Abnormal network flow identification method and apparatus, and electronic device

Abstract

The invention provides an abnormal network traffic identification method and device and electronic equipment, and the method comprises the steps: carrying out the preprocessing of a plurality of data packages in network traffic data, and determining an input sequence of the network traffic data; wherein the input sequence comprises a target representation sequence of a plurality of data packets; using the trained abnormal network traffic identification model to identify whether the network traffic data is abnormal according to the input sequence; wherein the abnormal network traffic identification model comprises a feature encoder, a graph neural network module and a classification head module; the feature encoder is used for performing feature extraction on the target representation sequence of any data packet to obtain a first feature vector of the data packet; the graph neural network module is used for generating a graph structure of the network flow data according to the first feature vectors of the plurality of data packets, and determining a second feature vector of the graph structure; the classification head module is used for determining the category of the network flow data according to the second feature vector; wherein the category is used for indicating whether the network flow data is abnormal.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a method, apparatus and electronic device for identifying abnormal network traffic. Background Technology

[0002] In the field of cybersecurity, with the increasing complexity and stealth of network attacks, traditional detection methods are struggling to meet the real-time and accuracy requirements of highly dynamic, large-scale, and encrypted traffic environments. While AI-based traffic analysis technologies have gradually developed, they also have significant shortcomings. For example, end-to-end anomaly network traffic identification methods based on deep neural networks (such as CNNs and RNNs) are highly dependent on the order and integrity of the input data, making it difficult to cope with the out-of-order, packet loss, and retransmission phenomena commonly found in real network environments. Furthermore, most anomaly network traffic analysis methods based on GNNs (Graph Neural Networks) rely on fixed graph construction strategies (such as time order or communication direction), making it difficult to fully capture complex traffic relationships. Summary of the Invention

[0003] This application aims to at least partially address one of the technical problems in the related art.

[0004] Therefore, the first objective of this application is to propose a method for identifying abnormal network traffic.

[0005] The second objective of this application is to propose an abnormal network traffic identification device.

[0006] The third objective of this application is to propose an electronic device.

[0007] The fourth objective of this application is to provide a computer-readable storage medium.

[0008] The fifth objective of this application is to provide a computer program product.

[0009] To achieve the above objectives, a first aspect of this application proposes an abnormal network traffic identification method, comprising: preprocessing multiple data packets in network traffic data to determine an input sequence of the network traffic data; wherein the input sequence includes a target representation sequence of the multiple data packets; using a trained abnormal network traffic identification model, identifying whether the network traffic data is abnormal based on the input sequence; wherein the abnormal network traffic identification model includes a feature encoder, a graph neural network module, and a classification head module; the feature encoder is used to extract features from the target representation sequence of any of the data packets to obtain a first feature vector of the data packet; the graph neural network module is used to generate a graph structure of the network traffic data based on the first feature vector of the multiple data packets, and determine a second feature vector of the graph structure; the classification head module is used to determine the category of the network traffic data based on the second feature vector; wherein the category is used to indicate whether the network traffic data is abnormal.

[0010] To achieve the above objectives, a second aspect of this application proposes an abnormal network traffic identification device, comprising: a first processing module, configured to preprocess multiple data packets in network traffic data to determine an input sequence of the network traffic data; wherein the input sequence includes a target representation sequence of the multiple data packets; and an identification module, configured to use a trained abnormal network traffic identification model to identify whether the network traffic data is abnormal based on the input sequence; wherein the abnormal network traffic identification model includes a feature encoder, a graph neural network module, and a classification head module; the feature encoder is configured to extract features from the target representation sequence of any of the data packets to obtain a first feature vector of the data packet; the graph neural network module is configured to generate a graph structure of the network traffic data based on the first feature vector of the multiple data packets and determine a second feature vector of the graph structure; and the classification head module is configured to determine the category of the network traffic data based on the second feature vector; wherein the category is used to indicate whether the network traffic data is abnormal.

[0011] To achieve the above objectives, a third aspect of this application provides an electronic device, including: a processor and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement an abnormal network traffic identification method as described in the first aspect of this application.

[0012] To achieve the above objectives, a fourth aspect of this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement an abnormal network traffic identification method as described in the first aspect of this application.

[0013] To achieve the above objectives, a fifth aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements an abnormal network traffic identification method as described in the first aspect of this application.

[0014] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this application, nor is it intended to limit the scope of this application. Other features of this application will become readily apparent from the following description. Attached Figure Description

[0015] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 A flowchart illustrating an abnormal network traffic identification method provided in an embodiment of this application; Figure 2 A flowchart illustrating another abnormal network traffic identification method provided in an embodiment of this application; Figure 3 A flowchart illustrating another abnormal network traffic identification method provided in an embodiment of this application; Figure 4 A schematic diagram illustrating the principle of an abnormal network traffic identification method provided in an embodiment of this application; Figure 5 This is a schematic diagram of the structure of an abnormal network traffic identification device provided in an embodiment of this application; Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0016] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0017] In the field of cybersecurity, with the increasing complexity and stealth of network attacks, traditional detection methods are struggling to meet the real-time and accuracy requirements of highly dynamic, large-scale, and encrypted traffic environments. In recent years, AI-based traffic analysis technology has developed rapidly and gradually become a mainstream research direction. Currently, the mainstream solutions in this field can be mainly divided into the following categories: traditional detection methods based on rules and signatures, statistical modeling methods based on traditional machine learning, sequence modeling methods based on early deep learning such as CNNs and RNNs, and advanced deep learning methods based on GNNs, Transformer architectures, and self-supervised learning that have emerged in recent years. These technologies progress layer by layer, gradually improving the ability to understand and discriminate complex network behaviors.

[0018] Among them, sequence modeling methods based on early deep learning such as CNN and RNN use CNN or RNN to model the sequence of data packets in network traffic. Typically, network traffic is modeled as a fixed-length time series or matrix structure. CNN is used to extract local features, or RNN (such as LSTM (Long Short-Term Memory) or GRU (Gated Recurrent Unit)) is used to capture the temporal dependencies between packets. To a certain extent, automated feature learning of network traffic is achieved, avoiding the subjectivity and limitations of traditional manual feature design. It can be widely used in typical attack detection tasks such as DDoS and port scanning.

[0019] However, this method is highly dependent on the order and integrity of the input data, making it difficult to cope with out-of-order, packet loss, and retransmission phenomena commonly found in real-world network environments. For example, since RNN-type models process data packets strictly according to time steps, once the order of data packets is disordered or partially missing, the temporal logic modeled by the model will be disrupted, leading to distorted representations and consequently affecting detection performance. Even introducing attention mechanisms to enhance the weight of key packets cannot alleviate the semantic shift problem caused by input order perturbations. Furthermore, to adapt to fixed-dimensional input requirements, long streams are usually truncated or short streams are padded, which not only causes information loss or introduces noise but also limits the model's ability to naturally model variable-length traffic.

[0020] As the advantages of graph structures in modeling complex relationships have become widely recognized, anomaly network traffic analysis methods based on GNNs have gradually emerged. This method treats each data packet in network traffic as a graph node and establishes connections based on time sequence or communication direction to form an "inter-packet relationship graph." It then uses graph neural networks such as GCN (Graph Convolutional Network) and GAT (Graph Attention Network) to aggregate features, generating context-aware node and flow-level representations. Because graph structures inherently support non-Euclidean data and variable-length sequence processing, this method can handle variable-length sequences, supports robust modeling of real-world problems such as out-of-order delivery, packet loss, and retransmission prevalent in real-world network environments, and can reveal potential attack paths. However, this method has the following significant drawbacks: First, most graphs rely on fixed graph construction strategies (such as time order or communication direction), making it difficult to fully capture complex traffic relationships. For example, in some attacks, key data packets may not be adjacent, but rather semantically related through specific content patterns (such as identical payload characteristics or similar encryption behaviors). Traditional time-adjacency-based graph structures cannot capture such cross-time, non-continuous semantic dependencies.

