Traffic sample generation method, traffic detection method, device and equipment

Abstract

The invention discloses a traffic sample generation method, a traffic detection method, devices and equipment, which are applied to the technical field of network security, and the method comprises the following steps: carrying out feature extraction on traffic data under each network protocol by using a word segmentation device to obtain a structured symbol sequence, the word segmentation device being a word segmentation device for converting the traffic data into a semantic token sequence; utilizing a network security corpus to finely adjust the basic large language model to obtain an initial large language model; and determining a traffic type label corresponding to the structured symbol sequence, training the initial large language model based on the structured symbol sequence and the traffic type label corresponding to the structured symbol sequence to obtain a target traffic sample generation model, and generating a traffic sample based on the target traffic sample generation model. According to the method, the traffic data can be mapped into the token sequence to improve the understanding ability of the big language model for the traffic data, and the big language model is finely adjusted based on the two-stage fine adjustment to improve the learning ability of the model for the traffic, so that diversified traffic generation is met.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method for generating traffic samples, a method for detecting traffic, an apparatus, and equipment. Background Technology

[0002] Existing encrypted traffic detection schemes are highly dependent on samples. The quality and variety of samples significantly affect the effectiveness of traffic detection. Furthermore, the types of attacks in real network environments are extremely diverse, and it is difficult to generalize all the attacks encountered during training. However, the current training traffic samples do not generalize well enough.

[0003] It is evident that improving the diversity and accuracy of traffic samples is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a method for generating flow samples, a method for detecting flow, an apparatus and equipment, which solves the technical problems of insufficient generalization and poor quality of flow samples in the prior art.

[0005] To address the aforementioned technical problems, this invention provides a method for generating traffic samples, comprising: A word segmenter is used to extract features from traffic data under various network protocols to obtain a structured symbol sequence; wherein, the word segmenter is a word segmenter that converts traffic data into a semantic token sequence; The basic large language model was fine-tuned using a cybersecurity corpus to obtain an initial large language model; The traffic type label corresponding to the structured symbol sequence is determined, and the initial large language model is trained based on the structured symbol sequence and its corresponding traffic type label to obtain the target traffic sample generation model, and traffic samples are generated based on the target traffic sample generation model.

[0006] Optionally, before using a word segmenter to extract features from traffic data under various network protocols to obtain a structured symbol sequence, the following steps are also included: Features are extracted from the raw traffic data to obtain target features; wherein, the target features include statistical features, protocol features, and contextual information; An unsupervised word segmentation method is used to dynamically merge the byte sequences in the target features to obtain a vocabulary. The traffic data in the original traffic data is mapped to the words in the vocabulary to obtain a mapping relationship, and the word segmenter is constructed based on the mapping relationship.

[0007] Optionally, the basic large language model can be fine-tuned using a cybersecurity corpus to obtain an initial large language model, including: Using the aforementioned cybersecurity corpus, the basic large language model is fine-tuned with natural language instructions based on an adaptive moment estimation optimizer and a cross-entropy loss function to obtain the initial large language model.

[0008] Optionally, after determining the traffic type label corresponding to the structured symbol sequence, and training the initial large language model based on the structured symbol sequence and its corresponding traffic type label to obtain the target traffic sample generation model, the method further includes: Generate prompts by acquiring traffic; Based on the traffic generation prompt words, a traffic sample is generated using the target traffic sample generation model to obtain the generated traffic sample; The traffic detection model is trained based on the generated traffic samples to obtain the target traffic detection model.

[0009] Optionally, after determining the traffic type label corresponding to the structured symbol sequence, and training the initial large language model based on the structured symbol sequence and its corresponding traffic type label to obtain the target traffic sample generation model, the method further includes: The target traffic sample generation model is divided into a preset number of sub-models for different tasks or traffic patterns; Real-time monitoring of traffic changes in the network environment; identification of new traffic types using machine learning techniques; determination of the target sub-model corresponding to the new traffic type when the new traffic type is detected; wherein the new traffic type is a traffic type that the current target traffic sample generation model cannot generate; The target sub-model is incrementally updated based on the traffic data corresponding to the new traffic type to obtain the updated target traffic sample generation model.

[0010] The present invention also provides a flow rate detection method, comprising: Based on real traffic data and generated traffic samples, a behavior similarity graph based on sequence distance metric is constructed; wherein, the generated traffic samples are traffic obtained based on the target traffic sample generation model in the above traffic sample generation method; Based on the real traffic data and the generated traffic samples, an object association graph based on meta-path representation is constructed. A graph neural network-based encrypted malicious traffic detection model is constructed based on the behavior similarity graph and the object association graph. Traffic is detected based on the encrypted malicious traffic detection model.

[0011] Optionally, based on real traffic data and generated traffic samples, a behavior similarity graph based on sequence distance metric is constructed, including: The similarity between encrypted session record length sequences corresponding to traffic is determined using the fast dynamic time warping method and the Jaccard similarity coefficient method. The behavior similarity graph is constructed based on the similarity between traffic flows, using a sequence distance metric.

[0012] The present invention also provides a flow sample generation device, comprising: The structured symbol sequence generation module is used to extract features from traffic data under various network protocols using a word segmenter to obtain a structured symbol sequence; wherein, the word segmenter is a word segmenter that converts traffic data into semantic token sequences; The first fine-tuning module is used to fine-tune the basic large language model using a cybersecurity corpus to obtain the initial large language model; The second fine-tuning module is used to determine the traffic type label corresponding to the structured symbol sequence, train the initial large language model based on the structured symbol sequence and its corresponding traffic type label to obtain the target traffic sample generation model, and generate traffic samples based on the target traffic sample generation model.

[0013] The present invention also provides an electronic device, comprising: Memory, used to store computer programs; A processor is configured to execute the computer program to implement the steps of the traffic sample generation method and the steps of the traffic detection method described above.

[0014] The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the traffic sample generation method and the steps of the traffic detection method described above.

[0015] The present invention also provides a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of the above-described method.

[0016] As can be seen, this invention extracts features from traffic data under various network protocols using a word segmenter to obtain structured symbol sequences; wherein, the dedicated word segmenter is a word segmenter that converts traffic data into semantic token sequences; the basic large language model is fine-tuned using a network security corpus to obtain an initial large language model; the traffic type labels corresponding to the structured symbol sequences are determined, and the initial large language model is trained based on the structured symbol sequences and their corresponding traffic type labels to obtain a target traffic sample generation model, and traffic samples are generated based on the target traffic sample generation model. Compared to the current situation where the quality and variety of samples severely impact traffic detection capabilities, this application can map heterogeneous traffic data into token sequences, bridging the modal gap between natural language and traffic data, enhancing the understanding of traffic data by large language models. Furthermore, it fine-tunes the large language model based on a two-stage fine-tuning process (the first stage involves fine-tuning using a cybersecurity corpus to enable the model to master the semantics of specialized tasks; the second stage involves fine-tuning for specific traffic tasks to achieve accurate learning of traffic patterns, balancing model robustness and task adaptability). This enhances the model's ability to understand instructions and learn specific traffic patterns, thereby establishing a deep understanding and reasoning ability in diverse traffic generation tasks and improving the accuracy of traffic generation.

[0017] In addition, the present invention also provides a flow sample generation device, apparatus, and computer-readable storage medium, as well as a flow detection method, device, apparatus, and computer-readable storage medium, which also have the above-mentioned beneficial effects. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0019] Figure 1 A flowchart of a traffic sample generation method provided in an embodiment of the present invention; Figure 2 This is a schematic diagram illustrating the difference between traffic domain token generation and native token generation, provided as an embodiment of the present invention. Figure 3 A schematic diagram of a scalable adaptation process based on effective parameter fine-tuning is provided for an embodiment of the present invention; Figure 4 A flowchart illustrating a flow detection method provided in an embodiment of the present invention; Figure 5 A schematic diagram of a system based on traffic sample generation and traffic detection provided in an embodiment of the present invention; Figure 6 This is a schematic diagram of the structure of a flow sample generation device provided in an embodiment of the present invention; Figure 7 This is a schematic diagram of the structure of a flow detection device provided in an embodiment of the present invention; Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Some terms that appear in the description of the embodiments of this application are subject to the following interpretation: Tokenizer is a preprocessing procedure that transforms raw, continuous, or high-dimensional data into discrete symbol sequences. Its core objective is to map raw signals (natural language text, image pixel sequences, sensor data streams, etc.) that cannot be directly processed by models into a finite-sized symbol set (vocabulary).

