A method and system for encrypted stream attack detection based on pulse neural and bidirectional LSTM

Abstract

The application discloses an encryption flow attack detection method and system based on a pulse nerve and a bidirectional LSTM, and comprises the following steps: obtaining encryption flow data, performing flow-level reorganization and pulse coding, and generating a pulse input sequence; inputting a multi-layer pulse nerve network, calculating a local loss by using a DECOLLE local learning mechanism, and completing network training to generate a hierarchical pulse event representation sequence; calculating a change amplitude and detecting an event trigger boundary, and constructing an intra-segment and segment-level representation sequence; constructing a double-channel input sequence, inputting a bidirectional LSTM network to generate a global context gating vector; performing gating weighting and inter-layer consistency constraint based on the context gating vector, constructing a joint training target, and synchronously updating network parameters; obtaining to-be-detected encryption flow data, and generating an encryption flow attack detection result based on the trained model. The application improves the stability and accuracy of encryption flow attack detection.

Description

Technical Field

[0001] This invention relates to the field of flow-level intrusion detection, and in particular to a method and system for detecting encrypted flow attacks based on spiking neural networks and bidirectional LSTM. Background Technology

[0002] In today's network environment, an increasing number of network services are using end-to-end encryption to transmit data, making encrypted traffic the mainstream transmission method. While encryption mechanisms effectively protect data content, they also render traditional attack detection methods based on plaintext characteristics ineffective, making it difficult to effectively identify malicious behavior hidden in encrypted traffic.

[0003] Existing methods for detecting encrypted flow attacks largely rely on statistical feature modeling, traditional machine learning algorithms, or simple time-series models, which struggle to fully characterize the dynamic evolution and fine-grained time-dependent properties of complex traffic behavior. When dealing with encrypted traffic exhibiting nonlinear evolution and mutation patterns, these methods suffer from weak feature extraction capabilities, insufficient context modeling, and a lack of sensitivity to traffic mutations, resulting in low detection accuracy and stability.

[0004] Furthermore, most existing methods employ a uniform strategy to process the entire traffic stream, failing to distinguish the semantic differences between different stages of traffic and lacking effective local and global modeling mechanisms. This makes it difficult to capture the segmented evolutionary characteristics of attack behavior in the temporal dimension. This deficiency is particularly pronounced when dealing with diverse encryption protocols or mutated attack streams, limiting the generalization ability and practicality of detection models.

[0005] Therefore, how to provide a method and system for detecting encrypted stream attacks based on spiking neural networks and bidirectional LSTM is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0006] One objective of this invention is to propose a method and system for detecting encrypted stream attacks based on spiking neural networks and bidirectional LSTM. Addressing the shortcomings of existing technologies, such as the lack of plaintext features in encrypted traffic, highly concealed attack patterns, and insufficient contextual modeling, this invention designs a multi-layer spiking neural network structure to model temporal activation features. It then extracts intra-segment and segment-level representations using an event segment generation mechanism, and employs a dual-channel input structure to introduce a bidirectional LSTM for contextual modeling, generating a global context-gated vector. Finally, it constructs a training mechanism that co-optimizes local loss and global discrimination. This method achieves integrated temporal modeling and contextual discrimination for complex attack behaviors, possessing advantages such as strong representational capabilities, high detection accuracy, and superior training efficiency. It is particularly suitable for attack detection tasks in encrypted network environments and has strong innovative and practical engineering value.

[0007] A method for detecting encrypted stream attacks based on spiking neural networks and bidirectional LSTM according to an embodiment of the present invention includes the following steps:

[0008] Acquire encrypted traffic data, perform stream-level reconstruction, construct encrypted traffic feature sequence, perform pulse coding processing, and generate pulse input sequence;

[0009] The pulse input sequence is input into a multi-layer spiking neural network. The local loss value of each layer is calculated based on the DECOLLE local learning mechanism, and the corresponding layer weights are updated to generate a hierarchical pulse event representation sequence.

[0010] Based on the hierarchical impulse event representation sequence, the change amplitude sequence is calculated, the event triggering segment boundary set is determined, and the hierarchical impulse event representation sequence is segmented to generate intra-segment representation sequences and segment-level representation sequences.

[0011] Align the intra-segment representation sequence and the segment-level representation sequence along a unified time axis to construct a dual-channel input sequence. Input the sequence into a bidirectional LSTM network to perform bidirectional context modeling and generate a global context gating vector.

[0012] Gating weights are applied to the local loss values ​​of each layer based on the global context gating vector, while inter-layer consistency constraints are constructed to form a joint training objective, and the parameters of the multi-layer spiking neural network and the bidirectional LSTM network are updated synchronously.

[0013] The encrypted traffic data to be detected is acquired, the pulse input sequence to be detected is constructed, and the encrypted flow attack detection result is generated based on the trained multi-layer spiking neural network and the trained bidirectional LSTM network.

[0014] Optionally, the generation of the pulse input sequence includes:

[0015] Obtain encrypted traffic data, extract the source address, destination address, source port, destination port, and transport layer protocol from the data, and form a five-tuple identifier;

[0016] Based on the quintuple identifier, stream-level reassembly is performed on the encrypted traffic data to generate a reassembled encrypted traffic sequence.

[0017] Based on the reconstructed encrypted traffic sequence, the feature sequence of the encrypted traffic is extracted using protocol-independent field parsing and sequence reconstruction methods;

[0018] Based on the preset pulse coding rules, the encrypted traffic feature sequence is converted into a pulse input sequence.

[0019] Optionally, the generation of the hierarchical impulse event representation sequence includes:

[0020] The pulse input sequence is input into a multi-layer spiking neural network to model pulse event features. Each layer receives the pulse sequence, performs time-series pulse response processing, and generates the pulse activation sequence of the corresponding layer.