[0021] Second, the reliance on supervised learning paradigms limits generalization ability in scenarios where labeled data is scarce. Due to the scarcity of abnormal network traffic samples in real-world environments and the high cost of labeling, GNN models trained with only limited labels are prone to overfitting and struggle to generalize to novel or unknown attack types.

[0022] Furthermore, the Transformer architecture can be applied to network traffic modeling. Pre-training on unlabeled data through self-supervised tasks such as masked packet reconstruction and next packet prediction allows for the learning of transferable traffic semantic representations. This method possesses powerful long-sequence modeling capabilities and parallel computation efficiency, making it particularly suitable for processing long streams containing hundreds or even thousands of packets, demonstrating certain advantages in encrypted traffic analysis and zero-day attack detection. However, this method has the following limitations: First, existing self-supervised methods mostly employ simple token-level masking strategies, failing to adequately simulate the complex perturbation patterns in real-world network environments. For example, traditional mask reconstruction tasks typically randomly mask some bytes, failing to accurately simulate packet loss in real-world network environments. Furthermore, most methods use only a single auxiliary task (such as MPR (Masked Packet Reconstruction) or NPP (Next Packet Prediction), resulting in limited supervisory signals and hindering the comprehensive stimulation of the model's understanding of various traffic attributes.

[0023] Second, although Transformer excels at long-range dependency modeling, its self-attention mechanism has a time complexity of O(N²), which incurs huge computational costs when processing extremely long traffic sequences, making it difficult to meet the requirements of high-throughput and low-latency online detection. Furthermore, Transformer is essentially still a sequence model; although it can preserve order information through positional encoding, it still struggles to reconstruct the original semantic structure when faced with severely disordered or discontinuous semantic associations.

[0024] To address the aforementioned issues, this application proposes a method, apparatus, and electronic device for identifying abnormal network traffic.

[0025] The following description, with reference to the accompanying drawings, describes an abnormal network traffic identification method, apparatus, and electronic device according to embodiments of this application.

[0026] Figure 1 This is a flowchart illustrating an abnormal network traffic identification method provided in an embodiment of this application.

[0027] like Figure 1 As shown, this abnormal network traffic identification method includes the following steps: Step 101: Preprocess multiple data packets in the network traffic data to determine the input sequence of the network traffic data, wherein the input sequence includes the target representation sequence of multiple data packets.

[0028] Network traffic is essentially a collection of unstructured data packets. To facilitate modeling, it needs to be organized into "streams" with semantic consistency. In this embodiment, network traffic data is the "stream" obtained by dividing the received data packets according to the set flow division criteria.

[0029] As an example, received data packets can be divided into five-tuples. Data packets that satisfy the condition (SrcIP, DstIP, SrcPort, DstPort, Protocol) are grouped into a single "flow," thus obtaining at least one "flow," or at least one piece of network traffic data. Here, SrcIP represents the source IP (Internet Protocol) address, DstIP represents the destination IP address, SrcPort represents the source port number, DstPort represents the destination port number, and Protocol represents the protocol.

[0030] In one possible embodiment of this application, network traffic data can be filtered to avoid noise interference; wherein the filtering process includes at least one of the following: Empty flow filtering is used to filter network traffic data that contains only control information. Long-term filtering is used to filter target network traffic data, wherein the target network traffic data includes at least one of the following: network traffic data with a number of data packets exceeding a first set packet number threshold, and network traffic data with a duration exceeding a first set duration.

[0031] Control information can include, for example, SYN (Synchronize Sequence Number), ACK (Acknowledgment), and FIN (Finish).

[0032] As an example, network traffic data that contains only control packets (such as SYN, ACK, FIN) and no application layer payload (“stream”) can be excluded because this type of network traffic data (“stream”) is typically used for connection establishment or closure and does not carry content.

[0033] As another example, if a network traffic data (“flow”) contains more packets than a set packet count threshold, or if the duration of a network traffic data (“flow”) exceeds a set duration, then this type of network traffic data (“flow”) may be affected by the network environment and needs to be truncated, or marked as an “over-length flow” for separate processing.

[0034] In one possible embodiment of this application, in order to improve the generalization ability of the model across network environments, protocol layer stripping can be performed on network traffic data; wherein, protocol layer stripping includes deleting the Ethernet header information of any data packet in the network traffic data, while retaining the Internet Protocol header information.

[0035] The Ethernet header contains information such as the MAC (Media Access Control) address, which is only relevant within the local area network and can easily lead to overfitting of the model to a specific physical topology, so it needs to be deleted; the IP header has global significance and therefore needs to be retained.

[0036] Network traffic data needs to be vectorized and embedded before it can be processed by deep learning models. However, the semantic meaning of the same byte value appearing in the IP header or application layer payload can be completely different. For example, the byte "0x18" may represent PSH (Push) + ACK in the TCP (Transmission Control Protocol) flags, but may be any encrypted data in the application layer payload. To enable the model to clearly distinguish the different semantic meanings of the same byte in the header and payload, in one possible embodiment of this application, for any data packet in any network traffic data, an embedded representation of the byte can be generated based on the content, position, and type information of any byte in the data packet; a target representation sequence of the data packet can be generated based on the order of multiple bytes in the data packet and the embedded representation of multiple bytes; and the input sequence of the network traffic data can be determined based on the target representation sequence of multiple data packets in the network traffic data.

[0037] As an example, content information is used to indicate the byte value of the corresponding byte, position information is used to indicate the position of the corresponding byte in the corresponding data packet, and type information is used to indicate the type of the corresponding byte in the corresponding data packet. The type information includes header type and payload type. In the case where the type information of any byte is of header type, the position information of that byte is used to indicate the absolute position information of that byte in the corresponding data packet; When the type information of any byte is payload type, the position information of that byte is used to indicate the relative position information of that byte in the corresponding data packet.

[0038] For example, the embedded representation of bytes can be generated using the following formula: E t =E content (x t )+E position (p t )+E type (t t ) Among them, E t The embedded representation of byte t, x t E represents the content information of byte t. content (x t ) represents the embedded representation of the content of byte t, p t E represents the position information of byte t. position (p t ) represents the positional embedding of byte t, t t E represents the type information of byte t. type (tt ) indicates the type embedding representation of byte t.

[0039] Where, p t In t t In the case of a header type, it is used to indicate the absolute position information of byte t in the corresponding data packet (because the absolute position information in the header represents the version number, packet length, time to live, etc.); p t In t t In the case of payload type, it is used to indicate the relative position information of byte t in the corresponding data packet.

[0040] For example, the target representation sequence of any data packet can be, for example, [x1,...,x...]. T ]∈ Where T represents the sequence length and d represents the dimension. For example, the embedding representation of a byte includes content embedding representation, position embedding representation, and type embedding representation, so d=3.

[0041] As an example, a target delimiter can be used to organize the target representation sequence of multiple packets in any network traffic data to obtain the input sequence of the network traffic data.