[0022] Please refer to Figure 1 , Figure 1 A flowchart illustrating a traffic sample generation method provided in an embodiment of the present invention. The method may include: S101, the word segmenter is used to extract features from the traffic data under various network protocols to obtain a structured symbol sequence; wherein, the word segmenter is a word segmenter that converts the traffic data into a semantic token sequence.

[0023] The steps in this embodiment can be executed by a designated electronic device, which can be a server, a portable terminal, or other forms. The traffic data under each network protocol in this embodiment can be traffic data under various network protocols within a preset number of networks, or traffic data under all current network protocols. To bridge the modal gap between natural language and heterogeneous traffic data (transforming unstructured, complex network traffic data into information that can be understood and processed by a natural language processing model), this embodiment proposes an innovative traffic domain token generation module, such as... Figure 2 As shown, Figure 2This illustration demonstrates the difference between traffic domain token generation and native token generation in an embodiment of the present invention. The core objective of this module is to significantly improve the adaptability and performance of Large Language Models (LLMs) by handling diverse inputs encountered in traffic detection and generation tasks through efficient tokenization techniques. By constructing a dedicated tokenizer, which is systematically trained on a large-scale traffic domain corpus, the native token generation capabilities of LLMs are effectively extended. This allows the tokenizer to accurately process and understand the unique features of traffic data, thus providing richer input representations for LLMs. Furthermore, the tokenizer can handle the dynamic changes and complexity of traffic data, ensuring high efficiency and accuracy in various network environments. The tokenizer provided in this embodiment employs a byte-pair encoding (BPE) algorithm, training a dedicated tokenizer on large-scale traffic data to map heterogeneous traffic data into discrete token sequences, bridging the modal gap between natural language and traffic data, and improving the large language model's understanding of traffic data.

[0024] It should be further noted that, based on any of the above embodiments, before using a word segmenter to extract features from traffic data under various network protocols to obtain a structured symbol sequence, the following may also be included: Step 1: Extract features from the raw traffic data to obtain target features; the target features include statistical features, protocol features, and contextual information.

[0025] In processing traffic data, the insufficient understanding and generation capabilities due to modal differences are one of the main challenges faced by LLM. The complex structure and diverse protocol characteristics of traffic data make it difficult for traditional natural language tokenizers to fully capture its deep information. For example, network traffic typically contains multiple protocols (such as HTTP (Hypertext Transfer Protocol), TCP (Transmission Control Protocol), UDP (User Datagram Protocol), etc.), each with its specific format and semantics. Traditional tokenizers often fail to effectively identify and process the characteristics of these protocols, which not only leads to potential misjudgments and omissions in traffic detection but also prevents the model from generating effective data that conforms to actual network behavior in traffic generation tasks. Therefore, this solution designs an innovative traffic domain tokenizer that can deeply understand the details of various protocols and transform these details into a format that the model can understand, thereby improving the accuracy and efficiency of the model in traffic detection and generation tasks. Specifically, extracting features from large-scale traffic data is the first step in building the tokenizer. This embodiment collects real network traffic data containing multiple protocols such as HTTP, TCP, and UDP. During feature extraction, this embodiment combines traditional feature engineering with modern deep learning techniques to extract the following types of features: Statistical features: including traffic size, frequency, and number of packets; Protocol features: in-depth analysis of the format and semantics of different protocols to extract specific fields; Contextual information: considering the temporal characteristics and interrelationships of traffic data to extract relevant contextual information. These features, through in-depth analysis of the structure and patterns of traffic data, provide rich input for subsequent tokenizer training.

[0026] Step 2: Using an unsupervised word segmentation method, the byte sequences in the target features are dynamically merged to obtain a vocabulary.

[0027] This embodiment designs a dedicated feature extractor based on the unsupervised word segmentation method (BPF) to extract suitable traffic features for different traffic detection and generation tasks. These feature extractors combine traditional feature engineering with modern deep learning techniques. Through comprehensive analysis of the statistical characteristics, traffic patterns, and contextual information of traffic data, they ensure that the extracted features are highly relevant to specific tasks, thereby improving model performance. These feature extractors not only extract key information from traffic data but also dynamically adapt to changes in the network environment, providing the model with real-time and accurate traffic features, thus playing a crucial role in traffic detection and generation tasks. During feature extraction, a dedicated tokenizer for traffic data is constructed to form tokens suitable for the input traffic. To achieve this goal, Byte Pair Encoding (BPE, unsupervised analysis method) is used, and the tokenizer is trained on large-scale fine-tuning data. BPE has the following advantages: Efficiency: BPE is an unsupervised word segmentation method that can adaptively handle the sparsity and complexity of traffic data by dynamically merging byte pairs. Compared to traditional word segmentation methods based on spaces or punctuation, BPE can more accurately capture the features of traffic data. Flexibility: BPE can flexibly adapt to new traffic characteristics. As traffic data changes, the tokenizer can continuously update and optimize its vocabulary, maintaining model effectiveness. Deep Understanding: BPE can effectively extract deep information from traffic data by merging frequent byte pairs to form new tokens. This capability is particularly important for network security tasks that require accurate understanding of various protocol details. Compared to traditional tokenization methods, BPE's advantages in traffic data processing are more pronounced. Traditional tokenizers often fail to fully identify and process the complex structures and semantic features in traffic data, potentially leading to misjudgments and missed detections in traffic detection. BPE, however, can deeply mine the potential patterns in traffic data, effectively transforming raw byte sequences into more semantic tokens, making the model perform better in traffic detection and generation tasks. The BPE algorithm is a simple and effective unsupervised tokenization method that gradually builds an optimized vocabulary by dynamically merging the most frequently occurring byte pairs. This method is well-suited for processing traffic data, which typically exhibits high sparsity and complexity. Traditional tokenization methods based on spaces or punctuation struggle to accurately capture the complex protocol features and patterns in traffic data. The BPE algorithm can adaptively discover the potential structure in traffic data, efficiently transforming the original byte sequence into more representative tokens. By dynamically merging the most frequent byte pairs, the BPE method effectively addresses the sparsity of traffic data, generating tokens that accurately reflect traffic characteristics. Specifically, step 2 may include: after completing feature extraction, starting to construct the tokenizer's vocabulary.The BPE algorithm dynamically merges byte sequences in traffic data to gradually form an optimized vocabulary. The core idea of ​​the BPE algorithm is to count the frequency of all byte pairs. The most frequent byte pairs are then merged to form new tokens. This process is repeated until the set vocabulary size is reached. This method effectively captures the underlying structure in traffic data and generates representative tokens, facilitating subsequent model training and inference.

[0028] Step 3: Map the traffic data in the original traffic data to the words in the vocabulary to obtain the mapping relationship, and build a word segmenter based on the mapping relationship.

