Hierarchical distillation method for botnet detection in encrypted dns traffic

Abstract

The present application relates to a hierarchical distillation method for encrypted DNS traffic in botnet detection, mainly comprising the following steps: through the combination of entropy weight method and grey correlation analysis, the pretreated data is adaptively extracted and screened, and the optimal features with strong correlation with botnet behavior are screened out; the spatial clustering classification strategy is used to classify the botnet, and multiple different types of botnet features are obtained; a hierarchical knowledge distillation model HLD-TCN is constructed and trained; the trained multiple student models are deployed; the real-time encrypted DNS traffic is input, and parallel detection is carried out in turn through each student model, if a certain student model is determined to be abnormal, it is immediately marked as botnet traffic and the subsequent detection is terminated. The present application has the advantages of improving the accuracy of botnet detection in encrypted DNS traffic, and providing an efficient and lightweight solution for network security protection.

Description

Technical Field

[0001] This invention belongs to the field of network traffic security monitoring technology, and in particular relates to a layered distillation method for detecting botnets in encrypted DNS traffic. Background Technology

[0002] With the widespread application of encrypted DNS technologies (such as DNSoverHTTPS and DNSoverTLS), the privacy of network communication has been significantly improved, but this has also brought new challenges to malicious traffic detection. A botnet is a network composed of a large number of internet-connected devices (such as personal computers, servers, mobile devices, and IoT devices) infected and remotely controlled by attackers using malware. These controlled devices execute the attacker's instructions without the user's knowledge, coordinating to carry out illegal activities such as distributed denial-of-service (DDoS) attacks, spam propagation, and the theft of sensitive information. The covert propagation and attacks of botnets through encrypted DNS traffic are becoming increasingly common. Traditional detection methods rely on plaintext traffic characteristics, making them difficult to apply directly to encrypted scenarios, resulting in low detection efficiency, high false positive rates, and an inability to effectively address the complexity and diversity of botnet behavior. Furthermore, existing technical solutions generally rely on manual feature engineering to extract encrypted DNS traffic features, which struggles to comprehensively capture dynamic behavioral patterns. The use of a single detection model or a clustering algorithm with a predetermined number of clusters leads to insufficient adaptability to diverse botnet attacks, while the computational overhead of complex models limits real-time detection efficiency. Summary of the Invention

[0003] To address the aforementioned problems, the present invention aims to provide a hierarchical distillation method for detecting botnets in encrypted DNS traffic. This method solves the challenges of concealment, diversity, and real-time performance in detecting botnets in encrypted DNS traffic, providing an efficient and lightweight solution for network security protection.

[0004] To achieve the above objectives, the present invention adopts the following technical solution:

[0005] A hierarchical distillation method for botnet detection in encrypted DNS traffic includes the following steps: Preprocessing and structuring of encrypted DNS traffic: Adaptive feature extraction and filtering are performed on the preprocessed data by combining entropy weighting and grey relational analysis to select the optimal features with strong correlation to botnet behavior; Spatial clustering classification strategy is used to classify botnets to obtain features of multiple different types of botnets; A hierarchical knowledge distillation model HLD-TCN is constructed and trained, which includes a teacher model and multiple student models; The trained multi-student model is deployed; Real-time encrypted DNS traffic is input and passed through each student model for parallel detection. If a student model determines that the traffic is abnormal, it is immediately marked as botnet traffic and subsequent detection is terminated.

[0006] The present invention has the following beneficial effects:

[0007] 1. This invention employs an adaptive feature extraction algorithm that combines entropy weighting and grey relational analysis to automatically filter temporal features (such as request frequency and data packet size distribution) that are highly correlated with botnets in encrypted DNS traffic, thereby reducing the cost of manual intervention.

[0008] 2. This invention adopts a spatial clustering classification strategy—OPTICS clustering algorithm, which performs multi-classification of botnets based on traffic characteristics. It does not require a preset number of clusters, can identify clusters of arbitrary shapes and effectively remove noise, thus improving classification robustness.

