectors to generate a fusion feature vector, and classifying the network behavior samples based on the fusion feature vector.

[0012] As an optional implementation of the first aspect of the application, the step of using independent feature extraction networks to map the statistical feature data, the packet length sequence data and the payload byte sequence data into first modal feature vectors, second modal feature vectors and third modal feature vectors in a shared semantic space comprises: using a multi-layer perception network to process the statistical feature data to generate the first modal feature vectors; using a sequence processing network containing an embedding layer and a bidirectional long short-term memory network to process the packet length sequence data to generate the second modal feature vectors; and using a local feature extraction network containing an embedding layer, a one-dimensional convolutional network and a global max-pooling layer to process the payload byte sequence data to generate the third modal feature vectors.

[0013] As an optional implementation of the first aspect of the present application, in the step of training the independent feature extraction network based on the joint loss function, the joint loss function is obtained by weighted summation of a classification loss, an intra-group modal alignment loss for implementing the modal alignment constraint, and an inter-group modal repulsion loss for implementing the sample repulsion constraint.

[0014] As an optional implementation of the first aspect of the present application, the intra-group modal alignment loss is calculated by: calculating a first cosine distance between the first modal feature vector and the second modal feature vector, a second cosine distance between the first modal feature vector and the third modal feature vector, and a third cosine distance between the second modal feature vector and the third modal feature vector for the same network behavior sample; and summing the first cosine distance, the second cosine distance, and the third cosine distance to obtain the intra-group modal alignment loss.

[0015] As an optional implementation of the first aspect of the present application, the inter-group modal repulsion loss is calculated by: calculating a fourth cosine distance between the first modal feature vectors of two different network behavior samples, a fifth cosine distance between the second modal feature vectors, and a sixth cosine distance between the third modal feature vectors; summing the fourth cosine distance, the fifth cosine distance, and the sixth cosine distance to obtain a distance sum; and subtracting the distance sum from a preset margin parameter to obtain the inter-group modal repulsion loss.

[0016] As an optional implementation of the first aspect of the present application, after the step of extracting statistical feature data, packet length sequence data, and payload byte sequence data from the network behavior samples, the method further comprises: preprocessing the statistical feature data, the packet length sequence data, and the payload byte sequence data, including: performing Z-score standardization processing on the statistical feature data; normalizing the length of the packet length sequence data to a first preset length and limiting the packet length value range; and normalizing the length of the payload byte sequence data to a second preset length and zero-padding the insufficient sequence part.

[0017] As an optional implementation of the first aspect of the present application, the step of classifying the network behavior samples based on the fusion feature vector comprises: mapping the first modal feature vector, the second modal feature vector, and the third modal feature vector to the fusion feature vector through a fusion module comprising a fully connected layer, a batch normalization layer, and a Dropout layer; and inputting the fusion feature vector into a classifier comprising a fully connected layer and a Softmax activation function to output the class probability distribution of the network behavior sample.

[0018] In a second aspect, the embodiments of the present application provide a network behavior representation learning system based on cross-modal alignment, comprising:

[0019] a data acquisition module configured to acquire network behavior samples and extract statistical feature data, packet length sequence data and payload byte sequence data from the network behavior samples;

[0020] a feature extraction module configured to map the statistical feature data, the packet length sequence data and the payload byte sequence data into first, second and third modal feature vectors in a shared semantic space respectively by using independent feature extraction networks;

[0021] a cross-modal alignment module configured to train the independent feature extraction networks based on a joint loss function, wherein the training process imposes modal alignment, and the modal alignment is to minimize the distance between the first, second and third modal feature vectors derived from the same network behavior sample under a sample repulsion constraint, and the sample repulsion constraint is to maximize the distance between corresponding modal feature vectors derived from different network behavior samples;

[0022] a network behavior classification module configured to fuse the first, second and third modal feature vectors obtained after training to generate a fused feature vector, and classify the network behavior samples based on the fused feature vector.