[0021] A set of local classification heads is set up in each layer to generate local classification prediction results and corresponding confidence values ​​for the current layer based on the pulse activation sequence of the current layer, thus constructing a hierarchical supervision mechanism.

[0022] The DECOLLE local learning mechanism is used to implement the training process of the hierarchical supervision mechanism. The local classification prediction results are compared with the label information to calculate the local loss value of the current layer.

[0023] Based on the local loss value corresponding to each layer, local update operations are performed on the neural parameters within that layer to achieve inter-layer decoupling in a multi-layer spiking neural network;

[0024] The pulse activation sequences output from each layer are organized into a hierarchical pulse event representation sequence, and the confidence value sets output from each local classification head are organized into a hierarchical local confidence sequence.

[0025] Optionally, the generation of the intra-segment representation sequence and the segment-level representation sequence includes:

[0026] Based on the hierarchical pulse event representation sequence, the number of pulse activations within each fixed time window is counted to construct a pulse rate change sequence;

[0027] Perform difference calculations between adjacent time points on the pulse rate change sequence to obtain the pulse rate change amplitude sequence.

[0028] A fixed threshold is constructed by summing the mean and standard deviation of the change amplitude sequence. When the value in the change amplitude sequence is greater than the fixed threshold, its position is determined as the paragraph boundary position and combined into the event-triggered paragraph boundary set.

[0029] Based on the event-triggered paragraph boundary set, the hierarchical pulse event representation sequence is organized into paragraphs. Pulse events that are consecutively located in the same paragraph are merged and processed to generate intra-segment representation sequences. Based on the overall pulse state of each paragraph, segment-level statistical features are extracted to generate segment-level representation sequences.

[0030] Optionally, the generation of the global context gating vector includes:

[0031] Based on the intra-segment representation sequence and the segment-level representation sequence, they are aligned in time order to construct a dual-channel input sequence;

[0032] The dual-channel input sequence is fed into a bidirectional LSTM network for bidirectional context modeling, and the forward hidden state sequence and backward hidden state sequence corresponding to each time step are output respectively.

[0033] The forward hidden state sequence and the backward hidden state sequence are connected and normalized to generate the context state representation of the corresponding time step. The gating network structure is set to calculate the context gating weight set of each time step, and then weighted and fused with the context state representation to generate the global context gating vector.

[0034] The global context gating vector is input into the discriminant layer structure to perform attack behavior classification operations, generate global attack discrimination results, and extract the confidence value corresponding to the current attack discrimination as the global discrimination confidence.

[0035] Optionally, the updating of the network parameters includes:

[0036] The global context gating vector is invoked, and element-wise multiplication is performed with the local loss values ​​of each layer of the multilayer spiking neural network to obtain the gated weighted local loss values ​​of each layer.

[0037] Invoke the global confidence score and combine it with the hierarchical local confidence score sequence to construct inter-layer consistency constraints;

[0038] The local loss values ​​of each layer after gating and weighting are linearly weighted and combined with the inter-layer consistency constraints to form a joint training objective function;

[0039] Based on the joint training objective function, the time backpropagation mechanism is used to perform gradient calculation and synchronous update operations for each parameter inside the multilayer spiking neural network and the bidirectional LSTM network, respectively, until all model parameters converge, and finally the trained multilayer spiking neural network and the trained bidirectional LSTM network are obtained.

[0040] Optionally, the generation of the encrypted stream attack detection result includes:

[0041] Acquire the encrypted traffic data to be detected and construct the corresponding encrypted traffic feature sequence to be detected;

[0042] The encrypted traffic feature sequence to be detected is segmented, and a pulse trigger judgment operation is performed to trigger the generation of a pulse event signal, thereby constructing the pulse input sequence to be detected.

[0043] The pulse input sequence to be detected is input into the trained multi-layer spiking neural network, and the pulse timing response calculation is performed layer by layer. The pulse activation sequences of each layer are output and summarized into the pulse event representation sequence of the layer to be detected.

[0044] Based on the pulse event representation sequence of the level to be detected, the potential event triggering position is identified, the set of triggering paragraph boundaries of the event to be detected is determined, and then paragraph organization is performed to generate the representation sequence within the segment to be detected and the segment-level representation sequence to be detected.

[0045] Based on the intra-segment representation sequence and the segment-level representation sequence to be detected, a dual-channel input sequence to be detected is constructed;

[0046] The dual-channel input sequence to be detected is input into the trained bidirectional LSTM network, which outputs a bidirectional hidden state sequence. Combined with the gating mechanism parameters retained during the training phase, a global context gating vector is generated.

[0047] The discriminant layer structure built during the training completion phase is invoked, the global context gating vector is input into the discriminant layer structure, the final classification operation of the encrypted stream attack behavior is performed, and the encrypted stream attack detection result is generated.

[0048] An encrypted stream attack detection system based on spiking neural networks and bidirectional LSTM according to an embodiment of the present invention includes:

[0049] The data acquisition and reconstruction module is used to acquire encrypted traffic data, extract quintuple identifiers, perform stream-level reconstruction, and construct encrypted traffic feature sequences.

[0050] The pulse coding module is used to perform encoding processing on the encrypted traffic feature sequence according to the pulse coding rules to generate a pulse input sequence;

[0051] The pulse event modeling module is used to input pulse input sequences into a multilayer spiking neural network and generate hierarchical pulse event representation sequences and hierarchical local confidence sequences based on the DECOLLE local learning mechanism.