[0009] 3. This invention employs a hierarchical knowledge distillation mechanism, which, through a teacher-student model architecture, distills the temporal feature extraction capabilities and decision logic of a complex teacher model (TCN) into multiple lightweight student models (DE-TCN), achieving parallel detection. Each student model focuses on a specific type of botnet (such as DDoS, data theft, etc.), and combines data augmentation technology (ADASYN) to optimize sample balance, significantly improving detection accuracy and real-time performance.

[0010] 4. This invention automatically filters time-series features that are highly correlated with botnets through an adaptive feature extraction algorithm, combines the OPTICS spatial clustering strategy to achieve multi-classification without the need for a preset number of clusters, and constructs multiple lightweight student models for parallel detection based on a hierarchical knowledge distillation mechanism. This reduces computational complexity while improving the detection accuracy and real-time performance of multiple types of botnets in encrypted DNS traffic, effectively solving the technical challenges of concealment, diversity, and resource efficiency imbalance. Attached Figure Description

[0011] Figure 1 This is a schematic diagram of the layered distillation model of the present invention;

[0012] Figure 2 This is a flowchart of the present invention;

[0013] Figure 3 This is a schematic diagram of the hierarchical knowledge distillation model HLD-TCN of the present invention. Detailed Implementation

[0014] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments:

[0015] See Figure 1 and Figure 2 A hierarchical distillation method for detecting botnets in encrypted DNS traffic includes the following steps:

[0016] Step 10: Preprocess and structure the encrypted DNS traffic. The specific steps are as follows:

[0017] In the preprocessing stage of the detection process, invalid packets, duplicate traffic, and abnormal data are first removed from the raw encrypted DNS traffic to eliminate interference and retain the temporal context data required for the detection task, such as DNS request sequences and response time sequences. The preprocessed data undergoes a unified formatting process, converting the preprocessed encrypted DNS packets into a structured data format. For example, this step includes extracting contextual information such as the temporal sequence data of DNS requests and responses, requested domain names, request frequency, response time, and packet size distribution, thus laying the data foundation for subsequent feature extraction and classification.

[0018] Step 20: Adaptive feature extraction and filtering are performed on the preprocessed data by combining the Entropy Weight Method (EWM) and Grey Relational Analysis (GRA). The adaptive feature extraction module automatically selects the features most strongly correlated with botnet behavior from a large number of traffic features by combining the Entropy Weight Method (EWM) and Grey Relational Analysis (GRA). Extracted features include packet size distribution, DNS request frequency, time series characteristics, and traffic patterns. These features help improve the model's ability to identify various botnet behaviors. The specific steps are as follows:

[0019] First, construct the training dataset and perform step 21:

[0020] Step 21: Combine the preprocessed and structured encrypted DNS traffic dataset As the input dataset, the target label is Where n is the number of samples and m is the number of features. This represents the network traffic category corresponding to the i-th sample. Let represent the j-th feature value of the i-th sample.

[0021] Secondly, the effectiveness of features is evaluated and weights are automatically assigned using the entropy weighting method, which measures the information entropy of the features. The lower the value, the greater its impact on the output, and the higher its weight. Proceed to steps 22 to 24:

[0022] Step 22: From the encrypted DNS traffic dataset Extract as many relevant features as possible and standardize the feature matrix. For example, the processed input feature matrix is: ,in Indicates a sample, Representing features. The standardization formula is:

[0023] ;

[0024] in, The standardized value of the feature. , They represent features j in Minimum and maximum values ​​among all samples.

[0025] Step 23: Calculate the information entropy based on the standardized value of each feature. :

[0026] ;

[0027] ;

[0028] in, It is a feature In the sample The probability distribution in.

[0029] Step 24: Using information entropy Calculate the entropy weights of the features :

[0030] .

[0031] Next, grey relational analysis is used to evaluate the correlation between features and labels. The higher the correlation between features and target labels, the more significantly botnet traffic can be distinguished. Steps 25 and 26 are then executed.

[0032] Step 25: Add target tags Standardize:

[0033] ;

[0034] in, The standardized target label vector, This represents the network traffic category corresponding to the i-th sample. , They represent in Minimum and maximum values ​​among all labels.

