Abnormal traffic classification method based on LLM compression prompt project

Abstract

The invention relates to the technical problem of digital data processing, and provides an abnormal traffic classification method based on an LLM compressed prompt project in order to solve the technical problems of insufficient accuracy and poor reliability of LLM classification, which comprises the following steps of: constructing a Pallas system at least comprising a feature purification module and a prompt project fusion module; abnormal traffic classification based on the LLM compression prompt project is realized; the method comprises the following steps: inputting original data, and dividing the original data into a training set and a test set; eliminating zero variance features by using the feature purification module, and sorting and selecting residual features by using mutual information; and performing numerical regulation and statistical knowledge injection on the training set by using a prompt project fusion module, performing numerical regulation on the test set, and generating classification response and outputting constraint by using a standardized reasoning template. The feature purification module and the compression type prompt engineering method provided by the invention have the advantages that the classification accuracy and reliability are obviously improved, and the application prospect is wide.

Description

Technical Field

[0001] This invention belongs to the field of digital data processing technology, specifically relating to an abnormal traffic classification method based on LLM compressed alerting engineering. Background Technology

[0002] Distributed Denial-of-Service (DDoS) attacks have become one of the most serious challenges facing modern network infrastructure, posing a significant risk to the availability and stability of online services. The impact of this cybersecurity issue extends across multiple industries, with a considerable portion of losses directly caused by DDoS attacks. These cybersecurity incidents, by congesting target systems with massive amounts of abnormal traffic, can damage critical infrastructure and cause economic losses. As cyberattack methods continue to evolve, the DDoS threat is further intensifying—attackers are increasingly employing various techniques, including amplifying abnormal data volumes, reflecting vulnerability exploits, and protocol-specific vulnerability attacks.

[0003] To address these threats, researchers have proposed anomaly traffic detection techniques to identify abnormal traffic. Traditional machine learning methods primarily rely on expert knowledge to design manually crafted features; while deep learning methods can automatically extract features from raw data through neural networks, both methods heavily depend on high-quality training data. Furthermore, due to the unknown data distribution of novel attack traffic, both methods face challenges in identifying new attack patterns. In recent years, LLM (Large Language Model) has made groundbreaking progress in the field of NLP (Natural Language Processing) and has been widely applied in network tasks such as network configuration, fault diagnosis, and network management. This has prompted researchers to explore applying LLM-based classifiers to traffic classification tasks.

[0004] However, LLM-based classifiers face two major challenges in practical deployment: 1) The curse of dimensionality in network datasets leads to the dilution of discriminative signals by redundant features, making the model susceptible to false correlations and resulting in illusions, thus reducing classification accuracy; 2) LLM is essentially designed for text data, and when processing numerical network features, it suffers from cross-modal cognitive bias, making it difficult to correlate high-precision numerical values ​​with potential semantic magnitudes.

[0005] In summary, to address the aforementioned challenges, it is necessary to propose a compressed cueing engineering method that preserves discriminative features, reduces noise interference and token overhead, thereby improving classification accuracy and performance. Summary of the Invention

[0006] This invention addresses the technical problems of decreased classification accuracy due to the curse of dimensionality and poor reliability of text modal models when processing numerical network features in existing technologies. It proposes an abnormal traffic classification method based on LLM compressed cue engineering. This method is based on constructing a Pallas system, which includes two core components: a feature extraction module and a cue engineering fusion module. The method uses a feature purification module to filter high-discriminative features to eliminate noisy features and reduce token overhead; and a cue engineering fusion module designs an efficient background knowledge injection mechanism and employs a carefully constructed inference template to reduce model illusions and improve classification performance.