[0042] The target delimiter can be, for example, [CLS], [SEP], and . [CLS] and are used to separate different network traffic data. [CLS] indicates the beginning of any network traffic data, indicates the end of any network traffic data, and [SEP] is used to separate different data packets in the network traffic data.

[0043] For example, the input sequence of any network traffic data is shown below: [CLS] Header_1 Payload_1 [SEP]Header_2 Payload_2 [SEP] ... [SEP]Header_n Payload_n Here, Header_1 represents the embedded representation sequence of at least one byte in the header of the first data packet, and Payload_1 represents the embedded representation sequence of at least one byte in the payload of the first data packet. Header_1 and Payload_1 together form the target representation sequence of the first data packet. Header_2, Payload_2, Header_n, and Payload_n are similar and will not be described in detail. In summary, this application proposes a multi-dimensional embedding representation mechanism to address the semantic ambiguity of the same byte across different protocol layers. This mechanism introduces type embedding representation (E... typeThe model distinguishes each byte from the header or payload; it generates a context-aware embedding representation by combining content, location, and type information; and it organizes multi-packet sequence inputs with [CLS], [SEP], and delimiters, enabling the model to identify different semantic roles of bytes such as "0x18" in TCP flags and application layer payloads, thus alleviating byte-level semantic confusion and enhancing the model's ability to identify covert behaviors such as encrypted traffic and obfuscated payloads.

[0044] Step 102: Using the trained abnormal network traffic identification model, identify whether the network traffic data is abnormal based on the input sequence. The abnormal network traffic identification model includes a feature encoder, a graph neural network module, and a classification head module.

[0045] The feature encoder is used to extract features from the target representation sequence of any data packet to obtain the first feature vector of the data packet. The graph neural network module is used to generate a graph structure of network traffic data based on the first feature vector of multiple data packets, and to determine the second feature vector of the graph structure. The classification head module is used to determine the category of network traffic data based on the second feature vector; where the category is used to indicate whether the network traffic data is abnormal.

[0046] As an example, a BERT-like structure can be used as the feature encoder in an anomaly network traffic identification model. This is because the BERT structure employs a self-attention mechanism, which can capture the dependencies between long-range sequence data (such as speech and text), and network traffic data is precisely long-range sequence data. Using the BERT structure is suitable for modeling the features of network traffic data spanning multiple data packets. Moreover, the BERT model is trained using a self-supervised training method, which can learn universal features from a large amount of unlabeled natural language data. Natural language data and network traffic data have certain similarities, and using the BERT model, universal features of network traffic data can be learned through self-supervised learning.

[0047] For example, the feature encoder BERT model in the abnormal network traffic identification model has a model structure consisting of L layers of multi-head self-attention modules and a feedforward network, with each layer followed by residual connections and layer normalization. Assume that the target representation sequence of any data packet is [x1,...,x...]. T ]∈ Then the output of the l-th layer is: ; ; Final output H (L)In this context, each target representation sequence element corresponds to a context-aware feature vector. Therefore, the mean pooling of the feature vectors corresponding to all target representation sequence elements in the target representation sequence of the data packet can be used as the first feature vector of the data packet.

[0048] In one possible embodiment of this application, the similarity between any two data packets in network traffic data can be determined based on the first feature vector of multiple data packets; and a graph structure can be generated by establishing connection edges based on the similarity between any two data packets in network traffic data, using multiple data packets as nodes.

[0049] Specifically, a connection edge can be established between two data packets in network traffic data if the similarity between any two data packets is greater than a set threshold; or, a connection edge can be established using the K-nearest neighbor strategy based on the similarity between any two data packets in network traffic data.

[0050] As an example, the feature encoder in a trained abnormal network traffic identification model can be used to extract features from each data packet in the network traffic data, obtaining the first feature vector for each data packet: z i =Encoder(Packet i ) Among them, z i ∈ Let d represent the first feature vector of the i-th data packet, and d represent the dimension. See the above for related explanations.

[0051] Then, using the graph neural network module in the trained abnormal network traffic identification model, the similarity between any two data packets in the network traffic data is calculated based on the first feature vector of each data packet using the following formula:

[0052] Among them, s ij This represents the similarity between the i-th data packet and the j-th data packet, and can then be based on s ij Generate a similarity matrix S∈ , where N is the number of data packets.

[0053] Furthermore, based on the similarity matrix S, edge connections are established using a dynamic threshold or a KNN (K-Nearest Neighbors) strategy to generate a graph structure. The graph structure can be constructed using an adjacency matrix A∈{0,1}. N×N (Undirected and unweighted graph) or A∈ (Weighted graph) mathematical modeling; where N is the total number of nodes in the graph, A i,jThis represents the connection between node i and node j (1 indicates the existence of an edge, 0 indicates no edge; in a weighted graph, if an edge exists, then A). i,j Let A be the weight of the edge. If no edge exists, then A... i,j =0).

[0054] In addition, time difference, direction change, and other attributes can be introduced into the graph structure as attribute information of the connecting edges.

[0055] Therefore, it is possible to dynamically construct graph structures based on the principle of maximizing mutual information, which breaks through the limitations of time-sequential modeling in related technologies, can capture high semantic similarity behaviors across time periods, and improve the ability to model covert attacks.

[0056] In one possible embodiment of this application, for any node in the graph structure, feature aggregation can be performed on at least some of the node's neighboring nodes to obtain a feature aggregation vector of the node; and a second feature vector can be generated based on the feature aggregation vectors of multiple nodes in the graph structure.

[0057] In related technologies, the GCN method can only handle fixed graph structures that appear during the training phase and cannot directly generalize to unseen new nodes or graph structures. However, in the embodiments of this application, feature aggregation is performed only on at least some of the neighboring nodes of a node to generate a feature aggregation vector for the node, and the second feature vector of the graph structure is determined accordingly. This does not rely on global graph structure information and can dynamically adapt to new nodes or unseen graph data. Moreover, feature aggregation is performed only on the local neighboring nodes of each node, which reduces computational complexity. Thus, the model can handle graph data of any scale while maintaining high computational efficiency.

[0058] As an example, the graph neural network module can adopt an inductive learning framework based on GraphSAGE (Graph Sample and Aggregate) to address the limitations of the transductive methods of graph convolutional networks in related technologies.

[0059] For example, the aggregation operation of the l-th layer of GraphSAGE can be:

[0060] AGGREGATE can be a mean, pooling, or LSTM aggregation function.

[0061] After K layers of propagation, the feature aggregation vector h of the nodes is obtained. (K) .

[0062] After obtaining the feature aggregation vectors of each node, the second feature vector z of the graph structure can be generated using the Readout function. G :

[0063] As an example, the classification head module in an abnormal network traffic identification model can adopt a two-layer MLP (Multilayer Perceptron) structure, with Dropout regularization added to the middle layer, and finally output the predicted probability distribution of each category (e.g., normal category, abnormal category).

[0064] In this embodiment, multiple data packets in the network traffic data are preprocessed to determine the input sequence of the network traffic data. The input sequence includes the target representation sequence of multiple data packets. A trained abnormal network traffic identification model is used to identify whether the network traffic data is abnormal based on the input sequence. The abnormal network traffic identification model includes a feature encoder, a graph neural network module, and a classification head module. The feature encoder extracts features from the target representation sequence of any data packet to obtain a first feature vector of the data packet. The graph neural network module generates a graph structure of the network traffic data based on the first feature vectors of multiple data packets and determines a second feature vector of the graph structure. The classification head module determines the category of the network traffic data based on the second feature vector. The category indicates whether the network traffic data is abnormal. The abnormal network traffic identification model uses a feature encoder to extract deep features from individual data packets, a graph neural network module to capture complex relationships and overall features between data packets, and a classification head module to identify whether the traffic is abnormal based on the overall features. This improves the accuracy and robustness of anomaly identification, enabling more efficient and accurate identification of potential network threats and enhancing proactive network security defense capabilities.