[0029] This embodiment maps raw traffic data into token sequences after the vocabulary is constructed. By combining extracted features with the constructed vocabulary, each traffic sample can be transformed into a corresponding token sequence. This process includes replacing each byte or byte pair of traffic data with the corresponding token. Bytes not appearing in the vocabulary are handled and represented as "unknown tokens" to ensure the robustness of the model. During the training of the Tokenizer, this invention collects a large amount of real network traffic data, covering mainstream network protocols such as HTTP, TCP, and UDP. Through in-depth analysis of this traffic data, this embodiment extracts various statistical features, protocol features, and contextual information as input for BPE training. After multiple rounds of iterative optimization, the Tokenizer finally learns a highly compressed and expressive vocabulary that can accurately capture the complex semantics of traffic data. This BPE-based tokenization method not only improves the processing efficiency of traffic data but also significantly enhances the model's ability to understand and generate traffic data, making it perform better in practical applications. By converting the original byte sequences into more semantic tokens, the Tokenizer effectively bridges the modal gap between LLM and heterogeneous traffic data. LLMs can better understand and learn the inherent patterns in traffic data, thus achieving significant results in tasks such as traffic detection and anomaly behavior identification. Furthermore, the BPE method can flexibly adapt to new traffic characteristics, allowing the tokenizer to continuously evolve to cope with constantly changing network environments. By constructing a traffic domain tokenizer, not only can the limitations of traditional tokenizers in traffic data processing be addressed, but LLMs can also gain greater adaptability and flexibility. This extension enables LLMs to achieve significant results in traffic detection and generation tasks, especially when facing complex and dynamic network environments. For example, traffic domain tokenizers can identify and process various patterns in traffic data, including the distinction between normal and abnormal traffic, data structures in different protocols, and the temporal characteristics of traffic behavior. This enhanced capability allows LLMs to make more accurate decisions and generate appropriate responses when handling network security-related tasks. In addition, this dedicated tokenizer provides a foundation for subsequent model optimization, enabling the model to better adapt to new traffic characteristics and behavioral patterns. Data processed by a traffic domain tokenizer can better support model training, helping the model gradually learn and adapt to new traffic characteristics and behavioral patterns. This continuous learning capability enables the model to maintain high performance in constantly changing network environments, thereby improving network security protection capabilities.Through continuous optimization and adjustment, this tokenizer ensures that the model is always in optimal condition to generate high-quality samples.

[0030] S102, the basic large language model is fine-tuned using a network security corpus to obtain the initial large language model.

[0031] This embodiment does not limit itself to a specific basic large language model. The basic large language model in this embodiment can be Wenxin Yiyan, Tongyi Qianwen, ChatGPT (Generative Pre-trained Transformer), etc. The cybersecurity corpus in this embodiment includes background information, objectives, and requirements for various cybersecurity tasks. This information provides the model with the necessary context, enabling it to effectively understand the context and objectives of different tasks. To build a high-quality task description corpus, this embodiment systematically collects and organizes professional literature, technical reports, industry standards, and related online resources in the cybersecurity field. These text materials have been screened and organized to ensure broad coverage, including descriptions of specific attack types, characteristics of different traffic patterns, and countermeasures. In this way, this embodiment constructs a text corpus containing rich task descriptions, providing rich contextual information for the fine-tuning process. Fine-tuning based on the cybersecurity corpus in this embodiment is the first stage, mainly involving the introduction of natural language instructions for fine-tuning. The core of this stage is to inject professional task description text from the cybersecurity field into the LLM. When the LLM is fine-tuned using this corpus of text data, the model not only masters industry terminology and task context but also enhances its understanding of instructions. For example, the model will learn how to summarize the key points of cybersecurity tasks, understand the security policies, execution steps, and relevant industry standards implied in the instructions. This process is designed to ensure the model's accuracy and reliability in real-world operations, enabling it to respond more appropriately to complex network environments.

[0032] It should be further explained that, based on any of the above embodiments, the fine-tuning of the basic large language model using a cybersecurity corpus to obtain an initial large language model can include: using the cybersecurity corpus to fine-tune the basic large language model with natural language instructions based on an adaptive moment estimation optimizer and a cross-entropy loss function to obtain an initial large language model. To achieve robust representation learning of the large language model (LLM) in different traffic domain tasks, this embodiment adopts a two-stage fine-tuning scheme. This aims to improve the model's ability to understand instructions and learn specific traffic patterns through a systematic and progressive training process, thereby establishing a deep understanding and reasoning ability in diverse traffic detection and generation tasks. Specifically, this scheme guides the model to deeply understand complex network traffic data through two stages of fine-tuning, demonstrating superior adaptability and reliability in practical applications. In the first stage, the goal of this invention is to enable the LLM to understand professional tasks and instructions in the cybersecurity field. To this end, this embodiment uses the following optimization algorithms and loss functions: Optimization Algorithm: This embodiment uses the Adam (Adaptive Moment Estimator) optimizer because it performs well in handling sparse gradients and can effectively accelerate convergence. Adam combines adaptive learning rate and momentum, facilitating stable training in complex tasks. Loss Function: The cross-entropy loss function is chosen, suitable for multi-class classification problems, accurately evaluating the model's understanding of different task instructions. This loss function effectively reflects the model's performance in instruction classification, ensuring high accuracy in natural language understanding tasks. Hyperparameter Settings: In this stage, the learning rate can be set to 0.001, and the mini-batch size to 32, balancing training efficiency and performance. This embodiment also employs an early stopping strategy, stopping training prematurely when the loss on the validation set no longer improves, to prevent overfitting.

[0033] S103, determine the traffic type label corresponding to the structured symbol sequence, train the initial large language model based on the structured symbol sequence and its corresponding traffic type label to obtain the target traffic sample generation model, and generate traffic samples based on the target traffic sample generation model.

[0034] S103 in this embodiment belongs to the second stage of fine-tuning the large language model, focusing on traffic fine-tuning for specific tasks. The goal of this stage is to enable the model to deeply learn traffic patterns so as to effectively represent and model traffic in actual traffic detection and generation tasks. To achieve this goal, this invention collects traffic data related to specific tasks, including normal traffic samples and attack traffic samples, and annotates this data in detail (traffic type labels) to form a high-quality training set. When selecting labeled samples, it is ensured that multiple traffic patterns, attack types, and normal behaviors are covered so that the model can comprehensively learn various possible traffic features. By fine-tuning the LLM using traffic data and corresponding labels (i.e., training the initial large language model based on structured symbol sequences and the corresponding traffic type labels), the model will learn how to identify and generate traffic patterns suitable for specific tasks. In this process, the model not only needs to understand the contextual features of the traffic data, but also needs to master time series patterns and protocol characteristics to achieve effective representation of traffic detection and generation tasks. As traffic fine-tuning deepens, the model will gradually build a deep understanding of traffic data and be able to make accurate judgments and responses when facing different traffic scenarios. This fine-tuning phase not only significantly improves the model's performance on specific tasks but also enhances its robustness in complex traffic environments. In the second phase, the invention focuses on learning traffic patterns in the model to improve its performance in traffic detection and generation tasks. Similarly, specific optimization strategies can be employed in this phase: Optimization Algorithm: This embodiment continues to use the Adam optimizer and tries different learning rate scheduling strategies, such as learning rate decay, which gradually reduces the learning rate in the later stages of training to help the model converge more finely. Loss Function: In the traffic fine-tuning phase, the cross-entropy loss function is used, but depending on the specific task requirements, a weighted loss may be introduced to differentiate traffic samples of different categories, especially when facing imbalanced datasets. Hyperparameter Settings: This embodiment adjusts the learning rate to 0.0005 to adapt to more complex traffic data while maintaining a mini-batch size of 64 to improve training efficiency. With this configuration, the invention can better capture the characteristics of traffic data during training. It should be noted that the two fine-tuning phases are not isolated but complementary. The first stage of natural language instruction fine-tuning provides a solid foundation for the model, enabling it to understand the semantics and contextual knowledge of the task. The second stage of task-specific traffic fine-tuning allows the model to apply this understanding to real-world traffic data analysis. Employing a progressive fine-tuning strategy instead of a one-time full-scale fine-tuning has several advantages: Robustness: Progressive fine-tuning allows the model to gradually adapt to new information as it understands the task, thus reducing training instability caused by updating parameters all at once. Through staged training, the model can focus on specific learning objectives at each stage.Knowledge Preservation: By fine-tuning with natural language instructions first, the model can retain the industry knowledge and contextual information learned in the first stage. This allows the model to more effectively apply previous learning results and avoid information loss when fine-tuning specific task traffic in the second stage. Resource Efficiency: Progressive fine-tuning reduces computational resource consumption because the training objectives at each stage are more clearly defined, effectively utilizing the model's existing knowledge for optimization and avoiding unnecessary full-scale training. Performance Improvement: This staged training approach allows the model to be specifically optimized at each stage, resulting in significant performance improvements on specific tasks. During the two-stage fine-tuning process, this invention employs cross-entropy loss and mini-batch gradient descent as optimization strategies. The cross-entropy loss function effectively evaluates the model's predictive performance, especially suitable for multi-class classification problems, ensuring the model's accuracy in traffic label prediction. Simultaneously, mini-batch gradient descent improves training efficiency and reduces computational burden, making training on large-scale datasets more efficient. To ensure the model remains in optimal condition, this invention implements a periodic evaluation and parameter saving mechanism. At the end of each training cycle, the model's performance is evaluated, and the model parameters with the minimum loss are saved. This approach not only ensures the stability of the model but also provides a reliable foundation for subsequent practical applications. Ultimately, this two-stage fine-tuning scheme provides a systematic and efficient framework for the application of LLM in the field of cybersecurity, capable of meeting ever-changing security requirements and demonstrating superior adaptability and reliability in practical applications. Through this two-stage fine-tuning, the model not only improves performance in specific tasks but also exhibits higher accuracy and robustness when handling various complex traffic scenarios.

