Long-period attack behavior detection method based on multi-instance learning
By employing a multi-instance learning-based approach, full-information lossless packet tokenization, and a linear attention flow encoder, we have achieved efficient detection and tracing of long-cycle attack behaviors. This solves the problems of high false negative rate and high computational resource consumption in existing technologies, and improves detection accuracy and interpretability.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-15
- Publication Date
- 2026-03-13
AI Technical Summary
Existing network attack detection methods suffer from high false negative rates, excessive computational resource consumption, and lack of interpretable tracing capabilities when dealing with long-term, multi-stage attacks, especially when facing encrypted traffic and complex attack behaviors.
By employing a multi-instance learning approach, a lightweight long-cycle attack detection model is constructed through lossless data packet tokenization, a linear attention-based stream encoder, and time-aware stream aggregation and key instance localization, enabling efficient detection and tracing of long-cycle attack behaviors.
It significantly improves the detection accuracy of complex multi-stage attacks, reduces computational complexity, provides fine-grained tracing capabilities, enhances robustness under encrypted traffic, and enables real-time detection on ordinary hardware.
Smart Images
Figure CN121664540A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of network attack detection and traffic analysis technology, specifically relating to a method for detecting long-term attack behavior based on multi-instance learning. Background Technology
[0002] Currently, network attack detection or traffic analysis mainly employs flow-based or packet-based analysis methods. Especially for encrypted traffic and complex attack behaviors, existing technologies typically use either "single-stream independent analysis" or "full sequence concatenation" approaches.
[0003] However, existing methods suffer from the following insurmountable technical drawbacks when dealing with long-term, multi-stage network attack detection tasks: Single-flow independent analysis severs the contextual relationships of attack behaviors, leading to high false negative rates. Current technologies primarily employ a single-flow analysis model, segmenting network traffic into independent flows for detection. However, modern advanced cyberattacks (such as advanced persistent threats) are typically complex processes spanning multiple flows and lasting for extended periods. Attackers utilize different flows at different times for reconnaissance, command and control, and data theft. Existing technologies treat these logically connected flows as isolated entities, severing the temporal and causal dependencies between flows, causing models to fail to identify coordinated attack patterns scattered across multiple flows.
[0004] Full sequence concatenation results in excessive computational resource consumption, making it difficult to implement in real-world environments. To capture contextual information, some existing technologies attempt to directly concatenate all data packets within a long period into an ultra-long sequence and input it into the model. This approach leads to a quadratic increase in computational complexity and memory consumption with the sequence length. When facing real-world attack sessions containing tens of thousands of data packets, its computational overhead is unacceptable and cannot meet the needs of real-time detection.
[0005] Relying on fine-grained labels and lacking interpretable attribution capabilities. Existing deep learning models typically rely on fine-grained labels at the packet or flow level for supervised training. However, in real-world network environments, obtaining such precise flow-by-flow labels is extremely costly and difficult to achieve. Usually, only coarse-grained labels at the session level (e.g., labeling overall traffic within a certain time period as malicious) can be obtained. Furthermore, existing models are often black boxes, only outputting whether the traffic is malicious or not, without indicating which specific flow(s) triggered the alert, making it difficult to support subsequent forensic work by security personnel.
[0006] Therefore, there is a need for a long-cycle attack behavior detection method that can improve the detection accuracy of complex multi-stage attacks and achieve efficient processing of large-scale traffic, in order to solve the above-mentioned technical problems. Summary of the Invention
[0007] This invention provides the following technical solution: a method for detecting long-term attack behavior based on multi-instance learning, comprising the following steps: Step 1: Lossless Packet Tokenization. The original PCAP traffic file is first divided into independent streams by a full-information tokenization scheme that includes metadata and payload. Then, each packet in the stream is converted into a token sequence.
[0008] Step 2: Construct a stream encoder based on linear attention. The stream encoder uses a kernel function to decompose the attention calculation into the inner product of the feature maps, reducing the computational complexity to linear.
[0009] Step 3: Time-aware stream aggregation and key instance localization, using an aggregation module that includes a bidirectional long short-term memory network and an attention mechanism to detect long-cycle attacks.
[0010] Step 4: Downstream task classification. Input the global fingerprint vector generated in Step 3 into a lightweight fully connected layer classifier and output the probability that the session belongs to a malicious attack or a benign business.
[0011] Preferably, in step 1, the token sequence of the data packet includes: a metadata token, a timestamp token, and a payload token.
