Malicious traffic detection model backdoor detection method and device

Abstract

According to the malicious traffic detection model backdoor detection method and device provided by the invention, a backdoor in a malicious traffic pre-training model based on dynamic generation backdoor trigger disturbance can be effectively detected, the detection accuracy and the detection efficiency are remarkably improved, and the safety and the robustness of a malicious traffic detection system are enhanced.

Description

Technical Field

[0001] This invention relates to the field of malicious traffic detection model backdoor detection, and more particularly to a method and apparatus for malicious traffic detection model backdoor detection. Background Technology

[0002] With the development of deep learning technology, malicious traffic detection has become a core technology in network security defense systems, widely used in areas such as network intrusion identification, abnormal behavior analysis, and data leakage protection. Among related technologies, an end-to-end malicious traffic identification system has been constructed through the collaborative operation of a pre-trained encoder and a supervised classifier. Specifically, this technology system covers the entire process from traffic feature extraction and embedding vector generation to classification decisions, including key stages such as data collection, model training, and online detection. While pre-trained models significantly improve detection accuracy due to their powerful feature representation capabilities, their potential backdoor attack risks are gradually becoming a key bottleneck restricting the widespread adoption of this technology.

[0003] However, existing deep learning-based backdoor detection methods directly employ trigger reconstruction or meta-classifier strategies, failing to fully consider the dynamic generation characteristics of backdoor trigger perturbations in malicious traffic scenarios. This can lead to decreased detection accuracy or inability to adapt to the output format of pre-trained models, thus affecting the reliability and practicality of the detection system. Specifically, trigger reconstruction-based methods rely on iterative search for perturbations, making it difficult to handle real-time changing backdoor features; while meta-classifier-based methods are limited by the output structure of traditional supervised models and cannot be effectively transferred to pre-trained encoder scenarios. These limitations result in significantly insufficient detection performance of existing technologies when facing dynamic backdoor trigger perturbations from tunneling tools such as DNS2TCP and DNSCat2. Therefore, there is an urgent need for a backdoor detection method that is output-independent, requires no trigger reconstruction, and possesses high-efficiency detection capabilities. Summary of the Invention

[0004] The present invention aims to at least partially solve one of the technical problems in the related art.

[0005] This invention proposes a backdoor detection method for malicious traffic detection models.

[0006] Another objective of this invention is to provide a backdoor detection device for a malicious traffic detection model.

[0007] To achieve the above objectives, this invention proposes a method for detecting backdoors in a malicious traffic detection model, comprising: S1, Construct multiple shadow pre-trained models, including shadow models with backdoors and shadow models without backdoors; S2, based on the shadow pre-trained model, calculate the centroid of the benign sample embedding vector and the centroid of the malicious sample embedding vector, and generate a feature importance score based on the gradient of the embedding vector of the interpreted sample to the centroid of the benign sample embedding vector and the centroid of the malicious sample embedding vector. S3, concatenate the original sample with the feature importance score in the column direction to form the input sample of the meta-classifier; S4, Use the input samples to train a meta-classifier to distinguish between models with backdoors and models without backdoors; S5, detect the target pre-trained model, calculate the average prediction score of its input samples, and compare the average prediction score with a preset threshold to determine whether the target pre-trained model has a backdoor.

[0008] The malicious traffic detection model backdoor detection method of this invention may also have the following additional technical features: In one embodiment of the present invention, the construction of multiple shadow pre-trained models further includes: S11, the shadow pre-trained model uses a shadow model with a DNS2TCP backdoor, or has A shadow model of the DNSCat2 backdoor, or a shadow model with the Iodine backdoor, or a shadow model with all three of the above backdoors. S12, the construction process of the shadow pre-trained model includes training with backdoor samples generated by different tunneling tools to simulate the model behavior under real attack scenarios.

[0009] In one embodiment of the present invention, the step of calculating the centroids of benign sample embedding vectors and malicious sample embedding vectors based on the shadow pre-training model, and generating feature importance scores based on the gradients from the embedding vector of the interpreted sample to the centroids of the benign and malicious sample embedding vectors, further includes: S21, the centroid of the benign sample embedding vector is the average vector of all benign samples in the embedding space, and the centroid of the malicious sample embedding vector is the average vector of all malicious samples in the embedding space. S22, the feature importance score is the absolute difference between the gradient of the embedded vector of the explained sample with respect to the centroid of the embedded vector of the benign sample and the gradient with respect to the centroid of the embedded vector of the malicious sample.

[0010] In one embodiment of the present invention, the step of concatenating the original sample with the feature importance score in the column direction to form the input sample of the meta-classifier further includes: S31, the column-direction concatenation is to concatenate the feature vector of the original sample with the feature importance score vector in the feature dimension to form a higher-dimensional feature representation; S32, the concatenated input samples are used for meta-classifier training to enhance the model's ability to discriminate backdoor states.

[0011] In one embodiment of the present invention, it further includes: S6, the prediction results of the meta-classifier are averaged to reduce the noise impact of individual sample predictions and improve the robustness of the overall detection. S7. Based on the comparison result between the average predicted score and the preset threshold, output the backdoor state of the target pre-trained model and record the detection log for subsequent model auditing.

[0012] To achieve the above objectives, another aspect of the present invention provides a backdoor detection device for a malicious traffic detection model, comprising: The shadow model building module is used to build multiple shadow pre-trained models, including shadow models with backdoors and shadow models without backdoors. The embedding vector centroid calculation module is used to calculate the centroids of benign sample embedding vectors and malicious sample embedding vectors based on the shadow pre-trained model, and generate feature importance scores based on the gradients from the embedding vector of the interpreted sample to the centroids of benign and malicious sample embedding vectors. The feature concatenation module is used to concatenate the original sample with the feature importance score in the column direction to form the input sample of the meta-classifier; The meta-classifier training module is used to train a meta-classifier using the input samples to distinguish between models with backdoors and models without backdoors. The backdoor detection and judgment module is used to detect the target pre-trained model, calculate the average prediction score of its input samples, and compare the average prediction score with a preset threshold to determine whether the target pre-trained model has a backdoor.

