Network traffic detection method and device, electronic equipment and storage medium

Abstract

The invention relates to the technical field of network security, in particular to a network traffic detection method and device, electronic equipment and a storage medium, which are used for improving the accuracy of network traffic detection. The method comprises the following steps: dividing network traffic to be detected into at least one session according to session information; aiming at each session, respectively executing the following steps: aiming at each load characteristic category in a plurality of load characteristic categories, extracting the load characteristics of each data packet in the session from each characteristic dimension related to the load characteristic category so as to form a plurality of data packet load characteristic sets corresponding to the session; each data packet load feature set comprises load features of each data packet under one feature dimension; aggregating the load characteristics of the data packets to obtain aggregation characteristics corresponding to the session; the aggregation features are used for comprehensively representing load feature distribution conditions of the session under different feature dimensions; and inputting the aggregation feature into a traffic detection model, so as to carry out malicious traffic detection on the session through the traffic detection model.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a network traffic detection method, apparatus, electronic device, and storage medium. Background Technology

[0002] In the field of cybersecurity, with the rapid development of information technology, the internet has penetrated every corner of human society, drastically changing people's lives and work. However, the widespread use of the internet has also brought increasingly serious cybersecurity problems. Cyberattack methods are becoming more diversified and covert, posing a serious threat to personal privacy, corporate interests, and even national security.

[0003] Against this backdrop, network intrusion detection technology has become one of the key lines of defense for ensuring network security. Traditional intrusion detection technologies mainly rely on session-level statistical characteristics, identifying potential attack behaviors by analyzing session data in network traffic. However, this method has significant limitations:

[0004] First, the granularity of session statistics features is relatively coarse, lacking in-depth analysis of packet payload content, which makes it impossible to fully describe the behavioral patterns of traffic and difficult to accurately identify attack traffic with high concealment and complex behavioral characteristics.

[0005] In conclusion, improving the accuracy of network traffic detection is an urgent issue that needs to be addressed. Summary of the Invention

[0006] This application provides a network traffic detection method, apparatus, electronic device, and storage medium to improve the accuracy of network traffic detection.

[0007] This application provides a network traffic detection method, including:

[0008] The network traffic to be detected is divided into at least one session according to session information; for each session, the following operations are performed:

[0009] For each of the multiple load feature categories, load features of each data packet in the session are extracted from each feature dimension related to the load feature category to form multiple data packet load feature sets corresponding to the session; wherein, each data packet load feature set includes: the load features of each data packet in the session under one of the feature dimensions;

[0010] The load features of each data packet in the load feature set are aggregated to obtain the aggregated feature corresponding to the session; the aggregated feature is used to comprehensively characterize the load feature distribution of the session under different feature dimensions;

[0011] The aggregated features are input into the traffic detection model to detect malicious traffic in the session.

[0012] This application provides a network traffic detection device, comprising:

[0013] A segmentation unit is used to divide the network traffic to be detected into at least one session according to session information; for each session, the following operations are performed:

[0014] An extraction unit is configured to extract the load features of each data packet in the session from each feature dimension related to the load feature category for each of the multiple load feature categories, so as to form multiple data packet load feature sets corresponding to the session; wherein, each data packet load feature set includes: the load features of each data packet in the session under one of the feature dimensions;

[0015] The aggregation unit is used to aggregate the load features of each data packet in the load feature set to obtain the aggregated features corresponding to the session; the aggregated features are used to comprehensively characterize the load feature distribution of the session under different feature dimensions.

[0016] The detection unit is used to input the aggregated features into the traffic detection model so as to detect malicious traffic in the session through the traffic detection model.

[0017] Optionally, the plurality of load feature categories includes a load size category, and the feature dimensions related to the load size category are multiple different protocol layer dimensions; then the extraction unit is used for:

[0018] Under each of the aforementioned protocol layer dimensions, the following operations are performed respectively:

[0019] At a protocol layer level, determine the payload size of each data packet in the session at the corresponding protocol layer;

[0020] The payload sizes determined at the aforementioned protocol layer dimension are used to form the packet payload feature set corresponding to the session at that protocol layer dimension.

[0021] Optionally, the plurality of load feature categories include load content categories, and the feature dimensions related to the load content categories are multiple different first statistical dimensions; then the extraction unit is used for:

[0022] Under each of the first statistical dimensions, perform the following operations:

[0023] Under a first statistical dimension, the core statistical values ​​corresponding to the core payload content of each data packet in the session are extracted respectively; wherein, the core payload content of a data packet is: the payload field content of the data packet at the highest resolvable protocol layer;

[0024] The core statistical values ​​extracted under the first statistical dimension are used to form the packet load feature set of the session corresponding to the first statistical dimension.

[0025] Optionally, when the first statistical dimension is an information entropy dimension, and the core statistical value is an entropy value, the extraction unit is used to obtain the entropy value corresponding to the core payload content of a data packet in the following manner:

[0026] Encode each field in the core payload of the data packet to obtain the encoded value sequence corresponding to the data packet;

[0027] Each coded value in the coded value sequence is divided into multiple preset discrete intervals;

[0028] For each discrete interval, perform the following operations:

[0029] Determine the frequency of occurrence of each coded value in a discrete interval;

[0030] Based on the determined frequencies of occurrence and the total length of the encoded value sequence, the probability parameter corresponding to the discrete interval is calculated;

[0031] Based on the probability parameters, calculate the entropy components of the discrete interval;

[0032] The sum of the entropy components corresponding to each discrete interval is taken as the entropy value of the data packet in the information entropy dimension.

[0033] Optionally, the plurality of load feature categories include load process categories, and the feature dimensions related to the load process categories are multiple different process control dimensions; then the extraction unit is used for:

[0034] Under each of the aforementioned process control dimensions, the following operations shall be performed:

[0035] Under one flow control dimension, extract the flow control field values ​​corresponding to each data packet in the session;

[0036] The values ​​of each flow control field extracted under the aforementioned flow control dimension are used to form the packet payload feature set corresponding to the session under that flow control dimension.

[0037] Optionally, the process control dimensions include some or all of the following: Transmission Control Protocol (TCP) acknowledgment number, TCP sequence number, TCP flags, TCP window size, Internet Control Message Protocol (ICMP) type, and Internet Group Management Protocol (IGMP) type.

[0038] Optionally, the aggregation unit is used for:

[0039] For each packet load feature set, extract the load features of each packet in the packet load feature set, and the corresponding session statistics under different second statistical dimensions;

[0040] Multiple session statistics corresponding to each data packet load feature set are concatenated to obtain the aggregated feature corresponding to the session.

[0041] Optionally, the extraction unit is used for:

[0042] Based on the direction of data packets during network transmission, the data packets in the session are divided into two categories. One category corresponds to the direction in which the source port sends data packets to the target port in the session, and the other category corresponds to the direction in which the target port responds to the source port in the session.

[0043] For each type of data packet, perform the following operations:

[0044] For each load feature category among multiple load feature categories, load features of each data packet in a class of data packets are extracted from each feature dimension related to the load feature category to form multiple data packet load feature sets corresponding to that class of data packets in the session.

[0045] Optionally, the partitioning unit is used for:

[0046] By parsing and segmenting the network traffic to be detected, multiple data packets and session information corresponding to each data packet are obtained; the session information includes session 5-tuple information and time information;

[0047] Based on the session 5-tuple information of each of the multiple data packets, create at least one session identifier;

[0048] Among the multiple data packets, those belonging to the same session identifier are grouped into the same session;

[0049] Based on the time information, data packets that exceed a preset time window in the same session are discarded.

[0050] An electronic device provided in this application includes a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of any of the above-described network traffic detection methods.

[0051] This application provides a computer-readable storage medium including a computer program. When the computer program is run on an electronic device, the computer program is used to cause the electronic device to perform the steps of any of the above-described network traffic detection methods.

[0052] This application provides a computer program product, which includes a computer program stored in a computer-readable storage medium. When the processor of an electronic device reads the computer program from the computer-readable storage medium, the processor executes the computer program, causing the electronic device to perform the steps of any of the above-described network traffic detection methods.

[0053] The beneficial effects of this application are as follows:

[0054] This application provides a network traffic detection method, apparatus, electronic device, and storage medium, which constructs a complete process from traffic data preprocessing and feature extraction to model detection in its overall design. Specifically, firstly, this application divides the network traffic to be detected according to session information, enabling the identification of a complete communication flow based on the session information of each data packet. Session division is structured at the session level, effectively integrating data packets under the same session, preserving communication sequences and behavioral context, which helps in the subsequent identification of complex network behavior patterns and improves the detection context awareness capability.

[0055] Secondly, within each session, load features of each data packet are extracted based on multiple load feature categories and their associated feature dimensions, thus forming multiple data packet load feature sets. This process provides a refined characterization of network traffic at the data packet level, comprehensively reflecting the load characteristics of each data packet from different feature perspectives. This helps to fully preserve the differences and feature expressiveness in the original communication, providing a high-quality input foundation for subsequent feature aggregation and malicious traffic detection.

[0056] Then, this application generates session-level aggregated features by aggregating the feature sets of each data packet payload. This effectively reduces dimensionality and improves the abstraction ability of feature representation while maintaining information integrity. These aggregated features comprehensively reflect the behavioral patterns of a session across different dimensions, facilitating the construction of more representative and discriminative feature vectors and demonstrating global feature modeling capabilities at the session level.

[0057] Finally, the aggregated features are input into the traffic detection model for malicious traffic identification. These features are extracted and aggregated at both the packet and session dimensions, forming a two-layered input feature structure, which enhances the automation and intelligence of the detection process. Through model training and inference, abnormal network traffic can be identified, effectively reducing manual intervention and false alarm rates while ensuring detection accuracy, thus improving the overall system's practicality and scalability.

[0058] Overall, the method described in this application is based on the technical path of session segmentation, multi-dimensional load feature extraction, session feature aggregation, and model detection. It can systematically and finely mine network communication features, improve the expressive power, generalization ability, and response efficiency of the detection system, and provide a practical, stable, and efficient solution for traffic threat identification in various network security scenarios.