[0023] In a third aspect, the embodiments of the present application provide an electronic device, which comprises a processor, a memory, and a program or instructions stored in the memory and executable on the processor, and the program or instructions are executed by the processor to implement the steps of the method according to the first aspect.

[0024] In a fourth aspect, the embodiments of the present application provide a readable storage medium, which stores a program or instructions, and the program or instructions are executed by the processor to implement the steps of the method according to the first aspect.

[0025] Compared with the prior art, the present application has the following beneficial effects:

[0026] 1. Deep alignment and essential feature mining: Through double contrast constraints, the consistency and difference between modalities are explicitly modeled, deep alignment of features is achieved, and the essential patterns of attack behaviors are effectively mined.

[0027] 2. Inhibition of accidental pattern learning: The inter-group repulsion mechanism forces the model to ignore the accidental similarity between samples in a single modality and focus on discriminative features that can be generalized across samples, significantly improving the generalization ability of the model.

[0028] 3. Improve model robustness and stability: the intra-group aggregation mechanism makes the model less sensitive to noise or missing of a single modality, as it can obtain compensation information from other aligned modalities, thereby improving the stability and robustness of detection.

[0029] 4. End-to-end optimization framework: integrating multi-modal feature extraction, cross-modal alignment and classification tasks in an end-to-end learning framework, realizing the collaborative work of each module through joint optimization, providing an efficient and robust solution for network behavior detection in complex IoT scenarios. BRIEF DESCRIPTION OF DRAWINGS

[0030] Figure 1 is a flowchart of a network behavior representation learning method based on cross-modal alignment according to an embodiment of the present application;

[0031] Figure 2 is a structural schematic diagram of a network behavior representation learning system based on cross-modal alignment provided by an embodiment of the present application.

[0032] The following specific embodiments will further illustrate the present application in conjunction with the above-mentioned drawings. DETAILED DESCRIPTION

[0033] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0034] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein. In addition, "and / or" in the specification and claims indicates at least one of the connected objects, and the character " / ", generally indicates that the front and rear associated objects are in an "or" relationship. In the description of the present application, the meaning of "multiple" is two or more, unless otherwise explicitly specified.

[0035] Embodiment 1

[0036] Please refer to Figure 1 is a flowchart of a network behavior representation learning method based on cross-modal alignment provided by an embodiment of the present application. The method can include the following steps:

[0037] S1: Obtain network behavior samples, and extract statistical feature data, packet length sequence data, and payload byte sequence data from the network behavior samples;

[0038] This step aims to convert the multi-dimensional structured features in the original network behavior into a unified and standardized multi-modal input form to support subsequent deep feature extraction and model training. It is assumed that the original data set contains N samples, denoted as where each sample contains multiple types of features such as statistical feature data, packet length sequence data, and payload byte sequence data. The statistical feature data is a type of session statistical feature, such as average packet length, duration, etc. The packet length sequence data is a sequence composed of the packet length values of data packets that arrive sequentially within the same session. The payload byte sequence data is a byte sequence composed of binary data at the application layer of the data packet.

[0039] First, irrelevant fields are removed from the obtained network behavior samples, and only initial statistical features are retained to form an initial statistical feature matrix where is the statistical feature dimension. Zero padding or mean substitution is used for missing values, and protocol anomalies and empty packets are removed to ensure data quality. Subsequently, the initial statistical features are split into three modalities:

[0040] Statistical feature data modality : After data cleaning, we obtain , which is processed by Z-score standardization: where and are the mean and standard deviation of the training set statistical features, respectively, and the statistical feature vector of the th sample is denoted as ;

[0041] Packet length sequence data modality : The packet length sequence of the th sample is denoted as , where the sequence length is uniform as L, represents the value of the th packet length in the packet length sequence of the th sample, and the packet length value is limited within the vocabulary size : ;

[0042] Payload sequence data modality : The forward and backward payloads are merged into a fixed-length byte sequence , where , the length is uniform as M, and the insufficient sequence part is padded with zeros, where represents the value of the byte at the i-th position in the byte sequence of the i-th sample. represents the value of the byte at the i-th position in the byte sequence of the i-th sample.