[0035] Step 26: Calculate the grey relational degree between each feature and the label. :

[0036] ;

[0037] Among them, feature-label differences , The resolution factor is typically set to 0.5. and These represent the minimum and maximum values ​​of the feature-label difference, respectively.

[0038] Step 27: Based on the entropy weights of the features and grey relational degree weighted sum Select the optimal feature; weighted sum The calculation formula is as follows:

[0039] ;

[0040] in, This is for adjusting the coefficient.

[0041] Weighted sum of features Sorting: From j features, according to... Select k features from largest to smallest for subsequent encrypted DNS traffic botnet detection, where k is a value preset by the user according to their needs.

[0042] Step 30: Classify the botnet using a spatial clustering classification strategy. Preferably, the botnet is classified based on the OPTICS algorithm. The specific steps are as follows:

[0043] Step 31: First, initialize the parameters: input the DNS traffic feature matrix set after feature extraction and filtering. The number of samples is n, and the number of features is k. Set the OPTICS parameters, including the minimum neighborhood number MinPts and the radius. .

[0044] Step 32: Construct the core object collection: Initialize the core object collection. Iterate through each sample point in Z. If it is a core object, add it to the collection. The method for determining the core object is as follows: for any sample point... If its - Neighborhood If it contains at least MinPts number of sample points, then The core object. Among them, , Let i and q represent the feature vectors of the i-th and q-th sample points, respectively. Represents the spatial distance between two sample points, radius It is a constant.

[0045] Step 33: Calculate the reachable distance and core distance: Let... , about The reachable distance is : ,in, Core distance: The mathematical expression is: This makes the sample points The minimum neighborhood radius of the core point is called The core distance.

[0046] Step 34: Sort the sample points logically according to their reachability distance to form an ordered list p. The specific steps are as follows:

[0047] Step 341, if the core object collection If all elements have been processed, the algorithm ends; otherwise, proceed to step 342.

[0048] Step 342, in the core object collection In the middle, randomly select an unprocessed core object. core objects Mark as processed, and simultaneously add the core object Push into an ordered list Finally, the core object of - For unvisited points in the neighborhood, calculate the reachability distance from unvisited neighbor points. The reachability distances of points are stored sequentially in the seed set. middle;

[0049] Step 343, if the seed set If not, proceed to step 341; otherwise, proceed from the seed set. Select the seed point with the closest reach. First, set the seed point Mark as visited, and simultaneously seed point Push into an ordered list Then determine the seed point. of - Neighborhood Check if the number of sample points excluding those already added to the ordered list p is greater than or equal to MinPts. If so, of - Add unvisited neighboring points in the neighborhood to the seed set. In the middle, recalculate the seed set. Mid-distance seed point If the reachable distance is found, proceed to step 343.

[0050] Step 35: By analyzing the ordered list p, determine the final clusters and noise points, and output the classification results. Specifically, based on the reachability distance values ​​of the ordered list p, clusters and noise are identified through preset distance thresholds rd and number thresholds sd. In the ordered list p, identify continuous sample subsets with a length greater than the number threshold sd, where the distance between adjacent sample points within the subset is less than the preset distance threshold rd. Points in the continuous subset are grouped into the same cluster, and outliers are marked as noise, thus forming the final classification results. Each cluster represents a type of botnet attack.

[0051] After classifying the original traffic samples through steps 31-35, each sample will be assigned a corresponding category label (such as various botnets or normal traffic). For example, the true label of sample i is denoted as The true labels of the samples are used in the subsequent step 43, knowledge distillation, to calculate the loss function.

[0052] Step 40, please refer to Figure 3 We constructed and trained a hierarchical knowledge distillation model, HLD-TCN.

[0053] To address the complexity of botnet detection in encrypted DNS traffic, this invention proposes a hierarchical detection strategy based on knowledge distillation. By constructing multiple student models focused on specific botnet types, accurate classification and real-time monitoring are achieved during the detection process. Each student model focuses on a specific type of botnet attack, enabling the hierarchical detection strategy to have higher accuracy and flexibility in dealing with diverse attack scenarios.