[0065] This embodiment provides another method for identifying abnormal network traffic. Figure 2 This is a flowchart illustrating another abnormal network traffic identification method provided in an embodiment of this application.

[0066] like Figure 2 As shown, this abnormal network traffic identification method may include the following steps: Step 201: Obtain traffic data from multiple training networks.

[0067] Among them, the training network traffic data is the network traffic data used to train the model. For a related explanation of network traffic data, please refer to the above text, and it will not be repeated here.

[0068] Step 202: Determine the input sequence of multiple training network traffic data as the first training sample.

[0069] The input sequence of any training network traffic data includes the target representation sequence of multiple training data packets in the training network traffic data, and the target representation sequence of any training data packet includes the embedded representation of multiple bytes in the training data packet.

[0070] The process of determining the input sequence of training network traffic data is described above and will not be repeated here.

[0071] Step 203: Mask the embedding representation of at least some bytes in multiple training data packets according to a first preset probability, and mask the target representation sequence of at least some training data packets in multiple training data packets according to a second preset probability, to obtain a second training sample.

[0072] The first preset probability and the second preset probability can be any preset probability value. They can be the same or different. For example, the first preset probability and the second preset probability can both be 15%, or the first preset probability is 15% and the second preset probability is 20%, and so on.

[0073] In one possible embodiment of this application, at least some bytes can be selected from all bytes of multiple data packets in each training network traffic data according to a first preset probability, and the embedding representation of the selected bytes can be replaced with a target tag. In addition, at least some data can be selected from multiple data packets in each training network traffic data according to a second preset probability, and the target representation sequence of the selected data packets can be replaced with a target tag, that is, the embedding representation of all bytes of the selected data packets can be masked.

[0074] The target tag could be, for example, the [MASK] tag.

[0075] Specifically, by masking the embedded representation of at least some bytes in multiple training data packets according to a first preset probability, byte-level corruption and network transmission noise can be simulated; by masking the target representation sequence of at least some training data packets in multiple training data packets according to a second preset probability, the phenomenon of whole packet loss in a real network environment can be simulated.

[0076] As an example, in related technologies, a training strategy of random masking and recovery is often used during model training, such as randomly masking 15% of tokens and having the model predict these masked tokens. However, this training strategy cannot accurately simulate packet loss in real network environments. To address this, a Packet-Level Mask mechanism is proposed—randomly masking the entire data packet with a second preset probability p2, including all header and payload tokens in the packet, while retaining a partial Token-Level Mask (randomly masking a portion of bytes in any data packet with a first preset probability p2) to simulate byte-level corruption. Masked tokens can be replaced using a special marker [MASK]. Since packet loss in real network environments usually occurs in the form of "whole packets" rather than random byte loss, the above Packet-Level Mask mechanism is closer to the actual network environment and can force the model to learn the ability to infer the content of missing data packets from the context, thereby improving the robustness of the model.

[0077] Step 204: Based on the second training sample and the first training sample, train the feature encoder to be trained in the abnormal network traffic identification model to obtain the trained feature encoder.

[0078] In one possible embodiment of this application, a second training sample and a first training sample can be input into the feature encoder to be trained to determine a first loss function; wherein, the first loss function is used to indicate the difference between the target training sample recovered by the feature encoder to be trained based on the second training sample and the first training sample; the feature encoder to be trained is trained according to the first loss function, or according to the first loss function and the second loss function of the auxiliary task, to obtain the trained feature encoder; wherein, the auxiliary task includes at least one of the following: flow duration prediction task; bandwidth prediction task; protocol type prediction task; packet count prediction task; flow direction prediction task.

[0079] As an example, the first loss function could be:

[0080] It should be noted that obtaining static statistical features of the entire network traffic data presents a real-time challenge in actual inference. However, in self-supervised training, in addition to using unlabeled data, labeled self-supervised auxiliary tasks can be designed using the calculated static statistical data of the entire network traffic data to assist the model in more accurate feature extraction.

[0081] As an example, the auxiliary task and its loss function are shown in Table 1: Table 1. Examples of Auxiliary Tasks

[0082] In this system, all tasks share a backbone encoder, with inputs consisting of streaming [cls] labels, but each task has its own independent prediction head (MLP or linear layer). The total loss function is a weighted combination of the various loss functions.

[0083] Therefore, by designing multiple auxiliary tasks to jointly train the feature encoder, each task shares the backbone encoder but has an independent prediction head, and the total loss is automatically balanced by an uncertainty weighting method to improve the generalization ability of the representation.

[0084] The trained feature encoder can serve as a packet-level feature extractor, and the extracted packet-level features are used to train the graph neural network module. Since real-time inference of network traffic types in real-world network environments typically cannot be performed after acquiring the complete flow, a packet-by-packet feature extraction approach can be adopted to meet the demands of real-time inference.

[0085] It's important to note that the [CLS] token is not used directly in the feature extraction process, as is common in related techniques. This is because the [CLS] token is already used for flow-level auxiliary tasks; using it only as an auxiliary means of feature extraction would lead to inconsistencies between the training task and the actual usage objective. To address this issue, mean pooling of all tokens within a data packet can be used as the feature representation of that packet. This ensures consistency between feature extraction and the model training objective, and improves the performance of downstream tasks.

[0086] Step 205: Preprocess multiple data packets in the network traffic data to determine the input sequence of the network traffic data, wherein the input sequence includes the target representation sequence of multiple data packets.

[0087] Step 206: Using the trained abnormal network traffic identification model, identify whether the network traffic data is abnormal based on the input sequence. The abnormal network traffic identification model includes a feature encoder, a graph neural network module, and a classification head module.

[0088] The relevant content in steps 205-206 can be found in the relevant descriptions in any embodiment of this application, and will not be repeated here.

[0089] In this embodiment, multiple training network traffic data are acquired; the input sequence of the multiple training network traffic data is determined as the first training sample; wherein, the input sequence of any training network traffic data includes the target representation sequence of multiple training data packets in the training network traffic data, and the target representation sequence of any training data packet includes the embedding representation of multiple bytes in the training data packet; the embedding representation of at least some bytes in the multiple training data packets is masked according to a first preset probability, and the target representation sequence of at least some training data packets in the multiple training data packets is masked according to a second preset probability, to obtain the second training sample; based on the second training sample and the first training sample, the feature encoder to be trained in the abnormal network traffic identification model is trained to obtain the trained feature encoder; wherein, by masking some bytes to simulate network transmission noise and masking complete data packets to simulate network packet loss, the obtained second training sample can be closer to the real disturbance scenario, thereby forcing the model to infer the missing content from the context and enhancing the robustness of the model.

[0090] This embodiment provides another method for identifying abnormal network traffic. Figure 3 This is a flowchart illustrating another abnormal network traffic identification method provided in an embodiment of this application.

[0091] like Figure 3 As shown, this abnormal network traffic identification method may include the following steps: Step 301: Obtain traffic data from multiple training networks.

[0092] The relevant content in step 301 can be found in the relevant description in any embodiment of this application, and will not be repeated here.

[0093] Step 302: Perform data augmentation on any training network traffic data to obtain the target training network traffic data corresponding to the training network traffic data.