[0007] An abnormal traffic classification method based on LLM compressed alert engineering is disclosed. The method constructs a Pallas system to classify abnormal traffic based on LLM compressed alert engineering. The Pallas system includes at least a core component feature extraction module and an alert engineering fusion module. The method includes: Step 110: Input the raw network traffic data. Each traffic item in the data corresponds to a feature vector; each component in the feature vector corresponds to a feature. Step 120: Divide the original data proportionally into two datasets: a training set and a test set. Step 130: Input the training set and test set into the Pallas system respectively, use the feature purification module to remove zero-variance features from the training set or test set data, and sort and select the remaining features after removing zero-variance features through mutual information to obtain the feature-purified training set or test set. Step 140: Input the training set after feature purification into the prompting engineering fusion module. After numerical normalization using adaptive numerical formatting, inject multiple statistical indicators of the features into the LLM using statistical knowledge injection to guide the LLM to complete the abnormal traffic classification. Step 150: Input the feature-purified test set into the prompting engineering fusion module. After numerical normalization using adaptive numerical formatting, generate the classification response of LLM inference using the standardized inference template to enhance the classification performance of LLM inference and provide output constraints. Step 160: After generating the classification response using multiple statistical indicators of LLM reception features and standardized inference templates, extract the abnormal traffic classification labels and corresponding confidence scores from the test set, and output the classification results of abnormal traffic.

[0008] Compared with the prior art, the technical effects of the present invention include: (1) Design a feature purification module to eliminate non-informative features and retain discriminative features by sorting mutual information, thereby solving the signal saturation problem in high-dimensional space and reducing computational overhead; (2) Develop a prompt engineering fusion module, which includes an adaptive feature representation format and an efficient background knowledge injection method. At the same time, design a dedicated inference template to improve classification performance and standardize the output format. (3) Extensive experiments were conducted on public datasets to evaluate the classification performance and token cost of the Pallas system. The results show that Pallas achieves a classification accuracy of 91.81% and an AUC of 0.9469, which are significantly better than all baseline models. In addition, this method can save users 69.37% of token consumption. Attached Figure Description

[0009] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the structures shown in these drawings without creative effort.

[0010] Figure 1 This is a flowchart illustrating the framework of an abnormal traffic classification method based on LLM compressed alerting engineering in one embodiment of the present invention. Figure 2 The diagram shows the overall architecture and workflow of the Pallas system, which uses an abnormal traffic classification method based on LLM compressed alerting engineering in the experiment of this invention. Figure 3 Different experiments in this invention A comparative diagram showing Pallas's performance across accuracy, AUC, and precision at different values; Figure 4 Different experiments in this invention A diagram showing the comparison of Pallas's performance in F1 score and recall rate under different values. Detailed Implementation

[0011] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0012] In one embodiment, such as Figure 1As shown, this invention provides an abnormal traffic classification method based on LLM compressed suggestion engineering. The method constructs a Pallas system to achieve abnormal traffic classification based on LLM compressed suggestion engineering. The Pallas system includes at least a feature extraction module and a suggestion engineering fusion module. The method includes: Step 110: Input the raw network traffic data. Each traffic item in the data corresponds to a feature vector; each component in the feature vector corresponds to a feature. Step 120: Divide the original data proportionally into two datasets: a training set and a test set. Step 130: Input the training set and test set into the Pallas system respectively, use the feature purification module to remove zero-variance features from the training set or test set data, and sort and select the remaining features after removing zero-variance features through mutual information to obtain the feature-purified training set or test set. Step 140: Input the training set after feature purification into the prompting engineering fusion module. After numerical normalization using adaptive numerical formatting, inject multiple statistical indicators of the features into the LLM using statistical knowledge injection to guide the LLM to complete the abnormal traffic classification. Step 150: Input the feature-purified test set into the prompting engineering fusion module. After numerical normalization using adaptive numerical formatting, generate the classification response of LLM inference using the standardized inference template to enhance the classification performance of LLM inference and provide output constraints. Step 160: After generating the classification response using multiple statistical indicators of LLM reception features and standardized inference templates, extract the abnormal traffic classification labels and corresponding confidence scores from the test set, and output the classification results of abnormal traffic.

