Lightweight malicious traffic detection method and system based on multi-teacher collaborative debate

Abstract

The invention provides a lightweight malicious traffic detection method and system based on multi-teacher collaborative debate, and belongs to the field of network security. Inputting the network flow data into a plurality of teacher big language models to respectively obtain prediction classification labels and hierarchical reasoning reasons; comparing the prediction classification labels, if the prediction classification labels are inconsistent, selecting an expert review group leader according to the historical performance of each model, outputting classification judgment and reason statement layer by layer by each model according to a preset specification, and performing multi-round debate under the guidance of the leader; after debate is finished, the group leader carries out knowledge alignment based on the sponsoring rates of different labels, and consensus labels and fused reasoning reasons are generated; comparing the consensus tag with the real tag, and if the consensus tag is consistent with the real tag, taking the consensus tag and the corresponding reasoning reason as the original textbook content; according to the method, a lightweight student model is selected, an original teaching material is utilized for training, and the trained model is deployed in a real network environment, so that real-time detection of malicious traffic is realized, and powerful support is provided for network security protection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a lightweight malicious traffic detection method and system based on multi-teacher collaborative debate. BACKGROUND

[0002] Malicious traffic detection based on network traffic large language model is a technology that captures hidden malicious patterns in encrypted traffic through deep semantic modeling of massive traffic sequence data by a large language model, and realizes malicious traffic classification and protocol identification. Its core advantage is that the detection accuracy far exceeds traditional rule-based or feature-based methods, and it is a key technical support for protecting personal information security, enterprise business interests and network space security in the digital era.

[0003] With the intensification of network security threats, the types of malicious traffic are increasing and the means are being renewed, significantly improving the accuracy and real-time requirements of detection technology. Although network traffic large language models can meet the accuracy requirements, the parameter quantity often reaches tens of billions or even hundreds of billions, requiring extremely high hardware computing and storage resources, making it difficult to deploy in resource-constrained devices such as gateways and edge terminals. Moreover, the high detection delay caused by complex model calculations makes it impossible to respond to sudden network security incidents in edge scenarios, and its application faces serious obstacles.

[0004] To solve this problem, knowledge distillation technology is used for model lightweight, but existing methods mostly use single-teacher distillation paradigm: on the one hand, a single teacher model is limited by training data and architecture, resulting in knowledge blind spots and cognitive biases, which leads to poor generalization performance of student models and makes it difficult to adapt to cross-scenario encrypted malicious traffic detection; on the other hand, a single model cannot fully cover the dynamic and diverse multi-modal malicious traffic patterns, making the student model lack the ability to identify new malicious traffic variants; at the same time, traditional distillation only imitates the output results of the teacher, ignoring the reasoning logic chain, resulting in a lack of explainability in the student model, which is not conducive to malicious traffic traceability analysis and makes it difficult to meet the actual network security protection needs. SUMMARY

[0005] To solve the above problems, the present application provides a lightweight malicious traffic detection method and system based on multi-teacher collaborative debate, which meets the real-time detection requirements in real network environments and provides strong support for network security protection.

[0006] To achieve the above purpose, the present application adopts the following technical solutions: In a first aspect, the present application provides a lightweight malicious traffic detection method based on multi-teacher collaborative debate, comprising: inputting network traffic data into multiple teacher large language models to obtain predicted classification labels and layered reasoning reasons respectively; the layers include original data layer, behavior reasoning layer and protocol feature layer; If there is any inconsistency between the predicted classification labels, an expert review panel leader is selected based on the historical performance of each model. Each model outputs classification judgments and reasoning statements layer by layer according to preset specifications, and the panel leader guides multiple rounds of debate. After the debate, the panel leader performs knowledge alignment based on the approval rate of different labels to generate consensus labels and fusion reasoning. The consensus label is compared with the real label. If they match, the consensus label and the corresponding reasoning are used as the original teaching material. A lightweight student model was selected, trained using the original teaching materials, and then deployed in a real network environment to achieve real-time detection of malicious traffic.