[0052] The event segment generation module is used to calculate pulse rate and amplitude changes based on the hierarchical pulse event representation sequence, determine the event triggering segment boundary set, and generate intra-segment representation sequences and segment-level representation sequences.

[0053] The context modeling module is used to construct a dual-channel input sequence based on the intra-segment representation sequence and the segment-level representation sequence, input the bidirectional LSTM network, and generate a global context gating vector and a global discriminant confidence.

[0054] The network parameter optimization module is used to perform local loss weighting based on the global context gating vector, construct inter-layer consistency constraints by combining global discrimination confidence and hierarchical local confidence sequences, and update the parameters of the multi-layer spiking neural network and bidirectional LSTM network.

[0055] The encrypted flow attack detection module is used to generate encrypted flow attack detection results based on the encrypted traffic data to be detected, combined with a trained multi-layer spiking neural network and a bidirectional LSTM network.

[0056] The beneficial effects of this invention are:

[0057] First, by constructing a multi-layer spiking neural network and introducing the DECOLLE local learning mechanism, this invention achieves efficient modeling and local supervised optimization of spiking timing features under the condition of no global backpropagation path, effectively improving the sensitivity and recognition accuracy of fine-grained attack behaviors in encrypted traffic.

[0058] Secondly, by leveraging the event segment generation mechanism, continuous pulse event representations can be divided into semantically consistent time segments, and intra-segment and segment-level representations can be extracted, giving the model a stronger temporal organization capability and providing a structured input foundation for subsequent context modeling, significantly enhancing the detection model's ability to analyze complex traffic patterns.

[0059] Furthermore, this invention proposes to construct a dual-channel input sequence based on intra-segment and segment-level representations, and introduces a bidirectional LSTM network to perform context modeling, generating a global context gating vector and a global attack discrimination result. This achieves the synergistic fusion of local detail features and global context information, effectively improving the overall detection accuracy.

[0060] Finally, the joint training mechanism constrains the consistency between the local loss of each layer and the global discrimination result, and uses a gating weighting method to dynamically optimize the parameters of each layer, thereby improving the stability and convergence efficiency of model training and further enhancing the practicality and robustness of the method of this invention in encrypted streaming environments. Attached Figure Description

[0061] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0062] Figure 1 This is an overall flowchart of a cryptographic stream attack detection method and system based on spiking neural networks and bidirectional LSTM proposed in this invention.

[0063] Figure 2 This is a schematic diagram of the multilayer spiking neural network modeling structure based on the DECOLLE local learning mechanism in this invention;

[0064] Figure 3 This is a schematic diagram of the structure based on event paragraph generation and dual-channel context modeling in this invention. Detailed Implementation

[0065] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0066] refer to Figure 1-3 A method for detecting encrypted stream attacks based on spiking neural networks and bidirectional LSTM includes the following steps:

[0067] The encrypted traffic data is acquired, and the encrypted traffic data is reassembled at the flow level according to the five-tuple identifier to construct the encrypted traffic feature sequence. The encrypted traffic feature sequence includes the packet arrival time interval sequence, packet length sequence, packet direction mark sequence, and transport layer mark sequence. The encrypted traffic feature sequence is then processed by pulse coding according to the pulse coding rules to generate a pulse input sequence.

[0068] The pulse input sequence is input into a multilayer spiking neural network. A local classification head is set in each layer of the multilayer spiking neural network. The local loss value of each layer is calculated based on the DECOLLE local learning mechanism, and the corresponding layer weights are updated according to the local loss value to generate a hierarchical pulse event representation sequence and a hierarchical local confidence sequence.

[0069] The pulse rate change sequence is calculated based on the hierarchical pulse event representation sequence. The amplitude change sequence of the pulse rate change sequence is further calculated. Based on the amplitude change sequence, a fixed threshold determination rule is used to determine the event triggering paragraph boundary set. The hierarchical pulse event representation sequence is segmented based on the event triggering paragraph boundary set to generate intra-segment representation sequences and segment-level representation sequences. The fixed threshold determination rule is as follows: a fixed threshold is constructed by the sum of the mean and standard deviation of the amplitude change sequence. When the value in the amplitude change sequence is greater than the fixed threshold, the corresponding position is determined to be a paragraph boundary position.

[0070] Align the intra-segment representation sequence and the segment-level representation sequence along a unified time axis to construct a dual-channel input sequence. Input the dual-channel input sequence into a bidirectional LSTM network to perform bidirectional context modeling and generate a global context gating vector, a global attack discrimination result, and a global discrimination confidence.

[0071] Gating weights are applied to the local loss values ​​of each layer based on the global context gating vector. Inter-layer consistency constraints are constructed based on the global discriminant confidence and the layer-level local confidence sequences. The gating weighted local loss values ​​of each layer and the inter-layer consistency constraints are combined to form a joint training objective. The parameters of the multi-layer spiking neural network and the bidirectional LSTM network are updated synchronously according to the joint training objective, thereby generating the trained multi-layer spiking neural network and the trained bidirectional LSTM network.

[0072] The process involves acquiring encrypted traffic data to be detected and performing flow-level reassembly to construct a feature sequence of the encrypted traffic. This feature sequence is then input into a pulse coding rule to output a pulse input sequence. This pulse input sequence is then fed into a trained multi-layer spiking neural network to generate a sequence of pulse event representations at the detection level. Based on this sequence, the set of triggering segment boundaries for the events to be detected is determined, and the sequence is segmented to obtain intra-segment representation sequences and segment-level representation sequences. These intra-segment and segment-level representation sequences are aligned along a unified time axis to construct a dual-channel input sequence for detection, which is then input into a trained bidirectional LSTM network to generate encrypted flow attack detection results.