[0059] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0060] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0061] Figure 1 A schematic diagram illustrating an application scenario provided in an embodiment of this application;

[0062] Figure 2 A flowchart illustrating the implementation of a network traffic detection method provided in this application embodiment;

[0063] Figure 3 This application provides a schematic diagram of data packet payload feature extraction and organization structure.

[0064] Figure 4 This is a schematic diagram of the overall process modules of a network traffic detection method provided in an embodiment of this application;

[0065] Figure 5 This is a detailed flowchart illustrating a network traffic detection method provided in an embodiment of this application.

[0066] Figure 6 This is a schematic diagram of the structure of a network traffic detection device provided in an embodiment of this application;

[0067] Figure 7This is a schematic diagram of the composition structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0068] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this application. Obviously, the described embodiments are only some embodiments of the technical solutions of this application, and not all embodiments. Based on the embodiments recorded in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the technical solutions of this application.

[0069] The following describes some of the concepts involved in the embodiments of this application.

[0070] 1. Malicious Traffic Detection: This refers to the process of analyzing the behavioral characteristics of network traffic to determine whether it contains malicious behaviors such as attacks, intrusions, or virus propagation. In this embodiment, it refers to inputting the aggregated features corresponding to each session into a pre-trained traffic detection model to identify whether the session is malicious network traffic.

[0071] 2. Session: In network communication, a session refers to a continuous, stateful data interaction process between two terminals. In this embodiment, it refers to the set of data packets obtained by classifying and dividing data packets with the same session 5-tuple information and time information in the original network traffic, which is the basic unit for load feature extraction.

[0072] 3. Load Feature Category: A standard used to classify different types of load information in network packets, facilitating hierarchical feature extraction. In this embodiment, it refers to the classification of load information in packets during a session, including at least load size category (representing the number of load bytes at different protocol layers), load content category (representing the statistical characteristics of load field content in the core layer), and load flow category (representing the change pattern of flow control field values).

[0073] 4. Packet Load Feature Set: Refers to a set of packet load features extracted according to preset rules on a certain dimension. In the embodiments of this application, it refers to the set of load features of all packets extracted for a certain load feature category and a feature dimension in a session. Each packet load feature set is used to summarize the load features of each packet under that feature dimension.

[0074] 5. Statistical Dimension: A statistical dimension refers to a preset dimension used for statistical processing from different analytical perspectives. In the embodiments of this application, the statistical dimensions include a first statistical dimension and a second statistical dimension. The first statistical dimension refers to the dimension used to perform statistics on each field in the core payload content of a data packet, reflecting the structural characteristics or information characteristics of the data packet at the payload content level. The second statistical dimension refers to the dimension used to perform statistics on the payload characteristics of each data packet in a data packet payload characteristic set, reflecting the change pattern and distribution of payload characteristics during transmission in a session.

[0075] The preferred embodiments of this application are described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit this application. Furthermore, the embodiments and features in the embodiments of this application can be combined with each other without conflict.

[0076] like Figure 1 The diagram shown is an application scenario illustration of an embodiment of this application. The application scenario diagram includes two terminal devices 110 and one server 120.

[0077] In this embodiment, the terminal device 110 includes, but is not limited to, mobile phones, tablets, laptops, desktop computers, e-book readers, smart voice interaction devices, smart home appliances, and in-vehicle terminals. The terminal device may have a network communication-related client installed, which can be software (such as a browser, instant messaging software, etc.), or a webpage, mini-program, etc. The server 120 is a backend server corresponding to the software, webpage, mini-program, etc., or a server specifically used for network traffic detection and processing; this application does not impose specific limitations. The server 120 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0078] It should be noted that the network traffic detection methods in the embodiments of this application can be executed by an electronic device, which can be a terminal device 110 or a server 120. That is, the method can be executed by the terminal device 110 or the server 120 alone, or by both the terminal device 110 and the server 120. For example, when executed by both the terminal device 110 and the server 120, the overall scheme is as follows:

[0079] Terminal device 110 initiates a network request to server 120, and server 120 returns corresponding data, forming a network communication session between the two. The side with detection capabilities (e.g., server 120) receives the network traffic sent by terminal device 110 and the response traffic returned by the server itself, collects and analyzes all data packets in the communication process, and divides the entire communication process according to session information. Subsequently, for each session, server 120 extracts data packet features under multiple load feature categories, constructs a data packet load feature set, and further performs statistical aggregation to obtain the aggregated features corresponding to the session. Finally, server 120 inputs the aggregated features into the traffic detection model to determine whether the session is malicious traffic.

[0080] In one alternative implementation, the terminal device 110 and the server 120 can communicate via a communication network.

[0081] In one alternative implementation, the communication network is a wired network or a wireless network.

[0082] It should be noted that, Figure 1 The examples shown are merely illustrative; in reality, the number of terminal devices and servers is unlimited and is not specifically limited in the embodiments of this application.

[0083] In this embodiment of the application, when there are multiple servers, the multiple servers can form a blockchain, and the servers are nodes on the blockchain; as disclosed in the network traffic detection method of this embodiment, the network traffic detection data involved can be stored on the blockchain, for example, detecting network traffic, sessions, packet load feature sets, etc.

[0084] Furthermore, the embodiments of this application can be applied to various scenarios, including not only network security detection scenarios, but also scenarios such as cloud technology, artificial intelligence, smart transportation, and assisted driving.

[0085] The network traffic detection method provided by the exemplary embodiments of this application will be described below with reference to the accompanying drawings and the application scenarios described above. It should be noted that the application scenarios described above are only shown to facilitate understanding of the spirit and principles of this application, and the embodiments of this application are not limited in any way in this respect.

[0086] See Figure 2 The diagram shown is a flowchart of a network traffic detection method provided in this application embodiment. Taking a server as the execution subject, the specific implementation process of this method is as follows: S21-S22:

[0087] S21: Divide the network traffic to be detected into at least one session according to session information.

[0088] The traffic to be detected refers to network communication data that needs to be detected. In one optional implementation, the traffic to be detected may include raw traffic data collected from locations such as switch port mirrors, network probes, gateway devices, or host network cards.

[0089] In the embodiments of this application, the traffic to be detected can be request data initiated by the terminal device to the server, or response data returned by the external server to the local terminal. This application does not make specific limitations on this, that is, it can be bidirectional traffic analysis or unidirectional collection scenario.

[0090] In an optional implementation, to improve the accuracy of session segmentation and enhance the temporal consistency of subsequent behavior pattern recognition, this application also proposes a session reorganization mechanism based on time window constraints. An optional implementation of S21 is as follows: S211~S214 ( Figure 2 (Not shown):

[0091] S211: By parsing and segmenting the network traffic to be detected, multiple data packets and the session information corresponding to each data packet are obtained; the session information includes session 5-tuple information and time information.

[0092] In the embodiments of this application, network traffic to be detected can be obtained from network interfaces, mirror ports, gateway devices, switch ports, terminal devices or network probes through data capture. The network traffic to be detected can be a real-time transmission stream or an offline traffic data file, such as a packet capture file format (PCAP). This application does not make any specific limitation on this.

[0093] The following explanation uses offline PCAP format traffic data as an example of the network traffic to be detected. That is, the file format of the network traffic to be detected is PCAP. The tools used for data capture can include, but are not limited to, the following: capturing traffic of a specific network interface via commands, such as using the general network packet capture tool tcpdump (Transmission Control Protocol Dump); using the graphical network protocol analyzer Wireshark for manual or automated traffic collection and saving; or using a custom traffic collection module deployed on border devices (such as gateways, firewalls, intrusion detection systems, etc.) for real-time traffic capture and saving. All these tools can save the captured network traffic data in the standard PCAP file format for subsequent session segmentation and feature extraction processing.

[0094] After being parsed, the captured traffic data file is converted into individual packets. Wireshark traffic parsing tools can be used to parse the raw PCAP file into individual packets. Each individual packet records the original information during the communication process, including session 5-tuple information (including protocol type, source IP address, destination IP address, source port, and destination port) and time information (such as timestamps). It may also contain other fields such as payload content.

[0095] It should be noted here that the multiple data packets obtained from parsing typically belong to multiple different sessions. During capture, they are arranged chronologically without being organized according to session logic. Therefore, these data packets need to be reassembled according to session dimensions to enable accurate analysis and feature extraction based on session structure. This will be explained in detail below:

[0096] S212: Create at least one session identifier based on the session 5-tuple information of each of the multiple data packets.

[0097] In this embodiment of the application, a session dictionary is initialized based on the session 5-tuple information carried by each data packet, which is used to record the data packet set under different session identifiers.

[0098] For each data packet, a unique session identifier (session_id) is generated based on the session 5-tuple information, and this identifier is added to the session dictionary as a key. Simultaneously, the list of empty data packets corresponding to this key is initialized. Specifically, the session identifier (session_id) can be represented as:

[0099] session_id =<src_ip,dst_ip,src_port,dst_port,protocol> Formula 1

[0100] The above method lays the foundation for unified processing and statistics of data packets within the same communication session. The following section will classify the data packets based on the established session identifiers.

[0101] S213: Assign packets belonging to the same session identifier to the same session among multiple packets.

[0102] Then, all data packets are traversed, and packets belonging to the same session_id are grouped into the same session. Each session contains a series of data packets representing a complete communication from the source host port to the destination host port, thus ensuring that traffic information within the same session is integrated together for subsequent unified session-based analysis and feature extraction.

[0103] After completing the initial aggregation of data packets, the continuity of communication needs to be considered. The following section will perform filtering and optimization processing on the session data based on time information.

[0104] S214: Based on time information, discard data packets in the same session that exceed the preset time window.

[0105] Time information can be obtained through the timestamp information of data packets, which can be obtained from the metadata of the data packets. In an optional implementation, to improve the accuracy of time determination, the high 32 bits, low 32 bits, and time resolution (e.g., microseconds or milliseconds) of the timestamp are extracted from the metadata of each data packet, and the timestamp value accurate to the second is calculated using the following formula 2:

[0106]

[0107] Among them, T high T represents the high 32 bits of the meta timestamp. low , represents the lower 32 bits of the timestamp, and R represents the time resolution.

