Network attack pattern recognition method based on equidistant immersion kernel function learning

Abstract

The invention relates to an information security technology, and provides a network attack pattern recognition method based on isometric immersion kernel function learning, which comprises the following steps of: firstly constructing geometric representation for network behavior data by using an isometric immersion kernel function, and then extracting characteristics capable of quantifying a network behavior form from the constructed geometric representation of the network behavior data; the equidistant immersion kernel function model is used for explicitly maintaining an inner product structure of non-Euclidean discrete data in a manifold representation construction process by introducing a learnable tangent space kernel function into the neural network model; according to the method, the most essential geometrical relationship in complex and nonlinear network behavior data is compressed into a low-dimensional space more suitable for machine learning model processing in a lossless or low-loss manner, the essential form of the attack behavior is accurately and stably captured in the complex and confrontation-full data, the sensitivity of attack pattern recognition is improved, and the recognition efficiency is improved. Therefore, the recognition accuracy is improved.

Description

Technical Field

[0001] This invention belongs to the field of information security, and specifically relates to network attack pattern recognition technology based on kernel function learning. Background Technology

[0002] Network behavior data possesses a complex, high-dimensional structure, containing various characteristics of attack behaviors. By extracting geometric structural representations, this high-dimensional data can be mapped to a low-dimensional space while preserving key geometric information such as the inner product relationships between vectors and topological structure. This geometric information can more intuitively reflect the essential characteristics of attack behaviors. For example, certain attack behaviors may cause specific deformations or anomalous clustering in the geometric structure of network traffic data. By capturing these geometric changes, attack patterns can be identified more accurately.

[0003] In high-dimensional network behavior data, noise and data diversity can interfere with the identification of attack patterns. Geometric representation, however, provides a stable feature representation that is unaffected by minute changes in the specific values ​​of the data, focusing only on the inherent geometric relationships within the data. For example, network intrusion detection methods based on dynamic multi-scale topological representation can enhance detection performance and improve the ability to detect network intrusions by extracting hidden topological patterns and geometric information from the data, thereby reducing the dimensionality of the detection model's input.

[0004] However, current cyberattack data, such as high-dimensional interaction logs, cannot fill the entire high-dimensional space regardless of how densely sampled. Therefore, it inherently possesses non-Euclidean geometric properties, and can be understood as a low-dimensional manifold structure existing in a high-dimensional space. Its geometric relationships cannot be accurately characterized using linear metrics in Euclidean space (such as Euclidean distance). Therefore, when performing dimensionality reduction, embedding, or modeling on cyberattack data, using traditional Euclidean assumptions can easily lead to geometric distortions, topological breaks, or physical quantity distortions, thereby affecting the accuracy and interpretability of downstream tasks such as classification, reconstruction, and anomaly detection.

[0005] To address the challenge of representing the non-Euclidean geometric properties of cyberattack behavior data, numerous geometry-preserving representation learning models based on manifold learning and kernel methods have emerged in recent years. These methods emphasize preserving the local or global geometric structure of the original data during the mapping process, with particular focus on maintaining physically meaningful geometric quantities such as distance, angle, and inner product. Kernel functions, in particular, implicitly map data from the input space to a high-dimensional feature space, becoming a crucial foundation for nonlinear structural modeling.

[0006] Traditional neural networks struggle to directly process the geometric structures of non-Euclidean discrete data because their tensor operations based on Euclidean space are ill-suited for modeling the implicit nonlinear geometric relationships within the data, such as manifold curvature, neighborhood angles, and local isometry.

[0007] Data on cyberattack behavior trajectories has complex spatial relationships. If the geometric relationships between the original vectors cannot be preserved during the mapping process, it will seriously affect the accuracy and interpretability of the model's representation.

[0008] Therefore, current methods for attack pattern recognition using kernel function learning still face challenges:

[0009] 1. Kernel functions are usually defined based on Euclidean distance, which cannot naturally adapt to manifold structures or preserve geometric properties in non-Euclidean spaces.