[0073] In this embodiment, the generation of the pulse input sequence includes:

[0074] The encrypted traffic data is a network transmission data stream that has been encrypted. The source address, destination address, source port, destination port, and transport layer protocol are extracted from the data to form a five-tuple identifier, which is used to uniquely identify the encrypted traffic connection session.

[0075] Based on the five-tuple identifier, the encrypted traffic data is reassembled at the flow level, and encrypted traffic packets belonging to the same connection session are merged in chronological order to generate a reassembled encrypted traffic sequence.

[0076] Based on the reconstructed encrypted traffic sequence, the encrypted traffic feature sequence is extracted using the protocol-independent field parsing method and the sequence reconstruction method. The encrypted traffic feature sequence includes the following four categories: a packet arrival time interval sequence representing the time difference between adjacent packets, a packet length sequence representing the payload length of each packet, a packet direction mark sequence representing the packet transmission direction, and a transport layer flag sequence representing the values ​​of the transport layer flag bits.

[0077] According to the preset pulse coding rules, the encrypted traffic feature sequence is converted into a pulse input sequence. The pulse coding rules are used to encode continuous or discrete value features into a pulse firing mode with time information. The pulse input sequence is used for subsequent pulse event coding by a multi-layer spiking neural network.

[0078] In this embodiment, the generation of the hierarchical pulse event representation sequence includes:

[0079] The pulse input sequence is input into a multilayer spiking neural network for pulse event feature modeling. The multilayer spiking neural network consists of multiple sequentially connected spiking neural network layers, which are used to perceive asynchronous temporal information in the pulse input sequence and extract hierarchical representations. Each layer receives the pulse activation sequence from the input pulse sequence or the output of the previous layer, performs temporal pulse response processing operations, and generates the pulse activation sequence of the corresponding layer. The activation sequence is the pulse firing state vector at each time step, which is used to reflect the response intensity and distribution pattern of the layer to the input temporal sequence.

[0080] To enhance the representation capabilities of each layer under complex asynchronous encrypted traffic, a set of local classification heads is set on each layer. The local classification heads generate the local classification prediction results and corresponding confidence values ​​of the current layer based on the pulse activation sequence of the current layer through a lightweight output channel structure. A hierarchical supervision mechanism that supports independent output and feedback of each layer is constructed, enabling each layer to have autonomous learning capabilities during training.

[0081] The DECOLLE local learning mechanism is used to implement the training process of the hierarchical supervision mechanism. This mechanism introduces intermediate neural states of time expansion and constructs a local error signal processing process within each layer without the need for global backpropagation. Specifically, the DECOLLE mechanism compares the local classification prediction results with the label information and calculates the local loss value of the current layer.

[0082] Based on the local loss value corresponding to each layer, local update operations are performed on the neural parameters within that layer, so that the loss calculation and parameter update process of each layer is completed independently within the layer, forming a hierarchical training mechanism that does not depend on the gradient information of other layers. This achieves inter-layer decoupling of the multi-layer spiking neural network. This decoupling mechanism supports parallel training and effectively improves the convergence efficiency and system training stability in asynchronous pulse input scenarios.

[0083] After completing the local training of the multilayer spiking neural network, the spiking activation sequences output by each layer are summarized and organized into a hierarchical spiking event representation sequence in chronological order. At the same time, the confidence value sets output by each local classification head are organized into a hierarchical local confidence sequence. The above two types of structured representations serve as the core inputs for subsequent event segment boundary detection and inter-layer consistency constraint modeling, supporting the semantic segmentation and global discrimination process of attack behavior.

[0084] In this embodiment, the generation of the intra-segment representation sequence and the segment-level representation sequence includes:

[0085] Based on the hierarchical pulse event representation sequence, the number of pulse activations within each fixed time window is counted in chronological order to construct a pulse rate change sequence, which reflects the density fluctuation of pulse events in the time domain.

[0086] The difference between adjacent time points is calculated on the pulse rate change sequence to obtain the change amplitude sequence of the pulse rate change sequence, which is used to characterize the intensity of the change in continuous pulse rate;

[0087] Based on the change amplitude sequence, an event-triggered paragraph boundary set is constructed. Specifically, a fixed threshold is constructed by the sum of the mean and standard deviation of the change amplitude sequence. When any value in the change amplitude sequence is greater than the fixed threshold, its location is determined as a paragraph boundary location, and all locations that meet this condition are combined into an event-triggered paragraph boundary set.

[0088] Based on the event-triggered paragraph boundary set, the hierarchical pulse event representation sequence is organized into paragraphs. Pulse events that are consecutively located in the same paragraph are merged and processed to generate intra-segment representation sequences. Based on the overall pulse state of each paragraph, segment-level statistical features are extracted to generate segment-level representation sequences.

[0089] The intra-segment representation sequence and the segment-level representation sequence are output and used in subsequent steps to construct a dual-channel input sequence and input it into a bidirectional LSTM network to perform context modeling and discrimination operations for cryptographic stream attack behavior.

[0090] In this embodiment, the generation of the global context gating vector includes:

[0091] Based on the intra-segment representation sequence and the segment-level representation sequence, a dual-channel input sequence is constructed by aligning them in chronological order. The first channel of the dual-channel input sequence is the intra-segment representation sequence, and the second channel is the segment-level representation sequence. The two channels retain the consistency of the segment-level structure under the same time axis.

[0092] The constructed dual-channel input sequence is input into a bidirectional LSTM network for bidirectional context modeling. The bidirectional LSTM network models the forward and backward dependencies of the dual-channel input sequence in parallel and outputs the forward and backward hidden state sequences corresponding to each time step.