[0007] Secondly, this invention provides a lightweight malicious traffic detection system based on multi-teacher collaborative debate, comprising: The multi-model collaborative analysis module is used to input network traffic data into multiple teacher large language models to obtain predicted classification labels and hierarchical inference reasons; the hierarchical structure includes the raw data layer, the behavior inference layer, and the protocol feature layer. The expert review and debate module is used to compare the predicted classification labels. If there is any inconsistency, an expert review group leader is selected based on the historical performance of each model. Each model outputs classification judgments and reasoning statements layer by layer according to preset specifications, and the group leader guides multiple rounds of debate. After the debate, the group leader performs knowledge alignment based on the approval rate of different labels to generate consensus labels and fusion reasoning reasons. The textbook construction module is used to compare the consensus label with the real label. If they match, the consensus label and the corresponding reasoning reason are used as the original textbook content. The lightweight detection deployment module is used to select a lightweight student model, train it using the original teaching materials, and deploy the trained model in a real network environment to achieve real-time detection of malicious traffic.

[0008] Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the lightweight malicious traffic detection method based on multi-teacher collaborative debate described in the first aspect.

[0009] Fourthly, the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the lightweight malicious traffic detection method based on multi-teacher collaborative debate described in the first aspect.

[0010] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention leverages a multi-teacher large language model to output prediction results and hierarchical reasoning from the raw data layer, behavioral reasoning layer, and protocol feature layer. It combines historical performance to select group leaders, guide multiple rounds of debate, and align knowledge, effectively integrating the advantages of multiple models and overcoming the "cognitive silos" of single models, thus improving detection accuracy and generalization ability. By comparing consensus labels with real labels to filter teaching material content and training a lightweight student model, it significantly reduces the number of model parameters and inference time, enabling deployment on resource-constrained devices such as gateways and edge terminals to meet real-time detection needs. Furthermore, hierarchical reasoning and consensus knowledge make the detection results interpretable, the teaching material system easy to update, and enhance knowledge maintainability, providing reliable support for network security protection.

[0011] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0012] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute a limitation thereof.

[0013] Figure 1 The main flowchart of a lightweight malicious traffic detection method based on multi-teacher collaborative debate provided in this embodiment of the invention; Figure 2 This is a flowchart illustrating a lightweight malicious traffic detection method based on multi-teacher collaborative debate, provided as an embodiment of the present invention. Detailed Implementation

[0014] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0015] Example 1 like Figure 1 As shown, this embodiment discloses a lightweight malicious traffic detection method based on multi-teacher collaborative debate, including the following steps: S1: Input network traffic data into multiple teacher large language models to obtain predicted classification labels and hierarchical inference reasons; the hierarchical structure includes the raw data layer, the behavior inference layer, and the protocol feature layer. S2: If there is any inconsistency between the predicted classification labels, the expert review group leader is selected based on the historical performance of each model. Each model outputs classification judgments and reasoning statements layer by layer according to the preset specifications, and the group leader guides multiple rounds of debate. After the debate, the group leader performs knowledge alignment based on the approval rate of different labels to generate consensus labels and fusion reasoning reasons. S3: Compare the consensus label with the real label. If they match, use the consensus label and the corresponding reasoning as the original teaching material. S4: Select a lightweight student model, train it using the original teaching materials, and deploy the trained model in a real network environment to achieve real-time detection of malicious traffic.

[0016] Next, combined Figure 2 This embodiment provides a detailed description of a lightweight malicious traffic detection method based on multi-teacher collaborative debate.

[0017] In the field of malicious traffic detection, knowledge distillation technology provides a key path to solve the problem of deploying large language models for large network traffic. It can compress and transfer the complex traffic analysis knowledge and decision-making capabilities contained in large models to lightweight models, thereby reducing hardware resource consumption while retaining the detection accuracy of large models to a certain extent. This provides a technical possibility for the traffic detection needs of resource-constrained devices such as gateways and edge terminals.