[0010] 2. Kernel function design heavily relies on prior knowledge or manual parameter tuning. Because traditional kernel methods rely on a fixed, pre-defined form, modeling may fail if the kernel function does not match the data's geometric structure or distribution.

[0011] 3. Lack of a unified parameterized learning mechanism to adapt to complex structural scenarios. Although some deep kernel learning methods have attempted to learn kernel functions using neural networks, these methods often fail to incorporate geometric prior knowledge, such as inner product preservation or isometric mapping principles, resulting in weak geometric interpretability and limited model generalization ability.

[0012] The above challenges result in poor accuracy in current attack pattern recognition based on kernel function learning. Summary of the Invention

[0013] The technical problem to be solved by the present invention is to provide a method that can accurately and stably maintain the geometric structure of network attack behavior data in a low-dimensional space, especially the kernel function of the inner product relationship between vectors in the tangent space, thereby improving the data representation capability of captured network attack behavior and thus more accurately identifying network attack behavior.

[0014] The technical solution adopted by this invention to solve the above-mentioned technical problems is a network attack pattern recognition method based on equidistant immersion kernel function learning, comprising the following steps:

[0015] Data preprocessing steps: Collect network behavior data and perform preprocessing;

[0016] The isometric immersion kernel function processing steps are as follows: The preprocessed network behavior data is input into the isometric immersion kernel function model for processing. The isometric immersion kernel function model first constructs a geometric representation of the network behavior data, mapping each independent network behavior event to a point in a high-dimensional feature space; then, it extracts network behavior features that can quantify the network behavior pattern from the constructed geometric representation of the network behavior data. The isometric immersion kernel function model is used to explicitly preserve the inner product structure of non-Euclidean discrete data in the manifold representation construction process by introducing a learnable tangent space kernel function into the neural network model.

[0017] Machine learning model training and recognition steps: The features of the extracted network behavior data are input into the neural network classifier for supervised learning. By learning the geometric feature patterns corresponding to different network attack types, the attack pattern classification and recognition are completed.

[0018] The beneficial effects of this invention are that, by using an isometric immersion kernel function, it can maintain the inner product structure of the original high-dimensional manifold data tangent space in a low-dimensional feature space. This allows for the lossless or low-loss compression of the most essential geometric relationships in complex, nonlinear network behavior data into a low-dimensional space that is more suitable for machine learning models. In complex and adversarial data, it can accurately and stably capture the essential form of attack behavior, improve the sensitivity of attack pattern recognition, and thus improve recognition accuracy. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the processing flow of the isometric immersion kernel function model of the present invention. Detailed Implementation

[0020] This example targets network behavior data that has been tagged, with tags including normal traffic, DDoS attacks, and port scans. Attack pattern identification includes the following steps:

[0021] Data preprocessing steps: Collect network behavior data, such as network flow data, firewall logs, system logs, packet PCAP, etc.; perform standardization processing on this network behavior data, such as noise reduction, handling missing values, standardizing IP addresses and port numbers, and unifying timestamps;

[0022] The isometric immersion kernel function processing steps are as follows: Preprocessed network behavior data is input into the isometric immersion kernel function model for processing. The model first constructs a geometric representation of the network behavior data, mapping each independent network behavior event, such as a flow record or a log entry, to a point in a high-dimensional feature space. Then, features that can quantify network behavior patterns are extracted from the constructed geometric representation of the network behavior data. The isometric immersion kernel function can better preserve the similarity of flow patterns in high-dimensional geometric representations, making it an end-to-end neural network model. This invention proposes a geometry-preserving representation learning method based on the isometric immersion kernel function IIK. The core idea is to introduce a learnable tangent space kernel function into the neural network model, thereby explicitly preserving the inner product structure of non-Euclidean discrete data in the manifold representation construction process.

[0023] Machine learning model training and recognition steps: Supervised learning is performed using the features of network behavior data. A neural network classifier is used to learn the geometric feature patterns corresponding to different attack types, thereby completing the attack pattern classification and recognition.