[0013] The malicious traffic detection model backdoor detection method and apparatus of the present invention can effectively detect backdoors in malicious traffic pre-trained models based on dynamically generated backdoor triggering perturbations, significantly improving detection accuracy and efficiency, and enhancing the security and robustness of the malicious traffic detection system.

[0014] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0015] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1This is a flowchart of a backdoor detection method based on a malicious traffic detection model according to an embodiment of the present invention; Figure 2 This is an architecture diagram of a backdoor detection method for a malicious traffic detection model according to an embodiment of the present invention; Figure 3 This is a schematic diagram of the detection time of the comparison detection algorithm according to an embodiment of the present invention; Figure 4 This is a structural diagram of a backdoor detection device based on a malicious traffic detection model according to an embodiment of the present invention. Detailed Implementation

[0016] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0017] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0018] The malicious traffic detection model backdoor detection method and apparatus proposed according to embodiments of the present invention are described below with reference to the accompanying drawings.

[0019] Example 1 Figure 1 This is a flowchart of a malicious traffic detection model backdoor detection method according to an embodiment of the present invention, such as... Figure 1 As shown, it includes: S1, construct multiple shadow pre-trained models, including shadow models with backdoors and shadow models without backdoors.

[0020] Specifically, in the training phase of this invention, constructing multiple shadow pre-trained models is one of the key technical steps in implementing the backdoor detection algorithm. These shadow models include shadow models with backdoors and shadow models without backdoors, and their purpose is to provide representative input features and labels for the subsequent training of the meta-classifier. In some implementations, the construction process of the shadow models must strictly follow the pre-training architecture and training process consistent with the target model to ensure that their behavior patterns are highly similar to the target model, thereby improving the detection generalization ability.

[0021] Specifically, the process of building a shadow model includes defining the model structure, preparing training data, designing a backdoor injection mechanism, and training the model. Specifically, a shadow model without a backdoor uses a standard pre-trained architecture (such as Transformer, CNN, etc.) and is trained using normal traffic data to ensure its output behavior matches the expectations of a benign model. A shadow model with a backdoor, however, introduces a specific backdoor injection mechanism during training, such as embedding dynamically generated trigger perturbations into malicious traffic samples. These perturbations can be constructed based on features of DNS tunneling tools (such as DNS2TCP, DNSCat2, Iodine). That is, padding data is added to the end of the traffic sample.

[0022] In one embodiment of the present invention, the number of shadow models is typically set to 100-200 to cover the diversity of different backdoor types and model structures. The training dataset for each shadow model must contain no fewer than 15,000 benign traffic samples and 15,000 malicious traffic samples to ensure the representativeness of the model. Furthermore, the generation of backdoor trigger perturbations must meet certain concealment standards, such as the perturbation amplitude not exceeding 5%-10% of the original traffic characteristics, to simulate backdoor behavior in real attack scenarios.

[0023] In application scenarios, this step provides the data foundation for training the meta-classifier, and is particularly suitable for detecting malicious traffic backdoors based on dynamically triggered perturbations. By constructing shadow models with and without backdoors, the algorithm can learn the differences in feature interpretation between backdoor models, thereby improving the discriminative ability of the meta-classifier.

[0024] The technical advantage of this step lies in its ability to effectively capture the differences in model behavior under different backdoor attack modes by constructing diverse shadow models, providing high-quality training samples for the meta-classifier, thereby significantly improving the accuracy and robustness of backdoor detection. Experimental results show that this method achieves the best detection performance with an F1 score of 1.0000 in various DNS tunnel backdoor types.

[0025] Furthermore, S1 includes: S11, the shadow pre-trained model can be a shadow model with a DNS2TCP backdoor, or a shadow model with a DNSCat2 backdoor, or a shadow model with an Iodine backdoor, or a shadow model with all three of the above backdoors.

[0026] Specifically, in some implementations, the shadow pre-training model can use a shadow model with a DNS2TCP backdoor, or a shadow model with a DNSCat2 backdoor, or a shadow model with an Iodine backdoor, or a shadow model with all three of the above backdoors. This step is a key construction step in the training stage of this invention, aiming to provide representative training data for the meta-classifier by constructing a shadow model with a specific backdoor type, thereby improving its ability to distinguish whether the target model has a backdoor.

[0027] Furthermore, the shadow model is constructed based on the same architecture and training data distribution as the target pre-trained model, but it is artificially injected with specific types of backdoors during training. DNS2TCP, DNSCat2, and Iodine are all common DNS tunneling tools, and their backdoor mechanisms manipulate the detection model by embedding specific trigger patterns into the traffic. In this invention, these backdoors are embedded in the encoder of the shadow model, causing it to output a tampered feature representation when faced with specific trigger traffic, thereby simulating the model behavior under real attack scenarios.

[0028] At the parameter level, each shadow model's backdoor injection must meet certain triggering conditions, such as the length, frequency, and domain name structure of the trigger traffic. That is, the backdoor is triggered by adding padding data to the end of the traffic data. Taking DNS2TCP as an example, its triggering perturbation typically manifests as a specific subdomain encoding method, such as converting each byte into two DNS tags, with a fixed tag length of 3 characters. DNSCat2 uses a character-encoding-based triggering method, and its triggering pattern is usually embedded in the alphabetical sequence of the domain name. Iodine's triggering perturbation is based on the encoding of IP addresses, typically converting IP addresses into domain name format, such as "abcdexample.com". These parameter settings must be consistent with the actual attack samples to ensure the shadow model's behavior is realistic and representative.