[0094] In one possible embodiment of this application, the data augmentation process includes at least one of the following: Packet dropping processing is used to delete packets from any training network traffic data according to a first set ratio; Packet copying processing is used to copy target packets from any training network traffic data; where the target packet is the packet that plays a decisive role in the establishment, maintenance and completion of communication; The load perturbation process is used to flip the low-order bits of the load in any training network traffic data according to a second set ratio. Stream truncation is used to extract a set number of data packets from any training network traffic data.

[0095] For example, the target data packet includes TCP three-way handshake packets (SYN, SYN-ACK, ACK), DNS (Domain Name System) query and response packets, HTTP / HTTPS request packets, etc.

[0096] In this embodiment of the application, by performing data augmentation processing on any training network traffic data, not only is the robustness of the model improved, but also diverse positive samples are provided for subsequent comparative learning, thereby enhancing the model's generalization ability.

[0097] Step 303: Based on multiple training network traffic data and the target training network traffic data corresponding to the multiple training network traffic data, determine the positive training sample pairs and negative training sample pairs.

[0098] As an example, suppose the traffic data for multiple training networks are X1, X2, ..., X... n Data augmentation is performed on X1 to obtain X. 1_a X 1_b X 1_c Data augmentation is performed on X2 to obtain X. 2_a X 2_b X 2_c Similarly, a positive training sample pair is two target training network traffic data points obtained by data augmentation of the same training network traffic data, while a negative training sample pair is any two target training network traffic data points obtained by data augmentation of different training network traffic data. For example, for X... 1_a X 1_a and X 1_b It is a positive training sample pair, X 1_a and X 1_c It is a positive training sample pair, X 1_a and X 2_a It is a negative training sample pair, X 1_a and X 2_b It is a negative training sample pair.

[0099] Step 304: Based on the positive training sample pairs and negative training sample pairs, train the graph neural network module to be trained in the abnormal network traffic identification model to obtain the trained graph neural network module.

[0100] In one possible embodiment of this application, positive training sample pairs and negative training sample pairs can be input into the graph neural network module to be trained to determine a third loss function and a fourth loss function; wherein, the third loss function is used to indicate the representation distance of the positive training sample pairs, and the fourth loss function is used to indicate the representation distance of the negative training sample pairs; the graph neural network module to be trained is trained according to the third loss function and the fourth loss function to obtain the trained graph neural network module.

[0101] As an example, positive and negative training sample pairs are input into the graph neural network module to be trained. For any positive training sample pair, the graph neural network module will generate two graph structures corresponding to that positive training sample pair and determine the second feature vectors of these two graph structures. Then, based on the second feature vectors of these two graph structures, the third loss function for the positive training sample pair can be determined.

[0102] in, This represents the second feature vector of the two graph structures corresponding to the positive training sample pair. For cosine similarity, >0 represents a temperature hyperparameter that controls the degree of concentration in the distribution.

[0103] The handling of negative training sample pairs is similar and will not be repeated here.

[0104] The training objective of the graph neural network module to be trained is to narrow the representation distance of positive training samples and widen the representation distance of negative training samples, so that the graph neural network module to be trained can learn more discriminative feature representations.

[0105] Step 305: Preprocess multiple data packets in the network traffic data to determine the input sequence of the network traffic data, wherein the input sequence includes the target representation sequence of multiple data packets.

[0106] Step 306: Using the trained abnormal network traffic identification model, identify whether the network traffic data is abnormal based on the input sequence. The abnormal network traffic identification model includes a feature encoder, a graph neural network module, and a classification head module.

[0107] The relevant content in steps 305-306 can be found in the relevant descriptions in any embodiment of this application, and will not be repeated here.

[0108] In this embodiment, multiple training network traffic data sets are acquired; data augmentation processing is performed on any training network traffic data set to obtain the target training network traffic data corresponding to the training network traffic data set; based on the multiple training network traffic data sets and the target training network traffic data sets corresponding to the multiple training network traffic data sets, positive training sample pairs and negative training sample pairs are determined; based on the positive training sample pairs and negative training sample pairs, the graph neural network module to be trained in the abnormal network traffic identification model is trained to obtain the trained graph neural network module; wherein, by constructing positive and negative training sample pairs of network traffic data, the model can automatically learn the essential characteristics of different network traffic data without relying on a large amount of labeled data. This learning method alleviates the problem of scarce labeled data in the field of network security, and at the same time, the sample diversity brought about by data augmentation improves the robustness of the model to various interference factors in the real network environment.

[0109] Figure 4 This is a schematic diagram illustrating the principle of an abnormal network traffic identification method provided in an embodiment of this application.

[0110] like Figure 4 As shown, this abnormal network traffic identification method may include the following steps: Step 401: Preprocess multiple data packets in the network traffic data.

[0111] The relevant content in step 401 can be found in the relevant descriptions in any embodiment of this application, and will not be repeated here.

[0112] Step 402, First stage: The feature encoder extracts the first feature vector of the data packet; wherein, the feature encoder is trained using a multi-task self-supervised pre-training method.

[0113] As an example, this stage uses the BERT model as the feature encoder. The BERT model structure includes an L-layer multi-head self-attention module and a feedforward network, with each layer followed by residual connections and layer normalization.

[0114] In traditional BERT model training, a training strategy of random masking and recovery is typically used, such as randomly masking 15% of the tokens and having the model predict these masked tokens. However, this training strategy cannot accurately simulate packet loss in real-world network environments.

[0115] To address this, a Packet-Level Mask mechanism is proposed—randomly masking the entire data packet with a second preset probability p2, including all header and payload tokens in the packet, while retaining a partial Token-Level Mask (randomly masking a portion of bytes in any data packet with a first preset probability p2) to simulate byte-level corruption. Masked tokens can be replaced using a special marker [MASK]. Since packet loss in real-world network environments typically occurs as "whole packets" rather than random byte loss, the aforementioned Packet-Level Mask mechanism more closely reflects the actual network environment, forcing the model to learn the ability to infer the content of missing data packets from context, thereby improving the model's robustness.

[0116] During the training of the BERT model, the main loss function is the same as the loss function for the token reconstruction task:

[0117] Meanwhile, in order to enable the BERT model to achieve more accurate feature extraction, a labeled self-supervised auxiliary task can be designed using the static statistical data of the entire network traffic data. The auxiliary task and its loss function are shown in Table 1.

[0118] In this system, all tasks share a backbone encoder, with inputs consisting of streaming [cls] labels, but each task has its own independent prediction head (MLP or linear layer). The total loss function is a weighted combination of the various loss functions.

[0119] Therefore, by designing multiple auxiliary tasks to jointly train the feature encoder, each task shares the backbone encoder but has an independent prediction head, and the total loss is automatically balanced by an uncertainty weighting method to improve the generalization ability of the representation.

[0120] Other relevant content in step 402 can be found in the relevant descriptions in any embodiment of this application, and will not be repeated here.

[0121] Step 403, Second Stage: The graph neural network module determines the graph structure of the network traffic data based on the first feature vector of the data packet, and determines the second feature vector of the graph structure; wherein, the graph neural network module is trained using a graph contrastive learning method.

[0122] The first stage involves pre-training the model to learn general representations of network traffic. In the second stage, to focus the model on anomaly traffic identification and address the scarcity and uneven distribution of labeled anomaly traffic data in real-world scenarios, a contrastive learning mechanism is introduced to extract graph-level features based on a limited amount of labeled data. This mechanism reduces the model's dependence on the amount of labeled data and improves anomaly traffic detection performance in resource-constrained scenarios.