[0013] Generally, DDoS attacks, as a major threat in the field of cybersecurity, force network operators to deploy traffic classifiers to distinguish between abnormal traffic (non-compliant traffic) and normal traffic (legitimate traffic).

[0014] set up Indicates the first The feature vector of the flow, where, For the first The first of the traffic One characteristic, ; ; Indicates the number of traffic samples. Representing feature dimensions; feature vector for each traffic item. Corresponding unique tag The label value can be either "normal traffic (BENIGN)" or a specific type of DDoS attack (abnormal traffic). Accurately identifying abnormal traffic can help network operators configure firewall rules in a targeted manner and deploy defense mechanisms as needed. However, DDoS attacks exhibit complex and continuously evolving characteristics, posing a significant challenge to attack identification.

[0015] LLMs, with their excellent performance in classification tasks, have been proven effective in solving traffic classification problems. However, training an LLM from scratch is computationally extremely expensive, so developers typically fine-tune pre-trained models. Even with Parameter-Efficient Fine-Tuning (PEFT) techniques, the fine-tuning process still incurs considerable computational overhead.

[0016] Prompt engineering (PE), as a low-cost method, can effectively enhance the traffic classification capabilities of pre-trained LLMs. It requires no expensive fine-tuning and supports flexible and rapid deployment. Researchers have explored embedding network traffic statistics into prompt templates, confirming the feasibility of using various prompt engineering techniques to guide LLM-based DDoS traffic classification. However, LLM traffic classifiers based on prompt engineering still face the following key challenges: (1) Discrimination signal submersion in high-dimensional space Network traffic datasets typically contain high-dimensional features, encompassing multiple dimensions such as packet statistics, temporal patterns, and protocol behavior. Directly inputting such high-dimensional features into an LLM (Local Management Model) presents a core challenge: the discriminative signals required for DDoS detection are easily overwhelmed by irrelevant or redundant information. Specifically, many features have weak correlations with attack labels, and some are even completely unrelated to traffic categories. The noise introduced by these features distracts the model from key indicators. This signal overload not only forces the LLM to process excessive amounts of irrelevant data, increasing computational overhead and decreasing classification accuracy, but also exacerbates the resource waste within the LLM's limited context window.

[0017] (2) Cross-modal misalignment and inconsistency in reasoning LLMs are primarily trained on natural language data, while network traffic data is mainly composed of numerical features. This cross-modal mismatch presents inherent challenges for LLMs when processing traffic data. Firstly, large numerical features (such as total bytes) are fragmented into sequences, impairing the model's ability to perceive the actual magnitude of features; excessively high numerical precision not only fails to improve model performance but also wastes tokens. Secondly, LLMs lack inherent access to historical traffic statistics, making it difficult to contextualize new traffic within typical patterns. Furthermore, unstructured reasoning processes and non-standardized output formats can lead to model illusions, hindering reliable classification. These issues collectively weaken the model's ability to map traffic features to attack types, preventing the full realization of LLM's potential.

[0018] To address the aforementioned challenges, this invention designs a Pallas (Prompt Engineering Approach for Optimizing LLM-based Anomaly Traffic Classification) system. This system integrates a feature refinement module and a prompt engineering fusion module, enabling large language models (LLMs) to achieve high classification accuracy and robust inference capabilities with extremely low token overhead. Its overall architecture is as follows: Figure 1 As shown, it includes: (1) Feature purification module: This module is responsible for filtering a subset of features with high discriminative power from the original dataset to remove noisy features and reduce token overhead. First, it removes zero-variance features that are irrelevant to classification. Then, it sorts the remaining features based on mutual information (MI), retaining only the top-ranked features. These features are used in subsequent classification tasks to reduce noise interference and token overhead.