[0093] The forward hidden state sequence and the backward hidden state sequence are connected and normalized to generate the context state representation of the corresponding time step. Based on the context state representation, the context gating weight set of each time step is calculated by setting the gating network structure, and then weighted and fused with the context state representation to generate a global context gating vector, which is used to express the aggregated context state of global attack behavior.

[0094] The global context gating vector is input into the discriminant layer structure to perform attack behavior classification operations and generate a global attack discrimination result. At the same time, based on the classification output probability of the discrimination result, the confidence value corresponding to the current attack discrimination is extracted as the global discrimination confidence, which is used in the subsequent consistency constraint construction and joint optimization process of training objectives.

[0095] In this embodiment, the updating of network parameters includes:

[0096] The global context gating vector is invoked, and based on its global aggregation characteristics in the time dimension, element-wise multiplication is performed with the local loss values ​​corresponding to each layer of the multilayer spiking neural network to obtain the gated weighted local loss values ​​of each layer, which are used to guide the loss optimization process to focus on the key regions of the context.

[0097] The global discrimination confidence is invoked, and combined with the hierarchical local confidence sequences output by each local classification head in the multilayer spiking neural network, an inter-layer consistency constraint is constructed. This constraint is used to measure the confidence difference between the local judgment results of each layer and the global attack behavior judgment results. Specifically, it is generated by calculating the average deviation value between the global discrimination confidence and the local confidence of each layer.

[0098] The local loss values ​​of each layer after gating and weighting are linearly weighted and combined with the inter-layer consistency constraint to form a joint training objective function. The joint training objective function is used to uniformly optimize the parameters of the multi-layer spiking neural network and the bidirectional LSTM network. The loss weight ratio is fixedly configured according to the local classification performance index.

[0099] Based on the joint training objective function, the time backpropagation mechanism is used to perform gradient calculation and synchronous update operations for each parameter inside the multilayer spiking neural network and the bidirectional LSTM network, respectively, until all model parameters converge, and finally the trained multilayer spiking neural network and the trained bidirectional LSTM network are obtained.

[0100] In this embodiment, the generation of the encrypted stream attack detection result includes:

[0101] The encrypted traffic data to be detected is acquired and processed into data groups according to the communication session identifier. The packets within the group are reassembled in chronological order to construct the corresponding encrypted traffic feature sequence to be detected, which is used to recover the effective feature information in the complete communication stream.

[0102] The encrypted traffic feature sequence to be detected is segmented according to a preset time sampling window. Within each segment, a pulse trigger judgment operation is performed based on the change amplitude and direction of the feature vector to trigger the generation of a pulse event signal, thereby constructing a pulse input sequence to be detected. The pulse input sequence to be detected consists of multiple pulse events. Each pulse event includes the event trigger time, feature change direction marker, and standardized amplitude value, which are used to express the local change pattern and time dynamic features of the encrypted traffic features.

[0103] The pulse input sequence to be detected is input into the trained multilayer spiking neural network. According to the optimized neural parameters in each layer, the pulse timing response calculation is performed layer by layer, and the pulse activation sequence of each layer is output. Finally, the pulse event representation sequence of the layer to be detected is summarized, which constitutes the pulse feature modeling result of the target encrypted stream.

[0104] Based on the sequence of impulse events to be detected, the preset event segment boundary detection rules are invoked. The potential event triggering positions are identified according to the temporal density and mutation pattern of the impulse events. The set of triggering segment boundaries of the events to be detected is determined. Then, the sequence of impulse events to be detected is segmented and organized to generate the intra-segment representation sequence and the segment-level representation sequence to be detected.

[0105] Based on the intra-segment representation sequence and the segment-level representation sequence to be detected, they are aligned along a unified time axis to construct a dual-channel input sequence to be detected, which serves as the input to the dual-channel context modeling structure, ensuring the consistent expression of the paragraph structure in the time dimension.

[0106] The dual-channel input sequence to be detected is input into the trained bidirectional LSTM network, and the forward and backward context dependency modeling is performed respectively. The bidirectional hidden state sequence is output, and combined with the gating mechanism parameters retained in the training phase, a global context gating vector for attack behavior judgment is generated.

[0107] The discriminant layer structure built during the training completion phase is invoked. The global context gating vector is input into the discriminant layer structure to perform the final classification operation of the encrypted stream attack behavior, generate the encrypted stream attack detection result, and output the discriminant label of whether the target encrypted stream has an attack behavior and its corresponding confidence score.

[0108] A cryptographic stream attack detection system based on spiking neural networks and bidirectional LSTM includes:

[0109] The data acquisition and reconstruction module is used to acquire encrypted traffic data, extract the source address, destination address, source port, destination port and transport layer protocol to form a five-tuple identifier, and perform flow-level reconstruction on the encrypted traffic data based on the five-tuple identifier to construct an encrypted traffic feature sequence. The encrypted traffic feature sequence includes a packet arrival time interval sequence, a packet length sequence, a packet direction mark sequence, and a transport layer flag sequence.

[0110] The pulse coding module is used to perform pulse coding processing on the encrypted traffic feature sequence according to the pulse coding rules to generate a pulse input sequence, which is used as subsequent input to a multi-layer spiking neural network.

[0111] The pulse event modeling module is used to input the pulse input sequence into a multi-layer spiking neural network. Each layer of the multi-layer spiking neural network is equipped with a local classification head, calculates the local loss value and updates the neural parameters based on the DECOLLE local learning mechanism, and outputs a hierarchical pulse event representation sequence and a hierarchical local confidence sequence.