[0035] It should be further noted that, based on any of the above embodiments, after determining the traffic type label corresponding to the structured symbol sequence, and training the initial large language model based on the structured symbol sequence and its corresponding traffic type label to obtain the target traffic sample generation model, it may further include: S1: Generate prompts by acquiring traffic; S2: Generate traffic samples based on the traffic generation prompt words using the target traffic sample generation model; S3: Train the traffic detection model based on the generated traffic samples to obtain the target traffic detection model.

[0036] Given that existing solutions heavily rely on samples, and the quality and variety of samples significantly impact traffic detection capabilities, coupled with the vast array of attack types in real-world network environments, it's difficult to encompass all encountered attacks during training. This invention generates traffic samples based on a target traffic sample generation model obtained using the aforementioned method. This enhances robust traffic representation by improving generalization to heterogeneous traffic data, multi-mode learning across different tasks, and new network traffic environments. This embodiment does not limit the specific traffic detection model. For example, the traffic detection model in this embodiment can be a graph neural network-based traffic detection model. First, under adaptive weights, the scheme aggregates relevant encrypted session node features using meta-paths to obtain richer encrypted session node representations. Subsequently, a multilayer perceptron (MLP) model is used to perform binary classification on the generated representations to determine the maliciousness of the encrypted session nodes. Finally, in a real detection environment, if malicious traffic is not learned during training, it is fed back to the traffic domain token generation module for retraining. This embodiment can generate encrypted traffic samples using a target traffic sample generation model and combine them with a graph neural network-based traffic detection model generated by graph neural networks (GNN) and heterogeneous graph neural networks (HGNN) for detection.

[0037] It should be further noted that, based on any of the above embodiments, after determining the traffic type label corresponding to the structured symbol sequence, training the initial large language model based on the structured symbol sequence and its corresponding traffic type label to obtain the target traffic sample generation model, it may further include: S104 divides the target traffic sample generation model into a preset number of sub-models for different tasks or traffic patterns.

[0038] S105 monitors traffic changes in the network environment in real time, uses machine learning technology to identify new traffic types, and determines the target sub-model corresponding to the new traffic type when a new traffic type is detected; wherein, the new traffic type is a traffic type that the current target traffic sample generation model cannot generate.

[0039] S106, Based on the traffic data corresponding to the new traffic type, the target sub-model is incrementally updated to obtain the updated target traffic sample generation model.

[0040] To ensure that large language models (LLMs) can effectively adapt to constantly changing traffic environments, this embodiment proposes an innovative scalable adaptive method. This method employs Efficient Adaptation via Prompt Tuning (EA-PEFT) technology. The core objective of this technique is to update model parameters with the lowest possible overhead in dynamic scenarios caused by changing traffic patterns, thereby minimizing adaptation costs while maintaining high performance. Please refer to [reference needed]. Figure 3 , Figure 3This invention provides a schematic diagram of a scalable adaptation process based on efficient parameter fine-tuning, which may include a core control unit: an Adaptor, which continuously monitors real-time network traffic and uses machine learning techniques to analyze changes in traffic characteristics and patterns. When existing attack characteristics are detected to have mutated or a completely new attack pattern is identified, the Adaptor initiates a corresponding update process. A specialized skill library includes a PEFT sub-model library (such as Natural Language Processing module - NLP1, Malicious Traffic Detection - MTD, Traffic Generation - WAD1, Network Detection - BND, Encrypted Traffic Classification - EAC, etc.). Each block represents a parameter-efficient fine-tuning model, which is a small module specifically trained on a base model for a specific task (such as MTD, WAD, EAC, etc.). Each sub-model is proficient in only one skill. Based on the monitoring results, the Adaptor triggers two different mechanisms, corresponding to the two arrows in the diagram: Mechanism 1: Model Update - Response to "Variations of Known Threats," where attackers change the characteristics of a known attack to evade detection (e.g., changing the request headers of an HTTP flooding attack). The Adaptor selects a PEFT sub-model (e.g., WAD1) responsible for that traffic type and then calls the `Model_update` function. This function uses newly collected attack variant data as a training set to quickly and lightweightly incrementally train this specific sub-model. It doesn't require affecting the entire large model or other sub-models, resulting in fast updates and extremely low resource consumption. Mechanism Two: Model Addition - Addressing "New and Unknown Threats" When a previously unseen attack method emerges in the network (e.g., an attack exploiting a new protocol vulnerability), the Adaptor triggers a registration mechanism to train a completely new PEFT sub-model (e.g., creating an EAC model specifically for this new attack). After training, this new model is integrated into the existing sub-model library. This enables the system to extend its capabilities, covering constantly emerging new attack types, fundamentally improving the system's generalization ability and lifespan. The design philosophy of EA-PEFT is to subdivide the capabilities of the entire model into multiple Parameter Effective Fine-Tuning (PEFT) models. Each PEFT model is specifically optimized for a particular task or traffic pattern. For example, one PEFT model might focus on detecting malicious behavior in HTTP traffic, while another PEFT model is optimized for encrypted TLS traffic. This approach not only effectively manages model complexity and adaptability but also quickly identifies parts that need adjustment when traffic patterns change, avoiding the need for comprehensive fine-tuning of the entire model. Through this strategy, the system can save computational resources, accelerate model updates, and maintain high performance in rapidly changing network environments. Specifically, by decomposing the adaptation process into multiple small, specialized PEFT models, EA-PEFT enables finer-grained control and more efficient updates.For example, when a new attack is detected in HTTP traffic, the system can quickly update the corresponding PEFT model without retraining the entire LLM. This approach allows the model to respond more flexibly to changes in traffic patterns, reducing unnecessary computational overhead and thus improving the overall system's responsiveness. Research shows that this fine-grained model update strategy can significantly improve detection accuracy and system robustness when facing complex and ever-changing network traffic. In the EA-PEFT framework, the Adaptor plays a crucial role, managing the flexibility and efficiency of model updates. By monitoring changes in network traffic in real time, the Adaptor can identify new attack patterns or traffic characteristics. For example, when an attacker changes the characteristics of the HTTP request body to evade detection, the Adaptor can quickly capture this change and react accordingly. Specifically, the Adaptor utilizes advanced machine learning techniques and real-time data analysis to continuously track dynamic changes in traffic, ensuring timely detection of potential security threats. When a network attack method triggers a traffic update, the Adaptor can call the Model_update function to quickly provide new Traffic Anomaly Detection (EAC) or Traffic Generation (WAD) datasets to update the specific PEFT model. This efficient adaptation mechanism ensures that the model can quickly adapt to new traffic characteristics without the need for tedious retraining. In this way, TrafficGuardian can respond to constantly changing network environments in real time, ensuring its network security capabilities remain at their optimal state. Specifically, the Adaptor's workflow includes the following steps: (1) Monitoring traffic changes: The system continuously monitors traffic changes in the network environment, analyzes traffic characteristics and patterns, and uses machine learning technology to identify new attack patterns or traffic characteristics. This process relies on the analysis of real-time data streams and in-depth mining of historical data. By collecting and analyzing a large amount of traffic data, Adaptor can establish a baseline for normal traffic patterns, thereby more effectively detecting anomalies.