[0043] S2: using an independent feature extraction network, mapping the statistical feature data, the packet length sequence data and the payload byte sequence data into first, second and third modal feature vectors in a shared semantic space, respectively;

[0044] After the multi-modal input is completed, the standardization and unified formatting, three modalities of statistical feature data (STATS), packet length sequence data (PKT), and payload byte sequence data (PYL) are respectively designed with independent feature extraction networks (Multi-modal Independent Feature Extraction Network, MIFEN) to obtain deep semantic representation.

[0045] (1) For the statistical feature data (STATS) modality, the input is the Z-score standardized statistical feature vector , where d is the statistical feature dimension. Through a multi-layer perceptron (MLP), high-order semantics are extracted to generate a first modal feature vector:

[0046]

[0047] where f represents a ReLU activation function, is a weight matrix, is a bias parameter, and the output is .

[0048] (2) For the packet length sequence data (PKT) modality, the input is the packet length amplitude sequence

[0049]

[0050] where T is the maximum length of the sequence. First, an embedding layer (Embedding) is used to map the discrete amplitude index to a dense vector:

[0051] ,

[0052] Then, a bidirectional LSTM ( ) is used to capture the temporal dependence to generate a second modal feature vector:

[0053] , ​​​​

[0054] (3) For the Payload Byte Sequence (PYL) modality, the input is the concatenated forward and reverse Payload byte sequences , which is also mapped to dense representation by embedding layer:

[0055] ,

[0056] where is the sequence length, is the vector length;

[0057] Then, one-dimensional convolution (Conv1D) and global max pooling (GMP) are used to extract local pattern features, generating the third modality feature vector:

[0058]

[0059] Finally, three modalities get 128-dimensional deep feature representations respectively. These features will be aligned to the shared space in the subsequent fusion stage, which is used for cross-modal alignment and classification tasks.

[0060] S3: training the independent feature extraction network based on a joint loss function, the training process imposes modal alignment, which is to minimize the distance between the first modality feature vector, the second modality feature vector and the third modality feature vector of the same network behavior sample based on sample repulsion constraint, the sample repulsion constraint is to maximize the distance between the corresponding modality feature vectors of different network behavior samples;

[0061] To solve the lack of inter-modal correlation and accidental patterns, cross-modal alignment (CMA) is introduced. Let the three modality features of the same sample in a batch be , where d is the modality vector length. The three modality features of another different sample are .

[0062] (1) Classification Loss: the predicted result of the first sample is compared with the true label , and the standard cross-entropy loss is used:

[0063]

[0064] where C represents the number of classes of the classification task, c represents the cth class, represents the ​The label of the nth sample in the cth category (if the nth sample is a sample in the cth category) If a sample belongs to the c-th category, its label is 1; otherwise, it is 0.

[0065] The total classification loss is:

[0066]

[0067] in Representing samples respectively Standard cross-entropy loss and sample The standard cross-entropy loss.

[0068] (2) Intra-Modal Alignment Loss (DN): Intra-Modal Alignment Loss constrains different modal features of the same sample to be close in the shared semantic space. Cosine similarity is defined as follows:

[0069]

[0070] in These represent two vectors used for comparison.

[0071] For the sample :

[0072]

[0073] in Let represent the first cosine distance between the eigenvectors of the first mode and the eigenvectors of the second mode. The second cosine distance represents the distance between the eigenvectors of the first and third modes. This represents the third cosine distance between the eigenvectors of the second and third modes;

[0074] sample Similarly, we can obtain The final intra-group modal alignment loss is:

[0075]

[0076] (3) Inter-Sample Repulsion Loss (DJ): Inter-sample repulsion constrains the corresponding modal features of different samples to maintain sufficient spacing in the shared space to suppress modal randomness.