[0108] For example, a data packet is captured with the following timestamp metadata: high = 1718281032, low = 350000, resolution = 1000000. This means that the high 32 bits of the timestamp represent 1718281032 seconds, and the low 32 bits represent 350000 microseconds, with the time unit being microseconds. According to the formula timestamp = high + (low / resolution), the precise timestamp of the data packet can be obtained as 1718281032 + (350000 / 1000000) = 1718281032.35, indicating that the data packet was captured at 14:37:12.35 on June 13, 2024 (UTC time).

[0109] After obtaining the time information of each data packet, in an optional implementation, to avoid interference with the session analysis results due to abnormal latency, long interruptions, or other factors, a preset time window can be set for each session based on the aforementioned timestamp information. This time window is not limited; for example, it can be set to 300 seconds.

[0110] In this embodiment, a time window is set. If the time information of a new data packet under the same session identifier exceeds the time information of the last data packet in the current session data, the data packet will not be included in the current session. In this way, non-continuous redundant communication streams can be eliminated, data volume can be controlled, and processing efficiency can be improved, thereby ultimately forming an effective session data set with time consistency and communication continuity.

[0111] To facilitate data management and feature analysis, this application can further encapsulate each segmented session into a separate PCAP file, achieving a "one file per session" organizational structure.

[0112] The above implementation method realizes the entire process of accurately segmenting network traffic to be detected according to session information. By accurately segmenting network traffic based on session 5-tuple information and time information, it can ensure that each session has good communication integrity and timing consistency, which helps to accurately restore session context behavior, improve the effectiveness of feature extraction and the accuracy of detection model. At the same time, the time window mechanism controls the data scale, reduces the computation and storage burden, and improves the overall detection efficiency.

[0113] In one alternative implementation, to further improve overall processing efficiency, pre-filtering can also be performed before data parsing.

[0114] Optionally, the raw traffic can be filtered using a filtering algorithm.

[0115] In this embodiment of the application, in order to reduce storage pressure and improve processing efficiency, a filtering algorithm can be used to pre-filter the original traffic before parsing the network traffic to be detected. The filtering algorithm can be Berkeley Packet Filter (BPF).

[0116] During the filtering process, network traffic is filtered by setting filtering rules. In order to focus on the parts of network communication that are valuable for analysis, in one optional implementation, this application may retain only network traffic of the Transmission Control Protocol (TCP), Internet Control Message Protocol (ICMP), and Internet Group Management Protocol (IGMP) types related to detection, and exclude local loopback communication (e.g., data streams whose source and destination addresses are both local Internet Protocol (IP)). This method can effectively reduce the storage cost and computational processing overhead of the original data while ensuring the accuracy of detection.

[0117] After filtering the traffic to be detected and segmenting the valid sessions, the next processing stage will be carried out, which is to extract and aggregate data packet features for each session:

[0118] S22: For each session, perform the following operations:

[0119] S221: For each load feature category among multiple load feature categories, extract the load features of each data packet in the session from each feature dimension related to the load feature category to form multiple data packet load feature sets corresponding to the session; wherein, each data packet load feature set includes: the load features of each data packet in the session under one feature dimension.

[0120] Here, "load feature category" refers to the classification of different feature types of the content carried by data packets. Multiple load feature categories include at least two of the following: load content category, load process category, and load size category. "Feature dimension" refers to the specific analytical perspective set under a given load feature category. "Data packet load feature set" refers to the set of load features extracted from each data packet within the same session under a given feature dimension, used to characterize the communication behavior of that session under that feature dimension.

[0121] In the embodiments of this application, each load feature category corresponds to a different feature dimension. Through multi-dimensional joint modeling, the ability to identify malicious behavior is improved.

[0122] In this embodiment, before performing payload feature extraction on data packets of a certain session, all data packets within that session need to be preprocessed, including parsing the metadata and payload byte representation (i.e., the raw binary representation of the data packet payload). This lays the foundation for subsequent accurate extraction according to different payload feature categories and feature dimensions. Metadata refers to the structured information related to transmission in the data packet, such as timestamps, Ethernet frame headers, network layer and transport layer header fields, used to identify the attributes and context of the data packet. The payload byte representation refers to the actual content carried after removing the protocol headers of each layer, i.e., the effective data content of the data packet in the parsable protocol layer, existing in the form of a byte stream.

[0123] After parsing the metadata and payload byte representations as described above, the packet payload features under different feature dimensions in each payload feature category can be extracted based on the metadata and payload byte representations.

[0124] In an alternative implementation, in order to more accurately reflect the load characteristics of data packets at different protocol layers and thus enhance the ability of features to characterize complex communication behaviors, this application also proposes a method for extracting load size based on multiple protocol layer dimensions.

[0125] Optionally, the multiple load feature categories include a load size category, and the feature dimensions related to the load size category are multiple different protocol layer dimensions. The implementation method for extracting the load features of each data packet in the session from multiple different protocol layer dimensions related to the load size category is as follows:

[0126] Under each protocol layer dimension, perform the following operations: Under each protocol layer dimension, determine the payload size of each data packet in the session at the corresponding protocol layer; combine the payload sizes determined under each protocol layer dimension to form the data packet payload feature set corresponding to the session under that protocol layer dimension.

[0127] The protocol layer dimension may include, but is not limited to, the load size of the data link layer (i.e., layer 2), the network layer (i.e., layer 3), and the core layer.

[0128] It should be noted that the choice of the above protocol layer dimensions is not limited and can be flexibly configured according to specific needs. Other protocol layer dimensions can also be used to achieve a more refined characterization of network load features.

[0129] In addition, the above-mentioned protocol layer dimensions refer to the layered structure of the Open Systems Interconnection (OSI) model, and the payload size of different protocol layers is used to reflect the effective payload bytes of the data packet at the corresponding layer.

[0130] In this embodiment, the core layer payload size refers to the number of bytes of the payload field content at the highest identifiable protocol layer of the data packet. If no higher-level protocol is identifiable, the core layer can degenerate into the last parseable protocol layer under the transport layer or application layer. Therefore, the core layer payload size can flexibly adapt to different application scenarios to characterize the actual business payload of the data packet.

[0131] In one optional implementation, taking Layer 2 (data link layer) and the core layer as protocol layer dimensions, for each data packet in the session, the load size of each data packet in the session at Layer 2 and the core layer is statistically analyzed to obtain the data packet load feature set corresponding to each protocol layer dimension, that is, the data packet load feature set corresponding to the Layer 2 protocol dimension and the data packet load feature set corresponding to the core layer protocol dimension in the session. The calculation formula is as follows:

[0132] Layer2_payload_bytes_list=Layer2{size i}, i = 1, 2, ..., m (Formula 3)

[0133] Here, `Layer2_payload_bytes_list` represents a feature list consisting of the payload byte sizes of all data packets in this session at the Layer 2 (i.e., data link layer) dimension; that is, the data packet payload feature set corresponding to the Layer 2 protocol dimension in this session. `Layer2{size_i}` represents the number of payload bytes of the i-th data packet in the data link layer of the session. `m` represents the total number of data packets in this session. `i` represents the sequence number of each data packet in this session, ranging from 1 to `m`.

[0134] core_payload_bytes_list=core{size i}, i = 1, 2, ..., m (Formula 4)

[0135] Here, `core_payload_bytes_list` represents a feature list consisting of the payload byte size of all packets in the session at the core layer dimension. That is, it's the packet payload feature set corresponding to the core layer protocol dimension in this session. `core{size_j}`: represents the payload byte count of the i-th packet in the session at the core layer.

[0136] It should be noted that, for other protocol layer dimensions, the same method can be used to extract the payload bytes of each data packet in that protocol layer and form a corresponding data packet payload feature set, so as to comprehensively obtain the payload size feature information of the session at different protocol layer granularities.

[0137] The above implementation method enables multi-dimensional characterization of the load size of data packets across multiple protocol layers in a session, fully capturing the behavioral differences of network traffic at each protocol layer. This helps improve the expressive power of network traffic characteristics and the accuracy of malicious traffic detection. This approach flexibly adapts to different protocol scenarios, improving the detection model's ability to discriminate complex network traffic while maintaining protocol universality.

[0138] In an alternative implementation, in order to comprehensively characterize the structural and variational features of the payload within the data packet and improve the ability to identify potential patterns or anomalies in communication behavior, this application also proposes a feature extraction scheme based on payload content.

[0139] Optionally, the multiple load feature categories include load content categories, and each feature dimension related to the load content category is a different first statistical dimension. The implementation method for extracting the load features of each data packet in the session from the multiple different first statistical dimensions related to the load content category is as follows:

[0140] Under each first statistical dimension, perform the following operations: Under each first statistical dimension, extract the core statistical values ​​corresponding to the core payload content of each data packet in the session; wherein, the core payload content of a data packet is: the effective payload field content of a data packet at the highest resolvable protocol layer; the core statistical values ​​extracted under each first statistical dimension are used to form the data packet payload feature set corresponding to the session under each first statistical dimension.

[0141] The first statistical dimension may include, but is not limited to, the mean dimension, standard deviation dimension, maximum value dimension, minimum value dimension, and information entropy dimension.

[0142] It should be noted here that the choice of the first statistical dimension is not limited and can be flexibly configured according to specific needs. It can also be other statistical dimensions that can extract distribution characteristics or trends from the core load content, such as frequency distribution dimension, length distribution dimension, repetition rate dimension, etc.

[0143] Additionally, it should be noted that the core payload content refers to the core layer payload, i.e., the effective payload field content of the aforementioned data packet at the highest resolvable protocol layer, representing the actual communication data portion carried in the core layer. Furthermore, due to the unstructured and variable-length characteristics of the original payload content, direct content extraction and comparison are quite difficult. To more effectively and uniformly represent and measure this portion, in this embodiment, it is preferable to encode and convert each field in the core payload content for subsequent calculation of various statistical indicators. The field encoding method can be the American Standard Code for Information Interchange (ASCII), or other encoding standards suitable for representing fields. This application does not specifically limit this; ASCII will be used as an example below.