[0018] However, traditional knowledge distillation often employs a single-teacher model paradigm, which has significant limitations: On the one hand, single-teacher models are constrained by their own training data distribution (e.g., only covering malicious traffic in specific scenarios) and architectural design (e.g., focusing on a single dimension such as protocol parsing or behavior recognition), easily forming "cognitive silos." When faced with cross-scenario encrypted malicious traffic (e.g., different attack modes from corporate intranets to home networks), their generalization ability drops sharply. On the other hand, single models struggle to fully cover multimodal network traffic characteristics (e.g., the periodic heartbeat traffic of botnets, the differences in encrypted C&C traffic of ransomware), resulting in the lightweight model after distillation having insufficient ability to identify new variants of malicious traffic and failing to improve the interpretability of detection results through multi-dimensional reasoning logic.

[0019] To overcome the bottleneck of single-teacher distillation and fully integrate the complementary advantages of different large models in traffic feature extraction, protocol parsing, and behavior pattern judgment, this embodiment proposes to use multiple network traffic large language models for collaborative processing, construct a "teacher team" to carry out traffic analysis and knowledge fusion, and lay the foundation for efficient learning of the subsequent lightweight student model.

[0020] In S1, a multi-teacher model is used for collaborative processing, with teacher models undergoing preprocessing. As one implementation method, TrafficLLM, TrafficGPT, and DoLLM are selected as multiple teacher models. TrafficLLM possesses language interaction capabilities. TrafficGPT and DoLLM are adjusted to retain encoder functionality while acquiring classification results from the classifier output, enabling them to perform network traffic-based inference and interact with external language.

[0021] Multi-teacher model network traffic inference: Traffic data in network flow format is uniformly used as input (all three models support this format), and standardized input / output templates are designed. The templates include system settings (defining the "Network Traffic Analysis Expert" role), task descriptions (selecting labels from predefined categories and combining source / destination IPs, port numbers, and other features for hierarchical inference), and output standards (including "Label: Classification Label" and "Reason: Inference Reason," with the reason covering layers such as the original data layer, behavioral inference layer, and protocol feature layer). The teacher model autonomously extracts features based on traffic metadata, outputting classification labels and the hierarchical inference process.

[0022] In S2, if the output labels of each teacher model are consistent, the model directly enters the textbook construction stage; if there are inconsistencies, the model is guided to compare the inference process of other models layer by layer (such as checking whether the original data layer has missed key port information), locate the differences, optimize the inference logic, and output the corrected labels and reasons.

[0023] The layered design of the inference chain for streaming (stream form of encrypted traffic) mainly includes the raw data layer, the protocol feature layer, and the behavior inference layer.

[0024] Raw data layer: Based on the network flow side channel feature layer, it includes data carrying network flow side channel features such as IP header (source IP / destination IP) and transport layer TCP / UDP header (source port / destination port, sequence number).

[0025] Protocol Feature Layer: Associates HTTP / RFC standards, TLS protocol standards (such as RFC 8446), and knowledge of cryptographic attacks (such as certificate forgery), and mainly carries protocol information data for network traffic.

[0026] Behavioral reasoning layer: Combining historical experience with other characteristics, it performs reasoning analysis on the behavior of network traffic.

[0027] In addition, there is an encoding layer, which is responsible for processing natural language information related to network traffic to capture expression differences, and transforming multi-dimensional traffic data into high-dimensional tensors to capture data feature differences, providing semantic and high-dimensional feature support for reasoning; and a hidden layer, which is used to guide the large language model to call additional knowledge not covered by the first four layers (such as historical anomaly patterns, cross-scene association rules, etc.), output supplementary reasoning reasons, and improve the encrypted traffic reasoning chain.