[0029] At the application level, this step is applicable to backdoor detection systems in the pre-training stage of malicious traffic detection models. By constructing shadow models containing multiple backdoor types, the system can cover tunneling tools that different attackers might use, thereby enhancing the generalization ability of the meta-classifier. During the training phase, each shadow model will be used to generate feature importance scores with backdoor features. These scores will serve as input features for the meta-classifier, training its ability to identify backdoor models.

[0030] The technical advantage of this step lies in its ability to effectively simulate the response patterns of the target model under different backdoor attacks by introducing multiple shadow models with realistic backdoor mechanisms, thereby improving the discrimination accuracy of the meta-classifier. Experimental results show that the present invention achieves an F1 score of 1.0000 in DNS2TCP, DNSCat2, Iodine, and multi-tunnel backdoor detection, significantly outperforming existing solutions, demonstrating the crucial role of this step in improving detection accuracy and robustness.

[0031] S12, the construction process of the shadow pre-trained model includes training with backdoor samples generated by different tunneling tools to simulate the model behavior under real attack scenarios.

[0032] Specifically, in some implementations, the construction process of the shadow pre-trained model involves training it by introducing backdoor samples generated by different tunneling tools to simulate model behavior under real attack scenarios. This is a key technical step in the present invention for training the meta-classifier and improving the accuracy and generalization ability of backdoor detection. The core of this step lies in constructing a representative shadow model dataset, which contains pre-trained model samples of both backdoor and non-backdoor types, thereby providing high-quality training input for the meta-classifier.

[0033] At the technical implementation level, building the shadow pre-trained model first requires generating malicious traffic samples with backdoor characteristics. These samples are injected with specific triggering perturbations through various DNS tunneling tools (such as DNS2TCP, DNSCat2, and Iodine). These perturbations include, but are not limited to, abnormal DNS query frequencies, non-standard domain name structures, and tampering with specific protocol fields. During training, these backdoor samples are input into the shadow model along with normal traffic samples to simulate the diverse attack methods attackers might use in a real-world environment. Furthermore, the shadow model is trained using the same pre-training architecture and parameter configuration as the target model, ensuring its behavior is highly similar to the target model, thereby enhancing the transferability of the meta-classifier.

[0034] In terms of parameters, the training dataset for the shadow model needs to meet certain sample ratio and diversity requirements. Typically, the ratio of backdoor samples to normal samples is set to 1:9 to avoid the model becoming biased towards the majority class due to data imbalance. Furthermore, each shadow model is trained for 100 epochs, using a cosine annealing scheduling strategy with an initial learning rate of 2e-5 and a minimum learning rate of 1e-6 to ensure model convergence stability. During training, the cross-entropy loss function is used, and the F1 score is monitored on the validation set to evaluate the model's detection performance.

[0035] In terms of application scenarios, this step is widely applicable to deep learning-based malicious traffic detection systems, especially in scenarios where pre-trained models are used for traffic classification. By simulating backdoor samples generated by different tunneling tools, the shadow model can cover multiple attack modes, thereby improving the robustness of the meta-classifier against unknown or hybrid attacks.

[0036] In terms of technical effectiveness, this step provides the meta-classifier with training data containing real attack characteristics, enabling it to learn the behavioral differences between the backdoor model and the normal model. By introducing backdoor samples generated by various tunneling tools, this invention effectively improves the detection algorithm's ability to identify multi-tunnel backdoors. As shown in the experimental results, in multi-tunnel backdoor scenarios, the invention achieves an F1 score of 1.0000, significantly outperforming existing solutions. This step not only improves detection accuracy but also enhances the practicality and adaptability of the detection system.

[0037] S2, based on the shadow pre-training model, calculate the centroid of the benign sample embedding vector and the centroid of the malicious sample embedding vector, and generate a feature importance score based on the gradient of the embedding vector of the interpreted sample to the centroid of the benign sample embedding vector and the centroid of the malicious sample embedding vector.

[0038] Specifically, in some implementations, the interpretation algorithm of this invention generates feature importance scores by calculating the gradient of the interpreted sample embedding vector relative to the centroids of benign and malicious sample embedding vectors, thereby providing input features for the meta-classifier. The core technical principle of this step is based on the geometric distribution characteristics in the embedding space, revealing the sensitivity of samples between benign and malicious categories through gradient analysis, and thus reflecting whether they may be affected by backdoor triggering perturbations.

[0039] In application scenarios, this step is suitable for malicious traffic detection models based on pre-trained encoders, especially for scenarios involving dynamically generated backdoor triggering perturbations such as DNS tunnels. Through gradient analysis, this method can identify key feature regions in the sample that may be exploited by backdoors without reconstructing the triggers, thereby improving the robustness and efficiency of detection.

[0040] The technical advantage of this step lies in its ability to effectively capture the boundary sensitivity between benign and malicious categories of samples by embedding gradient information in the space. This provides the meta-classifier with more discriminative feature input, thereby significantly improving the accuracy and response speed of backdoor detection. Experimental results show that this method achieves an F1 score of 1.0000 under various backdoor types, demonstrating excellent detection performance.

[0041] Furthermore, S2 includes: S21, the centroid of the benign sample embedding vector is the average vector of all benign samples in the embedding space, and the centroid of the malicious sample embedding vector is the average vector of all malicious samples in the embedding space.