[0012] More preferably, the meta-information token includes a Start token that identifies the start of the data packet and a Protocol token that identifies the link layer protocol. The meta-information token provides structural boundary information for the model. The timestamp token is used to calculate the arrival time interval between the current data packet and the previous data packet, and quantizes and encodes the arrival time interval into an independent time token. The payload token converts the complete header of the data packet and the application layer payload into a hexadecimal character sequence, with each character serving as a token.
[0013] Preferably, in step 2, a two-stage training strategy is adopted: first, pre-training is performed on a large-scale general dataset to learn a general flow syntax; then, fine-tuning is performed on a specific task. In the fine-tuning stage, supervised training is performed by assigning labels to all flow instances within the packet, so that the encoder learns to extract the most discriminative flow features.
[0014] Preferably, step 3 specifically includes the following sub-steps: Temporal modeling: using a bidirectional long short-term memory network to process the feature vector sequence output by the stream encoder to capture the temporal dependencies between streams; Key instance localization: introducing an attention layer after the bidirectional long short-term memory network to automatically learn the importance weight of each stream to the overall session nature; in attack scenarios, malicious C2 communication streams or data theft streams will be given extremely high weights, while the weight of background noise streams will be close to zero; Fingerprint generation: weighting and summing all stream features according to the learned weights to generate a global fingerprint vector representing the entire long-term session.
[0015] Preferably, in step 1, the quintuple consists of: source IP, destination IP, source port, destination port, and transport layer protocol.
[0016] Preferably, in step 1, when the stream is divided into independent streams according to the five-tuple, each long-cycle session contains multiple independent stream instances.
[0017] Preferably, in step 1, the data packet payload is converted into a hexadecimal token during tokenization, and the arrival time interval between adjacent data packets is quantized into a timestamp token; the stream truncation length is set to a preset threshold, which is configured according to the network environment and memory size to cover the interactive content of the vast majority of streams.
[0018] Preferably, in step 2, all data are divided into training set, validation set and test set in a ratio of 8:1:1; during the training phase, only session-level coarse-grained labels are used for supervised training of the model.
[0019] The beneficial effects of this invention are: 1. This invention overcomes the context blind spot of single-flow analysis, significantly improving the detection accuracy of complex multi-stage attacks. By introducing a time-aware flow aggregation module and utilizing a bidirectional long short-term memory network to process flow feature sequences, this invention can capture collaborative attack patterns spanning multiple flows, such as "reconnaissance-control-theft." The context-aware analysis capability of this invention enables the model to comprehensively judge the causal dependencies between flows when facing advanced persistent threats containing complex interaction logic, thereby improving the F1 score of long-cycle attack detection to a near-perfect level, especially outperforming traditional methods in scenarios with severe feature obfuscation.
[0020] 2. This invention addresses the computational resource bottleneck in long-cycle full-volume traffic analysis, enabling efficient processing of large-scale traffic. It employs a layered, decoupled architecture of "stream coding-stream aggregation," combined with an encoder based on a linear attention mechanism, reducing computational complexity from quadratic to linear. Experimental data demonstrates that when processing ultra-large-scale complex sessions containing nearly 1 billion tokens, the computational overhead of this invention is less than a quarter of that of traditional end-to-end models, significantly reducing memory consumption and inference latency, making real-time long-cycle traffic detection possible on ordinary hardware.
[0021] 3. This invention provides fine-grained critical attack flow tracing capabilities, solving the interpretability problem of traditional deep learning models. Utilizing the attention mechanism in a multi-instance learning framework, this invention can automatically learn and assign extremely high weights to critical attack flows even with only session-level coarse-grained label supervision. Visual analysis shows that this invention can accurately "locate" critical malicious flows such as privilege escalation and data backhaul from massive amounts of background noise traffic, providing security analysts with intuitive tracing evidence and significantly reducing the cost of manual investigation.