[0123] Through the two-stage training described above, the model can first obtain a general representation of network traffic, and then optimize it for specific abnormal network traffic tasks, thereby achieving high-precision classification and recognition even with limited labeled data.

[0124] Among them, the graph neural network module addresses the lack of semantic relevance modeling ability of GNN methods in related technologies, which rely on fixed graph structures (such as connecting adjacent packets in chronological order). It proposes a dynamic graph construction mechanism based on maximizing mutual information: 1. A feature encoder is used to extract features from each data packet in the network traffic data, resulting in the first feature vector for each data packet: z i =Encoder(Packet i ) Among them, z i ∈ Let d represent the first feature vector of the i-th data packet, and d represent the dimension. See the above for related explanations.

[0125] 2. Using a graph neural network module, the similarity between any two data packets in the network traffic data is calculated based on the first feature vector of each data packet:

[0126] Among them, s ij This represents the similarity between the i-th data packet and the j-th data packet, and can then be based on s ij Generate a similarity matrix S∈ , where N is the number of data packets.

[0127] 3. Based on the similarity matrix S, establish edge connections using dynamic thresholding or KNN (K-Nearest Neighbors) strategy to generate a graph structure.

[0128] The graph structure can be represented by the adjacency matrix A∈{0,1} N×N (Undirected and unweighted graph) or A∈ (Weighted graph) mathematical modeling; where N is the total number of nodes in the graph, A i,j This represents the connection between node i and node j (1 indicates the existence of an edge, 0 indicates no edge; in a weighted graph, if an edge exists, then A). i,j Let A be the weight of the edge. If no edge exists, then A... i,j =0).

[0129] In addition, time difference, direction change, and other attributes can be introduced into the graph structure as attribute information of the connecting edges.

[0130] Therefore, it can overcome the limitations of time-series modeling in related technologies, capture highly semantically similar behaviors across time periods, and improve the ability to model covert attacks.

[0131] As an example, the graph neural network module employs an inductive learning framework based on GraphSAGE to address the limitations of transductive methods in graph convolutional networks in related technologies.

[0132] In related technologies, the GCN method can only handle fixed graph structures that appear during the training phase and cannot directly generalize to unseen new nodes or graph structures. However, in this embodiment, the GraphSAGE framework generates node embeddings through a neighbor feature aggregation mechanism, without relying on global graph structure information, and can dynamically adapt to new nodes or unseen graph data. Specifically, this framework uses a neighbor sampling technique, performing feature aggregation only on the local neighbors of each node, thereby reducing computational complexity. This design enables the model to handle graph data of arbitrary scale while maintaining high computational efficiency.

[0133] For example, the aggregation operation of the l-th layer of GraphSAGE can be:

[0134] AGGREGATE can be a mean, pooling, or LSTM aggregation function.

[0135] After K layers of propagation, the feature aggregation vector h of the nodes is obtained. (K) .

[0136] After obtaining the feature aggregation vectors of each node, the second feature vector z of the graph structure can be generated using the Readout function. G :

[0137] Contrastive learning is a self-supervised learning paradigm. Its core principle is to learn more discriminative feature representations by narrowing the representation distance between positive sample pairs and widening the representation distance between negative sample pairs. In this embodiment, by constructing positive and negative training sample pairs of network traffic data, the model can automatically learn the essential features of different network traffic data without relying on a large amount of labeled data. This learning method alleviates the problem of scarce labeled data in the field of network security, and at the same time, the sample diversity brought about by data augmentation improves the robustness of the model to various interference factors in the real network environment. Moreover, the introduction of contrastive learning enables the model to achieve excellent graph-level feature extraction capabilities with a small number of labeled samples, laying a solid foundation for subsequent abnormal network traffic detection tasks.

[0138] For example, positive training sample pairs include: (1) Two versions of the same network stream after different data augmentation processes; (2) Graph representation of similar abnormal flows (such as multiple DDoS attack flows); Negative training samples include: (1) Different types of network flows.

[0139] As an example, to improve the model's adaptability to real network perturbations, the following data augmentation processing can be used: Packet drop: Randomly delete no more than 30% of the data packets at a certain ratio to simulate network packet loss scenarios; Packet copying: Copy critical data packets once to simulate the network retransmission mechanism; Load disturbance: Flip a certain percentage of the low-order bits of the load portion to simulate transmission noise; Stream truncation: Randomly extract the first N data packets to simulate an online truncation inference scenario.

[0140] The data augmentation process described above not only improves the robustness of the model, but also provides diverse positive samples for comparative learning, thereby enhancing the model's generalization ability.

[0141] The infoNCE loss function can be used to train the graph neural network module.

[0142] in, This represents the second feature vector of the two graph structures corresponding to the positive training sample pair. For cosine similarity, >0 represents a temperature hyperparameter that controls the degree of concentration in the distribution.

[0143] Other relevant content in step 403 can be found in the relevant descriptions in any embodiment of this application, and will not be repeated here.

[0144] Step 404, third stage: The classification head module identifies whether the network traffic data is abnormal based on the second feature vector; in this stage, the classification head module undergoes lightweight fine-tuning.

[0145] As an example, the classification head module in an abnormal network traffic identification model can adopt a two-layer multilayer perceptron structure, with Dropout regularization added to the middle layer, and finally output the predicted probability distribution of each category (e.g., normal category, abnormal category).

[0146] During the training of the classification head module, the parameters of the trained graph neural network module and the trained feature encoder can be frozen, allowing only the classification head module to be trained. This preserves the general feature extraction and graph-level feature extraction capabilities acquired during pre-training. The basic loss function used is cross-entropy loss.

[0147] Where 'c' represents the category, This represents the value of category c in the actual label. This represents the model's predicted output for category c; For scenarios with class imbalance, Focal Loss can be used:

[0148] in, It is a control parameter used to control the weight of hard examples (samples that are misclassified by the model or have low prediction confidence).

[0149] To meet the requirements of high throughput and low latency online detection, an automatic truncation triggering mechanism based on two conditions is proposed: the graph construction and reasoning process is immediately triggered when any of the following conditions are met: (1) Packet truncation condition: The cumulative number of received data packets reaches the preset threshold N_max (e.g., 50 packets); (2) Time window truncation condition: The duration of the network flow exceeds the preset threshold T_max (e.g., 10 seconds).

[0150] This avoids waiting for the entire network flow to finish, enabling near real-time detection capabilities. Especially for long-running network flows, it can identify attack characteristics (such as a large number of SYN packets) in the early stages, thus triggering early attack warnings.

[0151] Specifically, for high-precision detection scenarios, an incremental inference mechanism is proposed: (1) Newly arriving data packets are dynamically added to the graph structure; (2) Re-execute the graph neural network aggregation operation and update the second feature vector z. G ; (3) Real-time refresh of classification results.

[0152] This mechanism is suitable for application scenarios with high latency tolerance, such as cloud firewalls and intrusion detection systems.

[0153] In this embodiment, a three-stage learning framework of "multi-task self-supervised pre-training - graph contrastive learning - lightweight fine-tuning" is constructed. In the first stage, a general representation capability is obtained on unlabeled traffic through multi-task self-supervised learning. In the second stage, contrastive learning is performed on a dynamic graph structure using a small amount of labeled data to enhance class separability. In the third stage, only the classification head is fine-tuned to complete task adaptation, reducing the dependence on labeled data and improving small sample generalization ability.