[0019] (2) Hint Engineering Fusion Module: This module aims to efficiently inject background knowledge into LLMs and reduce model illusions and improve classification performance through a carefully designed inference template. It utilizes various statistical indicators to extract global features for each category as background knowledge for LLMs, employs an adaptive numerical formatting method to regularize all features, and avoids excessively discrete tokenization of large numerical features. Subsequently, the features of the traffic to be classified (tested) are encoded into a unified inference template and input into the LLMs. This template integrates multiple hint engineering techniques to enhance inference performance and constrains the output format.

[0020] Not all traffic features contribute positively to abnormal traffic classification; therefore, this invention designs a feature purification module to select features based on perceived information. The feature purification module's workflow comprises two consecutive stages: zero-variance feature removal and mutual information feature selection. The former removes invariant attributes from the original dataset, while the latter ranks the remaining features based on their information contribution to class classification.

[0021] 1) Zero-variance feature removal The CICDDoS2019 dataset is a public dataset released in 2019 by the Canadian Institute for Cybersecurity (CIC) specifically for research on distributed denial-of-service attacks. It focuses on network traffic datasets that reflect modern and complex DDoS attacks and contains a benchmark dataset with rich features and labels for various types of DDoS attacks.

[0022] By observing the CICDDoS2019 dataset, this invention discovered an important phenomenon: the values ​​of some features remain constant throughout the dataset. These features with constant values ​​are defined as zero-variance features, which cannot provide any effective information for identifying abnormal traffic and therefore must be removed from the dataset first.

[0023] The features of all traffic samples are concatenated into a feature matrix by piecing together row vectors. For the characteristic matrix Calculate the variance of each feature (feature component): (1) in, Indicates the number of traffic samples. Representing feature dimension, For the first Features The mean. If =0, then feature Features identified as having zero variance are removed from the feature matrix. After this step, the dimension of the feature matrix is ​​reduced to... .

[0024] 2) Mutual information feature selection Even after removing zero-variance features, the high-dimensionality of the remaining features still affects the classification performance and computational efficiency of LLMs. To further reduce feature redundancy and select features with the greatest discriminative power for DDoS detection, this invention uses mutual information (MI) to rank feature importance. Mutual information quantifies feature distribution. With category label variables The statistical dependence between features and classification label variables can effectively capture complex nonlinear association patterns. Its core principle is to measure the distribution of known features. The degree to which the uncertainty of the classification label variable Y is reduced.

[0025] Mutual Information The mathematical definition of is: (2) in, ( , ) represents the characteristic distribution Values And the category tags are The joint probability; ( )and ( ) are characteristic distributions With category label variables The marginal probabilities. The logarithmic function is usually base 2, so the unit of mutual information is bits. This indicates that the feature distribution is completely independent of the classification label variable; the larger the value, the richer the classification label discrimination information contained in the feature distribution.

[0026] Network traffic characteristics are mostly continuously distributed, while formula (2) only applies to discrete characteristics. Therefore, continuous characteristics need to be discretized to avoid bias and retain information. To this end, this invention adopts a method based on... Neighbors ( The Kraskov-Stögbauer-Grassberger (KSG) estimator of (-NN) directly computes mutual information. For each continuous feature The formula for calculating the KSG estimator is: (3) in, It is a double gamma function, a function of the logarithmic derivative of the gamma function, used in calculations to provide unbiased or asymptotically unbiased estimates of statistics; Neighborhood size (default) ), , Counting for local points; Representing the characteristic distribution The value of is a specific characteristic of network traffic (such as protocol, packet size, etc.). Represents category label variables The possible values ​​(specific category tags) are: BENIGN or ATTACK.

[0027] The computational complexity of mutual information is ,in, For the sample size, The number of features after zero variance screening.

[0028] Traditional discretization methods (such as equal-width binning) are prone to introducing biases, such as distorting the tail distribution or generating spurious dependencies. KSG estimation methods, through distance-based density estimation, can preserve discriminative information in the tail distribution and mitigate such discretization artifacts. After obtaining the mutual information of all features, the features are sorted in descending order of mutual information values. LLMs only need to consider the first few features during the inference phase. Features (of which) , , The compression ratio is... (This indicates rounding down). In this way, Pallas achieves feature dimensionality reduction while preserving discriminative properties, effectively reducing token overhead and noise interference faced by LLMs.