[0022] 4. This invention achieves lossless utilization of the temporal side-channel characteristics of encrypted traffic, enhancing its robustness against interference. The full-information tokenization scheme designed in this invention explicitly encodes the microsecond-level packet arrival interval, enabling the model to keenly capture the temporal side-channel characteristics generated by the automated behavior of attack tools. Even when attackers inject up to 50% noisy traffic in an attempt to counteract interference, this invention still maintains extremely high detection accuracy, demonstrating the strong robustness of the method in adversarial environments. Attached Figure Description
[0023] Figure 1 This is a flowchart of the overall architecture of Tracegram, a long-cycle attack behavior detection method based on multi-instance learning according to the present invention. Figure 2 This is a comparison chart of the computational overhead between the present invention and the traditional end-to-end full sequence splicing method; Figure 3 This is a diagram illustrating the effect of the present invention in locating critical flows in a real APT attack scenario; Figure 4 This is a schematic diagram of the method steps of the present invention. Detailed Implementation
[0024] The related technologies of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.
[0025] like Figures 1-4 As shown, this implementation uses a multi-instance learning-based traffic analysis framework. It models long-cycle network interaction behavior as packets containing multiple flow instances and utilizes a time-aware aggregation mechanism to capture cross-flow contextual dependencies. Unlike existing technologies that employ independent single-flow analysis or brute-force concatenation of the entire sequence, this implementation achieves low-overhead, high-precision detection and tracing of long-cycle attack behaviors through a layered processing architecture.
[0026] The implementation process of this method is as follows: Figure 1As shown, Figure 1 This demonstrates the complete processing flow from data hierarchy partitioning, tokenization (M0), stream encoding (M1), stream aggregation (M2) to downstream classification tasks (M3). The implementation process of this method mainly includes four core processing stages: packet tokenization, stream encoder, stream aggregator, and downstream task classification.
[0027] Step 1: Lossless tokenization of all data packets (corresponding to...) Figure 1 (M0 module in the middle) To address the issue of lost temporal and payload details during feature extraction in existing technologies, this invention proposes a full-information tokenization scheme that includes metadata and payload. This scheme first segments the original PCAP traffic file into independent streams based on 5-tuples, and then converts each packet in the stream into a token sequence. Specifically, the token sequence for each packet consists of three parts: Meta-information tokens: These include a [Start] token that identifies the start of a data packet and a [Protocol] token that identifies the link layer protocol, providing structural boundary information for the model.
[0028] Timestamp Token: This is the key design feature that distinguishes this invention from existing technologies. This invention calculates the arrival time interval between the current data packet and the previous data packet and quantizes and encodes it as an independent timestamp token. This allows the model to explicitly learn microsecond-level traffic bursts and silent patterns, i.e., sequential side-channel characteristics.
[0029] Payload tokens: The complete header and application layer payload of a data packet are converted into a hexadecimal character sequence, with each character serving as a token. This approach avoids the limitations of protocol-specific parsers and enables lossless representation of any encrypted traffic.
[0030] Compared with existing technologies, the improvement of this step is that existing technologies often discard time intervals or truncate payloads, while this invention, by introducing timestamp tokens and full hexadecimal encoding, fully preserves the temporal and content characteristics of the traffic, providing a rich information foundation for subsequent detection.
[0031] Step 2: Stream encoder based on linear attention (corresponding to...) Figure 1 (M1 module in the middle) To address the issue that the computational complexity of existing Transformer models increases quadratically with sequence length, making it difficult to handle long streams containing thousands of data packets, this invention constructs a stream encoder based on a linear attention mechanism. This encoder uses a kernel function to decompose attention computation into the inner product of feature maps, reducing computational complexity to linear. This enables the model to handle ultra-long stream sequences exceeding 12,000 tokens, thus fully covering all interaction details within a single stream.
[0032] Furthermore, this invention employs a two-stage training strategy: first, pre-training is performed on a large-scale general dataset to learn a general traffic syntax; then, fine-tuning is performed on a specific task. During the fine-tuning stage, even with only coarse-grained session labels, this invention supervises training by assigning labels to all flow instances within a packet, enabling the encoder to learn to extract the most discriminative flow features.
[0033] Compared with existing technologies, the improvement of this step is that existing technologies are forced to truncate the long stream due to computing power bottlenecks, resulting in the loss of key attack features at the tail of the stream (such as the data theft stage); while this invention breaks through the length limit through a linear attention mechanism, achieving efficient extraction of features from the entire stream.
[0034] Step 3: Time-aware stream aggregation and key instance localization (corresponding to...) Figure 1 (M2 module in the middle) This is the core step in the long-cycle attack detection of this invention. Existing technologies typically perform simple average pooling on flow features or ignore the order between flows. This invention designs an aggregation module that includes a bidirectional long short-term memory network (Bi-LSTM) and an attention mechanism.