[0042] Specifically, in the interpretation algorithm of this invention, calculating the centroids of the embedding vectors of benign and malicious samples is one of the key steps in achieving backdoor detection. This step, based on the vector representation in the embedding space, extracts the global feature distribution centers of the two types of samples through statistical learning, thereby providing a benchmark reference for subsequent importance score calculation.

[0043] At the technical implementation level, this step first inputs benign and malicious samples into a pre-trained encoder (such as a network based on the Transformer architecture) to obtain their feature vector representations in the embedding space. The centroid of the embedding vector of benign samples is calculated by taking the arithmetic mean of the embedding vectors of all benign samples in each dimension.

[0044] At the parameter level, the calculation of the embedding vector needs to meet certain standardization requirements, such as using L2 normalization to eliminate the influence of vector length on distance calculation.

[0045] At the application level, this step is widely used in the backdoor detection stage of malicious traffic detection models, especially when dealing with covert attacks based on DNS tunneling. By calculating the distribution centers of benign and malicious samples in the embedding space, it is possible to effectively identify whether the target model exhibits abnormal embedding behavior when faced with specific perturbation samples, thereby assisting the meta-classifier in determining whether a backdoor exists.

[0046] From a technical perspective, this step provides a stable reference point for subsequent gradient calculation and importance score generation, which helps improve the robustness and generalization ability of the interpretation algorithm. Comparative experiments show that this method achieves an F1 score of 1.0000 across various backdoor types, indicating high accuracy and discriminative power in feature space modeling. This is a crucial foundation for the efficient and high-precision backdoor detection achieved in this invention.

[0047] S22, the feature importance score is the absolute difference between the gradient of the embedded vector of the explained sample with respect to the centroid of the embedded vector of the benign sample and the gradient with respect to the centroid of the embedded vector of the malicious sample.

[0048] Specifically, in some implementations, the feature importance score is the absolute difference between the gradient of the embedded vector of the explained sample with respect to the centroid of the benign sample embedded vector and the gradient with respect to the centroid of the malicious sample embedded vector. This technical implementation is based on gradient sensitivity analysis and the geometric characteristics of the embedding space. Specifically, this step first extracts feature embeddings from the input sample using a pre-trained model to obtain its representation vector in a high-dimensional embedding space. Subsequently, the algorithm calculates the geometric center (i.e., the mean of the benign sample embedded vectors) and the geometric center of the malicious sample embedded vectors, respectively, as representative feature points of the two types of samples in the embedding space. In a further implementation, the distance between the embedded vector of the explained sample and the centroids of the benign and malicious sample embedded vectors is defined as the Euclidean distance.

[0049] S3, the original sample and the feature importance score are concatenated in the column direction to form the input sample of the meta-classifier.

[0050] Specifically, in some implementations, the original samples are concatenated column-wise with the feature importance scores to form the input samples for the meta-classifier. This is a key data preprocessing step in the backdoor detection algorithm of this invention. This step aims to integrate the original traffic features with the model's interpretation of the samples, thereby enhancing the meta-classifier's ability to discriminate whether the target model contains a backdoor.

[0051] From a technical implementation perspective, the original samples are typically preprocessed malicious traffic feature vectors, such as time-series features based on DNS requests. The feature importance score is calculated using an interpretation algorithm. This algorithm, based on gradient information, calculates the distance gradient between the centroids of the embedded vectors of the interpreted sample and those of benign and malicious samples, respectively, and then synthesizes these gradients to obtain the importance score. This score reflects the degree of attention the model pays to each feature in its classification decision, demonstrating significant interpretability.

[0052] At the application level, this step is widely used in the shadow model construction process during the training phase. Each shadow model represents a pre-trained model with or without a backdoor. The input samples generated through this concatenation operation are used to train the meta-classifier, enabling it to distinguish between different backdoor types. In the detection phase, this step is also used to generate input samples for the target model, which are then used by the meta-classifier to predict whether a backdoor exists.

[0053] The technical advantage of this step lies in its ability to effectively capture abnormal patterns in model behavior by fusing raw samples with model explanation information, thereby improving the meta-classifier's ability to identify backdoor models. Experimental results show that this method achieves an F1 score of 1.0000 in detection accuracy across various DNS tunnel backdoor types, significantly outperforming existing solutions. Furthermore, this step eliminates the need for iterative search triggers, improving overall detection efficiency and demonstrating good practicality and innovation.

[0054] Furthermore, S3 includes: S31, the column-direction concatenation is to concatenate the feature vector of the original sample with the feature importance score vector in the feature dimension to form a higher-dimensional feature representation.

[0055] Specifically, in the malicious traffic detection model backdoor detection method of the present invention, this step is a key step in constructing the input features of the meta-classifier. Its technical implementation is based on vector concatenation operation, which aims to integrate the original data and model interpretation information to improve the discrimination ability of backdoor detection.

[0056] In practical applications, this step is typically used for constructing input features for the meta-classifier during the training phase. For example, during meta-classifier training, each sample needs to generate a corresponding concatenated feature vector as the training input for the meta-classifier. Similarly, during the detection phase, the samples from the target model are processed by an interpretation algorithm and then concatenated before being input into the meta-classifier for backdoor existence detection.

[0057] Through this concatenation operation, the meta-classifier can simultaneously perceive the original traffic features and the model's sensitivity to those features, thereby more effectively identifying whether a backdoor has been implanted in the model. Experimental results show that this method achieves an F1 score of 1.0000 in detection accuracy across various DNS tunnel backdoor types, significantly outperforming existing solutions and demonstrating its technical value in improving detection performance.

[0058] S32, the concatenated input samples are used for meta-classifier training to enhance the model's ability to discriminate backdoor states.