[0041] (2) Selecting a PEFT model: Once the Adaptor identifies new traffic characteristics or attack patterns, it selects the appropriate PEFT model for updating based on this information. Each PEFT model is optimized for a specific task or traffic characteristic, thus enabling it to process new data more effectively. The Adaptor considers both the similarity of traffic characteristics and the historical performance of the model to select the most suitable PEFT model for fine-tuning.

[0042] (3) Calling the Model_update function: The Adaptor calls the Model_update function to pass the new EAC or WAD training data to the selected PEFT model. During this process, the Adaptor automatically adjusts the relevant parameters and updates the model's state, thereby achieving rapid adaptation. This automated update process reduces the need for manual intervention and ensures the timeliness and effectiveness of model updates. Through automation, the system can complete updates within milliseconds, significantly improving response speed.

[0043] (4) Dynamic Update Mechanism: This dynamic update mechanism significantly improves the model's response speed and accuracy in the face of new threats or traffic patterns. The model can learn new information in real time and quickly update its internal state to cope with the ever-changing network security environment. This not only improves the model's responsiveness but also enhances the overall security of the system. Through this mechanism, TrafficGuardian can maintain efficient protection capabilities in the ever-changing network environment, ensuring the security and integrity of data.

[0044] The main advantages of EA-PEFT lie in its parameter validity and system scalability. By updating only model parameters relevant to new traffic patterns, EA-PEFT significantly reduces computational and storage overhead. This efficient update strategy enables the model to respond quickly to external changes in resource-constrained environments, ensuring its adaptability and reliability under dynamic conditions. Furthermore, the Adaptor's management of different PEFT models allows for flexible switching between various tasks and traffic patterns. This flexibility not only improves the model's usability but also enhances the overall system efficiency, enabling the model to perform excellently in diverse application scenarios. In summary, through EA-PEFT technology, LLM can maintain high performance and accurate response when facing rapidly changing traffic environments.

[0045] This invention provides a traffic sample generation method, which may include: S101, using a word segmenter to extract features from traffic data under various network protocols to obtain a structured symbol sequence; wherein the word segmenter is a word segmenter that converts traffic data into semantic token sequences; S102, using a network security corpus to fine-tune a basic large language model to obtain an initial large language model; S103, determining the traffic type labels corresponding to the structured symbol sequences, training the initial large language model based on the structured symbol sequences and their corresponding traffic type labels to obtain a target traffic sample generation model, and generating traffic samples based on the target traffic sample generation model. Compared with the current situation where the quality and type of samples seriously affect the traffic detection capability, this application can map heterogeneous traffic data into token sequences, solve the modal gap between natural language and traffic data, improve the understanding ability of the large language model of traffic data, and fine-tune the large language model based on two-stage fine-tuning to improve the model's understanding ability of instructions and its learning ability of specific traffic patterns, thereby establishing a deep understanding and reasoning ability in diverse traffic generation tasks and improving the accuracy of traffic generation.

[0046] For a clearer understanding of this invention, please refer to the following details. Figure 4 , Figure 4 A flowchart illustrating a traffic detection method provided in an embodiment of the present invention may specifically include: S201, Based on real traffic data and generated traffic samples, construct a behavior similarity graph based on sequence distance metric; wherein, the generated traffic samples are the traffic obtained based on the target traffic sample generation model in the above traffic sample generation method.

[0047] The execution subject in this embodiment is an electronic device. The real traffic data and generated traffic sample data in this embodiment can be encrypted traffic data. Before constructing a behavior similarity graph based on the traffic data, a series of data cleaning tasks can be performed, including traffic splitting, traffic filtering, and traffic reassembly. Traffic splitting: Traffic splitting is the first step in the preprocessing module. Its main purpose is to divide the original pcap (principal component analysis) file into multiple sessions. A session refers to a series of interrelated data exchanges during communication, typically defined by a five-tuple of information: source IP (network address), destination IP address, source port number, destination port number, and protocol type. Traffic filtering: Traffic filtering is a crucial step in the preprocessing module. Its main task is to filter out data irrelevant to the system's detection target and retain session data related to TLS (Transport Layer Security) encrypted traffic. In network communication, there is a large amount of unencrypted, non-TLS, or incomplete session data, which may interfere with and cause misjudgments in malicious traffic detection. Therefore, a strict filtering strategy can reduce the impact of irrelevant data on system performance and improve the accuracy and efficiency of detection. Traffic Reassembly: Traffic reassembly is the core part of the preprocessing module. Its main goal is to reassemble the fragmented communication sessions to restore the original TLS encrypted session. In network communication, due to the limitations of network MTU (Maximum Transmission Unit) and the diversity of TLS records, a single data packet's TCP (Transmission Control Protocol) segment may contain multiple TLS records, or a single TLS record may be distributed across multiple data packet TCP segments. This irregular distribution of TLS records poses a challenge to subsequent malicious traffic detection. Therefore, TCP reassembly technology is needed to reassemble the fragmented communication sessions to ensure the accuracy and reliability of subsequent TLS record length sequence statistics. This embodiment analyzes and constructs correlations from two aspects, and internalizes the constructed correlations into a behavioral similarity graph. Two types of metapaths ; Temporal offset mainly refers to the distortion or shift in the horizontal time dimension of TLS record length sequences with the same malicious activity due to differences in network conditions and other factors. This embodiment uses underscores to distinguish the relationships between TLS records with the same malicious activity. In this case, traditional time series distance metrics such as Euclidean distance perform poorly. To capture the changing trend of TLS encrypted session record length sequences, the scheme introduces the Fast Dynamic Time Warping (FastDTW) algorithm to measure the similarity of bidirectional encrypted communication record length sequences. The FastDTW algorithm can address the offset in the time dimension through time dimension distortion and accurately measure the similarity between two given time series, and its applications are very wide. After calculating the behavioral similarity between all encrypted session nodes using FastDTW, the scheme establishes associations in the behavioral similarity graph Gk based on the similarity using a KNN graph. . The issue of misaligned sequences refers to the fact that, due to differences in operating system versions, hosts, etc., different attackers issuing commands for the same attack threat do not strictly follow a fixed command order. To capture the overall behavior of TLS encrypted session record length sequences, this scheme further introduces Jaccard distance to measure the similarity of downlink encrypted communication record length sequences. Jaccard distance measures the similarity between two given time series by dividing the difference between the union and intersection of two sets by the size of the union. Its algorithmic nature makes it insensitive to the order of local signals, focusing instead on the repetition and sharing of behavioral elements appearing in the sequence. After calculating the behavioral similarity between all encrypted session nodes using Jaccard distance, the scheme establishes associations in the behavioral similarity graph Gk based on the similarity using a KNN graph. By combining the FastDTW algorithm (which handles time-series offsets) and the Jaccard coefficient algorithm (which handles sequence misalignments), the similarity of encrypted session record length sequences is calculated to comprehensively capture behavioral correlations. Using the FastDTW and Jaccard coefficient measurement algorithms, time-biased and sequence-biased KNN graphs are constructed, effectively processing time-series data and improving the accuracy of behavioral similarity analysis.

[0048] S202, construct an object association graph based on meta-path representation, based on real traffic data and generated traffic samples.