[0035] Temporal modeling: The Bi-LSTM network is used to process the feature vector sequence output by the stream encoder to capture the temporal dependencies between streams (e.g., a reconnaissance stream is usually followed by a command and control stream).
[0036] Key instance localization (source tracing): An attention layer is introduced after Bi-LSTM to automatically learn the importance weight of each flow to the overall session nature. In attack scenarios, malicious C2 communication flows or data theft flows are given extremely high weights, while the weight of background noise flows is close to zero.
[0037] Fingerprint generation: All stream features are weighted and summed based on the learned weights to generate a global fingerprint vector representing the entire long-term session.
[0038] Compared with existing technologies, the improvement of this step is that existing technologies sever the connection between flows and cannot locate specific malicious flows; this invention restores the context logic of the attack through temporal aggregation and realizes automatic location and source tracing of key attack flows through attention weights.
[0039] Step 4: Downstream task classification (corresponding to) Figure 1 (M3 module in the middle) The global fingerprint vector generated in step 3 is input into a lightweight fully connected layer classifier, which outputs the probability that the session belongs to a malicious attack or a benign business.
[0040] The key technical point of this invention is: 1. This invention is based on a layered and decoupled multi-instance learning detection architecture of "stream-level coding + temporal aggregation" (core architectural innovation). This invention protects a specific network traffic analysis framework, characterized by modeling long-cycle attack detection tasks as a multi-instance learning problem. Specifically, a session containing multiple flows is defined as a "packet," and a single flow is defined as an "instance." The core technology lies in decoupling the analysis process into two independent stages: first, the feature representation of each flow is independently extracted through a flow encoder; then, the flow feature sequence is uniformly modeled through an aggregator. This layered architecture is a fundamental means to resolve the contradiction between "context fragmentation" and "computational resource explosion" in long-cycle traffic.
[0041] 2. This invention incorporates a "temporally-aware aggregation" mechanism (core algorithm innovation) that combines bidirectional temporal modeling and attention weights. This invention protects a specific aggregation algorithm structure for processing stream feature sequences. Unlike traditional multi-instance learning that treats instances as an unordered set, this invention introduces a bidirectional long short-term memory network in the aggregation phase to explicitly show the sequential order and temporal dependencies between modeling streams (e.g., an attack stream immediately following a reconnaissance stream). Simultaneously, it automatically calculates the contribution weight of each stream to the overall session malice by combining an attention mechanism. This technique is crucial for achieving "cross-stream context understanding" and "precise source tracing of key attack streams."
[0042] 3. This invention relates to a long sequence stream encoder based on kernel function linear attention (key implementation method). This invention protects a deep neural network structure for extracting features from a single stream. Its key feature is the use of a kernel function-based linear attention mechanism instead of the traditional Softmax dot product attention, reducing the computational complexity from the square of the sequence length to linear. This method enables the model to handle ultra-long data packet sequences exceeding ten thousand units in length, ensuring lossless extraction of complete interactive behaviors within a single stream (especially stream tail features), and providing the computational foundation for efficient processing of large-scale traffic.
[0043] 4. This invention includes a lossless serialization method for all information using "relative time interval tokens" (an innovative data preprocessing approach). This invention incorporates a specific traffic data preprocessing method that not only converts the payload of data packets into hexadecimal tokens, but more importantly, calculates the microsecond-level arrival time interval between adjacent data packets and quantizes and encodes it as an independent "timestamp token" embedded in the sequence. This explicit temporal coding method enables the model to capture traffic bursts and silent patterns (temporal side-channel characteristics) generated by automated attack tools in encrypted scenarios, significantly enhancing its anti-interference capabilities.
[0044] Example This embodiment uses an Advanced Persistent Threat (APT) dataset simulating a real enterprise network environment as the experimental object to verify the effectiveness of the long-cycle attack behavior detection method based on multi-instance learning proposed in this invention. This experimental environment aims to detect complex, multi-stage attack behaviors hidden within massive amounts of benign background traffic. The attack chain includes multiple stages such as reconnaissance, establishing a foothold, command and control, lateral movement, and data theft.
[0045] The experimental environment and data preparation for this embodiment are as follows: The selected dataset contains traffic data simulating an enterprise intranet, with a total duration of 5 days. The experimental hardware platform uses a server configured with an NVIDIA RTX 3080Ti graphics card and 64GB of memory.