[0059] Specifically, in some implementations, the step of "using the concatenated input samples for meta-classifier training" is a core component of the backdoor detection algorithm training phase of this invention. Its technical implementation principle is based on sample interpretability analysis and feature fusion mechanisms. This step constructs the training input for the meta-classifier by concatenating the original input samples and their corresponding importance scores in the column direction, thereby enhancing the model's ability to discriminate backdoor states.

[0060] The specific operation is as follows: First, the original samples are processed using an interpretation algorithm (such as gradient-based centroid distance analysis of embedding vectors) to calculate their gradient response between the centroids of benign and malicious sample embedding vectors, thereby obtaining the importance score vector of the sample. This importance score vector reflects the degree of influence of each feature in the sample on the model output and has strong interpretability. Further, the original sample feature vector and this importance score vector are concatenated in the column direction to form a new feature matrix, which serves as the input sample for the meta-classifier. For example, if the original sample dimension is... The importance score dimension is also The dimension of the concatenated input sample is then... This provides richer discriminative features for the meta-classifier.

[0061] At the parameter level, key parameters involved in this step include the dimension of the embedding vector. The calculation method for the centroid of the embedded vector (such as using the mean or weighted average), and the concatenation method (column concatenation or row concatenation). In this invention, column concatenation is used to maintain the original structure of the samples and ensure that the meta-classifier can effectively learn the correlation between the original features and the interpreted features.

[0062] In application scenarios, this step is suitable for the shadow model processing flow during the training phase, especially when facing dynamically generated backdoor triggering perturbations. By fusing original features and interpreted features, it improves the robustness of the meta-classifier in identifying backdoor states. For example, in DNS tunnel attack detection, this method can effectively distinguish between normal traffic and malicious traffic injected with backdoor triggering perturbations.

[0063] The technical advantage of this step lies in significantly improving the meta-classifier's ability to discriminate backdoor states by introducing the fusion of interpretable features and original features. Experimental results show that this method achieves an F1 score of 1.0000 on various backdoor types (such as DNS2TCP, DNSCat2, and Iodine), outperforming existing schemes based on reconstruction or meta-classifiers, thus achieving higher detection accuracy and stronger generalization ability.

[0064] S4, Use the input samples to train a meta-classifier to distinguish between models with backdoors and models without backdoors.

[0065] Specifically, in the step of training the meta-classifier, this invention employs a shadow model-based meta-learning framework to distinguish between pre-trained models with backdoors and those without. The core of this step lies in constructing a representative set of shadow models and extracting the importance features of the samples through an interpretation algorithm, which serve as input to the meta-classifier, thereby achieving efficient judgment of the backdoor state of the target model.

[0066] In some implementations, the training phase first generates multiple shadow pre-trained models, some of which are intentionally injected with backdoors, while others remain without backdoors. The construction of these shadow models must follow a structure and training process consistent with the target model to ensure similarity in feature space and behavioral patterns. For each shadow model, this invention uses an interpretation algorithm (such as gradient-based embedding vector centroid analysis) to calculate the importance score of the input sample. Specifically, the algorithm first calculates the class centers (i.e., embedding vector centroids) of benign and malicious samples in the embedding space, then calculates the distance gradient between the interpreted sample and these two class centers, and combines the gradient information to generate an importance score. This importance score reflects the sensitivity of the sample in the model's decision-making process and is a key feature for determining whether the model has been injected with a backdoor.

[0067] Optionally, the input to the meta-classifier is formed by concatenating the original sample features with their corresponding importance scores in a column-wise concatenation manner to create a high-dimensional feature vector. The meta-classifier can be trained using a neural network classification model. During training, supervised learning is performed using a labeled shadow model dataset (containing sample features from both backdoor and non-backdoor models) to optimize the classifier's decision boundary.

[0068] Furthermore, this step plays a crucial role in the overall technical solution. Through training the meta-classifier, the system can learn the difference patterns between the backdoor model and the non-backdoor model in the feature space, thus achieving efficient backdoor detection without reconstructing triggers or relying on the output of the target model during the detection stage. Experimental results show that this method achieves an excellent F1 score of 1.0000 in various DNS tunnel backdoor types, significantly outperforming existing solutions and demonstrating its technical advantages in detection accuracy and efficiency.

[0069] S5, detect the target pre-trained model, calculate the average prediction score of its input samples, and compare the average prediction score with a preset threshold to determine whether the target pre-trained model has a backdoor.

[0070] Specifically, in the detection phase, this invention calculates the average prediction score of the target pre-trained model for the input samples and compares it with a preset threshold to determine whether the model contains a backdoor. This step is a key decision-making step in the entire backdoor detection algorithm, and its technical implementation is based on the synergistic effect of model interpretability analysis and meta-classifier.

[0071] In some implementations, this step first processes a set of test samples, typically including benign and malicious traffic samples. Forward propagation is performed on each sample using a pre-trained model targeting the target traffic to obtain the model's predicted output. Since malicious traffic backdoor trigger perturbations are dynamically generated, this invention does not rely on reconstructing the trigger but instead calculates an importance score for each sample using an interpretation algorithm (such as gradient-based embedding vector centroid analysis). This importance score reflects the model's sensitivity to input features during prediction, thus indirectly revealing whether the model exhibits anomalous behavior.

[0072] Furthermore, this invention concatenates the original samples with their corresponding importance scores along the feature dimension to form the input feature vector of the meta-classifier. The meta-classifier, trained during the training phase using multiple shadow models with and without backdoors, can effectively identify backdoor traces in model behavior patterns. During the detection phase, the meta-classifier predicts the concatenated feature vector and outputs a predicted score for each sample. This predicted score is typically a probability value between 0 and 1, representing the likelihood that the model is a backdoor model.