[0029] To improve the understanding and classification performance of LLMs, this invention further designs a prompt engineering fusion module to standardize the input prompt templates. The workflow of the prompt engineering fusion module includes three core parts: 1) Numerical standardization: simplifying the representation of large numerical features; 2) Knowledge injection: providing global feature statistics of historical (training) datasets; 3) Standardized inference: providing detailed inference templates for each traffic to be classified (test).

[0030] 1) Numerical regularization Network traffic datasets often contain large numerical features (such as byte counts, total number of packets, etc.). Due to the semantic gap between natural language and numerical values, LLMs have a weak ability to understand extremely large numerical values—such values ​​are usually tokenized into multiple scattered tokens; in addition, excessively high numerical precision can lead to a surge in token consumption without improving performance, because the low-order parts of large numerical features usually do not contribute to classification.

[0031] To this end, the present invention employs the following adaptive numerical formatting method to avoid LLMs from focusing excessively on lengthy numerical sequences and to reduce token overhead: (4) This formatting method significantly reduces the discretization of large numerical features while preserving key relative scale information. Through this compact representation, Pallas alleviates the burden on LLMs to learn complex dependencies between dispersed digital tokens, aligning numerical representations with human-readable formats, thereby improving the robustness and computational efficiency of LLM processing.

[0032] 2) Knowledge Injection Network traffic datasets typically contain tens of thousands or even millions of traffic records. Using all records as input would far exceed the maximum context window of a language model and consume a large number of tokens. To achieve a balance between token overhead and effective information, this invention borrows from DrLLM's approach, using categorical feature statistics instead of fine-grained individual traffic features.

[0033] Specifically, for all traffic records of each category in the historical (training) dataset, seven statistical metrics are calculated for each feature in the feature vector: maximum, minimum, median, mean, variance, skewness, and kurtosis. Skewness, in particular, characterizes the asymmetry of the distribution and is crucial for identifying burst patterns in traffic. The formula for calculating the skewness of each feature is: (5) in, Let σ be the third central moment and σ be the standard deviation. For the first The sample mean of each feature, For the first The first of the traffic One characteristic, This represents the sample size.

[0034] Kurtosis is used to quantify the thickness of the tail of a distribution and can indicate anomalies in flow volume. The formula for calculating the kurtosis of a feature is: (6) in, The central moment is the fourth order. Subtracting 3 from the formula makes the kurtosis of the normal distribution zero, thus more clearly reflecting deviations in tail thickness (such as volume anomalies in flow patterns). The above statistical indicators can serve as background knowledge to guide LLMs in classifying abnormal flow patterns.

[0035] 3) Standardized reasoning This invention designs a standardized inference template to enhance the inference performance of LLMs and constrain their output behavior. The template contains the following four core components: Role assignment is used to clarify the task roles of LLMs: For the problem of abnormal traffic classification, the domain-specific role of "cybersecurity analyst" is assigned to LLMs to help the model better access domain knowledge.

[0036] Stream embedding: Encodes the features of the traffic to be classified into a structured natural language representation, in the format: "{features }:{value }; ...; {Features }: {value }".

[0037] Thought chain guidance is used to require LLMs to reason step by step: a zero-shot chain-of-thought (CoT) prompting strategy is used to guide LLMs to perform progressive analytical reasoning.

[0038] Output constraints are used to strictly regulate the output format: To ensure output consistency and reduce the illusion phenomenon, a constraint-of-deviation (CoD) prompting strategy is adopted, which forces the model to output results in a strict JSON format (e.g., {"attack_prob": float, "benign_prob": float}), and the sum of the probability values ​​is 1.