[0024] This invention focuses on feature extraction from network behavior data, specifically how to use an isometric immersion kernel function model to extract features that can quantify network behavior patterns.

[0025] Isometric immersion kernel function model, such as Figure 1 As shown, it includes an immersion module and an isometric kernel learning module;

[0026] The immersion module employs an autoencoder structure to establish an invertible mapping between the original high-dimensional data space and the low-dimensional manifold space, ensuring that this mapping satisfies the immersion condition in the local neighborhood, thus realizing the immersion from the high-dimensional data space. to low-dimensional manifold space The representation is embedded while maintaining the continuity of local geometric topology.

[0027] An autoencoder includes an encoder and a decoder. For encoder mapping functions, For decoder mapping function, These are the learnable parameters of the autoencoder.

[0028] The encoder is used to determine the content based on the data. Network behavior data corresponding to a network behavior event Encoding as latent space representation As a geometric representation of network behavior data These are the learnable parameters of the autoencoder. ;

[0029] The decoder is used to determine the content based on the data. Characterizing latent space Reconstructed network behavior data , .

[0030] To ensure approximate immersion in the mapping, a reconstruction loss is added as the original immersion module loss function during the immersion module training process. :

[0031] ;

[0032] in, Represents the high-dimensional data space Calculate the expectation of a sample from the distribution.

[0033] Through the immersion module, the model can provide a smooth differentiable mapping that approximately satisfies the immersion condition of the manifold and preserves the topological relationships between points.

[0034] The isometric kernel learning module constructs a kernel function in the sample tangent space, outputting a manifold metric tensor as the extracted network behavior features. This function preserves the vector inner product between samples, achieving the transfer and preservation of geometric information, i.e., within the manifold... any point above tangent space Inside, among which This refers to the tangent space notation. The isometric kernel learning module uses kernel functions... To keep the vector dot product unchanged:

[0035] ;

[0036] ;

[0037] in, Equivalent to tangent space Cut space It is a linear space that contains all points. Location and manifold Tangent vectors, subscript Representing kernel function It is in the tangent space Defined in Indicates identity, kernel function Its function is to measure the two vectors sampled in the tangent space. and A certain degree of similarity or association between them. Representation space Inner product operations, For mapping processing, it will cut the space. vectors in and Mapped to another space In the middle, space For the target space, It is the mapped vector and In space The inner product in the kernel function is obtained through the kernel function. Make the tangent space The inner product relation of vectors, after mapping, is in space It was thus preserved. It is the derivative of the mapping from the tangent space to the original space, i.e., the tangent mapping. This represents a metric based on the tangent mapping. It is the metric tensor on the induced characterization manifold. Represents the use of metric tensors To calculate the tangent space Mid-vector and The geometric relationship is also equal to the kernel function. This demonstrates that the preservation or related calculation of the inner product of vectors in the tangent space can also be achieved by using a metric tensor.

[0038] The tangent space kernel function described above This allows the inner product of the tangent vectors to remain unchanged, thus preserving the geometric structure information on the manifold.

[0039] In practice, the kernel function is pulled back from the isometric kernel learning module. Calculated These are the learnable parameters in the isometric kernel learning module; Represents tangent space Within, defined in the tangent space metric tensor on for:

[0040] ;

[0041] Among them, superscript For matrix transpose, For the cutting mapping operator, the induced metric tensor is ensured through the above product operation. The symmetry is satisfied, thus correctly defining the inner product relationship of vectors in the tangent space.

[0042] Constructing an isometric loss function as the original isometric kernel learning module loss function The difference between the learned kernel function and the inner product of the original space is measured.

[0043] ;

[0044] in, express For tangent space A point, Representing the tangent space point Seeking expectations, This represents the inner product operation. The isometric loss function is essentially equivalent to fitting a kernel function in the tangent space that preserves the inner product, thereby ensuring that the geometric structure between samples is not distorted during dimensionality reduction.