[0154] To address the issue of semantic ambiguity of the same byte across different protocol layers, a multidimensional embedding representation mechanism is proposed. Independent type indicators are assigned to the Header field and the Payload content, and multidimensional embedding information such as content, position, and paragraph is combined to construct a multidimensional input representation. This mechanism can clearly distinguish the meaning of bytes in different semantic domains, alleviate the problem of byte-level semantic confusion, and enhance the model's ability to identify hidden behaviors such as encrypted traffic and obfuscated payloads.

[0155] By extracting the first feature vector of each data packet using a feature encoder, calculating the inter-packet cosine similarity matrix, and establishing connection edges using dynamic thresholding or KNN strategies, a semantic association graph structure driven by non-temporal order is formed. This breaks through the rigid dependence on time series and uses dynamic graph construction strategies to adaptively identify semantically related data packets and establish connections, enabling the model to maintain stable representation capabilities under discontinuous and irregular input conditions and improving the model's robustness to network disturbances.

[0156] By randomly masking all header and payload tokens (instead of individual bytes) of the entire data packet at a preset probability during the self-supervised pre-training stage of the feature encoder and replacing them with [MASK] tags, the phenomenon of whole packet loss in real networks is simulated; at the same time, part of the token-level mask is retained to simulate transmission noise, which is closer to the real disturbance scenario and further enhances the robustness of the model.

[0157] By adopting GNN as the backbone structure in the third stage, its local aggregation mechanism has linear or near-linear complexity, reducing computational overhead. At the same time, a flow-level automatic truncation mechanism is designed, which combines the maximum number of packets and the time window as dual judgment conditions to achieve rapid graph construction and inference under limited resources, balancing accuracy and efficiency. It is suitable for real-time threat detection deployment in large-scale network boundaries or cloud environments.

[0158] To achieve the above embodiments, this application also proposes an abnormal network traffic identification device.

[0159] Figure 5 This is a schematic diagram of an abnormal network traffic identification device provided in an embodiment of this application.

[0160] like Figure 5 As shown, the abnormal network traffic identification device 500 includes: The first processing module 501 is used to preprocess multiple data packets in network traffic data to determine the input sequence of network traffic data; wherein, the input sequence includes the target representation sequence of multiple data packets; The identification module 502 is used to identify whether network traffic data is abnormal based on the input sequence using a trained abnormal network traffic identification model. The abnormal network traffic identification model includes a feature encoder, a graph neural network module, and a classification head module. The feature encoder is used to extract features from the target representation sequence of any data packet to obtain the first feature vector of the data packet; The graph neural network module is used to generate a graph structure of network traffic data based on the first feature vector of multiple data packets, and to determine the second feature vector of the graph structure. The classification head module is used to determine the category of network traffic data based on the second feature vector; where the category is used to indicate whether the network traffic data is abnormal.

[0161] Optionally, the identification module 502 is specifically used to: determine the similarity between any two data packets in the network traffic data based on the first feature vector of multiple data packets; and establish connection edges based on the similarity between any two data packets in the network traffic data, using multiple data packets as nodes, to generate a graph structure.

[0162] Optionally, the recognition module 502 is specifically used for: for any node in the graph structure, performing feature aggregation on at least some of the node's neighboring nodes to obtain a feature aggregation vector of the node; and generating a second feature vector based on the feature aggregation vectors of multiple nodes in the graph structure.

[0163] Optionally, the above apparatus further includes: a first acquisition module, configured to acquire multiple training network traffic data; a first determination module, configured to determine the input sequence of the multiple training network traffic data as a first training sample; wherein, the input sequence of any training network traffic data includes the target representation sequence of multiple training data packets in the training network traffic data, and the target representation sequence of any training data packet includes the embedded representation of multiple bytes in the training data packet; a second processing module, configured to mask the embedded representation of at least some bytes in the multiple training data packets according to a first preset probability, and to mask the target representation sequence of at least some training data packets in the multiple training data packets according to a second preset probability, to obtain a second training sample; and a first training module, configured to train the feature encoder to be trained in the abnormal network traffic identification model based on the second training sample and the first training sample, to obtain the trained feature encoder.

[0164] Optionally, the first training module is specifically configured to: input the second training sample and the first training sample into the feature encoder to be trained, and determine a first loss function; wherein the first loss function is used to indicate the difference between the target training sample recovered by the feature encoder to be trained based on the second training sample and the first training sample; train the feature encoder to be trained according to the first loss function, or according to the first loss function and the second loss function of the auxiliary task, to obtain the trained feature encoder; wherein the auxiliary task includes at least one of the following: flow duration prediction task; bandwidth prediction task; protocol type prediction task; packet count prediction task; flow direction prediction task.

[0165] Optionally, the above apparatus further includes: a second acquisition module for acquiring multiple training network traffic data; an enhancement processing module for performing data enhancement processing on any training network traffic data to obtain target training network traffic data corresponding to the training network traffic data; a second determination module for determining positive training sample pairs and negative training sample pairs based on the multiple training network traffic data and the target training network traffic data corresponding to the multiple training network traffic data; and a second training module for training the graph neural network module to be trained in the abnormal network traffic identification model based on the positive training sample pairs and negative training sample pairs to obtain the trained graph neural network module.

[0166] Optionally, the first processing module 501 is specifically used to: for any data packet in the network traffic data, generate an embedded representation of a byte based on the content information, position information, and type information of any byte in the data packet; generate a target representation sequence of the data packet based on the sorting of multiple bytes in the data packet and the embedded representation of multiple bytes; and determine the input sequence of the network traffic data based on the target representation sequence of multiple data packets in the network traffic data.

[0167] It should be noted that the foregoing explanation of the abnormal network traffic identification method embodiment also applies to the abnormal network traffic identification device of this embodiment, and will not be repeated here.

[0168] In this embodiment, multiple data packets in the network traffic data are preprocessed to determine the input sequence of the network traffic data. The input sequence includes the target representation sequence of multiple data packets. A trained abnormal network traffic identification model is used to identify whether the network traffic data is abnormal based on the input sequence. The abnormal network traffic identification model includes a feature encoder, a graph neural network module, and a classification head module. The feature encoder extracts features from the target representation sequence of any data packet to obtain a first feature vector of the data packet. The graph neural network module generates a graph structure of the network traffic data based on the first feature vectors of multiple data packets and determines a second feature vector of the graph structure. The classification head module determines the category of the network traffic data based on the second feature vector. The category indicates whether the network traffic data is abnormal. The abnormal network traffic identification model uses a feature encoder to extract deep features from individual data packets, a graph neural network module to capture complex relationships and overall features between data packets, and a classification head module to identify whether the traffic is abnormal based on the overall features. This improves the accuracy and robustness of anomaly identification, enabling more efficient and accurate identification of potential network threats and enhancing proactive network security defense capabilities.

[0169] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. The electronic device 600 in this embodiment is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0170] like Figure 6 As shown, the above-mentioned electronic device 600 includes: The memory 601 and the processor 602 are connected by a bus 603, which connects the different components (including the memory 601 and the processor 602). The memory 601 stores a computer program, and when the processor 602 executes the program, it implements the abnormal network traffic identification method of the present application embodiment.

[0171] Bus 603 represents one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus using any of the various bus architectures. For example, these architectures include, but are not limited to, the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MAC) bus, the Enhanced ISA bus, the Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnect (PCI) bus.

[0172] Electronic device 600 typically includes a variety of electronic device readable media. These media can be any available media that can be accessed by electronic device 600, including volatile and non-volatile media, removable and non-removable media.