[0039] This invention also verifies the beneficial technical effects of the abnormal flow classification method based on LLM compressed alerting engineering provided by this invention, particularly the performance superiority of the Pallas system, through comparative experiments and evaluations. Furthermore, ablation experiments are conducted to quantify the contribution of each module and determine the optimal feature retention ratio. The computational overhead was analyzed to demonstrate the advantages of the Pallas system in reducing token consumption and inference time.

[0040] (I) Experimental Setup The Pallas system was implemented using Python, with DeepSeek-chat-V3 as the base model. The experiment employed an anomaly traffic classification method based on LLM compressed suggestion engineering. The overall architecture and workflow of the Pallas system are as follows: Figure 2 As shown. All experiments were conducted on a workstation equipped with an Intel Core i9-14900HX processor and an NVIDIA GeForce RTX 4070 graphics card (8GB VRAM). In the feature purification module, the compression ratio η was set to 75%; in the prompting engineering fusion module, the global statistical features calculated in the knowledge injection stage were used as persistent background knowledge under the "system" role of the Large Language Model (LLM), while the inference template of the standardized inference stage was set to the "user" role of the LLM.

[0041] To achieve a comprehensive comparison, the zero-shot method and DrLLM were selected as baselines. DrLLM is a DDoS traffic classification method based on LLM. Its core mechanism is to encode the original features into natural language prompts and combine chain-of-thought (CoT) reasoning and constraint-of-deviation (CoD) techniques to enhance the prompts.

[0042] The experiment uses the CICDDoS2019 dataset to evaluate the Pallas method and baseline methods. This dataset contains over 10 million network traffic records, covering normal traffic and 7 types of DDoS attack traffic, with a total of 87 features. The data preprocessing steps are as follows: 8 non-numerical features and all defective flow records containing NaN or Inf are removed; to avoid information leakage, the dataset is divided into training and test sets in a 7:3 ratio; mutual information (MI) is calculated based on the flow records in the training set, and statistical indicators are extracted from the entire training set; finally, the labels of all flow records are binarized, that is, DDoS traffic with different attack modes is uniformly labeled as "Attack".

[0043] Five metrics widely used in the field of cybersecurity were employed to quantitatively evaluate the system performance: accuracy, precision, recall, F1 score, and AUC. Table 1 shows a comparison of the classification performance of Pallas with baseline methods.

[0044] Table 1. Classification performance comparison between Pallas and baseline methods

[0045] Classification Performance Analysis: First, the classification performance of Pallas was compared with that of the baseline methods, and the results are shown in Table 1. Under both base models, DrLLM's accuracy, F1 score, and recall were all higher than the zero-shot method, while Pallas significantly outperformed the baseline method in all evaluation metrics. Pallas's performance advantage is mainly attributed to two core modules: the feature purification module reduces the illusion problem of large language models by removing noisy features, and the cue engineering fusion module enhances the large language model's understanding of the task.

[0046] (II) Ablation Experiment To separate the independent contributions of each proposed module, comprehensive ablation experiments were conducted, and the results are shown in Table 2. Pallas, with a feature retention rate of 75%, achieved the best performance across all metrics. Key findings are as follows: Removing the cue engineering fusion module (w / o PEI) significantly reduced the F1 score by 10.63 percentage points, verifying that the redesigned cue strategy can effectively alleviate the cross-modal misalignment problem and improve classification performance; removing the mutual information feature selection module (w / o MIS) resulted in a significant decrease in both the F1 score and recall, indicating that this module can effectively identify discriminative features; furthermore, removing the zero variance elimination module (w / o ZVE) resulted in a moderate decrease in all metrics, demonstrating its effectiveness in filtering out non-informative features.

[0047] Table 2 Ablation experiments on key components of Pallas

[0048] (III) Optimal Determining the value By comparing different To determine the optimal value for the feature retention ratio based on the performance of the Pallas system, such as... Figure 3 and Figure 4 As shown, Pallas had the highest accuracy, while Pallas performed best on all other metrics, indicating that removing the bottom 25% of features achieves a good balance between precision and recall.