[0045] Furthermore, by introducing soft duality structure separation, the pullback mapping is pulled back. As a mapping function with the decoder The dual mapping. Theoretically, this pull-back mapping. Mapping function with decoder It should be a transposed dual, but directly forcing a dual relationship can easily lead to training difficulties.

[0046] Therefore, this invention designs two soft dual losses to guide but not enforce their consistency:

[0047] The positive dual loss used from decoding to pullback:

[0048] ;

[0049] The inverse dual loss used for pulling back to decoding:

[0050] ;

[0051] in, It represents the square of the L2 norm, used to measure the size of a vector.

[0052] By employing a two-way weakly coupled constraint method, the training stability of the network in complex structural spaces is significantly improved, while maintaining consistency with geometric theory.

[0053] The entire isometric immersion kernel model uses maximum likelihood estimation (MLE) as the training objective. The learnable parameters in the immersion module and the isometric kernel learning module are alternately optimized by the expectation-maximization (EM) algorithm to improve the stability and convergence of the model, and finally obtain a kernel function representation with geometry preservation capability.

[0054] The specific steps of the joint optimization framework based on maximum likelihood estimation (MLE) and the parameter update using the EM algorithm are as follows:

[0055] E-step (Expectation): Fixed isometric kernel learning module parameters By minimizing the optimized immersion module loss function Update decoder parameters :

[0056] ;

[0057] M-step (Maximization): Fixing decoder parameters The module loss function is learned by minimizing the optimized isometric kernel. Update the parameters of the isometric kernel learning module :

[0058] ;

[0059] in, , , All of these cases exceeded the allowed penalty levels. The loss function of the original immersion module. This is the loss function for the original isometric kernel learning module.

[0060] The objective function of the final isometric immersion kernel model is:

[0061] ;

[0062] This means that the learnable parameters of the decoder are obtained by minimizing the objective function. , This indicates that the learnable parameters of the isometric kernel learning module are obtained by minimizing the objective function. .

[0063] The above training mechanism ensures that each optimization step is aimed at the objective function of the current module, thereby improving the overall system's controllability, stability, and convergence efficiency.

[0064] The training process of the isometric immersion kernel model is as follows:

[0065] 1) Input discrete network behavior dataset Initialize the encoder decoder and soft dual pullback mapping parameters and Setting hyperparameters , , ;

[0066] 2) If the number of iterations in the outer loop is less than the maximum number of iterations, then execute steps 2-1) to 2-4); otherwise, proceed to step 3).

[0067] 2-1) Network behavior data corresponding to a network behavior event Input encoder to obtain latent representation ;

[0068] 2-2) In the potential space The neighborhood of the vector is sampled in the tangent space to obtain the vector. ;

[0069] 2-3) In the inner loop, if the number of iterations of the inner loop is less than the maximum number of iterations max_iter_imm, then execute steps 2-3-1) to 2-3-3); otherwise, enter another inner loop 2-4).

[0070] 2-3-1) Discrete network behavior datasets Data in ,vector Input Decoder ,get , ;

[0071] 2-3-2) Calculation

[0072] 2-3-3) Update parameters using the adaptive moment estimation ADAM optimizer. After updating the current inner loop count, proceed to steps 2-4);

[0073] 2-4) In another inner loop, if the number of iterations is less than the maximum number of iterations at equal intervals (max_iter_iso), then execute steps 2-4-1) to 2-4-3); otherwise, update the outer loop iterations and return to step 2).

[0074] 2-4-1) Calculate the metric tensor based on the pullback mapping: ;

[0075] 2-4-2) Calculation ;

[0076] 2-4-3) Update parameters using the ADAM optimizer And update the current inner loop count, then proceed to steps 2-3);

[0077] 3) Return the encoder mapping after training is complete. decoder mapping and pullback mapping Output manifold metric tensor As features of the extracted network behavior data.

[0078] The features of the network behavior data are then used as input to a neural network classifier that has learned geometric feature patterns corresponding to different types of network attacks to learn and classify network attack patterns.