[0144] In one optional implementation, taking the first statistical dimension as the mean dimension, standard deviation dimension, maximum value dimension, minimum value dimension, and information entropy dimension as an example, for each data packet in the session, the core statistical values ​​of each data packet in the session on the core load content are statistically calculated to obtain the data packet load feature set corresponding to each first statistical dimension.

[0145] The following section describes the packet load feature set corresponding to this session in the mean dimension, calculated using the following formula:

[0146]

[0147] Wherein, core_payload_mean_list represents a feature list composed of the mean values ​​of the core payload content of each data packet in this session along the mean dimension; n i The number of fields in the core payload of the i-th data packet represents the total number of fields; j represents the j-th field in the i-th data packet; x ij This represents the encoded value corresponding to the j-th field in the core payload content of the i-th data packet.

[0148] For example, in a session, there are 3 data packets with core payload contents of “BAFYU”, “GHMZH”, and “KLMN” respectively. According to Formula 5, the ASCII values ​​of the fields corresponding to the first data packet “BAFYU” are B(66), A(65), F(70), Y(89), and U(85), respectively, with a total of 375, 5 fields, and an average value of 375÷5=75.0; the ASCII values ​​corresponding to the second data packet “GHMZH” are G(71), H(72), M(77), Z(90), and H(72), with a total of 382, ​​5 fields, and an average value of 382÷5=76.4; the ASCII values ​​corresponding to the third data packet “KLMN” are K(75), L(76), M(77), and N(78), with a total of 306, 4 fields, and an average value of 306÷4=76.5. Therefore, the packet load feature set of this session in the mean dimension is: [75.0, 76.4, 76.5].

[0149] The following section describes the packet payload feature set corresponding to this session under the standard deviation dimension. The calculation formula is as follows:

[0150]

[0151] Wherein, core_payload_std_list represents a feature list composed of the standard deviations of the core payload content of each data packet in this session along the mean-standard-deviation dimension; μ i This represents the average value of the encoded value corresponding to the core payload content of the i-th data packet. The meanings of other repeated symbols are as described in the above embodiments, and will not be repeated here.

[0152] Taking the above session as an example, which contains 3 data packets with core payloads of “BAFYU”, “GHMZH”, and “KLMN” respectively.

[0153] For the first data packet "BAFYU", the corresponding ASCII values ​​are [66, 65, 70, 89, 85], with a mean of 75.0 and a standard deviation of:

[0154]

[0155] The second data packet, "GHMZH", has ASCII values ​​of [71, 72, 77, 90, 72], a mean of 76.4, and a standard deviation of:

[0156]

[0157] The third data packet, "KLMN", has ASCII values ​​of [75, 76, 77, 78], a mean of 76.5, and a standard deviation of:

[0158]

[0159] Therefore, the packet load feature set of this session in terms of standard deviation is: [10.02, 7.11, 1.12]. The following will introduce the corresponding packet load feature set of this session in terms of standard deviation, calculated using the following formula:

[0160] core_payload_max_list={max({x ij},j=1,…,n j )}, i=1,2,…,m(Formula 7)

[0161] Wherein, `core_payload_max_list` represents a feature list consisting of the standard deviations of the core payload content of each packet in this session under the dimension of the maximum mean; max({x ij},j=1,…,n j ) represents the maximum value among all the encoded values ​​corresponding to all fields in the core payload content of the i-th data packet. The meanings of other repeated symbols are as described in the above embodiments, and will not be repeated here.

[0162] Taking the above session as an example, which contains 3 data packets with core payloads of “BAFYU”, “GHMZH”, and “KLMN” respectively.

[0163] For the first data packet "BAFYU", the corresponding ASCII value is [66, 65, 70, 89, 85], with a maximum value of 89.

[0164] The second data packet, "GHMZH", has an ASCII value of [71, 72, 77, 90, 72], with a maximum value of 90.

[0165] The third packet, “KLMN”, has ASCII values ​​of [75, 76, 77, 78], with a maximum value of 78. Therefore, the packet payload feature set of this session in the maximum value dimension is: [89, 90, 78].

[0166] The following section describes the packet payload feature set corresponding to the minimum value dimension for this session. The calculation formula is as follows:

[0167] core_payload_min_list={min({x ij},j=1,…,n j )}, i=1,2,…,m (Formula 8)

[0168] Wherein, ore_payload_min_list represents a feature list consisting of the minimum values ​​of the core payload content of each data packet in this session under the minimum value dimension; min({xij},j=1,…,n j The symbol ) represents the minimum value among all the encoded values ​​corresponding to all fields in the core payload content of the i-th data packet. The meanings of other repeated symbols are as described in the above embodiments, and will not be repeated here.

[0169] Taking the above session as an example, which contains 3 data packets with core payloads of “BAFYU”, “GHMZH”, and “KLMN” respectively.

[0170] For the first data packet "BAFYU", the corresponding ASCII value is [66, 65, 70, 89, 85], with the minimum value being 65.

[0171] The second data packet, "GHMZH", has an ASCII value of [71, 72, 77, 90, 72], with a minimum value of 71.

[0172] The third data packet, “KLMN”, has an ASCII value of [75, 76, 77, 78], with a minimum value of 75. Therefore, the packet payload feature set of this session in the minimum value dimension is: [65, 71, 75].

[0173] The following section describes the packet payload feature set corresponding to this session in terms of entropy, calculated using the following formula:

[0174] Where ore_payload_min_list represents a feature list composed of the entropy values ​​of the core payload content of each data packet in this session, along with the entropy values; p(x ij ) represents the probability of the encoded value corresponding to the j-th field appearing in the i-th data packet, log(p(x) ij )) represents the logarithm of the probability of the occurrence of the encoded value corresponding to the j-th field in the i-th data packet. Here, it can be exemplified by a base of 2, or it can be the natural logarithm or the commonly used logarithm with a base of 10. This application does not limit this. For the meaning of other repeated symbols, please refer to the above embodiments. This application will not repeat them here.

[0175] Taking the above session as an example, which contains 3 data packets with core payloads of “BAFYU”, “GHMZH”, and “KLMN” respectively.

[0176] For the first data packet "BAFYU", the corresponding ASCII values ​​are [66, 65, 70, 89, 85]. Each field appears once, with a probability of 1 / 5. The entropy value corresponding to the first data packet is...

[0177] The second data packet, "GHMZH", has ASCII values ​​of [71, 72, 77, 90, 72]. The field H (i.e., 72) appears twice, and the others appear once each. Therefore, their probabilities are 1 / 5, 2 / 5, 1 / 5, and 1 / 5, respectively, and their entropy is [value missing].

[0178] The third data packet, "KLMN," has ASCII values ​​[75, 76, 77, 78], all of which are unique and have a probability of 1 / 4. Its entropy value is...

[0179] Therefore, the packet payload feature set of this session in terms of entropy is: [2.32, 1.92, 2.0].

[0180] Through the above implementation methods, multiple statistical features reflecting the data distribution pattern can be extracted from the core payload content of data packets, effectively capturing the changing patterns of different types of network traffic at the content level. Employing multiple primary statistical dimensions (such as mean, standard deviation, maximum, minimum, and entropy) to quantify the core payload content from multiple perspectives enhances the richness and discriminative power of feature representation, helping to more accurately characterize the behavioral features of each session at the content level, thereby strengthening the malicious traffic detection model's ability to identify complex and diverse network attack behaviors.

[0181] In an alternative implementation, in order to improve the computational efficiency of information entropy extraction and reduce resource consumption, this application also proposes an optimization method based on discrete interval partitioning.

[0182] Optionally, each field in the core payload of a data packet is encoded to obtain a sequence of encoded values ​​corresponding to the data packet; the encoded values ​​in the sequence of encoded values ​​are divided into multiple preset discrete intervals.

[0183] For example, if the core payload of a data packet is "ABCDXYZ", its fields are converted into the corresponding ASCII encoding sequence: [65, 66, 67, 68, 88, 89, 90]. Setting the discrete interval length to 5, the intervals are divided into [65–69], [70–74], [75–79], [80–84], [85–89], [90–94], and so on. The above ASCII values ​​will fall into different discrete intervals.

[0184] For each discrete interval, perform the following operations: determine the frequency of occurrence of each coded value in a discrete interval; calculate the probability parameter corresponding to a discrete interval based on the determined frequencies and the total length of the coded value sequence; calculate the entropy component of a discrete interval based on the probability parameter; and sum the entropy components corresponding to each discrete interval as the entropy value of a data packet in the information entropy dimension.

[0185] The probability parameter can be calculated using the following formula 10:

[0186]

[0187] Wherein, p(c ik ) represents the probability parameter of the k-th discrete interval of the i-th data packet; c ik Let represent the frequency of each coded value within the k-th discrete interval of the i-th data packet; N represents the total length of the coded value sequence of the i-th data packet; and m represents the total number of data packets. Formula 10 is used to quantify the frequency of coded values ​​within a certain interval, thereby assisting in the calculation of the corresponding entropy component.

[0188] It should be noted that the aforementioned discrete intervals can be understood as a binning process for dividing the encoded value sequence into intervals. This involves dividing continuous or discrete encoded values ​​into several intervals ("bins") according to a preset numerical range, thereby transforming the original field information into distribution features, facilitating statistical and probability calculations. In this application, this binning method is used to construct the probability parameters of the encoded values ​​and further calculate the information entropy, thereby improving the computational efficiency and robustness of entropy extraction while preserving the diversity of data features.