[0054] The hierarchical knowledge distillation model HLD-TCN employs a teacher-student model architecture to achieve hierarchical knowledge distillation: the teacher model uses a temporal convolutional network (TCN), whose structure includes a feature matrix set for receiving encrypted DNS traffic. The input layer consists of four temporal convolutional modules and one fully connected output layer, which generates the original classification prediction value. The student model adopts a lightweight depth separable TCN (DE-TCN), which has a structure containing two temporal convolutional modules and one fully connected output layer.

[0055] Hierarchical knowledge distillation consists of two stages: intermediate layer distillation and prediction layer distillation. Intermediate layer distillation refers to knowledge distillation performed in the middle part of the temporal convolutional network—the temporal convolutional modules. Specifically, between the output of the fourth temporal convolutional module of the teacher model and the last temporal convolutional module of the student model, the output difference between the two temporal convolutional modules is compared through an attention transfer mechanism. The intermediate layer distillation loss is calculated to determine the difference between the learning model and the teacher model. Based on the loss function, the parameters of the student model are updated to guide the student model to focus on the same key regions as the teacher model.

[0056] Prediction layer distillation refers to knowledge distillation performed at the output fully connected layer. It provides the student model with the raw classification predictions output by the teacher model's fully connected layer. Specifically, after processing encrypted DNS traffic samples, the teacher model outputs a classification prediction result that includes each attack type and normal traffic. During the learning process, the student model relies on the true labels and these classification logic values ​​provided by the teacher model. The prediction layer distillation loss is calculated. During the student model training phase, through several rounds of iterations (with fixed parameters set manually), the relevant parameters of the student model are continuously adjusted based on the intermediate layer distillation loss and the prediction layer distillation loss in each round, ultimately outputting a student model for monitoring encrypted DNS botnet traffic.

[0057] Specifically, the steps include the following:

[0058] Step 41: In the intermediate layer distillation stage, an attention mechanism (AttentionTransfer, AT) is used to process the output of the last temporal convolutional module of the teacher model and the student model, so as to transfer the intermediate attention mode of the teacher model to the student model. Specifically, the attention mechanism processes the original output F of the temporal convolutional module into an attention map Q, with the input being the original multidimensional tensor output by the temporal convolutional module and the output being the attention map.

[0059] The output of the fourth temporal convolutional module of the teacher model is denoted as: , Let be a multidimensional tensor with the number of feature channels as follows: (Equal to the number of convolutional kernels in that temporal convolutional module). Then, intermediate layer knowledge distillation uses an attention mechanism to generate the attention map for the teacher model. The attention map is a one-dimensional vector with a length of . This graph illustrates which feature parameters have a greater impact on the judgment result. Similarly, the student model outputs the result of its last temporal convolutional module. Attention maps of student models are obtained after processing with an attention mechanism. Next, the intermediate layer loss function is calculated. Representing the teacher model attention map Attention map of student model The differences between the two models guide the student model to adjust its focus, making it more closely resemble the teacher's model. This mechanism can effectively transfer attention information between teacher and student models of different sizes without requiring a transformation of feature dimensions. The loss function of the intermediate layer is as follows:

[0060] ;

[0061] ;

[0062] .

[0063] in, It is the number of temporal convolutional modules in the teacher model. This refers to the number of channels in the temporal convolutional module of the student model. This is the output of the y'-th temporal convolutional module in the teacher model. This is the output of the y'th temporal convolutional module in the student model. and These are attention maps for the teacher model and the student model, respectively. and They represent and The x'-th vector value in the matrix. Intermediate layer knowledge, compared to label knowledge, possesses stronger representational power as feature knowledge. For spoofing target detection tasks, rich feature information is required; otherwise, the student model will perform poorly in detecting spoofing targets such as encrypted DNS traffic.