[0028] This layer-by-layer comparison is not a comparison within a single layer, but rather a process that proceeds layer by layer in the order of the original data layer, protocol feature layer, behavioral reasoning layer, coding layer, and hidden layer: First, for the original data layer, the differences in the network flow side channel features used by each model are discussed to reach a consensus; then, for the protocol feature layer, behavioral reasoning layer, and subsequent layers, the root causes of the differences in each layer are located one by one, and the reasoning logic is re-optimized, finally outputting the corrected labels and reasons.

[0029] In the process of comparing each layer, an expert review and debate mechanism is introduced. First, a dynamic expert review panel is constructed. The panel leader is determined from the participating teacher models based on factors such as the model's historical performance on relevant tasks, including classification accuracy and reasoning robustness.

[0030] Then, each teacher model outlines its own step-by-step reasoning process to prepare for the subsequent debate. Each teacher model outputs its judgment and reasoning for the traffic classification according to pre-defined specifications. For example, Teacher 1 and Teacher 2 explain that the traffic is Weibo traffic based on characteristics such as TCP port 443 related to Weibo, while Teacher 3 explains that the traffic is SMB traffic based on RFC 1002 and TCP port 139 related to SMB-over-NetBIOS. During the explanation, they also use RAG technology to retrieve knowledge from the "textbook," which pre-packages various protocol standards.

[0031] Following this, the group leader guided each teacher's model through multiple rounds of debate at different levels. The models debated based on layers such as the raw data layer, behavioral reasoning layer, and protocol feature layer. When encountering difficult decisions during the debate, RAG technology was used to retrieve knowledge from the "textbook" as the standard answer. After multiple rounds of debate, regardless of whether a consensus was reached, the expert group leader would conclude the debate and collect the approval rates for different tags as the debate results.

[0032] In S3, if the approval rate for the same label reaches 100% after multiple rounds of debate, the expert panel leader will integrate the reasonable reasoning logic of each model to form a debate conclusion. If different labels have different approval rates after multiple rounds of debate, the expert panel leader will combine the approval rates of different labels with the corresponding reasoning reasons of each teacher model, and use RAG technology to retrieve knowledge from the textbook to confirm the final knowledge label and reasoning reasons, thereby achieving knowledge alignment at different levels.

[0033] In S4, the textbook system is constructed based on a multi-teacher model, and knowledge transfer from the student model is carried out.

[0034] First, to ensure the accuracy of the teaching materials, the consensus-based knowledge labels formed at different stages will be compared with the actual labels. If the consensus labels and actual labels match, these labels and their reasoning will be used as the original material for compiling the "teaching materials." If the consensus labels and actual labels do not match, a second label comparison will be conducted, whereby each teacher model's output label will be compared with the actual labels one by one. The consistent labels and their reasoning will be saved as the original material for compiling the "teaching materials," while the inconsistent ones will be discarded. During this process, the accuracy of each teacher model's reasoning will serve as the evaluation criterion for the expert panel leader in the expert review and debate mechanism.

[0035] Afterwards, all the original materials for writing the "textbook" obtained from the judgment of the real labels are sorted and summarized, and a structured "textbook" is formed by organizing it through a large language model and stored in the form of question-and-answer pairs in JSON format.

[0036] Lightweight models are selected as student models, and the open-source framework LLaMA Factory serves as the "classroom" for student model learning, enabling student models to master the knowledge and skills in the "textbook." It should be understood that lightweight models include Qwen, GPT-2, DeepSeek R1 (Distill), etc.

[0037] Finally, the lightweight model is deployed in a real network environment to capture network traffic in real time, output classification labels and inference process, and generate a structured report containing detection results, key feature matching list and risk level, providing a basis for network security protection.