[0189] Taking the above embodiment as an example, the frequency of occurrence of the encoded value is counted and the probability parameter is calculated for each interval. For the first discrete interval [65–69], there are 4 fields, and the total length of the encoded value sequence is 7, so the corresponding probability parameter is 4 / 7≈0.5714. For the second discrete interval [70–74] and the third discrete interval [75–79], no fields are included, so their probability parameter is 0. For the fourth discrete interval [85–89], there are 2 fields, and the probability parameter is 2 / 7≈0.2857; for the fifth discrete interval [90–94], there is 1 field, and the probability parameter is 1 / 7≈0.1429. The entropy components for each interval are calculated with a base of 2: -0.5714×log2(0.5714)≈0.4613, -0.2857×log2(0.2857)≈0.5164, -0.1429×log2(0.1429)≈0.4010, and the entropy value for the empty interval is 0. Summing the entropy components of all intervals, the final entropy value of the data packet in the information entropy dimension is 0.4613+0.5164+0.4010=1.3787.

[0190] The above implementation method, which encodes, bins, and calculates entropy components of the core payload content of data packets under the information entropy dimension, can effectively reduce the computational complexity and resource consumption in the entropy calculation process while maintaining information integrity, thereby improving feature extraction efficiency. Simultaneously, using the probability parameters of the binned encoded values ​​to calculate information entropy helps to more accurately characterize the distribution characteristics and changing trends of data packet content, thus enhancing the ability of features to express complex load patterns and improving the accuracy and generalization ability of malicious network traffic detection.

[0191] In an alternative implementation, in order to comprehensively reflect the control characteristics in the network communication process and improve the ability of the malicious traffic detection model to perceive abnormal protocol behavior, this application also proposes a load feature extraction method based on the process control field.

[0192] Optionally, the multiple load feature categories include load flow categories, and each feature dimension related to the load flow category is a different flow control dimension. The implementation method for extracting the load features of each data packet in the session from the multiple different flow control dimensions related to the load flow category is as follows:

[0193] Under each flow control dimension, perform the following operations: Under a flow control dimension, extract the flow control field values ​​corresponding to each data packet in the session; combine the extracted flow control field values ​​under a flow control dimension to form the data packet payload feature set corresponding to the session under a flow control dimension.

[0194] In one alternative implementation, the process control dimension includes some or all of the following: Transmission Control Protocol (TCP) acknowledgment number, TCP sequence number, TCP flags, TCP window size, Internet Control Message Protocol (ICMP) type, and Internet Group Management Protocol (IGMP) type.

[0195] Feature values ​​extracted from the aforementioned process control dimensions can reflect changes in control behavior during communication, exhibiting strong discriminative power and interpretability. For example, TCP acknowledgment numbers and sequence numbers reveal the data transmission order and acknowledgment mechanism; TCP flags reflect changes in connection state; TCP window size reflects adjustments in receiving capabilities; ICMP types are used to report network anomalies or diagnostic requests; and IGMP types are used for multicast group management. These process control information, as key fields in the packet payload, can help the system more effectively identify potential abnormal connection behavior, communication attacks, or changes in transmission strategies, thereby enhancing the performance and stability of the overall detection model.

[0196] In this embodiment of the application, in order to facilitate unified modeling and calculation analysis of the features of the flow control dimension, the flow control field values ​​of each data packet in the session are uniformly converted into numerical form to construct a numerical data packet load feature set.

[0197] Taking the process control dimensions of "Transmission Control Protocol TCP sequence number, TCP acknowledgment number, TCP window size, TCP flags, ICMP type, and IGMP type" as examples, the values ​​of each data packet in the corresponding field in the session are extracted and numerically processed.

[0198] The TCP sequence number, TCP acknowledgment number, and TCP window size fields are 32-bit or 16-bit integer fields, and their decimal values ​​can be directly extracted as the numerical characteristics of the data packet under the corresponding flow control dimension. The TCP flags consist of multiple control bits (such as SYN, ACK, FIN, RST, URG, and PSH), which can be concatenated into a binary string in a fixed order and mapped to a decimal number to achieve a unique encoded representation of this composite control state. For example, when SYN=1 and ACK=1, the bit combination is "00010010", corresponding to a decimal value of 18. It should be noted that the above is a simplified example; the actual flag combinations and their numerical mappings are not specifically limited and can be flexibly set according to the actual protocol definition or business requirements.

[0199] For ICMP type fields, encoding mapping can be performed according to standard protocol definitions, such as mapping "EchoRequest" to 8, "EchoReply" to 0, "DestinationUnreachable" to 3, and "TimeExceeded" to 11. It should be noted that the above are only typical field examples; the actual supported type encodings are not limited to those listed above and can be extended according to specific protocols.

[0200] Similarly, in the IGMP type fields, "MembershipQuery" can be mapped to 0x11 (i.e., decimal 17), "MembershipReport" can be mapped to 0x16 (i.e., 22), "LeaveGroup" can be mapped to 0x17 (i.e., 23), and so on. It should be noted that the above IGMP type mappings are optional application scenarios. In actual use, they can be extended and modified according to the specific requirements of the protocol implementation, without limitation.

[0201] After completing the above transformation, the corresponding packet payload feature set can be constructed based on the field values ​​extracted from each packet in the session under a certain flow control dimension. For example, if a session contains 4 packets, its packet payload feature set under the TCP sequence number dimension can be represented as [30545, 30601, 30657, 30713], under the TCP window size dimension as [64240, 64240, 64240, 64240], and under the ICMP type dimension as [8, 0, 8, 0].

[0202] This approach not only enables a unified representation of heterogeneous protocol fields in the numerical space, which is beneficial for subsequent feature normalization, statistical calculation, and vectorized modeling, but also provides a quantifiable input basis for advanced analysis tasks such as intrusion detection, protocol identification, or traffic classification based on process behavior features.

[0203] Through the above implementation methods, the control behavior information of each data packet in a network session can be structured into a feature set at the granularity of process control, enabling refined expression and modeling of communication process patterns. In particular, extracting and constructing feature sets for the process control field values ​​of each data packet helps to capture state changes and control logic characteristics during network interaction, thereby improving the accuracy and robustness of tasks such as anomaly detection and behavior recognition.

[0204] In an alternative implementation, in order to enhance the directional expressive power of feature extraction and improve the recognition effect of the "request-response" structure in network behavior, this application also proposes a feature extraction method based on transmission direction differentiation.

[0205] Optionally, according to the direction of data packets during network transmission, the data packets in the session can be divided into two categories: one category corresponds to the direction in which the source port sends data packets to the destination port in the session, and the other category corresponds to the direction in which the destination port responds to the source port in the session.

[0206] For each type of data packet, perform the following operations: For each load feature category among multiple load feature categories, extract the load features of each data packet in a category from each feature dimension related to the load feature category, so as to form multiple data packet load feature sets corresponding to that type of data packet in the session.

[0207] In one optional implementation, if a session contains multiple data packets, taking the example of extracting 13 dimensions of features under 3 load feature categories for each data packet (e.g., 2 dimensions for load size category, 5 dimensions for load content category, and 6 dimensions for load process category), then load features with the same structure can be extracted for data packets in both directions of the session, thereby forming 2×13=26 data packet load feature sets. These sets can directionally characterize the data distribution characteristics of "request" and "response" respectively, avoiding their mixing in feature structure and affecting the model's distinguishing ability.

[0208] The above implementation methods can effectively enhance the model's ability to express differences in bidirectional communication behavior and improve the accuracy of anomaly identification and behavior modeling.

[0209] The feature extraction process described above mainly involves fine-grained feature representation of each data packet under multiple payload feature categories and feature dimensions, forming a data packet-level feature set to capture the detailed features of each data packet in the session.

[0210] Additionally, it's important to note that during the load feature extraction process described above, the structure of the data packets needs to be analyzed layer by layer according to their protocol type to extract key load field features. Specifically, basic information can be extracted from the Ethernet layer, such as packet type, link layer type, source MAC address, destination MAC address, Ethernet protocol type, and frame size. If the packet belongs to the IP type, its source IP, destination IP, and IP protocol type (such as TCP, ICMP, IGMP, etc.) can be further analyzed. For packets with the TCP protocol type, fields such as TCP acknowledgment number, TCP flags, and TCP window size can be extracted. For ICMP, the ICMP type field is extracted; and for IGMP, the IGMP type field is extracted. This approach enables unified structured processing of different types of network data packets, providing rich field support and a complete semantic foundation for the subsequent construction of load features under different categories and dimensions.

[0211] See Figure 3As shown, it is a schematic diagram of a data packet load feature extraction and organization structure provided in an embodiment of this application.

[0212] Figure 3 The diagram from left to right illustrates the processing flow of each data packet in the session, and how load features are extracted based on multiple feature dimensions and organized into a structured feature set. Specifically, Figure 3 The left side represents "data packets within a session," indicating multiple raw data packets contained in a network communication session. The middle side represents "load characteristic categories," where this application divides the load characteristics of data packets into three categories: load size, load content, and load flow. The right side represents the feature dimensions corresponding to each load characteristic category. Each category contains multiple subdivided feature dimensions to describe data characteristics at different semantic levels. For example, for the load size category, the corresponding load size can be extracted under the protocol dimensions of Layer 2 (data link layer) and Core Layer (highest resolvable protocol layer), forming data packet load characteristic set 1 and data packet load characteristic set 2. For the load content category, the core load content of each data packet is encoded and extracted under the first statistical dimensions such as mean, standard deviation, maximum value, minimum value, and information entropy, forming data packet load characteristic sets 3 to 7. For the load flow category, fields such as TCP acknowledgment number, TCP sequence number, TCP flag, TCP window size, ICMP type, and IGMP type are extracted based on the flow control dimension and converted into numerical features, forming data packet load characteristic sets 8 to 13. After each type of feature is extracted, it is organized into a packet payload feature set, which is used to express the fine-grained feature information of each packet in the session under a specific dimension.

[0213] It should be noted that, Figure 3 This mainly demonstrates the application's ability to express multidimensional features at the data packet level, laying the foundation for the subsequent generation of session-level aggregated features.