[0077]

[0078] in Indicates the following h subscript It can be derived from statistical characteristic data ( ) or from the payload byte sequence data ( ) or from the payload byte sequence data ( ) when is represented as , represents the fourth cosine distance between the first modality feature vectors, when is represented as , represents the fifth cosine distance between the second modality feature vectors, when is represented as , represents the sixth cosine distance between the third modality feature vectors. is a preset margin parameter.

[0079] The final cross-modality aligned joint loss is:

[0080]

[0081] wherein , are the weight coefficients of intra-group alignment and inter-group repulsion, respectively.

[0082] S4: The first modality feature vector, the second modality feature vector and the third modality feature vector obtained after training are fused to generate a fused feature vector, and the network behavior sample is classified based on the fused feature vector.

[0083] After multi-modal independent feature extraction and cross-modality alignment optimization, the three-modal features of each group of samples are mapped to a unified low-dimensional representation space after fusion operation:

[0084]

[0085] wherein, is a fusion operation, including a fully connected layer, a batch normalization and a Dropout layer, to compress redundant information and enhance the generalization ability. Finally, the fused unified feature vector is input to a classifier module.

[0086] The classifier is composed of a fully connected layer and a Softmax layer, and outputs the probability distribution of classes, to obtain the probability value of the current sample being predicted as classes (the sum of the probability values is 1):

[0087]

[0088] wherein represent the weight vector and the bias parameter of the output layer, respectively.

[0089] This step converts the representation ability of fusion features into the final classification category discrimination result, realizing the end-to-end detection process closed loop from multi-modal input to accurate type prediction.

[0090] Embodiment 2

[0091] Please refer to Figure 2 , it is shown that the second embodiment of the application proposes a structure schematic diagram of a network behavior representation learning system based on cross-modal alignment, which includes the following key modules:

[0092] The data acquisition module 100 is used for acquiring network behavior samples, and extracting statistical feature data, packet length sequence data and payload byte sequence data from the network behavior samples;

[0093] The feature extraction module 200 is used for mapping the statistical feature data, the packet length sequence data and the payload byte sequence data into first modal feature vectors, second modal feature vectors and third modal feature vectors in a shared semantic space respectively by using independent feature extraction networks;

[0094] The cross-modal alignment module 300 is used for training the independent feature extraction networks based on a joint loss function, and the training process applies modal alignment, which is to minimize the distance between the first modal feature vectors, the second modal feature vectors and the third modal feature vectors derived from the same network behavior sample under the condition of sample repulsion constraint, and the sample repulsion constraint is to maximize the distance between the corresponding modal feature vectors derived from different network behavior samples;

[0095] The network behavior classification module 400 is used for fusing the first modal feature vectors, the second modal feature vectors and the third modal feature vectors obtained after training to generate a fusion feature vector, and classifying the network behavior samples based on the fusion feature vector.

[0096] The network behavior representation learning system based on cross-modal alignment in the embodiments of the present application can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. Exemplarily, the mobile electronic device can be a mobile phone, tablet computer, notebook computer, palm computer, vehicle-mounted electronic device, wearable device, Ultra-mobile Personal Computer (UMPC), netbook, or Personal Digital Assistant (PDA), and the non-mobile electronic device can be a server, Network Attached Storage (NAS), Personal Computer (PC), and the like, which are not limited in the embodiments of the present application.

[0097] The network behavior representation learning system based on cross-modal alignment in the embodiments of the present application can be a device with an operating system. The operating system can be an Android operating system, an IOS operating system, or other possible operating systems, which are not limited in the embodiments of the present application.

[0098] The network behavior representation learning system based on cross-modal alignment provided in the embodiments of the present application can implement Figure 1 The processes implemented by the network behavior representation learning method based on cross-modal alignment in the method embodiment are not repeated here to avoid repetition.

[0099] Optionally, the embodiments of the present application further provide an electronic device, which includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor. The program or instructions are executed by the processor to implement the processes of the network behavior representation learning method based on cross-modal alignment in the embodiments of the present application, and achieve the same technical effects. The processes are not repeated here to avoid repetition.