[0073] Optionally, this invention sets a preset threshold (e.g., 0.5) to distinguish between models with and without backdoors. If the average prediction score of the target model is greater than the threshold, it is determined that a backdoor exists; otherwise, it is determined that there is no backdoor. This threshold can be adjusted according to the false positive rate and false negative rate in actual application scenarios to meet the requirements of different security levels.

[0074] In practical applications, this step can be deployed in the model validation module of a malicious traffic detection system to screen for backdoors before the model goes live. Its technical advantage lies in achieving high-precision backdoor detection without reconstructing dynamic trigger perturbations, while avoiding the dependence on model output format found in traditional methods, thus improving detection efficiency and generalization ability. Experimental results show that this method achieves optimal detection performance with an F1 score of 1.0000 across various DNS tunnel backdoor types.

[0075] The malicious traffic detection model backdoor detection method of this invention can effectively detect backdoors in pre-trained models in malicious traffic detection, improve detection accuracy and efficiency, and reduce the risk of malicious traffic bypassing detection.

[0076] Furthermore, it also includes: S6, the prediction results of the meta-classifier are averaged to reduce the noise impact of individual sample predictions and improve the robustness of the overall detection.

[0077] Specifically, in some implementations, averaging the prediction results of the meta-classifier is a key step in improving the robustness of the backdoor detection method of this invention. This step reduces the impact of noise or outliers that may exist in the prediction of a single sample on the final detection result by fusing the prediction outputs of multiple samples, thereby enhancing the stability and accuracy of the overall model's judgment.

[0078] At the technical implementation level, this averaging process is based on the idea of ​​ensemble learning, employing a soft voting mechanism to fuse the output probabilities of multiple samples. Its output is the probability value of a sample belonging to either "with a backdoor" or "without a backdoor." During the detection phase, for each test sample predicted by the target model, the system averages these probability values ​​to obtain the final average prediction score.

[0079] At the parameter level, key parameters involved in averaging include prediction probability thresholds. In this invention, the number of meta-classifiers is typically set to 3 to 5 to balance model diversity and computational cost. The final average prediction score is compared with a preset threshold (e.g., 0.5). If the score is higher than the threshold, the target model is determined to have a backdoor; otherwise, it is determined to have no backdoor.

[0080] In terms of application scenarios, this step is suitable for backdoor detection tasks of pre-trained models in malicious traffic detection systems. It is particularly effective in mitigating misjudgments caused by model bias or sample noise in attack scenarios involving dynamically generated triggering perturbations such as DNS tunnels. Through averaging, the system maintains high detection accuracy even when facing complex and varied backdoor types (such as DNS2TCP, DNSCat2, Iodine, and multi-tunnel hybrid backdoors).

[0081] In terms of technical effectiveness, this step significantly improves the robustness and generalization ability of the detection system. Experimental results show that in DNS2TCP backdoor detection, the F1 score of this invention reaches 1.0000, which is better than the 0.6486 of existing meta-classifier schemes. Furthermore, this method avoids the inefficiency of traditional iterative search triggers, significantly shortening the detection time, thus possessing greater practical value in real-world deployments.

[0082] S7. Based on the comparison result between the average predicted score and the preset threshold, output the backdoor state of the target pre-trained model and record the detection log for subsequent model auditing.

[0083] Specifically, in some implementations, the backdoor state of the target pre-trained model is output based on the comparison between the average predicted score and a preset threshold, and a detection log is recorded for subsequent model auditing. This is a key decision-making and recording step in the backdoor detection method of this invention. This step is based on the meta-classifier's judgment of the target model's prediction results during the detection phase, thereby achieving the final determination of whether a backdoor exists in the pre-trained model.

[0084] From a technical implementation perspective, this step first calculates the average prediction score of the meta-classifier for the target model. Then, this average prediction score is compared with a preset threshold. If the prediction score is greater than or equal to the threshold, the target model is determined to be in a "backdoor" state; otherwise, it is determined to be in a "no backdoor" state. This threshold is typically set after statistical analysis of the prediction results of the shadow model during the training phase, for example, by using the F1 Score maximization principle or the Area Under the ROC Curve (AUC) optimization method for threshold selection.

[0085] At the parameter level, the calculation of the average prediction score involves key parameters such as sample gradient, centroid distance of embedding vectors, and weight allocation strategy. In this invention, the centroid distance of embedding vectors is measured using Euclidean distance, and the gradient calculation is based on the backpropagation algorithm. Furthermore, the threshold setting needs to consider the balance between the false positive rate and the false negative rate, typically adjusted between 0.1 and 0.9 to adapt to the detection requirements of different backdoor attack scenarios.

[0086] At the application level, this step is widely used in the pre-deployment review of malicious traffic detection systems, the security verification after model updates, and the model audit process. By recording detection logs, including prediction scores, thresholds, judgment results, sample characteristics, and other information, detailed data support can be provided for subsequent model tracing, attack analysis, and compliance review.

[0087] In terms of technical effectiveness, this step achieves efficient and accurate determination of the backdoor state of the target pre-trained model, avoiding the reliance on trigger reconstruction in traditional methods and significantly improving detection efficiency. Simultaneously, the logging mechanism enhances the auditability and transparency of the model, providing a guarantee for the secure operation of the malicious traffic detection system.

[0088] The method in this invention avoids using reconstruction trigger-based approaches, thus addressing the problem of dynamic generation and difficulty in reconstructing traffic backdoor trigger perturbations. This invention also avoids directly using the output of the target model, thus resolving the issue of different output formats between pre-trained encoders and traditional supervised models. These designs improve detection accuracy. Furthermore, this invention avoids using iterative search methods, thereby improving detection efficiency.