[0046] During the data preprocessing stage, the captured raw traffic files are first segmented into independent streams according to the five-tuple (source IP, destination IP, source port, destination port, transport layer protocol). Each long-cycle session (i.e., a "packet" in multi-instance learning) contains an average of about 20 to 50 independent stream instances.
[0047] In the tokenization process, this embodiment not only converts the data packet payload into a hexadecimal token, but also quantizes the arrival time interval between adjacent data packets into a timestamp token. A preset threshold is set for the stream truncation length, which is configured based on the network environment and memory size to cover the interaction content of the vast majority of streams.
[0048] The implementation process of this embodiment is as follows: All data is divided into training set, validation set and test set in a ratio of 8:1:1. During the training phase, only session-level coarse-grained labels (i.e., only marking whether an attack exists within a certain time period, without marking which specific flow is the attack flow) are used to supervise the training of the model.
[0049] The specific implementation steps are as follows: Step 1: Stream Feature Encoding. The segmented stream sequence is input into an encoder based on a linear attention mechanism. Compared to the traditional Transformer architecture, this encoder reduces the computational complexity from quadratic to linear, thus enabling efficient processing of long streams containing thousands of data packets.
[0050] Step 2: Temporal Aggregation. The encoded stream feature vector sequence is input into a bidirectional long short-term memory network to capture the temporal dependency pattern of the "reconnaissance stream" followed by the "command and control stream".
[0051] Step 3: Key Instance Localization. The weight of each stream is automatically calculated using an attention mechanism, and a global session fingerprint is generated.
[0052] Step 4: Classification and Decision. Input the global fingerprint into the fully connected layer and output the detection result.
[0053] As a control group, this embodiment selects two existing technical solutions for comparison: Control group 1 (independent analysis of single flow): The random forest model is used to extract statistical features of a single flow for independent classification, ignoring the relationship between flows.
[0054] Control group 2 (full sequence splicing method): All data packets in the session are directly spliced into a very long sequence, and the standard Transformer model is used for end-to-end processing.
[0055] Results and Analysis: Comparison of detection performance and resource consumption: The method of the present invention and the control group were evaluated on the test set. The detection accuracy (F1 score), single inference time and memory usage were statistically analyzed. The performance and resource consumption of different detection methods are compared in Table 1.
[0056]
[0057] Data Analysis: As shown in Table 1, although control group 1 has a fast inference speed, it cannot effectively identify highly covert collaborative attacks because it severs the contextual connections of the attack behavior, resulting in a low F1 score (0.88). Although control group 2 improves the accuracy (0.92) by splicing long sequences, it has huge computational overhead, with inference time more than 7 times that of the present invention, and extremely high memory usage, making it difficult to deploy in high-traffic environments.
[0058] In comparison, the method of this invention achieves the highest detection accuracy (0.98) while maintaining low resource consumption (3.5GB VRAM) and real-time performance (25 milliseconds). This is because the layered architecture of this invention preserves the microscopic details within the stream while effectively capturing cross-stream attack logic through the time-series aggregation module.
[0059] Computational efficiency verification: To further verify the advantages of the present invention in processing very long sequences, this embodiment compares the computation time growth trend of the present invention and control group 2 as the length of the input token increases.
[0060] Figure 2 This demonstrates that the computation time of this invention, when processing long sequences, is significantly lower with increasing length than the comparative methods, proving the scalability of the solution. For example... Figure 2 As shown, the computation time of the end-to-end model increases dramatically in a quadratic order with the increase in the number of data packets processed, while the computation time of the method of this invention only increases slowly in a linear order. This proves that the linear attention flow encoder combined with the hierarchical aggregation architecture adopted in this invention has significant engineering scalability when processing large-scale, long-cycle traffic.
[0061] Key attack flow tracing capabilities: This invention not only outputs classification results but also enables attack attribution through attention weights. This embodiment selects a typical attack session involving SQL injection, privilege escalation, and data theft, and visualizes the attention weight heatmap output by the model.
[0062] Figure 3 The model demonstrates that it assigns high attention weights to attack flows (such as privilege escalation and data theft) and low weights to background flows, proving the interpretability and attribution capability of the solution. Figure 3 As shown in the heatmap, darker colors represent higher weights. The results show that the model automatically gives extremely high attention to "privilege escalation flow" (weight approximately 0.95) and "data backhaul flow" (weight approximately 0.94), while the weights of a large number of irrelevant background business flows are close to 0.