[0038] This embodiment achieves multi-dimensional beneficial effects in the field of network traffic detection through an innovative technical approach involving multi-teacher collaboration, expert debate, and lightweight transfer. To verify the effectiveness of this embodiment: (a) Breakthrough improvement in detection accuracy and generalization ability; (1) In tests on a mixed dataset containing 20 common applications and 15 types of malicious traffic, the detection accuracy of this embodiment improved by an average of 5 percentage points compared to the single-teacher model. From the results of datasets covering different scenarios such as CSTNET2023, APP-53 2023, CW-100 2024, USTC TFC 2016, and ISCX Tor 2016, TrafficDLLM (the framework of this embodiment) performed excellently. On the CSTNET 2023 dataset, the accuracy reached 0.9697 with an F1 score of 0.9640; on the APP-532023 dataset, the accuracy was 0.9350 with an F1 score of 0.9339; on the CW-100 2024 dataset, the accuracy was 0.9418 with an F1 score of 0.9390; on the USTC TFC 2016 dataset, the accuracy was 0.9958 with an F1 score of 0.9956; and on the ISCX Tor 2016 dataset, the accuracy was 0.9892 with an F1 score of 0.9861. These indicators are leading across multiple datasets, fully validating the effectiveness and superiority of this technique in network traffic detection tasks. Specific experimental data comparing this technique with current state-of-the-art methods are shown in the table below.

[0039] Table 1 shows the comparison results on the CSTNET 2023, APP-53 2023, and CW-100 2024 datasets;

[0040] Table 2 shows the comparison results on the USTC TFC 2016ISCX Tor 2016 dataset;

[0041] (2) Multi-source knowledge fusion breaks through the limitations of single models. By leveraging the collaboration of multi-teacher models (TrafficLLM, TrafficGPT, DoLLM), it fully integrates the advantages of different models in traffic feature extraction, protocol parsing, and behavior pattern recognition. Through an expert review and debate mechanism, these scattered knowledge are integrated and verified, effectively solving the "cognitive blind spot" problem caused by the bias of training data or the defects of model architecture in single models.

[0042] (ii) Significant optimization of model lightweighting and deployment flexibility; (1) Extreme compression of resource consumption: Through knowledge distillation technology, the complex knowledge of the multi-teacher model is transferred to the lightweight student model, reducing the number of model parameters from tens of billions of parameters in the teacher model to less than one billion parameters in the student model. In terms of inference time on the RTX 4090 processor, the student model achieves 1 / 10 of the inference time of the teacher model.

[0043] (2) Rapid deployment in multiple scenarios: The lightweight student model can be efficiently deployed on resource-constrained devices such as gateways and edge terminals. In actual deployment tests, on a regular router (equipped with an ARM Cortex-A7 processor and 512MB of memory), the model can achieve real-time detection of network traffic, meeting the low-latency requirements for network traffic detection in multiple scenarios such as enterprise intranets and home networks, and solving the problem that traditional traffic detection solutions based on large language models are difficult to deploy on the edge due to high resource consumption.

[0044] (iii) Significantly enhanced knowledge interpretability and maintainability; (1) Transparent presentation of the layered inference chain: By designing standardized input and output templates, the model will simultaneously output the layered inference reasons when outputting detection results, including the original data layer (judgment based on side-channel characteristics such as source / destination IP and port number), the behavioral inference layer (inference on traffic behavior such as request-response patterns and data transmission frequency), and the protocol feature layer (analysis based on network flow protocol type and port mapping). This allows network security personnel to clearly understand the model's judgment logic. For example, when a certain traffic is detected as "Zeus" malware traffic, it can be clearly seen that it is based on multiple dimensions such as "the destination IP is the IP of the known control server of Zeus (original data layer), the traffic has periodic heartbeat packets and uses a specific encryption algorithm (behavioral inference layer), and uses a non-standard port for communication and the protocol fields match the Zeus feature library (protocol feature layer)," which facilitates manual verification and subsequent security strategy adjustments.

[0045] (2) Sustainable updating of the teaching material system: The structured "teaching material" system contains multi-layered reasoning and supports convenient knowledge updates. When new network applications or new types of malicious traffic emerge, new knowledge can be integrated into the teaching material system through manual processing, and then passed on to the student model, so that the entire detection system can continuously adapt to changes in the network environment and extend the effective life cycle of the model.