[0089] Example 2 This invention proposes a backdoor detection method for pre-trained models used in deep learning-based malicious traffic detection. The architecture of this method is as follows: Figure 2 As shown, the algorithm consists of two phases: a training phase and a detection phase. In the training phase, the algorithm trains a meta-classifier using a shadow pre-trained model. In the testing phase, the algorithm uses the meta-classifier to detect whether a backdoor exists in the target model. Furthermore, the algorithm uses an interpretation algorithm to calculate feature importance scores, which are then input into the meta-classifier.

[0090] During the training phase, the algorithm of this invention trains multiple pre-trained models with backdoor shadows. and shadowless pre-trained models without backdoors Based on each shadow pre-trained model, the algorithm of this invention computes a meta-classifier. Input samples The sample is labeled based on whether the shadow model has a backdoor. The process is as follows:

[0091] in This is an interpretable algorithm that outputs an importance score. This invention will use the original sample And importance score Concatenate along the column direction. The formula is as follows:

[0092] Finally, the algorithm of this invention uses the training sample set. Training shadow models .

[0093] During the detection phase, the algorithm of this invention calculates the meta-classifier. Input samples And calculate the predicted score for the sample. The process is as follows:

[0094] Finally, the algorithm of this invention calculates the average predicted score. and with threshold The results are compared. If the score is greater than the threshold, the detection result is that a backdoor exists. If the score is less than the threshold, the detection result is that no backdoor exists.

[0095] The interpretation algorithm of this invention calculates importance scores based on sample gradients. First, the algorithm calculates the centroid of the benign sample embedding vector. and the centroid of the embedding vector of malicious samples The formula is as follows:

[0096] Then, the algorithm calculates the interpreted sample. Embedded vector to the centroid of the embedded vector and The distance is calculated, and the distance between the explained sample pairs is also calculated. The gradient. The algorithm synthesizes the centroid of the embedding vector of benign samples. The gradient and centroid of the embedding vector of malicious samples The gradient is used to calculate the final importance score. With malicious samples For example, its formula is as follows:

[0097] This invention is compared with existing solutions across various backdoor types. These backdoor types include those set up by various DNS tunneling tools to bypass detection. Single-tunnel backdoors include DNS2TCP, DNSCat2, and Iodine. Multi-tunnel backdoors incorporate all three of these tunneling tools, meaning all three can bypass detection. First, the detection accuracy of this invention is compared with existing solutions. The F1 score is used in the comparison. A higher F1 score indicates higher detection accuracy. The comparison results are shown in Table 1.

[0098] Table 1. F1 Score of the Comparison Detection Algorithm

[0099] Then, the detection efficiency of this invention is compared with that of existing solutions. The comparison is primarily focused on the DNS2TCP backdoor; other backdoor types are similar. The detection time of the algorithms is evaluated during the comparison, in seconds. The comparison results are as follows: Figure 3 As shown.

[0100] Based on the comparison results, the present invention outperforms existing solutions in detection accuracy for various backdoor types. The present invention also outperforms existing solutions (excluding existing meta-classifiers) in detection efficiency for DNS2TCP backdoors. Therefore, compared to existing solutions, the present invention achieves higher detection accuracy and efficiency.

[0101] This invention presents a backdoor detection algorithm based on a pre-trained deep learning model for malicious traffic detection. This algorithm achieves both high detection accuracy and efficiency.

[0102] Example 3 To achieve the above embodiments, such as Figure 4 As shown, this embodiment also provides a malicious traffic detection model backdoor detection device 10, including: The shadow model construction module 100 is used to construct multiple shadow pre-trained models, including shadow models with backdoors and shadow models without backdoors. Embedding vector centroid calculation module 200 is used to calculate the centroid of benign sample embedding vector and the centroid of malicious sample embedding vector based on the shadow pre-trained model, and generate feature importance scores according to the gradient from the embedding vector of the interpreted sample to the centroid of benign sample embedding vector and the centroid of malicious sample embedding vector. The feature concatenation module 300 is used to concatenate the original sample with the feature importance score in the column direction to form the input sample of the meta-classifier; Meta-classifier training module 400 is used to train a meta-classifier using the input samples to distinguish between models with backdoors and models without backdoors; The backdoor detection and judgment module 500 is used to detect the target pre-trained model, calculate the average prediction score of its input samples, and compare the average prediction score with a preset threshold to determine whether the target pre-trained model has a backdoor.

[0103] Furthermore, the shadow model building module is also used for: Construct a shadow model with a DNS2TCP backdoor, or a shadow model with a DNSCat2 backdoor, or a shadow model with an Iodine backdoor, or a shadow model with all three of the above backdoors. The model was trained using backdoor samples generated by different tunneling tools to simulate the behavior of the model in real attack scenarios.

[0104] Furthermore, the embedded vector centroid calculation module is also used for: Calculate the average vector of all benign samples in the embedding space as the centroid of the benign sample embedding vector, and calculate the average vector of all malicious samples in the embedding space as the centroid of the malicious sample embedding vector. The absolute difference between the gradient of the embedded vector of the explained sample with respect to the centroid of the embedded vector of the benign sample and the gradient with respect to the centroid of the embedded vector of the malicious sample is calculated as the feature importance score.

[0105] Furthermore, the feature splicing module is also used for: The feature vectors of the original samples and the feature importance score vectors are concatenated in the column direction along the feature dimension to form a higher-dimensional feature representation; The concatenated input samples are used for meta-classifier training to enhance the model's ability to distinguish backdoor states.