[0063] This result demonstrates that even without providing fine-grained labels for each flow during the training phase, the present invention successfully learned to distinguish malicious traffic from background noise. This "localization" capability helps security analysts quickly pinpoint attack clues among tens of thousands of packets, explaining why the model determined the session to be malicious.
[0064] In summary, this invention decouples network traffic analysis tasks through a multi-instance learning framework, solves the bottleneck of long-sequence computation using a linear attention mechanism, and achieves high-precision detection and automated attribution of complex long-cycle attacks through temporal aggregation and attention mechanisms. Compared with existing technologies, this invention has significant advantages in detection accuracy, computational efficiency, and result interpretability, making it suitable for deployment in resource-constrained but high-security network environments.
[0065] It should be emphasized that the above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any way. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention shall still fall within the scope of the technical solution of the present invention.
Claims
1. A method for detecting long-term attack behavior based on multi-instance learning, characterized in that, Includes the following steps: Step 1: Lossless packet tokenization. The original PCAP traffic file is first divided into independent streams by a full-information tokenization scheme that includes metadata and payload. Then, each packet in the stream is converted into a token sequence. Step 2: Construct a stream encoder based on linear attention. The stream encoder uses a kernel function to decompose the attention calculation into the inner product of the feature maps, reducing the computational complexity to linear. Step 3: Time-aware stream aggregation and key instance localization, using an aggregation module that includes a bidirectional long short-term memory network and an attention mechanism to detect long-cycle attacks; Step 4: Downstream task classification. Input the global fingerprint vector generated in Step 3 into a lightweight fully connected layer classifier and output the probability that the session belongs to a malicious attack or a benign business.
2. The method for detecting long-term attack behavior based on multi-instance learning according to claim 1, characterized in that, In step 1, the token sequence of the data packet includes: metadata token, timestamp token, and payload token.
3. The method for detecting long-term attack behavior based on multi-instance learning according to claim 2, characterized in that: The meta-information token includes a Start token that identifies the start of a data packet and a Protocol token that identifies the link layer protocol. The meta-information token provides structural boundary information for the model. The timestamp token is used to calculate the arrival time interval between the current data packet and the previous data packet, and the arrival time interval is quantized and encoded into an independent timestamp token. The payload token converts the complete header and application layer payload of the data packet into a hexadecimal character sequence, with each character serving as a token.
4. The method for detecting long-term attack behavior based on multi-instance learning according to claim 1, characterized in that, In step 2, a two-stage training strategy is adopted: First, pre-training is performed on a large-scale general dataset to learn a general traffic syntax; Then, fine-tuning is performed on a specific task. During the fine-tuning phase, supervised training is conducted by assigning labels to all flow instances within the package, enabling the encoder to learn to extract the most discriminative flow features.
5. The method for detecting long-term attack behavior based on multi-instance learning according to claim 1, characterized in that, Step 3 specifically includes the following sub-steps: Temporal modeling: The feature vector sequence output by the stream encoder is processed using a bidirectional long short-term memory network to capture the temporal dependencies between streams; Key instance localization: An attention layer is introduced after the bidirectional long short-term memory network to automatically learn the importance weight of each flow to the overall conversation properties; In attack scenarios, malicious C2 communication streams or data theft streams are given extremely high weights, while background noise streams have weights close to zero. Fingerprint generation: All stream features are weighted and summed based on the learned weights to generate a global fingerprint vector representing the entire long-term session.
6. The method for detecting long-term attack behavior based on multi-instance learning according to claim 1, characterized in that, In step 1, the five-tuple consists of: source IP, destination IP, source port, destination port, and transport layer protocol.
7. The method for detecting long-term attack behavior based on multi-instance learning according to claim 1, characterized in that, In step 1, when the stream is divided into independent streams by 5-tuple, each long-cycle session contains multiple independent stream instances.
8. The method for detecting long-term attack behavior based on multi-instance learning according to claim 1, characterized in that, In step 1, the data packet payload is converted into a hexadecimal token during tokenization, and the arrival time interval between adjacent data packets is quantized into a timestamp token. The stream truncation length is set to a preset threshold, which is configured according to the network environment and memory size to cover the interactive content of most streams.
9. The method for detecting long-term attack behavior based on multi-instance learning according to claim 1, characterized in that, In step 2, all data are divided into training set, validation set and test set in a ratio of 8:1:1; During the training phase, the model is supervised and trained using only session-level coarse-grained labels.