[0214] In addition, after obtaining the packet payload characteristics, the extracted payload feature dataset is stored in a database for subsequent aggregation calculations, feature analysis, and detection modeling. The database can be a flexible, document-oriented non-relational database system, such as MongoDB (Mongo Database). This database can efficiently store and index multi-dimensional packet payload feature sets corresponding to different sessions, supporting fast field-based retrieval, aggregation queries, and batch read operations, significantly improving data access efficiency in large-scale traffic data processing.

[0215] Since actual malicious traffic detection often relies on the determination of overall session behavior, after extracting the above packet-level features, it is necessary to perform aggregation and statistical processing based on these features to generate session aggregation features, and then construct a detection input vector with global expressive power.

[0216] The following section will detail how this session aggregation feature is generated.

[0217] S222: Aggregate the load features of each data packet in the load feature set to obtain the aggregated features corresponding to the session; the aggregated features are used to comprehensively characterize the load feature distribution of the session under different feature dimensions.

[0218] In the embodiments of this application, the aggregated feature is a statistical summary of the load characteristics of each data packet under the same session, which can comprehensively reflect the feature distribution and change trend of the session in multiple feature dimensions from a global perspective.

[0219] In an optional implementation, to enhance the expressive power and discriminative value of aggregated features at the session level, this application also proposes a scheme for constructing aggregated features based on a second statistical dimension. An optional implementation of S222 is as follows: S2221~S2222 ( Figure 2 (Not shown):

[0220] S2221: For each packet load feature set, extract the load features of each packet in the packet load feature set, and the corresponding session statistics under different second statistical dimensions.

[0221] The second statistical dimension refers to the statistical dimension of the aggregation of the load of all packets in the same packet load feature set at the session granularity.

[0222] In this embodiment of the application, the second statistical dimension refers to the statistical dimension used to aggregate and analyze the packet load characteristics at the session level. Its function is to describe the distribution characteristics of a certain feature dimension (the feature dimension of the packet load characteristics) in a complete session as a whole. It differs from the first statistical dimension used to extract the core load content of a single packet in terms of the processing object: the first statistical dimension focuses on the content statistics of a single packet, while the second statistical dimension focuses on the statistical summary of multiple packet features in an entire session.

[0223] Furthermore, it should be noted that the first and second statistical dimensions can use the same or different statistical methods. For example, the first statistical dimension may include the mean, standard deviation, maximum value, minimum value, and information entropy dimensions, while the second statistical dimension may use the same set of dimensions, namely the mean, standard deviation, maximum value, minimum value, and information entropy dimensions. On the other hand, the second statistical dimension can also be flexibly expanded or trimmed according to actual needs. That is, while retaining some of the same elements as the first statistical dimension, new aggregation dimensions (such as quartiles, coefficient of variation, etc.) can be added, or certain statistical methods can be discarded to adapt to the performance characteristics and analytical needs of different levels and types of load features at the session level.

[0224] The following will use the example of a first statistical dimension including mean, standard deviation, maximum value, minimum value, and information entropy, and a second statistical dimension also including mean, standard deviation, maximum value, minimum value, and information entropy. We will also use a packet load feature set as an example, retrieving the packet feature set from the database, and then explaining how to extract the load characteristics of each packet in this packet load feature set, and the corresponding session statistics under different second statistical dimensions:

[0225] Under the mean dimension, the calculation formula for extracting the session statistics (i.e., session mean) of the load characteristics of each packet in the packet load feature set is as follows: Formula 11:

[0226]

[0227] Among them, feature mean This represents the session statistics (i.e., the session-level mean) of all packets in the packet payload feature set under the current mean dimension; feature v y represents the value of the load characteristic of the v-th data packet in the data packet load characteristic set, and y represents the total number of data packets in the data packet load characteristic set.

[0228] For example, taking the data packet load feature set obtained in step S221 above under the "information entropy dimension" (first statistical dimension) of the load content feature as [1.32, 1.65, 1.58, 1.47], the session mean value corresponding to this load feature set is (1.32+1.65+1.58+1.47)÷4=1.505.

[0229] For example, taking the packet load feature set obtained under the "second layer load byte count dimension" as [145, 137, 152, 150], the corresponding session average is (145+137+152+150)÷4=146.

[0230] Other load feature sets can have their session averages extracted using the same calculation method; examples will not be provided here.

[0231] Under the standard deviation dimension, the calculation formula for the session statistics (i.e., session standard deviation) of the load characteristics of each packet in the packet load feature set is as follows: Formula 12:

[0232]

[0233] Where feature_std represents the standard deviation of the packet load feature set in the current dimension, and μ represents the session mean of the packet load feature set.

[0234] For example, the packet payload feature set obtained in step S221 above under the "information entropy dimension" of the payload content features is [1.32, 1.65, 1.58, 1.47], with a session mean of 1.505 and a standard deviation of √((1 / 4)×((1.32-1.505)). 2 +(1.65-1.505) 2 +(1.58-1.505) 2 +(1.47-1.505) 2 ))≈0.123.

[0235] Other load feature sets can have their session standard deviations extracted using the same calculation method; examples will not be provided here.

[0236] Under the maximum value dimension, the calculation formula for extracting the session statistics value (i.e., session maximum value) of the load characteristics of each packet in the packet load feature set is as follows: Formula 13:

[0237] feature max =max({feature v},v=1,…,y)(Formula 13)

[0238] Here, feature_max represents the maximum session value among all packet load features in the packet load feature set.

[0239] For example, in step S221 above, the data packet load feature set obtained under the "information entropy dimension" of the load content feature is [1.32, 1.65, 1.58, 1.47], and the maximum value of the session is 1.65.

[0240] Other load feature sets can be calculated using the same method to extract their maximum session values; examples will not be provided here.

[0241] Under the minimum value dimension, the calculation formula for extracting the session statistics value (i.e., session minimum value) of the load characteristics of each packet in the packet load feature set is as follows: Formula 14:

[0242] feature min =min({feature v},v=1,…,y)(Formula 14)

[0243] Here, feature_min represents the minimum session value among all packet load features in the packet load feature set.

[0244] For example, in step S221 above, the data packet load feature set obtained under the "information entropy dimension" of the load content feature is [1.32, 1.65, 1.58, 1.47], and the minimum value for a session is 1.32.

[0245] Other load feature sets can be extracted using the same calculation method to obtain their session minimum values, which will not be illustrated here.

[0246] Under the information entropy dimension, the calculation formula for the session statistics (i.e., session entropy value) of the load characteristics of each data packet in the data packet load feature set is as follows: Formula 15:

[0247]

[0248] Where p(feature_v) represents the probability of the v-th load feature value appearing in the feature set, log represents the logarithmic function with base 2, and feature_entropy represents the result of summing the entropy components of all feature values, i.e., the entropy value of the session level.

[0249] For example, in step S221 above, the data packet load feature set obtained under the "information entropy dimension" of the load content features is [1.32, 1.65, 1.58, 1.47]. Each value appears once with a probability of 0.25, so the entropy value is -(0.25×log20.25×4)=2.

[0250] Other load feature sets can have their session information entropy extracted using the same calculation method, which will not be illustrated here.

[0251] Through the above implementation method, a set of session statistics values ​​for each packet payload feature set under multiple second statistical dimensions can be obtained, forming a comprehensive characterization of the session under different second statistical dimensions.

[0252] It should be noted that the above example uses only one load feature dataset for illustration. In practical applications, there may be multiple load feature sets, each corresponding to different load feature categories and feature dimensions. Therefore, multiple session statistics can be extracted from each load data feature set to further improve the coverage and accuracy of feature dimensions.

[0253] After extracting session statistics from all packet payload feature sets, the aggregation phase begins.

[0254] S2222: Concatenate multiple session statistics corresponding to each data packet payload feature set to obtain the aggregated features corresponding to the session.

[0255] By concatenating multiple session statistics corresponding to the aforementioned data packet payload feature sets, a feature vector of session-level aggregated features with a unified format and stronger expressive power can be constructed without losing the original semantics of various features. This approach not only enhances the expression of correlations between different dimensions but also improves the ability of subsequent detection models to identify complex behavioral patterns.

[0256] In this embodiment, taking the extraction of 26 load feature sets as an example, five session statistics—mean, standard deviation, maximum value, minimum value, and information entropy—are extracted from each data packet load feature set, resulting in a total of 26 × 5 = 130 session statistics. These 130 statistics are concatenated in a preset order to form an aggregate vector, which serves as the final input vector describing the overall load behavior characteristics of the session.

[0257] This vector retains the multidimensional information of the original features and achieves an abstract representation of the features through statistical compression, which facilitates subsequent modeling and analysis.

[0258] Through the above implementation method, by extracting session statistics under multiple second statistical dimensions for each packet load feature set and concatenating these statistics to form aggregated features, a global and multi-dimensional abstract expression of the load features of all packets in a session can be achieved. On the one hand, this method improves the hierarchical nature of feature representation, enabling the characterization of the overall distribution trend and fluctuation pattern of load features at the session granularity; on the other hand, the aggregation operation under different statistical dimensions enhances the robustness and discriminative power of the features, giving the subsequent traffic detection model stronger generalization and recognition capabilities when facing complex or concealed traffic behaviors. Overall, this implementation method effectively improves the accuracy, stability, and system adaptability of traffic detection.

[0259] Once the aggregated features are obtained, malicious traffic can be detected based on these features. The details are as follows:

[0260] S223: Input aggregated features into the traffic detection model to detect malicious traffic in the session.

[0261] In an alternative implementation, to achieve more efficient and accurate malicious traffic identification, this application also proposes a detection strategy that combines aggregated features with a deep learning architecture. Specifically, before inputting the session aggregated features extracted in S222 into the traffic detection model for malicious traffic identification, the feature data must first undergo standardized preprocessing.

[0262] Optionally, outlier handling can be performed on the input aggregated feature data, such as filling missing values, replacing invalid data, or performing one-hot encoding transformation on non-numerical fields. Subsequently, feature scaling can be performed on the aggregated features after outlier handling, such as using a min-max normalization algorithm to map all features to a uniform range to improve model convergence efficiency. Finally, a K-layer hierarchical cross-validation method can be used to divide the dataset to ensure consistency between the training set and the validation set in terms of attack type distribution, thereby reducing model bias. In addition, if there is class imbalance in the training samples, it is optional to upsample the attack types with fewer samples in the malicious traffic to enhance the model's ability to identify minority classes.