[0100] The embodiments of the present application further provide a readable storage medium having a program or instructions stored thereon. The program or instructions are executed by a processor to implement the processes of the network behavior representation learning method based on cross-modal alignment in the embodiments of the present application, and achieve the same technical effects. The processes are not repeated here to avoid repetition.

[0101] The processor is the processor in the electronic device in the embodiments of the present application. The readable storage medium includes a computer readable storage medium, such as a computer Read-Only Memory (ROM), Random Access Memory (RAM), magnetic disc, or optical disc.

[0102] It has to be noted that, as used herein, the terms "includes" and / or "contains", or any other tautological variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements is not limited to those elements, but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. In other words, without further restriction, the element defined by the phrase "comprising a" does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element. Furthermore, it is pointed out that the scope of the methods and apparatus of the present embodiments is not limited to performing functions in the order recited or discussed, but can include performing functions in a substantially simultaneous manner or in the reverse order, e.g., the described methods can be performed in a different order than described, and various steps can be added, omitted, or combined, and features described with respect to certain examples can be combined in other examples.

[0103] From the above description of the embodiments, it is apparent that the above-described method of the embodiments can be realized by means of software plus necessary universal hardware platforms, and of course, can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such an understanding, the technical solutions of the present application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions to make a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) execute the methods described in the various embodiments of the present application.

[0104] The embodiments of the present application are described above in conjunction with the drawings, but the present application is not limited to the above-described specific embodiments, which are merely illustrative, not restrictive, and a person of ordinary skill in the art can make many forms under the inspiration of the present application without departing from the scope of the present application and the protection scope of the claims.

Claims

1. A network behavior representation learning method based on cross-modal alignment, characterized in that, Includes the following steps: Obtain network behavior samples, and extract statistical feature data, packet length sequence data, and payload byte sequence data from the network behavior samples; Using an independent feature extraction network, the statistical feature data, the packet length sequence data, and the payload byte sequence data are respectively mapped into a first modality feature vector, a second modality feature vector, and a third modality feature vector in a shared semantic space; The independent feature extraction network is trained based on a joint loss function. During training, modality alignment is applied. Modality alignment, based on a sample exclusion constraint, minimizes the pairwise distances between the first modality feature vector, the second modality feature vector, and the third modality feature vector originating from the same network behavior sample. The sample exclusion constraint maximizes the distance between corresponding modality feature vectors originating from different network behavior samples. The joint loss function is obtained by weighted summing of the classification loss, the intra-group modality alignment loss used to implement the modality alignment constraint, and the inter-group modality exclusion loss used to implement the sample exclusion constraint. The intra-group modal alignment loss is calculated as follows: for the same network behavior sample, calculate the first cosine distance between the first modal feature vector and the second modal feature vector, the second cosine distance between the first modal feature vector and the third modal feature vector, and the third cosine distance between the second modal feature vector and the third modal feature vector; sum the first cosine distance, the second cosine distance, and the third cosine distance to obtain the intra-group modal alignment loss. The inter-group modal repulsion loss is calculated as follows: For two different network behavior samples, calculate the fourth cosine distance between the first modality feature vectors, the fifth cosine distance between the second modality feature vectors, and the sixth cosine distance between the third modality feature vectors; sum the fourth cosine distance, the fifth cosine distance, and the sixth cosine distance to obtain the sum of distances, and then subtract the sum of distances using a preset margin parameter to obtain the inter-group modal repulsion loss; The first modality feature vector, the second modality feature vector, and the third modality feature vector obtained after training are fused to generate a fused feature vector, and the network behavior samples are classified based on the fused feature vector.