[0064] Step 42: In the prediction layer distillation stage, the original classification logistic value vector output by the fully connected layer of the teacher model is processed. The original classification logistic value vector output by the student model in the fully connected layer. Knowledge distillation is performed, where N=K+1 (including K types of botnets and normal traffic categories). The probability distribution is adjusted using a temperature coefficient T, and the adjusted result is:

[0065]

[0066]

[0067] in , These are the original logic output values ​​for categories o and u, respectively (directly output by the fully connected layer of the teacher model). The temperature coefficient T is a fixed parameter used to compress extreme differences in the original logic output values. , The target category index (the category whose probability needs to be calculated). When o=1, the probability of category 1 is calculated. n' is the summation traversal index (a temporary variable with no practical meaning). and These are the original classification logical value vectors. and The n'th classification logical value; the probability distributions of the teacher and student models after processing by the above formula are respectively and That is, predicting the probability that the input data is of type o and type u traffic.

[0068] Step 43: Calculate the prediction layer loss function of the hierarchical knowledge distillation model HLD-TCN. .in, For real labels, This represents the probability distribution of the temperature value T=1. The prediction layer loss of the HLD-TCN model consists of the loss between the student model's predicted values ​​and the actual values. And the cross-entropy loss after distillation of the teacher model and the student model. constitute. These are the weight parameters.

[0069]

[0070]

[0071]

[0072] Step 44: Combined loss function based on intermediate layer and prediction layer : , These are the weight parameters.

[0073] During the parameter update process of knowledge distillation, the weight parameters of the student model... (A high-dimensional tensor composed of floating-point numbers, including the weights of each computational parameter in each layer of the temporal convolutional network) is iteratively optimized using a gradient descent mechanism: first, the comprehensive loss is calculated. right partial derivatives (This gradient is with) A tensor of the same dimension (representing the strength of each parameter's contribution to the total error), then the learning rate φ is... Element-wise multiplication is performed, and the product is then subtracted from the current parameter. The result is used to update the parameters. This operation is repeated in each training batch, updating the model weights along the direction of the fastest descent of the loss surface, gradually improving its ability to identify botnet features in encrypted traffic.

[0074]

[0075] The learning rate φ is a hyperparameter in the training algorithm used to update the parameters of the student model using gradient descent. It controls the step size for updating parameters in each iteration. Generally, the learning rate... The choice of ...

[0076] In the two-stage knowledge distillation, the intermediate layer features carry rich temporal and semantic information. This feature-level learning ensures the student model's flexibility in the face of variant attacks. In the prediction layer, the student model learns the teacher model's final output and its corresponding class probability distribution. This allows the student model to more closely approximate the teacher model's predictions during the decision-making process. This phased, refined learning reduces information loss during knowledge transfer.

[0077] During training, the teacher model's parameters are fixed and used solely to guide the student model's learning. The student model's parameters are updated based on the loss function after each training round.

[0078] During model training, data augmentation and model optimization can also be performed. Specifically, the ADASYN (Adaptive Synthetic Sampling) method is used to oversample minority class zombie network samples to generate synthetic samples to balance the dataset.

[0079] After completing model training, proceed to steps 50 to 60:

[0080] Step 50: Deploy multiple student models. The specific steps are as follows: Deploy multiple trained student models in layers according to botnet type, with each model focusing on detecting a specific attack type (such as DDoS, data theft, etc.).

[0081] Step 60: Layer-by-layer traffic detection. The specific steps are as follows: Input real-time encrypted DNS traffic, which passes through each student model in turn. If a student model at a certain layer determines that the traffic is abnormal, it is immediately marked as botnet traffic and the subsequent detection is terminated.

[0082] This invention also includes a dynamic update mechanism and anomaly alarm and log management steps:

[0083] The dynamic update mechanism involves periodically retraining the student model using new traffic data and adjusting data augmentation and distillation parameters to adapt to new attack patterns.

[0084] The anomaly alerting and log management system works as follows: high-risk traffic is directly blocked, while low-risk traffic is marked and then notified to the administrator for confirmation. The characteristics and classification results of suspected botnet traffic are recorded for model iteration optimization and threat intelligence analysis.