[0263] After the above preprocessing of the aggregated features, the preprocessed aggregated features are used as the input sample vector x and fed into the traffic detection model for session-level malicious traffic identification.

[0264] The preprocessed sample is used as input x′, and the sample's class label is y′. The network layer Emb is the computational equation of the selected machine learning or deep learning algorithm. The input vector x′ is processed by the intermediate network layer Emb, and the prediction result is mapped to the interval [0, 1] by the softmax function, so that the sum of the predicted values ​​of all classes is 1, thus obtaining the predicted probability distribution p of the output layer, where C represents the number of threat types of the input sample, and p e Let represent the predicted probability of category e. To achieve backpropagation and parameter training of the network, the cross-entropy loss Loss between the category label y′ and the predicted probability distribution p is defined as the loss function. The specific calculation formulas are shown in Formulas 16 and 17:

[0265] p = softmax(Emb(x′)) (Formula 16)

[0266] Where p represents the predicted probability distribution of the final output, Emb(x′) represents the intermediate representation of the input sample x′ after processing by the neural network embedding layer and its subsequent structure, and softmax is a normalization function used to map the multi-class output results to the interval [0, 1] and ensure that the sum of the predicted probabilities of each class is 1.

[0267] After obtaining the formula for the predicted probability distribution, the loss during model training is calculated using the following cross-entropy function:

[0268]

[0269] Where Loss represents the final loss function value, C represents the total number of classes, and y′ e p is the true label for class e. e This is used to predict the probability value belonging to class e. Formula 17 measures the accuracy of the model's prediction by calculating the difference in cross-entropy between the true label and the predicted probability distribution.

[0270] In the embodiments of this application, the detection model may adopt different algorithm architectures according to business needs, including but not limited to Random Forest (RFC), Support Vector Machine (SVM), Long Short-Term Memory (LSTM), etc.

[0271] It should be noted that this application targets a multi-classification detection task, aiming to identify and differentiate different types of malicious traffic. Typical categories of malicious traffic include: Reconnaissance (RECON), which is the early stage of a network attack, where attackers collect target information through scanning, sniffing, etc.; Backdoors (BD), where attackers secretly implant backdoor programs into the target system to achieve remote control; Shellcode (SC), which injects and triggers malicious code with execution privileges; Worms (WORM), which are malicious programs with self-replication capabilities that can automatically spread in the network; Exploits (EXP), which are attacks that trigger system anomalies or privilege escalation through known vulnerabilities; Fuzzers (FUZZ), which trigger unknown vulnerabilities by randomly inputting abnormal data into the system; and Denial of Service (DoS), which exhausts the resources of the target system or service through abnormally high-frequency traffic, thereby preventing it from responding to legitimate requests. Through the above implementation methods, the detection model can not only efficiently identify different types of malicious traffic, but also has good generalization ability and robustness, making it suitable for threat perception and security protection needs in real complex network environments.

[0272] The above implementation method enables supervised classification and identification of session traffic samples.

[0273] Furthermore, in an optional implementation, an early stopping callback mechanism can be configured during training to prevent model overfitting, thereby obtaining a threat identification model with stronger generalization ability and higher detection accuracy. This architecture can effectively adapt to constantly changing network attack behaviors, improving detection performance while enhancing overall network security protection capabilities.

[0274] See Figure 4 The diagram shown illustrates the overall workflow of a network traffic detection method provided in this application. The method mainly comprises three stages: data acquisition, feature extraction, and model prediction. In the data acquisition stage, network traffic data is captured and processed. In the feature extraction stage, the load characteristics of each data packet are extracted based on the captured raw network traffic, and session-level aggregated features are calculated. In the model prediction stage, the aggregated features are preprocessed and then input into the detection model for training and testing, thereby enabling the identification and judgment of malicious sessions in network traffic.

[0275] See Figure 5 The diagram illustrates a detailed process of a network traffic detection method provided in this application. The process comprises multiple modules and sub-steps. First, in the data acquisition phase, data capture, packet segmentation, and session reassembly are performed. Then, in the packet payload feature extraction phase, the payload content is parsed from the raw data, and features are extracted according to different payload feature categories (such as payload size category, payload content category, and payload process category) and their corresponding feature dimensions, ultimately constructing a packet-level feature matrix for each session. In the session-level aggregated feature calculation phase, multiple session statistical values ​​are extracted based on each feature set and concatenated into a complete aggregated feature vector. Next, feature preprocessing operations are performed, such as null value handling, data transformation, and max-min normalization, and the robustness and accuracy of the model are enhanced through K-fold cross-validation and data sampling. Finally, in the training and testing phase, the detection and classification of malicious traffic are achieved through model definition, training, and prediction. The overall process structure is clear and progressive, possessing good versatility and practicality.

[0276] Based on the same inventive concept, embodiments of this application also provide a network traffic detection device. For example... Figure 6 As shown, this is a structural schematic diagram of a network traffic detection device 600, which may include:

[0277] The segmentation unit 601 is used to segment the network traffic to be detected into at least one session according to session information; for each session, the following operations are performed:

[0278] Extraction unit 602 is used to extract the load features of each data packet in the session from each feature dimension related to the load feature category for each load feature category among multiple load feature categories, so as to form multiple data packet load feature sets corresponding to the session; wherein, each data packet load feature set includes: the load features of each data packet in the session under one feature dimension;

[0279] Aggregation unit 603 is used to aggregate the load features of each data packet in the load feature set to obtain the aggregated features corresponding to the session; the aggregated features are used to comprehensively characterize the load feature distribution of the session under different feature dimensions.

[0280] The detection unit 604 is used to input aggregated features into the traffic detection model so as to detect malicious traffic of the session through the traffic detection model.

[0281] Optionally, multiple load feature categories include a load size category, and the feature dimensions related to the load size category are multiple different protocol layer dimensions; then the extraction unit 602 is used for:

[0282] Perform the following operations at each protocol layer level:

[0283] At a protocol layer level, determine the payload size of each data packet in the session at the corresponding protocol layer.

[0284] The payload sizes determined at a protocol layer dimension are used to form the packet payload feature set corresponding to the session at that protocol layer dimension.

[0285] Optionally, multiple load feature categories include load content categories, and the feature dimensions related to the load content categories are multiple different first statistical dimensions; then the extraction unit 602 is used for:

[0286] Under each first statistical dimension, perform the following operations respectively:

[0287] Under a first statistical dimension, the core statistical values ​​corresponding to the core payload content of each data packet in the session are extracted respectively; wherein, the core payload content of a data packet is: the payload field content of a data packet at the highest resolvable protocol layer;

[0288] The core statistical values ​​extracted under a first statistical dimension are used to form the packet load feature set corresponding to the session under that first statistical dimension.

[0289] Optionally, if the first statistical dimension is the information entropy dimension and the core statistical value is the entropy value, the extraction unit 602 is used to obtain the entropy value corresponding to the core payload content of a data packet in the following manner:

[0290] Encode each field in the core payload of a data packet to obtain a sequence of encoded values ​​corresponding to the data packet;

[0291] Divide each coded value in the coded value sequence into multiple preset discrete intervals;

[0292] For each discrete interval, perform the following operations:

[0293] Determine the frequency of occurrence of each coded value in a discrete interval;

[0294] Based on the determined occurrence frequencies and the total length of the encoded value sequence, calculate the probability parameter corresponding to a discrete interval;

[0295] Based on probability parameters, calculate the entropy components of a discrete interval;

[0296] The sum of the entropy components corresponding to each discrete interval is taken as the entropy value of a data packet in the information entropy dimension.

[0297] Optionally, multiple load feature categories include load process categories, and the feature dimensions related to each load process category are multiple different process control dimensions; then the extraction unit 602 is used for:

[0298] Under each process control dimension, perform the following operations respectively:

[0299] Under one flow control dimension, extract the flow control field values ​​corresponding to each data packet in the session;

[0300] The values ​​of each flow control field extracted under a flow control dimension are used to form the packet payload feature set corresponding to the session under that flow control dimension.

[0301] Optionally, process control dimensions may include some or all of the following: Transmission Control Protocol (TCP) acknowledgment number, TCP sequence number, TCP flags, TCP window size, Internet Control Message Protocol (ICMP) type, and Internet Group Management Protocol (IGMP) type.

[0302] Optionally, the polymerization unit 603 is used for:

[0303] For each packet load feature set, extract the load features of each packet in the packet load feature set, and the corresponding session statistics under different second statistical dimensions;

[0304] Multiple session statistics corresponding to each packet payload feature set are concatenated to obtain the aggregated features corresponding to the session.

[0305] Optionally, the extraction unit 602 is used for:

[0306] Based on the direction of data packets during network transmission, the data packets in a session are divided into two categories. One category corresponds to the direction in which the source port sends data packets to the destination port in the session, and the other category corresponds to the direction in which the destination port responds to the source port in the session.

[0307] For each type of data packet, perform the following operations:

[0308] For each load feature category among multiple load feature categories, the load features of each data packet in a class of data packets are extracted from each feature dimension related to the load feature category to form multiple data packet load feature sets corresponding to that class of data packets in the session.

[0309] Optionally, the partitioning unit 601 is used for:

[0310] By parsing and segmenting the network traffic to be detected, multiple data packets and the session information corresponding to each data packet are obtained; the session information includes session 5-tuple information and time information.

[0311] Create at least one session identifier based on the session 5-tuple information of each of the multiple data packets;

[0312] Group data packets belonging to the same session identifier into the same session from among multiple data packets;

[0313] Based on time information, data packets that exceed the preset time window in the same session are dropped.

[0314] For ease of description, the above sections are divided into modules (or units) according to their functions and described separately. Of course, in implementing this application, the functions of each module (or unit) can be implemented in one or more software or hardware components.