2. The network behavior representation learning method based on cross-modal alignment according to claim 1, characterized in that, The step of mapping the statistical feature data, the packet length sequence data, and the payload byte sequence data into a first modality feature vector, a second modality feature vector, and a third modality feature vector in a shared semantic space using independent feature extraction networks includes: The statistical feature data is processed using a multilayer perceptron network to generate the first modality feature vector; The packet-length sequence data is processed using a sequence processing network that includes an embedding layer and a bidirectional long short-term memory network to generate the second modality feature vector; The payload byte sequence data is processed using a local feature extraction network that includes an embedding layer, a one-dimensional convolutional network, and a global max pooling layer to generate the third modality feature vector.

3. The network behavior representation learning method based on cross-modal alignment according to claim 1, characterized in that, Following the steps of extracting statistical feature data, packet length sequence data, and payload byte sequence data from the network behavior samples, the method further includes: Preprocessing of the statistical feature data, the packet length sequence data, and the payload byte sequence data includes: The statistical feature data are subjected to Z-score standardization. The length of the packet length sequence data is normalized to a first preset length, and the range of packet length values ​​is limited. The length of the payload byte sequence data is normalized to a second preset length, and zero padding is applied to any insufficient sequence portions.

4. The network behavior representation learning method based on cross-modal alignment according to claim 1, characterized in that, The steps for classifying the network behavior samples based on the fused feature vector include: The first modality feature vector, the second modality feature vector, and the third modality feature vector are mapped to the fused feature vector through a fusion module that includes a fully connected layer, a batch normalization layer, and a Dropout layer. The fused feature vector is input into a classifier containing a fully connected layer and a Softmax activation function to output the class probability distribution of the network behavior samples.

5. A network behavior representation learning system based on cross-modal alignment, characterized in that, include: The data acquisition module is used to acquire network behavior samples and extract statistical feature data, packet length sequence data and payload byte sequence data from the network behavior samples; The feature extraction module is used to map the statistical feature data, the packet length sequence data, and the payload byte sequence data into a first modality feature vector, a second modality feature vector, and a third modality feature vector in a shared semantic space using an independent feature extraction network. A cross-modal alignment module is used to train the independent feature extraction networks based on a joint loss function. The training process applies modal alignment, which is achieved by minimizing the pairwise distances between the first modal feature vector, the second modal feature vector, and the third modal feature vector originating from the same network behavior sample, under a sample exclusion constraint. The sample exclusion constraint maximizes the distance between corresponding modal feature vectors originating from different network behavior samples. The joint loss function is obtained by weighted summing of the classification loss, the intra-group modal alignment loss used to implement the modal alignment constraint, and the inter-group modal exclusion loss used to implement the sample exclusion constraint. The intra-group modal alignment loss is calculated as follows: for the same network behavior sample, the first modal feature vector and the second modal feature vector are calculated... The intra-group modal alignment loss is calculated by summing the first cosine distance between the first modal feature vector and the third modal feature vector, the second cosine distance between the first modal feature vector and the third modal feature vector, and the third cosine distance between the second modal feature vector and the third modal feature vector. The inter-group modal repulsion loss is calculated as follows: for two different network behavior samples, the fourth cosine distance between the first modal feature vectors, the fifth cosine distance between the second modal feature vectors, and the sixth cosine distance between the third modal feature vectors are calculated. The fourth cosine distance, the fifth cosine distance, and the sixth cosine distance are summed to obtain the sum of distances, and then the sum of distances is subtracted using a preset margin parameter to obtain the inter-group modal repulsion loss. The network behavior classification module is used to fuse the first modality feature vector, the second modality feature vector and the third modality feature vector obtained after training to generate a fused feature vector, and to classify the network behavior samples based on the fused feature vector.

6. An electronic device, characterized in that, It includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein when the program or instructions are executed by the processor, they implement the steps of a network behavior representation learning method based on cross-modal alignment as described in any one of claims 1-4.

7. A readable storage medium, characterized in that, The program or instructions are stored on the readable storage medium, and when the program or instructions are executed by the processor, they implement the steps of the network behavior representation learning method based on cross-modal alignment as described in any one of claims 1-4.

Images