[0049] Current methods for detecting encrypted malicious traffic typically rely on graph embedding or node embedding learning based on static source graphs. Static source graphs only reflect the system's current operational status and cannot capture the dynamic evolution of the system at different times. This leads to the omission of many potential malicious behavior patterns, as many attacks have temporal and phased characteristics. This invention fully analyzes various network objects and their potential relationships, and extracts the four most common types of network objects during a session: encrypted session S, client... ,server And certificate C. Encrypted session S: Represents a complete TLS session, i.e., sharing the same 5-tuple. The malicious behavior of a complete malicious attack is usually distributed across multiple streams within a single session. Analyzing only a single stream cannot fully capture the overall malicious behavior, potentially leading to missed detections. Since encrypted sessions can comprehensively depict the interaction between the server and client, this embodiment primarily focuses on malicious detection within TLS-encrypted environments. (Client) This represents the client corresponding to a TLS encrypted session. Because the client provides a detailed user profile and host configuration, its information facilitates the identification of infected hosts and related sessions. This embodiment will analyze client information and the client's association with other network objects in detail, thereby making the relationships referenced in the solution more comprehensive. Server **Server C:** Represents the server corresponding to a TLS encrypted session. Since server configuration information can reflect security attribute anomalies, and analyzing sessions on the same server can help discover malicious domain name services, this embodiment will analyze server information and the server's association with other network objects in detail, thus making the relationship between the solution reference more comprehensive. **Certificate C:** Represents a certificate issued by a Certificate Authority (CA) used to verify the server's identity. Since different servers with the same certificate often have close functional and application service associations, certificates can intuitively reflect the inherent connections between servers and their related sessions. This embodiment will analyze certificate information and the certificate's association with other network objects in detail, thus making the relationship between the solution reference more comprehensive. To fully capture the inherent connections between network objects, this embodiment summarizes the complex relationships between various network objects during the encrypted session from a global perspective and organizes them into four meta-paths. Construct an object association graph . This indicates that two different encrypted sessions share the same client. This means that the two different encrypted sessions were initiated by the same client application and have a strong correlation. : This indicates that two different encrypted sessions share the same server. This means that the encrypted sessions associated with this server correspond to strongly related web applications. SCS: This indicates that two different encrypted sessions share the same certificate. This means that the web (internet) services or applications accessed by the two encrypted sessions have the same authentication, and the certificates were issued by the same certificate authority. Since the same certificate is often used across multiple servers managed by an organization or institution to ensure consistency and convenience, two encrypted sessions sharing the same certificate have close functional and application service relationships. This indicates that the servers in two different encrypted sessions shared the same certificate, which means that the two servers accessed by the two encrypted sessions shared similar application functions and server configurations. As a supplement to SCS, it effectively fills the gaps in special cases such as server certificate replacement and server failure replacement, and can take into account the deeper relationships between encrypted sessions, servers, and certificates. Existing encrypted malicious traffic detection methods usually only focus on a single type of network object or simple object relationships, ignoring the complex relationships between different types of objects in the network environment. This leads to insufficient information utilization during the detection process and affects the detection effect. To this end, this invention proposes an object relationship graph construction method based on meta-path representation. By extracting four key network objects—encrypted sessions, servers, clients, and certificates—it constructs multi-relationship meta-paths to reflect the complex relationships between network objects. When constructing the object relationship graph, it not only considers direct relationships but also analyzes indirect relationships and hierarchical structures between different network objects, providing richer contextual information and improving the comprehensiveness and accuracy of malicious traffic detection. By dynamically constructing and updating the object relationship graph, it captures the dynamic changes in object relationships in the network, enabling the detection method to better adapt to complex and ever-changing network environments and improve the robustness of the system. By generating the object relationship graph, it can capture the relationship information between network objects in greater detail, which helps to make full use of this information during the detection process, thereby improving the detection effect on potential threats.

[0050] S203, Constructing an encrypted malicious traffic detection model based on graph neural networks based on behavioral similarity graphs and object association graphs.

[0051] This invention overcomes the shortcomings of existing association analysis methods, such as inaccurate behavioral analysis and failure to consider heterogeneous objects, by constructing behavioral similarity graphs and object association graphs. Furthermore, to fully analyze and utilize the captured complex associations, this method integrates the behavioral similarity graph and object association graph into an encrypted traffic graph. The data is then fed into a model primarily based on a Heterogeneous Graph Attention Network (HAN) for node association aggregation analysis. Specifically, firstly, under adaptive weights, the scheme aggregates relevant encrypted session node features using meta-paths to obtain richer encrypted session node representations. Subsequently, a Multilayer Perceptron (MLP) model is used to perform binary classification on the generated representations to determine the maliciousness of the encrypted session nodes. Finally, in a real-world detection environment, if malicious traffic is not learned during training, it is fed back to the traffic domain token generation module for retraining. Graph G contains a total of [number missing] nodes. The four types of nodes represent encrypted session nodes (S), server nodes, and so on. Client node Certificate node C. Graph G also includes Six types of edges represent the intrinsic associations between encrypted sessions and clients, encrypted sessions and servers, encrypted sessions and their corresponding certificates, servers and their corresponding certificates, behavioral similarity associations between encrypted session nodes calculated using FastDTW, and behavioral similarity associations between encrypted session nodes calculated using Jaccard. Figure G also includes the features of nodes in Figure X. Furthermore, since this embodiment performs maliciousness assessment on encrypted session nodes, features can be extracted from Figure G using encrypted session nodes as the starting and ending points. Six types of meta-paths. The detection framework of the encrypted malicious traffic detection method can input the encrypted traffic graph G into a HAN (Heterogeneous Graph Attention Network) and perform aggregation training through a two-layer attention mechanism, including node-level attention and semantic-level attention. In the two-layer attention architecture, firstly, the ETG is divided into multiple subgraphs according to different meta-paths, and then independent node-level attention is applied to each subgraph for training. During training, relevant information of encrypted session nodes is weighted and aggregated to obtain the representation of encrypted session nodes under different meta-paths. Next, semantic attention is used to further assign semantic attention values ​​to each meta-path. Finally, the encrypted session node representations calculated under all meta-paths are aggregated into the final node synthesis representation. The detection method is described as an encrypted malicious traffic detection method based on dual-graph fusion and graph neural networks. , ; where NA and SA represent node-level attention aggregations and semantic-level attention aggregations, respectively. Metapath The corresponding feature aggregation matrix (j is the meta-path index, the range of which is the meta-path set mentioned above) Consistency, that is (corresponding to 6 types of metapaths). In the metapath The neighbor set of the next node i This represents the meta-path set. During the HAN aggregation iteration process, nodes continuously capture node information from their multi-level neighbors, as well as semantic information under various meta-paths, thereby updating and enriching the node representation. Finally, through MLP model calculation, the maliciousness judgment result of the encrypted session node can be obtained. During the training process of the encrypted malicious traffic detection method, encrypted session nodes are labeled; benign encrypted session nodes will be marked. Malicious encrypted session nodes will be flagged. Furthermore, through The model's detection performance is optimized by minimizing the cross-entropy loss function for encrypted session nodes. Here, Z represents the set of model predictions. Let G represent the actual set of labels for the encrypted session nodes in the training set, and let G represent the association graph of the encrypted session nodes. This represents the actual label value of node i. This represents the model's predicted value. and Both directly correspond to "maliciousness assessment of encrypted session nodes": actual tag value For discrete binary values: if node i corresponds to a benign encrypted session, =0; if node i corresponds to a malicious encrypted session =1, this value is determined by manual annotation or verification in real attack scenarios; model prediction value. Continuous probability values: the range is [0,1]. The closer it is to 1, the higher the confidence level of the model in judging node i as a malicious encrypted session; The closer the value is to 0, the higher the confidence level of the model in classifying node i as a benign encrypted session. This value is calculated and output by the Encrypted Malicious Traffic Detection Model (HAN+MLP). The solution is tagged... Under the guidance of [unclear], the parameters of the encrypted malicious traffic detection method are implemented through Mini-Batch Gradient Descent (MBGD). The updates enable HAN and MLP to effectively focus on more relevant information to enrich the representation of encrypted session nodes and improve detection accuracy.

[0052] S204 detects traffic based on an encrypted malicious traffic detection model.

[0053] This embodiment can determine the malice of each encrypted session based on an encrypted malicious traffic detection model. Malicious traffic in this embodiment refers to abnormal behavior that attacks the network based on malicious content. Attacks based on malicious content aim to use secure channels built with encryption protocols to transmit malicious programs or instructions to infiltrate target machines. Attacks based on DDoS (Distributed Denial-of-Service) primarily initiate a large number of sessions by mimicking the statistical characteristics and behavioral patterns of normal traffic to overwhelm resources and ultimately disrupt the availability of the target machine. Attacks based on network topology aim to insert malicious nodes by altering the network topology to achieve malicious attacks.