[0315] In this application embodiment, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0316] Having introduced the network traffic detection method and apparatus according to exemplary embodiments of this application, we will now introduce an electronic device according to another exemplary embodiment of this application.

[0317] Those skilled in the art will understand that various aspects of this application can be implemented as a system, method, or program product. Therefore, various aspects of this application can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, collectively referred to herein as a "circuit," "module," or "system."

[0318] Based on the same inventive concept as the above-described method embodiments, this application also provides an electronic device. In one embodiment, the electronic device may be a server, such as... Figure 1 The server 120 is shown. In this embodiment, the structure of the electronic device can be as follows: Figure 7 As shown, it includes a memory 701, a communication module 703, and one or more processors 702.

[0319] The memory 701 is used to store computer programs executed by the processor 702. The memory 701 may mainly include a program storage area and a data storage area. The program storage area may store the operating system and programs required to run instant messaging functions, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0320] Memory 701 may be volatile memory, such as random-access memory (RAM); memory 701 may also be non-volatile memory, such as read-only memory, flash memory, hard disk drive (HDD), or solid-state drive (SSD); or memory 701 may be any other medium capable of carrying or storing a desired computer program having the form of instructions or data structures and accessible by a computer, but is not limited thereto. Memory 701 may be a combination of the above-described memories.

[0321] The processor 702 may include one or more central processing units (CPUs) or digital processing units, etc. The processor 702 is used to implement the aforementioned network traffic detection method when it calls the computer program stored in the memory 701.

[0322] The communication module 703 is used to communicate with terminal devices and other servers.

[0323] This application embodiment does not limit the specific connection medium between the memory 701, communication module 703, and processor 702 described above. This application embodiment... Figure 7The memory 701 and the processor 702 are connected via a bus 704, and the bus 704 is in Figure 7 The diagram uses thick lines to describe the connections between other components; these are for illustrative purposes only and should not be considered limiting. The 704 bus can be divided into address bus, data bus, control bus, etc. For ease of description, Figure 7 It is described using only a thick line, but does not indicate that there is only one bus or one type of bus.

[0324] The memory 701 stores a computer storage medium, which stores computer-executable instructions for implementing the network traffic detection method of this application embodiment. The processor 702 is used to execute the above-described network traffic detection method, such as... Figure 2 As shown.

[0325] In some possible implementations, various aspects of the network traffic detection method provided in this application can also be implemented as a program product, which includes a computer program. When the program product is run on an electronic device, the computer program causes the electronic device to perform the steps of the network traffic detection method according to the various exemplary embodiments of this application described above. For example, the electronic device can perform actions such as... Figure 2 The steps are shown in the figure.

[0326] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0327] The program product of the embodiments of this application may employ a portable compact disc read-only memory (CD-ROM) and include a computer program, and may run on an electronic device. However, the program product of this application is not limited thereto. In this document, the readable storage medium may be any tangible medium that contains or stores a program that may be used by or in conjunction with a command execution system, apparatus, or device.

[0328] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying a readable computer program. This propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting a program for use by or in conjunction with a command execution system, apparatus, or device.

[0329] Computer programs contained on readable media may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0330] Computer programs for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The computer program can execute entirely on the user's electronic device, partially on the user's electronic device, as a standalone software package, partially on the user's electronic device and partially on a remote electronic device, or entirely on a remote electronic device or server. In cases involving remote electronic devices, the remote electronic device can be connected to the user's electronic device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external electronic device (e.g., via the Internet using an Internet service provider).

[0331] It should be noted that although several units or sub-units of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of this application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units.

[0332] Furthermore, although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0333] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing a computer-usable computer program.

[0334] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, produce a machine for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0335] These computer program commands may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the commands stored in the computer-readable storage medium produce an article of manufacture including command means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0336] These computer program commands can also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing the commands executed on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0337] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0338] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A network traffic detection method, characterized in that, The method includes: The network traffic to be detected is divided into at least one session according to session information; for each session, the following operations are performed: For each of the multiple load feature categories, load features of each data packet in the session are extracted from each feature dimension related to the load feature category to form multiple data packet load feature sets corresponding to the session; wherein, each data packet load feature set includes: the load features of each data packet in the session under one of the feature dimensions; The load features of each data packet in the load feature set are aggregated to obtain the aggregated feature corresponding to the session; the aggregated feature is used to comprehensively characterize the load feature distribution of the session under different feature dimensions; The aggregated features are input into the traffic detection model to detect malicious traffic in the session.

2. The method as described in claim 1, characterized in that, The multiple load feature categories include a load size category, and the feature dimensions related to the load size category are multiple different protocol layer dimensions; The step of extracting the load features of each data packet in the session from each feature dimension related to the load feature category to form multiple data packet load feature sets corresponding to the session includes: Under each of the aforementioned protocol layer dimensions, the following operations are performed respectively: At a protocol layer level, determine the payload size of each data packet in the session at the corresponding protocol layer; The payload sizes determined at the aforementioned protocol layer dimension are used to form the packet payload feature set corresponding to the session at that protocol layer dimension.

3. The method as described in claim 1, characterized in that, The multiple load feature categories include load content categories, and the feature dimensions related to the load content categories are multiple different first statistical dimensions; The step of extracting the load features of each data packet in the session from each feature dimension related to the load feature category to form multiple data packet load feature sets corresponding to the session includes: Under each of the first statistical dimensions, perform the following operations: Under a first statistical dimension, the core statistical values ​​corresponding to the core payload content of each data packet in the session are extracted respectively; wherein, the core payload content of a data packet is: the payload field content of the data packet at the highest resolvable protocol layer; The core statistical values ​​extracted under the first statistical dimension are used to form the packet load feature set of the session corresponding to the first statistical dimension.

4. The method as described in claim 3, characterized in that, The first statistical dimension is the information entropy dimension. When the core statistical value is the entropy value, the entropy value corresponding to the core payload content of a data packet is obtained in the following way: Encode each field in the core payload of the data packet to obtain the encoded value sequence corresponding to the data packet; Each coded value in the coded value sequence is divided into multiple preset discrete intervals; For each discrete interval, perform the following operations: Determine the frequency of occurrence of each coded value in a discrete interval; Based on the determined frequencies of occurrence and the total length of the encoded value sequence, the probability parameter corresponding to the discrete interval is calculated; Based on the probability parameters, calculate the entropy components of the discrete interval; The sum of the entropy components corresponding to each discrete interval is taken as the entropy value of the data packet in the information entropy dimension.

5. The method as described in claim 1, characterized in that, The multiple load feature categories include load process categories, and the feature dimensions related to the load process categories are multiple different process control dimensions; The step of extracting the load features of each data packet in the session from each feature dimension related to the load feature category to form multiple data packet load feature sets corresponding to the session includes: Under each of the aforementioned process control dimensions, the following operations shall be performed: Under one flow control dimension, extract the flow control field values ​​corresponding to each data packet in the session; The values ​​of each flow control field extracted under the aforementioned flow control dimension are used to form the packet payload feature set corresponding to the session under that flow control dimension.

6. The method as described in claim 4, characterized in that, The process control dimensions include some or all of the following: Transmission Control Protocol (TCP) acknowledgment number, TCP sequence number, TCP flags, TCP window size, Internet Control Message Protocol (ICMP) type, and Internet Group Management Protocol (IGMP) type.

7. The method according to any one of claims 1 to 5, characterized in that, The step of aggregating the load features of each data packet in the load feature set to obtain the aggregated features corresponding to the session includes: For each packet load feature set, extract the load features of each packet in the packet load feature set, and the corresponding session statistics under different second statistical dimensions; Multiple session statistics corresponding to each data packet load feature set are concatenated to obtain the aggregated feature corresponding to the session.

8. The method according to any one of claims 1 to 5, characterized in that, For each of the multiple load feature categories, the load features of each data packet in the session are extracted from each feature dimension related to the load feature category to form multiple data packet load feature sets corresponding to the session, including: Based on the direction of data packets during network transmission, the data packets in the session are divided into two categories. One category corresponds to the direction in which the source port sends data packets to the target port in the session, and the other category corresponds to the direction in which the target port responds to the source port in the session. For each type of data packet, perform the following operations: For each load feature category among multiple load feature categories, load features of each data packet in a class of data packets are extracted from each feature dimension related to the load feature category to form multiple data packet load feature sets corresponding to that class of data packets in the session.

9. The method according to any one of claims 1 to 5, characterized in that, The step of dividing the network traffic to be detected into at least one session according to session information includes: By parsing and segmenting the network traffic to be detected, multiple data packets and session information corresponding to each data packet are obtained; the session information includes session 5-tuple information and time information; Based on the session 5-tuple information of each of the multiple data packets, create at least one session identifier; Among the multiple data packets, those belonging to the same session identifier are grouped into the same session; Based on the time information, data packets that exceed a preset time window in the same session are discarded.

10. A network traffic detection device, characterized in that, include: A segmentation unit is used to divide the network traffic to be detected into at least one session according to session information; for each session, the following operations are performed: An extraction unit is configured to extract the load features of each data packet in the session from each feature dimension related to the load feature category for each of the multiple load feature categories, so as to form multiple data packet load feature sets corresponding to the session; wherein, each data packet load feature set includes: the load features of each data packet in the session under one of the feature dimensions; The aggregation unit is used to aggregate the load features of each data packet in the load feature set to obtain the aggregated features corresponding to the session; the aggregated features are used to comprehensively characterize the load feature distribution of the session under different feature dimensions. The detection unit is used to input the aggregated features into the traffic detection model so as to detect malicious traffic in the session through the traffic detection model.

11. An electronic device, characterized in that, It includes a processor and a memory, wherein the memory stores a computer program that, when executed by the processor, causes the processor to perform the steps of any one of the methods described in claims 1 to 9.

12. A computer-readable storage medium, characterized in that, It includes a computer program that, when run on an electronic device, causes the electronic device to perform the steps of any of the methods described in claims 1 to 9.

Images