[0046] This specific embodiment first uses multiple network traffic large-scale language models as a "teacher team" to analyze, reason, and reflect on traffic. Then, it leverages an expert review and debate mechanism to form consensus knowledge, thereby constructing a "textbook" for lightweight student models to learn. This guides student models to learn the knowledge in the "textbook" to achieve malicious traffic detection. This method can be efficiently deployed in resource-constrained devices in real network environments such as gateways, edge terminals, and smart homes. It inherits the high detection accuracy advantage of network traffic large-scale language models for encrypted malicious traffic, while significantly improving detection speed due to the lightweight student model characteristics to meet the real-time detection requirements in real network environments.

[0047] Example 2 This embodiment provides a lightweight malicious traffic detection system based on multi-teacher collaborative debate, including: The multi-model collaborative analysis module is used to input network traffic data into multiple teacher large language models to obtain predicted classification labels and hierarchical inference reasons; the hierarchical structure includes the raw data layer, the behavior inference layer, and the protocol feature layer. The expert review and debate module is used to compare the predicted classification labels. If there is any inconsistency, an expert review group leader is selected based on the historical performance of each model. Each model outputs classification judgments and reasoning statements layer by layer according to preset specifications, and the group leader guides multiple rounds of debate. After the debate, the group leader performs knowledge alignment based on the approval rate of different labels to generate consensus labels and fusion reasoning reasons. The textbook construction module is used to compare the consensus label with the real label. If they match, the consensus label and the corresponding reasoning reason are used as the original textbook content. The lightweight detection deployment module is used to select a lightweight student model, train it using the original teaching materials, and deploy the trained model in a real network environment to achieve real-time detection of malicious traffic.

[0048] Example 3 This embodiment provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of a lightweight malicious traffic detection method based on multi-teacher collaborative debate as described in Embodiment 1 above.

[0049] Example 4 This embodiment provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps in the lightweight malicious traffic detection method based on multi-teacher collaborative debate described in Embodiment 1 above.

[0050] The steps or modules involved in Embodiments 2 to 4 above correspond to those in Embodiment 1. For specific implementation details, please refer to the relevant description section of Embodiment 1. The term "computer-readable storage medium" should be understood as a single medium or multiple media including one or more instruction sets; it should also be understood as including any medium capable of storing, encoding, or carrying an instruction set for execution by a processor and enabling the processor to perform any of the methods in this invention.

[0051] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A lightweight malicious traffic detection method based on multi-teacher collaborative debate, characterized in that, include: By inputting network traffic data into multiple teacher-specific large language models, predicted classification labels and hierarchical inference reasons are obtained respectively. The layering includes a raw data layer, a behavior reasoning layer, and a protocol feature layer; If there is any inconsistency between the predicted classification labels, an expert review panel leader is selected based on the historical performance of each model. Each model outputs classification judgments and reasoning statements layer by layer according to preset specifications, and the panel leader guides multiple rounds of debate. After the debate, the panel leader performs knowledge alignment based on the approval rate of different labels to generate consensus labels and fusion reasoning. The consensus label is compared with the real label. If they match, the consensus label and the corresponding reasoning are used as the original teaching material. A lightweight student model was selected, trained using the original teaching materials, and then deployed in a real network environment to achieve real-time detection of malicious traffic.

2. The lightweight malicious traffic detection method based on multi-teacher collaborative debate as described in claim 1, characterized in that, The process of inputting network traffic data into multiple teacher-based large language models to obtain predicted classification labels and hierarchical inference reasons specifically includes: Network traffic data and preset prompt word templates are input into each teacher's big language model. The templates define system roles, task descriptions, and output standards. Each model extracts features based on network traffic data to obtain the predicted classification label and a hierarchical reasoning process that includes the original data layer, the behavior reasoning layer, and the protocol feature layer.