[0112] The event segment generation module is used to calculate the pulse rate change sequence and change amplitude sequence based on the hierarchical pulse event representation sequence, determine the event trigger segment boundary set according to the fixed threshold judgment rule, and perform segmentation organization on the hierarchical pulse event representation sequence to generate intra-segment representation sequence and segment-level representation sequence.

[0113] The context modeling module is used to align the intra-segment representation sequence and the segment-level representation sequence along a unified time axis to construct a dual-channel input sequence. The dual-channel input sequence is then input into a bidirectional LSTM network to perform bidirectional context modeling, generating a global context gating vector, a global attack discrimination result, and a global discrimination confidence.

[0114] The network parameter optimization module is used to perform gated weighting on the local loss values ​​of each layer of the multilayer spiking neural network based on the global context gating vector, construct inter-layer consistency constraints based on the global discriminant confidence and the layer local confidence sequence, form a joint training objective by weighted local loss values ​​and consistency constraints, and synchronously update the parameters of the multilayer spiking neural network and the bidirectional LSTM network through the time backpropagation mechanism to generate the trained model.

[0115] The encrypted flow attack detection module is used to acquire encrypted traffic data to be detected, perform flow-level reconstruction to construct the feature sequence of the encrypted traffic to be detected, generate the pulse input sequence to be detected, and input it into the trained multi-layer spiking neural network and bidirectional LSTM network in sequence to finally generate the encrypted flow attack detection result.

[0116] like Figure 3 As shown, the event segment boundary detection module is used to calculate the pulse rate change sequence and its change amplitude sequence based on the hierarchical pulse event representation sequence, and determine the event trigger segment boundary set according to the fixed threshold judgment rule, thereby realizing the identification of significant change positions in the pulse event time sequence;

[0117] The unified time axis construction module is used to align the intra-segment representation sequence and the segment-level representation sequence according to the same time reference after obtaining them, so as to ensure a one-to-one correspondence between the intra-segment representation sequence and the segment-level representation sequence in the time dimension and eliminate the time offset problem between representations of different time granularities.

[0118] The dual-channel input sequence construction module is used to organize the intra-segment representation sequence as the first channel and the segment-level representation sequence as the second channel after time alignment is completed, forming a dual-channel input sequence, and then inputting the dual-channel input sequence into the bidirectional LSTM network.

[0119] Example 1:

[0120] To verify the feasibility of this invention in practice, it was applied to a scenario of encrypted flow attack detection in a certain facility network environment, continuously monitoring and analyzing large-scale encrypted communication data. In this scenario, the vast majority of service traffic in the network uses encrypted transmission. Traditional detection methods based on plaintext features or rule matching are difficult to effectively distinguish attacks hidden in normal service flows, especially when the attacks are short-lived, low-frequency, and distributed across time periods. The false positive and false negative rates are both high, making it difficult to meet actual protection requirements. This embodiment addresses the above problems by verifying the applicability and stability of the method of this invention in complex encrypted flow scenarios.

[0121] In this application scenario, the system continuously receives encrypted traffic data streams collected from the network side and processes the data in real time. After entering the detection process, the collected encrypted traffic data is merged at the session level based on a five-tuple identifier consisting of the source address, destination address, source port, destination port, and transport layer protocol, thereby restoring the complete encrypted communication stream. This method effectively avoids traffic fragmentation caused by packet transmission or network jitter, providing a continuous and stable input foundation for subsequent feature modeling.

[0122] After completing the stream-level reassembly, the system performs feature construction operations on each encrypted traffic sequence, forming an encrypted traffic feature sequence composed of a packet arrival time interval sequence, a packet length sequence, a packet direction marker sequence, and a transport layer flag sequence. This feature system does not rely on any plaintext content; it only characterizes communication mode changes based on the transmission behavior itself, and can truly reflect the dynamic characteristics of the encrypted stream in the time dimension. Based on this, the system maps the continuously changing feature sequence into discrete pulse events according to preset pulse coding rules, constructing a pulse input sequence, thus transforming the original network behavior into an asynchronous event stream representation suitable for spiking neural network processing.

[0123] The pulse input sequence is then fed into a multilayer spiking neural network to perform pulse event modeling. Each layer within the network processes the pulse temporal response layer by layer, forming pulse activation patterns at different levels of abstraction. To enhance the model's stability and adaptability during training, this invention sets a local classification head in each layer of the multilayer spiking neural network and independently calculates the local loss within each layer based on the DECOLLE local learning mechanism. This mechanism avoids the gradient decay problem that easily occurs in traditional global backpropagation in long-term pulse modeling, enabling each layer to maintain stable updates under asynchronous input conditions. After training, the system can output a hierarchical pulse event representation sequence and the corresponding hierarchical local confidence sequence, providing a reliable foundation for subsequent temporal semantic analysis.

[0124] Following this, the system statistically analyzes the pulse rate changes based on the hierarchical pulse event representation sequence and further calculates the change amplitude sequence. It then automatically identifies the time position of the event trigger using fixed threshold judgment rules, forming a set of event trigger segment boundaries. Through this mechanism, the system can divide a continuous pulse event stream into multiple semantically consistent event segments and generate intra-segment representation sequences and segment-level representation sequences respectively, thereby achieving temporal structured modeling of potential attack behaviors in the encrypted stream.

[0125] After aligning the intra-segment and segment-level representation sequences along a unified time axis, they are constructed as a dual-channel input sequence and fed into a bidirectional LSTM network. The bidirectional LSTM network simultaneously models forward and backward dependencies, enabling the system to capture both the evolutionary characteristics of attack behavior within a local timeframe and to comprehensively consider its contextual relationships over a longer time span. Through a gating fusion mechanism, the system generates a global context gating vector and further outputs the global attack discrimination result and the corresponding global discrimination confidence score, used for the final attack detection decision.