[0079] By isolating the collaborative work of various structures within the kernel function model at equal intervals, the model is endowed with the following important capabilities for engineering scenarios:

[0080] Inner product preservation capability for non-Euclidean data: The model explicitly guarantees that the inner product of vector pairs in the tangent space of any manifold remains unchanged, thereby preserving key geometric structures such as angles and distance relationships during the mapping process, providing clear physical interpretation.

[0081] Automatic kernel function learning capability: No longer relying on manual design or experience-based parameter tuning, the parameterized neural network model automatically learns the kernel function representation that best suits the current task and structure in the tangent space, adapting to different types of non-Euclidean data.

[0082] Highly compatible end-to-end neural implementation: The overall framework is built on neural networks, supports deployment on mainstream deep learning platforms, is easy to integrate with existing task models (such as reconstruction networks and classification networks), and has good engineering implementation capabilities.

[0083] Enhanced generalization ability due to geometric structure: Thanks to the geometric constraints in the kernel function construction process, this model can still output a consistent geometric representation under conditions such as changes in data distribution, local perturbations, and missing point clouds, and has strong robustness and interpretability.

[0084] Compared to other network attack pattern classification and identification technologies based on kernel functions, the present invention includes:

[0085] 1. Improves generalization ability by not relying on explicit manifold assumptions.

[0086] Many traditional manifold learning methods are typically based on explicit manifold structure assumptions (such as global isometric or local linear approximations) and rely on the construction of manifold graphs. These methods are susceptible to sampling sparsity, noise, and boundary effects when dealing with high-dimensional discrete non-Euclidean data, leading to geometric distortions. In contrast, the method proposed in this invention does not require explicit specification of the manifold distribution for representation. It learns the latent space and its tangent space structure end-to-end based on a neural network, preserving the inner product structure between points through kernel functions, thus exhibiting stronger adaptability and generalization ability.

[0087] 2. Explicitly construct isometric kernel functions to enhance geometry preservation capabilities.

[0088] While existing kernel methods can parameterize kernel functions through neural networks, most do not explicitly model their geometric meaning, often treating the kernel function as an optimization aid rather than the core of expressing the geometric structure. This invention, however, starts from geometric theory, formalizing "tangent space inner product preservation" as a kernel function construction constraint, and proposing an isometric kernel function that explicitly represents geometric relationships. This kernel function can explicitly characterize the "inner product metric similarity" relationship between samples in non-Euclidean space, thereby more effectively preserving geometric properties such as curvature, angle, and scale.

[0089] 3. Soft duality mechanism addresses training instability, improving convergence and practicality.

[0090] In many kernel-mapping-based deep models, the kernel function and the encoding function need to maintain mathematical duality. However, in actual training, this strongly coupled structure often leads to training oscillations or difficulty in convergence. This invention introduces a soft duality structure, which decouples the pullback mapping of the kernel function from the parameters of the decoding function and introduces bidirectional soft constraint terms. This design significantly improves the stability and tunability of training while preserving geometric consistency, and is suitable for complex structured data and large-scale training tasks.

[0091] 4. Supports end-to-end training and module integration, with good engineering deployability.

[0092] Traditional kernel methods are often independent of deep models, requiring manual design, parameter tuning, and even pre-training, resulting in separation in practical use and high maintenance costs.

[0093] The IIK model designed in this invention possesses a complete neural network structure and a unified optimization process, and can be deployed in mainstream deep learning frameworks (such as PyTorch and TensorFlow), supporting end-to-end training. Furthermore, its kernel function module, immersion module, and pull-back module can all be independently integrated into existing models (such as point cloud reconstruction, graph neural networks, VAE structures, etc.), exhibiting high engineering reusability.