[0173] Memory 601 may also include computer system readable media in the form of volatile memory, such as random access memory (RAM) 604 and / or cache memory 605. Electronic device 600 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 606 can be used to read and write non-removable, non-volatile magnetic media (… Figure 6 Not shown; usually referred to as a "hard drive"). Although Figure 6 As not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk") and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to bus 603 via one or more data media interfaces. Memory 601 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of the embodiments of this application.

[0174] A program / utility 608 having a set (at least one) of program modules 607 may be stored, for example, in memory 601. Such program modules 607 include, but are not limited to, an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include an implementation of a network environment. Program modules 607 typically perform the functions and / or methods described in the embodiments of this application.

[0175] Electronic device 600 can also communicate with one or more external devices 609 (e.g., keyboard, pointing device, display 611, etc.), and with one or more devices that enable a user to interact with the electronic device 600, and / or with any device that enables the electronic device 600 to communicate with one or more other computing devices (e.g., network card, modem, etc.). This communication can be performed through input / output (I / O) interface 612. Furthermore, electronic device 600 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) through network adapter 613. Figure 6 As shown, network adapter 613 communicates with other modules of electronic device 600 via bus 603. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0176] The processor 602 executes various functional applications and data processing by running programs stored in the memory 601.

[0177] It should be noted that the implementation process and technical principles of the electronic device in this embodiment are explained in the foregoing description of the abnormal network traffic identification method in this application embodiment, and will not be repeated here.

[0178] To implement the above embodiments, this application also proposes a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the methods provided in the foregoing embodiments.

[0179] To implement the above embodiments, this application also proposes a computer program product, including a computer program that, when executed by a processor, implements the methods provided in the foregoing embodiments.

[0180] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in this application all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0181] It should be noted that personal information collected from users should be used for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. Furthermore, such collection / sharing should only be conducted after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign an agreement / authorization that includes authorization of relevant user information before the user uses the function. In addition, any necessary steps must be taken to protect and safeguard access to such personal information data and ensure that others with access to personal information data comply with their privacy policies and procedures.

[0182] This application is intended to provide an implementation scheme for users to selectively prevent the use or access to their personal information data. Specifically, this disclosure is intended to provide hardware and / or software to prevent or block access to such personal information data. Once personal information data is no longer needed, risks can be minimized by restricting data collection and deleting data. Furthermore, where applicable, such personal information is de-identified to protect user privacy.

[0183] In the foregoing descriptions of the embodiments, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0184] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0185] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0186] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer system, a system including a processor, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0187] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0188] Those skilled in the art will understand that all or part of the steps of the methods described in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it includes one or a combination of the steps of the method embodiments.

[0189] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0190] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.

Claims

1. A method for identifying abnormal network traffic, characterized in that, include: Multiple data packets in network traffic data are preprocessed to determine the input sequence of the network traffic data; wherein, the input sequence includes the target representation sequence of the multiple data packets; Using a trained abnormal network traffic identification model, the network traffic data is identified as abnormal based on the input sequence. The abnormal network traffic identification model includes a feature encoder, a graph neural network module, and a classification head module. The feature encoder is used to extract features from the target representation sequence of any of the data packets to obtain the first feature vector of the data packets; The graph neural network module is used to generate a graph structure of the network traffic data based on the first feature vector of the plurality of data packets, and to determine the second feature vector of the graph structure; The classification head module is used to determine the category of the network traffic data based on the second feature vector; wherein the category is used to indicate whether the network traffic data is abnormal.

2. The method according to claim 1, characterized in that, The step of generating a graph structure of the network traffic data based on the first feature vector of the plurality of data packets, and determining the second feature vector of the graph structure, includes: Based on the first feature vector of the plurality of data packets, the similarity between any two data packets in the network traffic data is determined; Using the multiple data packets as nodes, connection edges are established based on the similarity between any two data packets in the network traffic data to generate the graph structure.

3. The method according to claim 1, characterized in that, Determining the second feature vector of the graph structure includes: For any node in the graph structure, feature aggregation is performed on at least some of the node's neighboring nodes to obtain the node's feature aggregation vector; The second feature vector is generated based on the feature aggregation vectors of multiple nodes in the graph structure.

4. The method according to claim 1, characterized in that, The method further includes: Obtain traffic data from multiple training networks; The input sequence of the plurality of training network traffic data is determined as the first training sample; wherein, any input sequence of the training network traffic data includes the target representation sequence of a plurality of training data packets in the training network traffic data, and any target representation sequence of the training data packet includes the embedded representation of a plurality of bytes in the training data packet; According to a first preset probability, the embedding representation of at least some bytes in the plurality of training data packets is masked, and according to a second preset probability, the target representation sequence of at least some training data packets in the plurality of training data packets is masked to obtain a second training sample; Based on the second training sample and the first training sample, the feature encoder to be trained in the abnormal network traffic identification model is trained to obtain the trained feature encoder.

5. The method according to claim 4, characterized in that, The step of training the feature encoder to be trained in the abnormal network traffic identification model based on the second training sample and the first training sample to obtain the trained feature encoder includes: The second training sample and the first training sample are input into the feature encoder to be trained to determine a first loss function; wherein, the first loss function is used to indicate the difference between the target training sample recovered by the feature encoder to be trained based on the second training sample and the first training sample; The feature encoder to be trained is trained according to the first loss function, or according to the first loss function and the second loss function of the auxiliary task, to obtain the trained feature encoder. The auxiliary task includes at least one of the following: Stream duration prediction task; Bandwidth prediction task; Protocol type prediction task; Packet count prediction task; Flow direction prediction task.

6. The method according to claim 1, characterized in that, The method further includes: Obtain traffic data from multiple training networks; Perform data augmentation processing on any of the training network traffic data to obtain the target training network traffic data corresponding to the training network traffic data; Based on the multiple training network traffic data and the target training network traffic data corresponding to the multiple training network traffic data, positive training sample pairs and negative training sample pairs are determined. Based on the positive training sample pairs and the negative training sample pairs, the graph neural network module to be trained in the abnormal network traffic identification model is trained to obtain the trained graph neural network module.

7. The method according to any one of claims 1-6, characterized in that, The preprocessing of multiple data packets in the network traffic data to determine the input sequence of the network traffic data includes: For any data packet in the network traffic data, an embedded representation of the byte is generated based on the content information, position information, and type information of any byte in the data packet; Based on the order of multiple bytes in the data packet and the embedded representation of the multiple bytes, a target representation sequence of the data packet is generated; The input sequence of the network traffic data is determined based on the target representation sequence of multiple data packets in the network traffic data.

8. An abnormal network traffic identification device, characterized in that, include: The first processing module is used to preprocess multiple data packets in network traffic data to determine the input sequence of the network traffic data; wherein, the input sequence includes the target representation sequence of the multiple data packets; The identification module is used to identify whether the network traffic data is abnormal based on the input sequence using a trained abnormal network traffic identification model. The abnormal network traffic identification model includes a feature encoder, a graph neural network module, and a classification head module. The feature encoder is used to extract features from the target representation sequence of any of the data packets to obtain the first feature vector of the data packets; The graph neural network module is used to generate a graph structure of the network traffic data based on the first feature vector of the plurality of data packets, and to determine the second feature vector of the graph structure; The classification head module is used to determine the category of the network traffic data based on the second feature vector; wherein the category is used to indicate whether the network traffic data is abnormal.

9. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions that, when executed by a processor, implement the method as described in any one of claims 1-7.

Images