[0054] It should be further explained that, based on any of the above embodiments, constructing a behavioral similarity graph based on sequence distance metrics, based on real traffic data and generated traffic samples, may include: determining the similarity between encrypted session record length sequences corresponding to traffic using the Fast Dynamic Time Warping (FastDTW) method and the Jaccard similarity coefficient method; and constructing a behavioral similarity graph based on sequence distance metrics based on the similarity between traffic sequences. This embodiment can use the Fast Dynamic Time Warping (FastDTW) algorithm to measure the similarity of bidirectional encrypted communication record length sequences, thereby constructing a behavioral similarity graph based on similarity using a KNN graph. Establishing a relationship This embodiment measures the similarity between two given time series based on the Jaccard similarity coefficient method (Jaccard distance) by dividing the difference between the union and intersection of the two sets by the size of the union. This embodiment also provides a specific method for constructing behavioral similarity maps, improving the accuracy of behavioral similarity map construction.

[0055] This invention proposes a method for detecting encrypted malicious traffic based on graph neural networks. The beneficial effects of this method can include: (1) Generating node representations and classifications using heterogeneous neural networks: Heterogeneous graph neural networks can handle different types of nodes (such as clients, servers, certificates) and edges (such as sessions, connections) in the network, thereby providing more refined feature representations, enabling the model to capture more potential features and improve the detection capability of encrypted malicious traffic. (2) Constructing multi-view observation sets: By observing and analyzing from different perspectives, and comprehensively considering different types of relationships and features in the network, the comprehensiveness and accuracy of detection are improved.

[0056] For easier understanding, please refer to Figure 5 , Figure 5 The system overall diagram provided for an embodiment of the present invention based on traffic sample generation and traffic detection may include: a traffic domain token generation module, a two-stage fine-tuning module, a scalable adaptation module based on effective parameter fine-tuning, a traffic sample preprocessing module, a behavior similarity graph construction module based on sequence distance metric, an object association graph construction module based on meta-path representation, an encrypted malicious traffic detection module based on graph neural network, and a system output module.

[0057] The traffic domain token generation module in this embodiment is used to perform the aforementioned feature extraction of traffic data under various network protocols using a word segmenter to obtain a structured symbol sequence; wherein, the word segmenter is a word segmenter that converts traffic data into a semantic token sequence. The two-stage fine-tuning module in this embodiment is used to perform the aforementioned fine-tuning of the basic large language model using a network security corpus to obtain an initial large language model; determine the traffic type labels corresponding to the structured symbol sequence; train the initial large language model based on the structured symbol sequence and its corresponding traffic type labels to obtain a target traffic sample generation model; and generate traffic samples based on the target traffic sample generation model. The traffic sample preprocessing module in this embodiment is used to perform a series of data cleaning tasks such as traffic splitting, traffic filtering, and traffic reassembly. The behavior similarity graph construction module based on sequence distance metric in this embodiment is used to perform the aforementioned determination of the similarity between encrypted session record length sequences corresponding to traffic using the fast dynamic time warping method and the Jaccard similarity coefficient method; and construct a behavior similarity graph based on sequence distance metric based on the similarity between traffic. The object association graph construction module based on meta-path representation in this embodiment is used to construct an object association graph based on meta-path representation based on real traffic data and generated traffic samples. The encrypted malicious traffic detection module based on graph neural networks in this embodiment is used to execute the construction of an encrypted malicious traffic detection model based on graph neural networks based on behavioral similarity graphs and object association graphs.

[0058] The flow sample generation device provided in the embodiments of the present invention will be described below. The flow sample generation device described below can be referred to in correspondence with the flow sample generation method described above.

[0059] Please refer to the details. Figure 6 , Figure 6 A schematic diagram of a flow sample generation device provided in an embodiment of the present invention may include: The structured symbol sequence generation module 100 is used to extract features from traffic data under various network protocols using a word segmenter to obtain a structured symbol sequence; wherein, the word segmenter is a word segmenter that converts traffic data into semantic token sequences; The first fine-tuning module 200 is used to fine-tune the basic large language model using a network security corpus to obtain an initial large language model; The second fine-tuning module 300 is used to determine the traffic type label corresponding to the structured symbol sequence, train the initial large language model based on the structured symbol sequence and its corresponding traffic type label to obtain the target traffic sample generation model, and generate traffic samples based on the target traffic sample generation model.

[0060] Furthermore, based on any of the above embodiments, the above-mentioned traffic sample generation device may further include: The target feature extraction module is used to extract features from the raw traffic data to obtain target features; wherein, the target features include statistical features, protocol features and context information; The vocabulary construction module is used to dynamically merge the byte sequences in the target features using an unsupervised word segmentation method to obtain a vocabulary. The word segmenter construction module is used to map the traffic data in the original traffic data to the words in the vocabulary to obtain the mapping relationship, and to construct the word segmenter based on the mapping relationship.

[0061] Furthermore, based on any of the above embodiments, the first fine-tuning module 200 may include: The first fine-tuning unit is used to fine-tune the basic large language model using natural language instructions based on the network security corpus, an adaptive moment estimation optimizer, and a cross-entropy loss function, to obtain the initial large language model.

[0062] Furthermore, based on any of the above embodiments, the above-mentioned traffic sample generation device may further include: The prompt word acquisition module is used to acquire traffic and generate prompt words; The traffic sample generation module is used to generate traffic samples based on the traffic generation prompt words and the target traffic sample generation model to obtain generated traffic samples. The traffic detection model training module is used to train the traffic detection model based on the generated traffic samples to obtain the target traffic detection model.

[0063] Furthermore, based on any of the above embodiments, the above-mentioned traffic sample generation device may further include: The sub-model partitioning module is used to divide the target traffic sample generation model into a preset number of sub-models for different tasks or traffic patterns. The target sub-model determination module is used to monitor traffic changes in the network environment in real time, identify new traffic types using machine learning technology, and determine the target sub-model corresponding to the new traffic type when the new traffic type is detected; wherein, the new traffic type is a traffic type that the current target traffic sample generation model cannot generate; The update module is used to incrementally update the target sub-model based on the traffic data corresponding to the new traffic type, so as to obtain the updated target traffic sample generation model.

[0064] It should be noted that the order of the modules and units in the above-mentioned traffic sample generation device can be changed without affecting the logic.

[0065] An embodiment of the present invention provides a traffic sample generation device, which may include: a structured symbol sequence generation module 100, used to extract features from traffic data under various network protocols using a word segmenter to obtain a structured symbol sequence; wherein the word segmenter is a word segmenter that converts traffic data into semantic token sequences; a first fine-tuning module 200, used to fine-tune a basic large language model using a network security corpus to obtain an initial large language model; and a second fine-tuning module 300, used to determine the traffic type label corresponding to the structured symbol sequence, train the initial large language model based on the structured symbol sequence and its corresponding traffic type label to obtain a target traffic sample generation model, and generate traffic samples based on the target traffic sample generation model. Compared to the current situation where the quality and variety of samples severely affect traffic detection capabilities, this application can map heterogeneous traffic data into token sequences, resolving the modal gap between natural language and traffic data, improving the understanding ability of large language models of traffic data, and fine-tuning the large language model based on two-stage fine-tuning to enhance the model's ability to understand instructions and learn specific traffic patterns. This enables the model to establish a deep understanding and reasoning ability in diverse traffic generation tasks, thereby improving the accuracy of traffic generation.

[0066] The flow detection device provided in the embodiments of the present invention will be described below. The flow detection device described below and the flow detection method described above can be referred to each other.

[0067] Please refer to the details. Figure 7 , Figure 7 A schematic diagram of a flow detection device provided in an embodiment of the present invention may include: The behavior similarity graph construction module 400 is used to construct a behavior similarity graph based on sequence distance metric based on real traffic data and generated traffic samples; wherein, the generated traffic samples are traffic obtained based on the target traffic sample generation model in the above-mentioned traffic sample generation method; The object association graph construction module 500 is used to construct an object association graph based on meta-path representation based on the real traffic data and the generated traffic samples; The encrypted malicious traffic detection model construction module 600 is used to construct an encrypted malicious traffic detection model based on a graph neural network based on the behavior similarity graph and the object association graph. The traffic detection module 700 is used to detect traffic based on the encrypted malicious traffic detection model.

[0068] Furthermore, based on any of the above embodiments, the behavior similarity graph construction module 400 may include: The similarity determination unit is used to determine the similarity between the encrypted session record length sequences corresponding to traffic using the fast dynamic time warping method and the Jaccard similarity coefficient method; A behavior similarity graph construction unit is used to construct the behavior similarity graph based on sequence distance metric based on the similarity between traffic flows.