[0094] This invention explicitly preserves the geometric structure of the data during dimensionality reduction by constructing a kernel function in the tangent space to maintain the invariance of the vector inner product. To verify this capability, two types of metrics were designed in the experiment: Isometry Preservation Loss, which measures the change in sample distance before and after dimensionality reduction; and Conformal Preservation Loss, which measures the degree of preservation of angular relationships before and after dimensionality reduction. The results were compared with several representative methods (including t-SNE, UMAP, ISOMAP, PaCMAP, CAMEL, DTR_AE, etc.) on two high-dimensional network security datasets, CIC-DDoS2019 and CIC-IDS2018. Experimental results show that IIK reduces the isotry preservation loss by an average of 71.15%–74.02% and the conformal preservation loss by 89.03%–96.84%, significantly outperforming all compared methods.

Claims

1. A network attack pattern recognition method based on equidistant immersion kernel function learning, characterized in that, Including the following steps: Data preprocessing steps: Collect network behavior data and perform preprocessing; Isometric immersion kernel function processing steps: The preprocessed network behavior data is input into the isometric immersion kernel function model for processing. The isometric immersion kernel function model first constructs the geometric representation of the network behavior data, that is, maps each independent network behavior event to a point in a high-dimensional feature space. Then, network behavior features that can quantify network behavior patterns are extracted from the geometric representation of the constructed network behavior data; The isometric immersion kernel function model is used to explicitly preserve the inner product structure of non-Euclidean discrete data in the manifold representation construction process by introducing a learnable tangent space kernel function into the neural network model. Machine learning model training and recognition steps: The features of the extracted network behavior data are input into the neural network classifier for supervised learning. By learning the geometric feature patterns corresponding to different network attack types, the attack pattern classification and recognition are completed.

2. The method as described in claim 1, characterized in that, The isometric immersion kernel function model includes an immersion module and an isometric kernel learning module; The immersion module employs an autoencoder structure to enable immersion from high-dimensional data space. to low-dimensional manifold space The representation embedding serves as a geometric representation of network behavior data while maintaining local geometric topological continuity; The isometric kernel learning module is used to construct kernel functions in the sample tangent space and output manifold metric tensors as extracted network behavior features; Kernel functions are used for operations on manifolds any point above tangent space Two vectors obtained from internal sampling and Through kernel function Preserving Vector and The inner product remains unchanged, where, This is the symbol for the tangent space.

3. The method as described in claim 2, characterized in that, An autoencoder structure includes an encoder and a decoder. For encoder mapping functions, For decoder mapping function, These are the learnable parameters of the autoencoder; Encoder is used for Network behavior data corresponding to a network behavior event Encoding as latent space representation As a geometric representation , , ; Decoder is used to use Characterizing latent space Reconstructed network behavior data , These are the learnable parameters in the isometric kernel learning module; ; Shear space kernel function Pullback mapping function in the isometric kernel learning module get, , For learnable parameters in the isometric kernel learning module, ,in, Equivalent to tangent space , For transpose, This is the cutting mapping operator.

4. The method as described in claim 3, characterized in that, The objective function of the isometric immersion kernel model is : ； in, This means that the learnable parameters of the decoder are obtained by minimizing the objective function. , This indicates that the learnable parameters of the isometric kernel learning module are obtained by minimizing the objective function. , For the immersion module loss function, The loss function for the equidistant kernel learning module; ； ； in, , , All of these cases exceeded the allowed penalty levels. The loss function of the original immersion module. The loss function for the original isometric kernel learning module is... The positive dual loss from decoding to pullback, This is the inverse dual loss from pull-back to decoding.

5. The method as described in claim 4, characterized in that, Original Immersion Module Loss Function : ； in, Represents the high-dimensional data space Calculate the expectation of a sample from the distribution.

6. The method as described in claim 5, characterized in that, Original isometric kernel learning module loss function : ； in, express For tangent space A point, Representing the tangent space point Seeking expectations, This indicates the inner product operation.

7. The method as described in claim 6, characterized in that, The positive dual loss from decoding to pullback : ； The inverse dual loss from pull-back to decoding : ； in, This represents the square of the L2 norm.

8. The method as described in claim 1, characterized in that, The network behavior data includes network flow data, firewall logs, system logs, and packet PCAPs.

Images