[0126] During the model training phase, the system performs gated weighting on the local loss values ​​of each layer of the multilayer spiking neural network based on the global context gating vector. Simultaneously, it constructs inter-layer consistency constraints by combining global discrimination confidence and layer-level local confidence sequences, forming a joint training objective to synchronously optimize the parameters of the multilayer spiking neural network and the bidirectional LSTM network. This training strategy effectively improves the consistency between discrimination results at different layers and reduces overall performance fluctuations caused by local misjudgments.

[0127] The experimental comparison methods selected current mainstream benchmark models, including traditional encrypted stream detection methods based on statistical rules, classic time series analysis models based on one-way LSTM, and CNN+LSTM structure models that have been deployed in actual network operators. All comparison methods were trained and tested on the same dataset, and the evaluation metrics included accuracy, recall, F1 score, average detection latency, computational resource consumption (peak memory usage), and mean detection confidence.

[0128] Table 1. Performance Comparison of the Invention Method and Existing Methods in Encryption Stream Attack Detection Tasks.

[0129]

[0130] As shown in Table 1, the method of this invention outperforms the comparative methods in key metrics such as detection accuracy, recall, and F1 score, demonstrating the synergistic advantages of integrating spiking neural networks and bidirectional LSTM network structures in modeling asynchronous events and global context in encrypted streams. The improved accuracy primarily stems from the multi-layer spiking neural network's ability to finely model asynchronous pulse patterns, capturing attack behavior features in sparse events. The improved recall reflects the effectiveness of the event segment structure; its boundary detection mechanism effectively divides and focuses on active attack segments, avoiding the missed detection problems caused by the ambiguous processing of long-term temporal distributions in traditional methods.

[0131] Furthermore, the improved F1 score reflects a good balance between accuracy and completeness in the detection results. Regarding detection latency, this invention employs the DECOLLE mechanism to perform local updates on the pulse network, avoiding computational blocking caused by long-chain backpropagation, significantly reducing detection response time, and enhancing system real-time performance. Although the peak memory usage is slightly higher than traditional models, it remains within an industrially acceptable range. In terms of decision confidence, the global context-gated vector generated by this invention can fuse contextual evidence under multiple input segments, outputting more confident information and providing highly reliable support for subsequent automated defense decisions.

[0132] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for encrypted stream attack detection based on pulse neural and bidirectional LSTM, characterized in that, The method comprises the following steps: Obtaining encrypted traffic data, performing stream-level reorganization, constructing encrypted traffic feature sequences, performing pulse coding processing, and generating pulse input sequences; Inputting the pulse input sequences into a multi-layer pulse neural network, calculating the local loss value of each layer based on the DECOLLE local learning mechanism and updating the corresponding layer weight to generate a hierarchical pulse event representation sequence; Based on the hierarchical pulse event representation sequence, a change amplitude sequence is calculated, a paragraph boundary set is determined, and the hierarchical pulse event representation sequence is organized into a paragraph to generate an intra-paragraph representation sequence and a paragraph-level representation sequence; Aligning the intra-paragraph representation sequence and the paragraph-level representation sequence on a unified time axis to construct a double-channel input sequence, inputting the double-channel input sequence into a bidirectional LSTM network to perform bidirectional context modeling, and generating a global context gating vector; Based on the global context gating vector, the local loss value of each layer is weighted, and an inter-layer consistency constraint is constructed to form a joint training target, and the parameters of the multi-layer pulse neural network and the bidirectional LSTM network are updated synchronously; Obtaining encrypted traffic data, constructing a to-be-detected pulse input sequence, and based on the trained multi-layer pulse neural network and the trained bidirectional LSTM network, generating an encrypted flow attack detection result.

2. The encryption stream attack detection method based on pulse neural and bidirectional LSTM according to claim 1, characterized in that, The generation of the pulse input sequence comprises: Obtaining encrypted traffic data, extracting the source address, destination address, source port, destination port and transmission layer protocol in the data to form a five-tuple identifier; According to the five-tuple identifier, the encrypted traffic data is reorganized at the stream level to generate a reorganized encrypted traffic sequence; Based on the reorganized encrypted traffic sequence, the protocol-independent field parsing method and the sequence reconstruction method are used to extract the encrypted traffic feature sequence; According to a preset pulse coding rule, the encrypted traffic feature sequence is converted into a pulse input sequence.

3. The encryption stream attack detection method based on pulse neural and bidirectional LSTM according to claim 1, characterized in that, The generation of the hierarchical pulse event representation sequence comprises: Inputting the pulse input sequence into a multi-layer pulse neural network for pulse event feature modeling, each layer receiving a pulse sequence and performing a time pulse response processing operation to generate a pulse activation sequence of the corresponding layer; A set of local classification heads is arranged on each layer, and based on the pulse activation sequence of the current layer, a local classification prediction result and a corresponding confidence value of the layer are generated to construct a hierarchical supervision mechanism; The DECOLLE local learning mechanism is used to realize the training process of the hierarchical supervision mechanism, the local classification prediction result is compared with the label information, and the local loss value of the current layer is calculated; According to the local loss value of each layer, local update operations are performed on the neural parameters in the layer to realize the inter-layer decoupling of the multi-layer pulse neural network; The pulse activation sequences output by each layer are arranged into a hierarchical pulse event representation sequence, and the confidence value sets output by each local classification head are arranged into a hierarchical local confidence sequence.