[0106] Furthermore, it also includes: An averaging module is used to average the prediction results of the meta-classifier in order to reduce the noise impact of individual sample predictions and improve the robustness of the overall detection. The status output and log recording module is used to output the backdoor status of the target pre-trained model based on the comparison result of the average prediction score and the preset threshold, and record the detection log for subsequent model auditing.

[0107] The malicious traffic detection model backdoor detection device of this invention can effectively detect backdoors in pre-trained models during malicious traffic detection, improve detection accuracy and efficiency, and reduce the risk of malicious traffic bypassing detection.

[0108] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0109] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A method for detecting backdoors in a malicious traffic detection model, characterized in that, include: S1, Construct multiple shadow pre-trained models, including shadow models with backdoors and shadow models without backdoors; S2, based on the shadow pre-trained model, calculate the centroid of the benign sample embedding vector and the centroid of the malicious sample embedding vector, and generate a feature importance score based on the gradient of the embedding vector of the interpreted sample to the centroid of the benign sample embedding vector and the centroid of the malicious sample embedding vector. S3, concatenate the original sample with the feature importance score in the column direction to form the input sample of the meta-classifier; S4, Use the input samples to train a meta-classifier to distinguish between models with backdoors and models without backdoors; S5, detect the target pre-trained model, calculate the average prediction score of its input samples, and compare the average prediction score with a preset threshold to determine whether the target pre-trained model has a backdoor.

2. The method as described in claim 1, characterized in that, The construction of multiple shadow pre-trained models also includes: S11, the shadow pre-trained model with backdoor uses a shadow model with DNS2TCP backdoor. It may be a shadow model with a DNSCat2 backdoor, or a shadow model with an Iodine backdoor, or a shadow model with all three of the above backdoors. S12, the construction process of the shadow pre-trained model includes training with backdoor samples generated by different tunneling tools to simulate the model behavior under real attack scenarios.

3. The method as described in claim 1, characterized in that, The step of calculating the centroids of benign and malicious sample embedding vectors based on the shadow pre-trained model, and generating feature importance scores based on the gradients from the embedding vector of the interpreted sample to the centroids of the benign and malicious sample embedding vectors, further includes: S21, the centroid of the benign sample embedding vector is the average vector of all benign samples in the embedding space, and the centroid of the malicious sample embedding vector is the average vector of all malicious samples in the embedding space. S22, the feature importance score is the absolute difference between the gradient of the embedded vector of the explained sample with respect to the centroid of the embedded vector of the benign sample and the gradient with respect to the centroid of the embedded vector of the malicious sample.

4. The method as described in claim 1, characterized in that, The step of concatenating the original samples with the feature importance scores in the column direction to form the input samples for the meta-classifier also includes: S31, the column-direction concatenation is to concatenate the feature vector of the original sample with the feature importance score vector in the feature dimension to form a higher-dimensional feature representation; S32, the concatenated input samples are used for meta-classifier training to enhance the model's ability to discriminate backdoor states.

5. The method as described in claim 1, characterized in that, Also includes: S6, the prediction results of the meta-classifier are averaged to reduce the noise impact of individual sample predictions and improve the robustness of the overall detection. S7. Based on the comparison result between the average predicted score and the preset threshold, output the backdoor state of the target pre-trained model and record the detection log for subsequent model auditing.

6. A backdoor detection device for a malicious traffic detection model, characterized in that, include: The shadow model building module is used to build multiple shadow pre-trained models, including shadow models with backdoors and shadow models without backdoors. The embedding vector centroid calculation module is used to calculate the centroids of benign sample embedding vectors and malicious sample embedding vectors based on the shadow pre-trained model, and generate feature importance scores based on the gradients from the embedding vector of the interpreted sample to the centroids of benign and malicious sample embedding vectors. The feature concatenation module is used to concatenate the original sample with the feature importance score in the column direction to form the input sample of the meta-classifier; The meta-classifier training module is used to train a meta-classifier using the input samples to distinguish between models with backdoors and models without backdoors. The backdoor detection and judgment module is used to detect the target pre-trained model, calculate the average prediction score of its input samples, and compare the average prediction score with a preset threshold to determine whether the target pre-trained model has a backdoor.

7. The apparatus as claimed in claim 6, characterized in that, The shadow model construction module is also used for: Construct a shadow model with a DNS2TCP backdoor, or a shadow model with a DNSCat2 backdoor, or a shadow model with an Iodine backdoor, or a shadow model with all three of the above backdoors. The model was trained using backdoor samples generated by different tunneling tools to simulate the behavior of the model in real attack scenarios.

8. The apparatus as claimed in claim 6, characterized in that, The embedded vector centroid calculation module is also used for: Calculate the average vector of all benign samples in the embedding space as the centroid of the benign sample embedding vector, and calculate the average vector of all malicious samples in the embedding space as the centroid of the malicious sample embedding vector. The absolute difference between the gradient of the embedded vector of the explained sample with respect to the centroid of the embedded vector of the benign sample and the gradient with respect to the centroid of the embedded vector of the malicious sample is calculated as the feature importance score.

9. The apparatus as claimed in claim 6, characterized in that, The feature splicing module is also used for: The feature vectors of the original samples and the feature importance score vectors are concatenated in the column direction along the feature dimension to form a higher-dimensional feature representation; The concatenated input samples are used for meta-classifier training to enhance the model's ability to distinguish backdoor states.

10. The apparatus as claimed in claim 6, characterized in that, Also includes: An averaging module is used to average the prediction results of the meta-classifier in order to reduce the noise impact of individual sample predictions and improve the robustness of the overall detection. The status output and log recording module is used to output the backdoor status of the target pre-trained model based on the comparison result of the average prediction score and the preset threshold, and record the detection log for subsequent model auditing.

Images