[0085] The following examples illustrate this:

[0086] The method proposed in this invention aims to achieve efficient identification of botnet threats in encrypted DNS traffic, providing a high-performance and highly adaptable solution for network security. In the experimental section, multiple encrypted DNS traffic datasets were used, including normal traffic and various types of botnet traffic, such as DDoS attacks, C&C communication, and data theft. Some botnet traffic data originated from the CTU-13 dataset. These data underwent DNS encryption to simulate the complexity of malicious network traffic in reality. To ensure the model's generalization ability, the data was standardized and divided into training and testing sets (80% for training and 20% for testing).

[0087] In the simulation design, the teacher model (TCN) has 256 convolutional kernels, a kernel size of 5, 3 residual layers, 4 residual blocks per layer, and a dropout rate of 0.2. The student model (DE-TCN) is simplified with 32 convolutional kernels and a kernel size of 3. The number of residual blocks per student model is the same as the teacher model, but reduced to 1 to minimize computational overhead. The student models detect different types of zombie traffic in parallel, with each model outputting the probability of that specific type. The final decision is made by combining the detection results from multiple student models.

[0088] During the experiment, we selected 102,634 test data points, all of which were processed with encrypted DNS to simulate complex network traffic that might be encountered in real-world scenarios. To verify the performance of different models in encrypted DNS botnet detection, the following four algorithms were used in the experiment: Logistic Regression, Convolutional Neural Network (CNN), TCN teacher model, and Hierarchical Layered Distillation TCN (HLD-TCN).

[0089] The experiment first compared the classification results obtained by different algorithm models. TCN, as a time-series model, showed stronger feature capture capabilities, outperforming CNN and logistic regression in TP and TN, demonstrating higher traffic identification accuracy. HLD-TCN performed best in TN, indicating its superior performance in detecting botnet traffic and effectively reducing false negatives. However, its TP value was relatively low, suggesting that it might misidentify normal traffic as botnet traffic in certain situations.

[0090] Secondly, the training time of different algorithm models was compared. HLD-TCN's training time was significantly longer than other models, reaching 2666.08 seconds (including the training time of the teacher model TCN), far exceeding that of traditional CNN (782.70 seconds) and TCN (1472.25 seconds). This is mainly because HLD-TCN employs a hierarchical knowledge distillation strategy, distilling training from multiple levels. While this increases training complexity and time cost, it also provides the model with stronger representation capabilities, enabling it to better adapt to the complexity of encrypted DNS traffic. Compared to LogisticRegression, HLD-TCN has a slightly longer testing time, but compared to CNN and TCN, HLD-TCN significantly reduces inference time. Under this design, although the training process of HLD-TCN is more complex, through sufficient knowledge distillation, the model can maintain low resource consumption and computational cost during the inference phase. This is crucial for the real-time-critical problem of encrypted DNS bot traffic detection.

[0091] This invention automatically selects highly discriminative temporal and behavioral features through an adaptive feature extraction algorithm, reducing manual intervention and improving feature representation capabilities. It employs the OPTICS spatial clustering strategy to achieve multi-classification without requiring a pre-defined number of clusters, effectively handling high-dimensional complex traffic data and eliminating noise. A lightweight multi-student model is constructed for parallel detection through a hierarchical knowledge distillation mechanism, significantly improving detection accuracy and real-time performance while reducing computational complexity. Data augmentation techniques are combined to optimize sample balance and enhance the model's generalization ability to rare attack types. This method provides an efficient, accurate, and resource-saving solution for botnet detection in encrypted DNS traffic.