[0069] It should be noted that the order of the modules and units in the above-mentioned flow detection device can be changed without affecting the logic.

[0070] This invention provides a traffic detection device, which may include: a behavior similarity graph construction module 400, used to construct a behavior similarity graph based on sequence distance metric based on real traffic data and generated traffic samples; wherein the generated traffic samples are traffic obtained based on the target traffic sample generation model in the above-mentioned traffic sample generation method; an object association graph construction module 500, used to construct an object association graph based on meta-path representation based on the real traffic data and the generated traffic samples; an encrypted malicious traffic detection model construction module 600, used to construct an encrypted malicious traffic detection model based on graph neural network based on the behavior similarity graph and the object association graph; and a traffic detection module 700, used to detect traffic based on the encrypted malicious traffic detection model. The technical solution provided by this invention can solve the technical problems of current encrypted malicious traffic detection methods, such as poor adaptability to adversarial attacks and dynamic network environments, insufficient robustness, and limitations of fixed graph structures, thereby improving the accuracy of traffic detection.

[0071] The following describes an electronic device provided by an embodiment of the present invention. The electronic device described below can be referred to in correspondence with the traffic sample generation method and traffic detection method described above.

[0072] Please refer to Figure 8 , Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present invention may include: Memory 10 is used to store computer programs; The processor 20 is used to execute computer programs to implement the above-mentioned traffic sample generation method and traffic detection method.

[0073] The memory 10, processor 20, and communication interface 30 all communicate with each other through the communication bus 40.

[0074] In this embodiment of the invention, the memory 10 is used to store one or more programs. The programs may include program code, which includes computer operation instructions. In this embodiment of the invention, the memory 10 may store programs for implementing the above-mentioned traffic sample generation method and traffic detection method.

[0075] In one possible implementation, the memory 10 may include a program storage area and a data storage area, wherein the program storage area may store the operating system and applications required for at least one function; and the data storage area may store data created during use.

[0076] Furthermore, memory 10 may include read-only memory and random access memory, providing instructions and data to the processor. A portion of the memory may also include NVRAM. The memory stores operating systems and operating instructions, executable modules, or data structures, or subsets thereof, or extended sets thereof, wherein the operating instructions may include various operating instructions for implementing various operations. The operating system may include various system programs for implementing various basic tasks and handling hardware-based tasks.

[0077] Processor 20 can be a central processing unit (CPU), an application-specific integrated circuit, a digital signal processor, a field-programmable gate array, or other programmable logic device. Processor 20 can be a microprocessor or any conventional processor. Processor 20 can call programs stored in memory 10.

[0078] The communication interface 30 can be an interface for the communication module, used to connect with other devices or systems.

[0079] Of course, it should be noted that, Figure 8 The structure shown does not constitute a limitation on the electronic device in the embodiments of the present invention. In practical applications, the electronic device may include more than Figure 8 More or fewer components as shown, or combinations of certain components.

[0080] The following describes the computer-readable storage medium provided in the embodiments of the present invention. The computer-readable storage medium described below can be referred to in correspondence with the traffic sample generation method and traffic detection method described above.

[0081] The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the above-described traffic sample generation method and traffic detection method.

[0082] The computer-readable storage medium may include various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0083] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0084] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0085] Finally, it should be noted that in this document, relationships such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0086] The present invention has provided a detailed description of a method for generating traffic samples, a method for detecting traffic, an apparatus, and a device. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method of generating a flow sample, the method comprising: The method comprises the following steps: characteristic extraction of traffic data under each network protocol is performed by using a word segmenter to obtain a structured symbol sequence; the word segmenter is a word segmenter for converting traffic data into a token sequence with semantics; a basic large language model is fine-tuned by using a network security corpus to obtain an initial large language model; a traffic type label corresponding to the structured symbol sequence is determined, and the initial large language model is trained based on the structured symbol sequence and the traffic type label corresponding thereto to obtain a target traffic sample generation model, so that a traffic sample is generated based on the target traffic sample generation model.

2. The flow sample generation method of claim 1, wherein, Before the characteristic extraction of traffic data under each network protocol by using the word segmenter to obtain the structured symbol sequence, the method further comprises the following steps: target features are extracted from original traffic data to obtain target features; the target features comprise statistical features, protocol features and context information; a dynamic merging of byte sequences in the target features is performed by using an unsupervised word segmentation method to obtain a vocabulary; traffic data in the original traffic data and words in the vocabulary are mapped to obtain a mapping relationship, and the word segmenter is constructed based on the mapping relationship.

3. The flow sample generation method of claim 1, wherein, The method of fine-tuning a basic large language model by using a network security corpus to obtain an initial large language model comprises the following steps: The natural language instruction of the basic large language model is fine-tuned by using the network security corpus based on an adaptive matrix estimator optimizer and a cross-entropy loss function to obtain the initial large language model.

4. The flow sample generation method of claim 1, wherein, After determining the traffic type label corresponding to the structured symbol sequence, training the initial large language model based on the structured symbol sequence and the traffic type label corresponding thereto to obtain the target traffic sample generation model, the method further comprises the following steps: a traffic generation prompt word is obtained; a traffic sample is generated based on the traffic generation prompt word by using the target traffic sample generation model to obtain a generated traffic sample; a target traffic detection model is obtained by training a traffic detection model based on the generated traffic sample.

5. The flow sample generation method of any one of claims 1 to 4, wherein, After determining the traffic type label corresponding to the structured symbol sequence, training the initial large language model based on the structured symbol sequence and the traffic type label corresponding thereto to obtain the target traffic sample generation model, the method further comprises the following steps: The target traffic sample generation model is divided into a preset number of sub-models for different tasks or traffic patterns; Real-time monitoring of traffic changes in a network environment is performed, and a new traffic type is identified by using machine learning technology; when the new traffic type is detected, a target sub-model corresponding to the new traffic type is determined; the new traffic type is a traffic type that cannot be generated by the current target traffic sample generation model; The target sub-model is incrementally updated based on traffic data corresponding to the new traffic type to obtain an updated target traffic sample generation model.

6. A method of flow detection, characterized by, The method comprises the following steps: a behavior similarity graph based on sequence distance measurement is constructed based on real traffic data and generated traffic samples; the generated traffic samples are obtained by the target traffic sample generation model in the traffic sample generation method according to any one of claims 1 to 5. Based on the real traffic data and the generated traffic samples, an object correlation graph based on a meta-path representation is constructed; Based on the behavior similarity graph and the object correlation graph, a graph neural network-based encrypted malicious traffic detection model is constructed; Based on the encrypted malicious traffic detection model, traffic is detected.

7. The flow detection method of claim 6, wherein, Based on real traffic data and generated traffic samples, a behavior similarity graph based on sequence distance measurement is constructed, including: The length of the sequence of encrypted session records corresponding to the traffic is determined using a fast dynamic time warping method and a Jaccard similarity coefficient method. Based on the similarity between the traffic, the behavior similarity graph based on sequence distance measurement is constructed.

8. A flow sample generation device, characterized by It includes: The structured symbol sequence generation module is used to extract features from the traffic data under each network protocol using a tokenizer to obtain a structured symbol sequence; wherein the tokenizer is a tokenizer that converts traffic data into a token sequence with semantics; The first fine-tuning module is used to fine-tune the base large language model using a network security corpus to obtain an initial large language model; The second fine-tuning module is used to determine the traffic type label corresponding to the structured symbol sequence, and train the initial large language model based on the structured symbol sequence and its corresponding traffic type label to obtain a target traffic sample generation model, so as to generate traffic samples based on the target traffic sample generation model.

9. An electronic device, comprising: It includes: Memory for storing computer programs; The processor is used to execute the computer program to realize the steps of the traffic sample generation method in any one of claims 1 to 5, and the steps of the traffic detection method in any one of claims 6 to 7.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed by the processor to realize the steps of the traffic sample generation method in any one of claims 1 to 5, and the steps of the traffic detection method in any one of claims 6 to 7.

Images