4. The encryption stream attack detection method based on pulse neural and bidirectional LSTM of claim 1, wherein, The generation of the intra-paragraph representation sequence and the paragraph-level representation sequence comprises: Based on the hierarchical pulse event representation sequence, the number of pulse activations in each fixed time window is counted to construct a pulse rate change sequence; The difference value between adjacent time points of the pulse rate change sequence is calculated to obtain a change amplitude sequence of the pulse rate change sequence; A fixed threshold is constructed by summing the mean and standard deviation of the amplitude of variation sequence, and when a value in the amplitude of variation sequence is greater than the fixed threshold, the position thereof is determined as a paragraph boundary position, and combined into an event triggered paragraph boundary set; Based on the event triggered paragraph boundary set, the hierarchical pulse event representation sequence is organized in paragraphs, the pulse events continuously located in the same paragraph are merged and processed, an intra-paragraph representation sequence is generated, and based on the overall pulse state of each paragraph, a paragraph-level statistical feature is extracted to generate a paragraph-level representation sequence.

5. The encryption stream attack detection method based on pulse neural and bidirectional LSTM according to claim 1, characterized in that, The generation of the global context gating vector includes: Based on the intra-paragraph representation sequence and the paragraph-level representation sequence, a two-channel input sequence is constructed in time sequence alignment; The two-channel input sequence is input into a bidirectional LSTM network for bidirectional context modeling, and a forward hidden state sequence and a backward hidden state sequence corresponding to each time step are respectively output; The forward hidden state sequence and the backward hidden state sequence are connected and normalized to generate a context state representation corresponding to each time step, and a gating network structure is set to calculate a context gating weight set for each time step, which is weighted and fused with the context state representation to generate a global context gating vector; The global context gating vector is input into a discrimination layer structure to perform attack behavior classification operation to generate a global attack discrimination result, and the confidence value corresponding to the current attack discrimination is extracted as a global discrimination confidence.

6. The method of claim 1, wherein, The update of the network parameters includes: The global context gating vector is called to perform element-level multiplication operation with the local loss value corresponding to each layer of the multi-layer pulse neural network respectively to obtain the local loss value of each layer after gating weighting; The global discrimination confidence is called, and a layer consistency constraint is constructed in combination with the hierarchical local confidence sequence; The local loss value of each layer after gating weighting and the layer consistency constraint are linearly weighted and combined to form a joint training target function; Based on the joint training target function, the gradient calculation and synchronous update operation of each parameter inside the multi-layer pulse neural network and the bidirectional LSTM network are respectively performed using the time reversal propagation mechanism until all model parameters converge, and finally the trained multi-layer pulse neural network and the trained bidirectional LSTM network are obtained.

7. The encryption stream attack detection method based on pulse neural and bidirectional LSTM according to claim 1, characterized in that, The generation of the encrypted stream attack detection result includes: Obtain the encrypted traffic data to be detected to construct a corresponding encrypted traffic feature sequence to be detected; The encrypted traffic feature sequence to be detected is segmented and processed to perform pulse trigger judgment operation to trigger the generation of a pulse event signal, and then an input pulse sequence to be detected is constructed; The input pulse sequence to be detected is input into the trained multi-layer pulse neural network to perform pulse time sequence response calculation layer by layer, output the pulse activation sequence of each layer, and aggregate into a hierarchical pulse event representation sequence to be detected; Based on the hierarchical pulse event representation sequence to be detected, the potential event trigger position is identified, the event triggered paragraph boundary set to be detected is determined, and then the paragraph organization is performed to generate an intra-paragraph representation sequence to be detected and a paragraph-level representation sequence to be detected; Based on the intra-paragraph representation sequence to be detected and the paragraph-level representation sequence to be detected, a two-channel input sequence to be detected is constructed; The bidirectional LSTM network trained is inputted with the to-be-detected dual-channel input sequence, and a bidirectional hidden state sequence is outputted, and a global context gating vector is generated by combining the retained gating mechanism parameters in the training completion stage; The discriminant layer structure constructed in the training completion stage is called, the global context gating vector is inputted into the discriminant layer structure, a final classification operation of the encrypted stream attack behavior is performed, and an encrypted stream attack detection result is generated.

8. A system for detecting encrypted stream attacks based on spiking neural and bidirectional LSTM, executing the method for detecting encrypted stream attacks based on spiking neural and bidirectional LSTM according to any one of claims 1 to 7. Comprise: A data acquisition and reorganization module is configured to acquire encrypted traffic data, extract a five-tuple identifier, perform stream-level reorganization, and construct an encrypted traffic feature sequence; A pulse coding module is configured to perform coding processing on the encrypted traffic feature sequence according to a pulse coding rule, and generate a pulse input sequence; A pulse event modeling module is configured to input the pulse input sequence into a multi-layer pulse neural network, and generate a hierarchical pulse event representation sequence and a hierarchical local confidence sequence based on a DECOLLE local learning mechanism; An event paragraph generation module is configured to calculate pulse rate changes and amplitude changes based on the hierarchical pulse event representation sequence, determine a set of event trigger paragraph boundaries, and generate an intra-paragraph representation sequence and a paragraph-level representation sequence; A context modeling module is configured to construct a dual-channel input sequence based on the intra-paragraph representation sequence and the paragraph-level representation sequence, input the dual-channel input sequence into a bidirectional LSTM network, and generate a global context gating vector and a global discriminant confidence; A network parameter optimization module is configured to perform local loss weighting based on the global context gating vector, construct an inter-layer consistency constraint based on the global discriminant confidence and the hierarchical local confidence sequence, and update parameters of the multi-layer pulse neural network and the bidirectional LSTM network; An encrypted stream attack detection module is configured to generate an encrypted stream attack detection result based on to-be-detected encrypted traffic data and in combination with the trained multi-layer pulse neural network and bidirectional LSTM network.

Images