[0092] The above description is merely a specific embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent structural transformations made based on the content of the present invention specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A hierarchical distillation method for detecting botnets in encrypted DNS traffic, characterized in that, Includes the following steps: Preprocessing and structuring of encrypted DNS traffic: By combining entropy weighting and grey relational analysis, adaptive feature extraction and filtering are performed on the preprocessed data to select the optimal features that are strongly correlated with botnet behavior. A spatial clustering classification strategy was used to classify botnets, resulting in features of multiple different types of botnets. A hierarchical knowledge distillation model HLD-TCN is constructed and trained, wherein the hierarchical knowledge distillation model includes a teacher model and multiple student models; Deploy the trained multi-student model; Real-time encrypted DNS traffic is input and processed in parallel by each student model. If a student model determines that a traffic is abnormal, it is immediately marked as botnet traffic and subsequent detection is terminated. The specific steps for constructing and training the hierarchical knowledge distillation model HLD-TCN are as follows: In the intermediate layer distillation stage, an attention mechanism is used to transfer knowledge. The attention mechanism calculates the activation level of each channel in the intermediate layer and normalizes it to generate an attention map, so that different regions of the student model receive different degrees of attention. Then, the intermediate layer loss function is calculated to represent the difference between the output results of the teacher model and the student model in the intermediate layer. The loss function for the intermediate layer is as follows: ; ； ； in, and These are the outputs of the last temporal convolutional module of the teacher model and the student model, respectively. It is the number of temporal convolutional modules in the teacher model. This refers to the number of channels in the temporal convolutional module of the student model. and These are the attention maps for the teacher model and the student model, respectively, where n is the sample length; During the prediction layer distillation stage, the original classification logistic value vector output by the fully connected layer of the teacher model is... The original classification logistic values ​​output by the student model in the fully connected layer. Knowledge distillation is performed, where N=K+1, and the probability distribution is adjusted using a temperature coefficient T. The adjusted result is as follows: ； ； in The original logical output value of the i-th category is directly output by the fully connected layer of the teacher model. The temperature coefficient T is a fixed parameter used to compress extreme value differences in the original logical output value. i is the target category index, and j is the summation traversal index. The probability distributions of the teacher and student models after processing by the above formula are respectively... and That is, predicting the probability that the input data is of type i. Calculate the prediction layer loss function of the hierarchical knowledge distillation model HLD-TCN The total loss of the HLD-TCN model consists of the loss between the student model's predicted values ​​and the true values. And the cross-entropy loss after distillation of the teacher model and the student model. constitute: ； ； ； in, For weight parameters, For real labels, This represents the probability distribution of the temperature value T=1; Calculate the combined loss function based on the intermediate layer and the prediction layer. : The parameters of the student model are updated using gradient descent. Specifically, during the parameter update process of knowledge distillation, the weight parameters of the student model are... Iterative optimization is performed using gradient descent: First, the comprehensive loss is calculated. right partial derivatives Then the learning rate and Element-wise multiplication, and finally subtract the learning rate from the current parameters. and The product of these operations is repeated in each training batch, causing the model weights to be updated along the fastest descent direction of the loss surface, gradually improving the model's ability to identify botnet features in encrypted traffic. These are the weight parameters.

2. The hierarchical distillation method for botnet detection in encrypted DNS traffic according to claim 1, characterized in that: The adaptive feature extraction and filtering of the preprocessed data by combining entropy weighting and grey relational analysis is specifically performed as follows: Building the training dataset: The effectiveness of features is evaluated and weights are automatically assigned using the entropy weight method to obtain entropy weight values; Grey relational analysis is used to evaluate the correlation between features and labels, and the grey relational degree is obtained. Based on the weighted sum of the entropy weights and grey relational degrees of the features, select several optimal features that are strongly associated with the botnet.

3. The hierarchical distillation method for botnet detection in encrypted DNS traffic according to claim 2, characterized in that: The construction of the training dataset specifically includes: combining the preprocessed and structured encrypted DNS traffic dataset. As the input dataset, the target label is Where n is the number of samples and m is the number of features. This represents the network traffic category corresponding to the i-th sample. This represents the j-th feature value of the i-th sample; The steps to obtain entropy weights are as follows: First, from the encrypted DNS traffic dataset... Multiple relevant features are extracted, and the feature matrix is ​​standardized to obtain the standardized values ​​of the features. The calculation formula is: ;in, The standardized value of the feature. , They represent features j in The minimum and maximum values ​​of all samples are identified; then, the information entropy is calculated based on the standardized values ​​of each feature. : ; ;in, It is a feature In the sample The probability distribution in the data; finally, through information entropy. Calculate the entropy weights of the features : ; The steps to obtain gray relational degree are: first, the target label Standardize: ;in, The standardized target label vector, This represents the network traffic category corresponding to the i-th sample. ; They represent in Find the minimum and maximum values ​​among all labels; then calculate the grey relational degree between each feature and the label. : Among them, feature-label differences , The resolution factor is typically set to 0.