[0049] Comparison of different Table 3 shows the token consumption of Pallas under the given conditions and the cost difference compared to the baseline method. Within Pallas, when the input features are reduced by 25%, the total token consumption decreases by 9.68%, while the generated tokens (cp tokens) remain stable. This is because changes in η only affect the input features. Furthermore, Compared to DrLLM, Pallas significantly reduces total token consumption by 69.37%. This reduction stems from two aspects: firstly, a decrease in the number of input features; and secondly, the cue engineering fusion module embeds statistical knowledge into the "system" role, avoiding repeated input of statistical information for each stream record, thus significantly reducing cue token consumption. Simultaneously, the more streamlined output structure also reduces the amount of tokens generated. Regarding inference time... Pallas shortens the time by 39.89% compared to DrLLM, compared to Pallas's length decreased by 9.20%.

[0050] Table 3 Comparison of computational costs

[0051] In summary, this invention proposes an abnormal traffic classification method based on LLM compressed cue engineering. By constructing the Pallas system, it utilizes its feature purification module to remove redundant features and its cue engineering fusion module to alleviate the illusion problem of large language models, significantly improving the performance of DDoS traffic classification based on large language models. Extensive experiments show that Pallas achieves a high accuracy of 91.81% while outperforming the current state-of-the-art baseline methods, and reduces token consumption by 69.37%. This demonstrates the feasibility of lightweight, cue-optimized large language models in practical network security tasks.

[0052] On the other hand, the present invention provides a computer device including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps of the abnormal traffic classification method based on LLM compressed alerting engineering provided in any of the above embodiments. The computer device may be a server. The computer device includes a processor, a memory, a network interface, and a database connected via a system bus. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device stores sample data. The network interface of the computer device is used for communication with external terminals via a network connection.

[0053] On the other hand, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, it implements the steps of the abnormal traffic classification method based on LLM compressed prompting engineering provided in any of the above embodiments.

[0054] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0055] Matters not covered in this invention are common knowledge.

[0056] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0057] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these modifications and improvements all fall within the protection scope of this application.

[0058] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An abnormal traffic classification method based on LLM compressed alerting engineering, characterized in that, The method constructs a Pallas system to classify abnormal traffic based on LLM compressed alerting engineering. The Pallas system includes at least a core component feature purification module and an alerting engineering fusion module. The method includes: Step 110: Input the raw network traffic data. Each traffic item in the data corresponds to a feature vector; each component in the feature vector corresponds to a feature. Step 120: Divide the original data proportionally into two datasets: a training set and a test set. Step 130: Input the training set and test set into the Pallas system respectively, use the feature purification module to remove zero-variance features from the training set or test set data, and sort and select the remaining features after removing zero-variance features through mutual information to obtain the feature-purified training set or test set. Step 140: Input the training set after feature purification into the prompting engineering fusion module. After numerical normalization using adaptive numerical formatting, inject multiple statistical indicators of the features into the LLM using statistical knowledge injection to guide the LLM to complete the abnormal traffic classification. Step 150: Input the feature-purified test set into the prompting engineering fusion module. After numerical normalization using adaptive numerical formatting, generate the classification response of LLM inference using the standardized inference template to enhance the classification performance of LLM inference and provide output constraints. Step 160: After generating the classification response using multiple statistical indicators of LLM reception features and standardized inference templates, extract the abnormal traffic classification labels and corresponding confidence scores from the test set, and output the classification results of abnormal traffic.

2. The abnormal traffic classification method based on LLM compressed alerting engineering according to claim 1, characterized in that, use Indicates the first The feature vector corresponding to each flow, where, This represents the transpose of a vector. For the first The first of the traffic One characteristic, ; ; Indicates the number of traffic samples. Indicates feature dimension; Feature vector Corresponding unique category tag The classification label is set to either normal traffic or abnormal traffic. The feature vectors of all traffic samples are concatenated row-wise to form a feature matrix. .