3. The lightweight malicious traffic detection method based on multi-teacher collaborative debate as described in claim 1, characterized in that, Each model outputs classification judgments and reasoning statements layer by layer according to preset specifications, specifically including: Each model, based on a pre-defined standardized template, presents its judgment reasons layer by layer, which are based on the raw data layer, the behavioral reasoning layer, and the protocol feature layer. During the presentation, each model queries a pre-built textbook knowledge base using enhanced generative techniques to obtain network protocol standards as a reference for reasoning.

4. The lightweight malicious traffic detection method based on multi-teacher collaborative debate as described in claim 1, characterized in that, The multiple rounds of debate specifically include: The group leader guides each model to conduct multiple rounds of debate at different levels of reasoning. When disagreements arise during a debate, retrieval enhancement generation technology is used to retrieve protocol standards from the textbook knowledge base as a basis for decision-making. When the number of debate rounds reaches the preset limit, the group leader will end the debate.

5. A lightweight malicious traffic detection method based on multi-teacher collaborative debate as described in claim 1, characterized in that, After the debate, the group leader performs knowledge alignment based on the approval rates of different tags, generating consensus tags and the reasoning behind the fusion, specifically including: If the approval rate of a single label reaches 100%, the group leader integrates the reasoning logic of each model to form the consensus label and the reasoning reasoning for the fusion. If different tags have different approval rates, the team leader will combine the approval rates of each tag with the corresponding reasoning, and use search enhancement generation technology to search the textbook knowledge base for final confirmation and complete the knowledge alignment.

6. The lightweight malicious traffic detection method based on multi-teacher collaborative debate as described in claim 1, characterized in that, The step of comparing the consensus label with the real label, and if they match, then using the consensus label and the corresponding reasoning as the original teaching material content, specifically includes: If the consensus label matches the real label, then the label and the reasoning behind it should be used directly as the original teaching material. If the consensus label is inconsistent with the real label, a secondary label comparison is performed. The output label of each teacher model is compared with the real label one by one, and only the consistent label and reasoning are retained as the original teaching material. During this process, the historical performance evaluation criteria used to select expert panel leaders are updated based on the accuracy of each teacher's model reasoning.

7. A lightweight malicious traffic detection system based on multi-teacher collaborative debate, characterized in that, include: The multi-model collaborative analysis module is used to input network traffic data into multiple teacher large language models to obtain predicted classification labels and hierarchical inference reasons; the hierarchical structure includes the raw data layer, the behavior inference layer, and the protocol feature layer. The expert review and debate module is used to compare the predicted classification labels. If there is any inconsistency, an expert review group leader is selected based on the historical performance of each model. Each model outputs classification judgments and reasoning statements layer by layer according to preset specifications, and the group leader guides multiple rounds of debate. After the debate, the group leader performs knowledge alignment based on the approval rate of different labels to generate consensus labels and fusion reasoning reasons. The textbook construction module is used to compare the consensus label with the real label. If they match, the consensus label and the corresponding reasoning reason are used as the original textbook content. The lightweight detection deployment module is used to select a lightweight student model, train it using the original teaching materials, and deploy the trained model in a real network environment to achieve real-time detection of malicious traffic.

8. A lightweight malicious traffic detection system based on multi-teacher collaborative debate as described in claim 7, characterized in that, The process of inputting network traffic data into multiple teacher-based large language models to obtain predicted classification labels and hierarchical inference reasons specifically includes: Network traffic data and preset prompt word templates are input into each teacher's big language model. The templates define system roles, task descriptions, and output standards. Each model extracts features based on network traffic data to obtain the predicted classification label and a hierarchical reasoning process that includes the original data layer, the behavior reasoning layer, and the protocol feature layer.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps in the lightweight malicious traffic detection method based on multi-teacher collaborative debate as described in any one of claims 1-6.

10. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the lightweight malicious traffic detection method based on multi-teacher collaborative debate as described in any one of claims 1-6.

Images