5. and These represent the minimum and maximum values ​​of the feature-label difference, respectively. The steps for selecting the optimal feature are as follows: calculate the entropy weight of the feature. and grey relational degree weighted sum , ;in, To adjust the coefficients; the features are weighted and summed. Sort, from j features according to Select k features from largest to smallest for subsequent encrypted DNS traffic botnet detection, where k is a value preset by the user according to their needs.

4. The hierarchical distillation method for botnet detection in encrypted DNS traffic according to claim 1, characterized in that: The specific steps for classifying botnets using a spatial clustering classification strategy to obtain features of multiple different types of botnets are as follows: Initialize the parameters of the OPTICS algorithm; Construct a core object collection; Calculate the reachability distance and core distance of sample points in the core object set; The sample points are logically sorted according to their reachability distance to form an ordered point set p; Analyze the ordered point set p, determine the final clusters and noise points, and output the classification results.

5. The hierarchical distillation method for botnet detection in encrypted DNS traffic according to claim 4, characterized in that: The parameters for initializing the OPTICS algorithm specifically include: the DNS traffic feature matrix after feature extraction and filtering. The number of samples is n, and the number of features is k; set the OPTICS parameters, including the minimum neighborhood number MinPts and the radius. ; The steps for constructing the core object set are as follows: Initialize the core object set. Iterate through each sample point in Z. If sample points If it is a core object, add it to the collection. The method for determining the core object is: for any sample point If sample points of - Neighborhood If it contains at least MinPts number of sample points, then As the core object; among which, , Let i and j represent the feature vectors of the i-th and j-th sample points, respectively. Represents the spatial distance between two sample points, radius It is a constant; The steps for calculating the reachability distance and core distance of sample points in the core object set are as follows: Let... , about The reachable distance is : ,in, Core distance: The mathematical expression is: This makes the sample points The minimum neighborhood radius of the core point is called Core distance; The step of logically sorting the sample points according to their reachability distance to form an ordered point set p is as follows: Step 341, if the core object collection If all elements have been processed, the algorithm ends; otherwise, proceed to step 342. Step 342, in the core object collection In the middle, randomly select an unprocessed core object. core objects Mark as processed, and also include the core object. Push into an ordered list Finally, the core object of - For unvisited points in the neighborhood, navigate to the unvisited neighbor points. The reachability distances of points are stored sequentially in the seed set. middle; Step 343, if the seed set If not, proceed to step 341; otherwise, proceed from the seed set. Select the seed point with the closest reach. First, set the seed point Mark as visited, and simultaneously seed point Push into an ordered list Then determine the seed point; of - Neighborhood Check if the number of sample points excluding those already added to the ordered list p is greater than or equal to MinPts; if so, of - Add unvisited neighboring points in the neighborhood to the seed set. In the middle, recalculate the seed set. Mid-distance seed point If the reachable distance is found, proceed to step 343; The analysis of the ordered point set p, determining the final clusters and noise points, and outputting the classification results specifically includes: based on the reachability distance value of the ordered list p, identifying clusters and noise through preset distance threshold rd and quantity threshold sd; identifying continuous sample subsets in the ordered list p whose length is greater than the quantity threshold sd, where the distance between adjacent sample points in the continuous sample subset is less than the preset distance threshold rd; grouping the points in the continuous subset into the same cluster; and marking outliers as noise, thereby forming the final classification results, with each cluster representing a type of botnet attack.

6. The hierarchical distillation method for botnet detection in encrypted DNS traffic according to claim 1, characterized in that: The steps for deploying the multi-student model are as follows: deploy the trained multiple student models in layers according to botnet type, with each model focusing on detecting one type of attack.

Images