3. The abnormal traffic classification method based on LLM compressed alerting engineering according to claim 2, characterized in that, Step 130 includes: Step 131, perform zero-variance feature removal on the training or test set data, including: Using the feature matrix Calculate the variance for each feature: ； in, For the first Features The mean; like =0, then feature Features identified as having zero variance are removed from the feature matrix. After removing zero-variance features, the dimension of the feature matrix is ​​reduced to [value missing]. ; Step 132: Rank and select the remaining features after removing zero-variance features using mutual information, including: Calculation features Feature distribution and category label variables mutual information ; Utilizing mutual information Calculate all features Mutual information value; All features are sorted in descending order of mutual information value. Sort and truncate. The components of the feature vector corresponding to each feature are used as the new feature vector; , , The preset compression ratio, This indicates rounding down to the nearest integer.

4. The abnormal traffic classification method based on LLM compressed alerting engineering according to claim 3, characterized in that, If the characteristic distribution If it is a discrete distribution, then It is given by the following formula: ； in, ( , ) represents the characteristic distribution Values And the category tags are The joint probability; ( )and ( ) are characteristic distributions With category label variables The marginal probability.

5. The abnormal traffic classification method based on LLM compressed alerting engineering according to claim 3, characterized in that, If the characteristic distribution If it is a continuous distribution, then Adopting based on The nearest neighbor KSG estimator is given by the following formula: ； in, It is a double gamma function. The size of the neighborhood; , They are local point counts, Representing the characteristic distribution The variable that can take values.

6. The abnormal flow classification method based on LLM compressed alerting engineering according to claim 4 or 5, characterized in that, The method of using adaptive numerical formatting for numerical normalization includes: Perform the adaptive formatting given by the following formula on the dataset: ； in, It is the first The first sample Features The corresponding features after formatting; It uses the rounding function. ,Will Retain two decimal places; It is a formatting function that will Format as scientific notation with two decimal places.

7. The abnormal traffic classification method based on LLM compressed alerting engineering according to claim 6, characterized in that, The method of efficiently injecting multiple statistical indicators of features into the LLM using statistical knowledge injection includes: For all traffic in the training set after feature purification and numerical normalization for each category label, calculate the following statistical indicators for each feature in the feature vector corresponding to the traffic: maximum value, minimum value, median, mean, variance, skewness, and kurtosis. No. Skewness of each feature It is given by the following formula: ; in, Let σ be the third central moment and σ be the standard deviation. For the first The sample mean of each feature, For the first The first of the traffic One characteristic, For sample size; No. The kurtosis of each feature is calculated using the following formula: ; in, It is the fourth-order central moment; The above statistical metrics are output and injected into the LLM to guide LLMs in classifying abnormal traffic.

8. The abnormal traffic classification method based on LLM compressed alerting engineering according to claim 7, characterized in that, The generation of classification responses for LLM inference using standardized inference templates includes: Role assignment is used to clarify the task roles of LLM: For the abnormal traffic classification problem of the test set, the LLM is assigned a dedicated role of network security analyst to help LLM better access domain knowledge; Stream embedding is used to encode the feature vectors of traffic to be classified into a structured natural language representation; Mind chain guidance is used to require LLMs to reason step by step: a zero-sample mind chain prompting strategy is used to guide LLMs to perform progressive analysis and reasoning. Output constraints are used to strictly regulate the output format: a bias constraint hint strategy is adopted to force the model to output results in strict JSON format, and the sum of the probability values ​​is 1.

9. The abnormal traffic classification method based on LLM compressed alerting engineering according to claim 5, characterized in that, The neighborhood size .

10. The abnormal traffic classification method based on LLM compressed alerting engineering according to claim 8, characterized in that, In the stream embedding, the feature vector encoding format of the traffic to be classified is as follows: {feature }: {value }; ...; {Features }: {value }

Images