Malicious traffic detection method and system based on multi-view feature collaboration and correlation analysis

Abstract

The invention relates to the technical field of network security, in particular to a malicious traffic detection method and system based on multi-view feature collaboration and correlation analysis, in a pre-training stage, a model is trained by using large-scale unlabeled traffic data, and the method comprises the following steps: extracting behavior quantitative features and semantic category features from network traffic data, and performing combined input after processing; an adaptive classification vector is added at the beginning of the feature sequence, and global representation is generated through multi-head self-attention mechanism aggregation; randomly masking partial features, retaining attributes of the partial features, and prompting to reconstruct mask features according to unmasked features and attributes; using mean square error loss to optimize behavior feature reconstruction, and using cosine similarity loss to optimize semantic feature reconstruction; in the downstream task stage, a small amount of annotated data is used for finely adjusting the pre-training model, and the method comprises the steps of inputting final representation output by an encoder into a full-connection classifier, and finely adjusting model parameters to realize malicious traffic classification. According to the invention, high-precision and high-robustness detection of multiple types of malicious traffic is realized.

Description

Malicious Traffic Detection Method and System Based on Multi-View Feature Collaboration and Correlation Analysis Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for detecting malicious traffic based on multi-view feature collaboration and correlation analysis. Background Technology

[0002] With the rapid development of digital technology, Cyber-Physical Systems (CPS) have been widely applied in fields such as medical devices, intelligent transportation, and industrial automation. However, their security risks are also becoming increasingly prominent. Attackers are using vulnerable sensors, actuators, and control systems within CPS to launch a constant stream of new types of cyberattacks. Therefore, accurately and effectively identifying malicious attacks within CPS is crucial for ensuring the secure operation of the system.

[0003] Against this backdrop, anomaly detection based on traffic characteristics has become a key technology for building proactive defense systems. With recent advancements in deep learning technology, significant progress has been made in various identification and classification tasks, and this also applies to traffic detection. By utilizing statistical and sequence information of traffic through supervised or unsupervised methods, malicious traffic can be identified. While these methods have made some progress, they still face challenges in practical applications.

[0004] Supervised methods are widely used in traffic detection due to their high detection accuracy. However, these methods rely on a large amount of labeled data for training, while the number of malicious traffic samples in reality is extremely limited. Insufficient labeled samples make it difficult for the model to learn the characteristic patterns of attacks, resulting in poor detection accuracy. Traffic detection based on unsupervised methods typically identifies potential new threats by recognizing traffic features that deviate significantly from historical normal traffic patterns. However, these methods essentially focus on anomaly detection rather than directly identifying malicious traffic. In scenarios where normal and malicious traffic behaviors are highly similar, unsupervised methods struggle to distinguish the subtle differences between small sample attacks and normal traffic, misclassifying malicious traffic as normal, leading to a high false positive rate.

[0005] Furthermore, cross-scenario generalization capability is a common deficiency in existing traffic detection methods, as models typically exhibit strong dependence on specific data distributions and feature spaces. This leads to most models, after being trained on specific datasets, having parameters and feature extraction mechanisms highly adapted to the statistical characteristics of the source data. However, when deployed to other data scenarios, differences in network topology, protocol diversity, or evolving attack behaviors can cause significant shifts in data features, resulting in a sharp drop in model performance.

[0006] The above problems indicate that a stable and efficient encrypted traffic detection method should have two capabilities: (1) reducing dependence on labeled data; and (2) effectively dealing with data feature shifts under cross-scenario conditions. Summary of the Invention

[0007] Current supervision methods rely on large amounts of labeled data, which leads to a significant drop in detection performance when traffic data collection is difficult and labeled data is insufficient in CPS scenarios. Furthermore, they lack cross-scenario generalization ability, and the models are highly dependent on specific data distributions, resulting in performance degradation when deployed to other data scenarios. This invention proposes a malicious traffic detection method and system based on multi-view feature collaboration and correlation analysis, achieving high-precision and robust detection of multiple types of malicious traffic even in scenarios with limited labeled data and cross-scenario deployment.

[0008] To achieve the above objectives, the technical solution adopted is:

[0009] This invention proposes a malicious traffic detection method based on multi-view feature collaboration and correlation analysis, including a pre-training stage and a downstream task stage:

[0010] During the pre-training phase, the model is trained using large-scale unlabeled traffic data:

[0011] Step 1, Behavioral-Semantic Multi-View Feature Extraction: Extract behavioral quantification features and semantic category features from network traffic data respectively, and combine the two types of features after processing as input for adaptive feature embedding;

[0012] Step 2, Adaptive Feature Embedding: A learnable adaptive classification vector is added to the beginning of the combined feature sequence. The embedded features are then input into a Transformer encoder, which includes a multi-head self-attention mechanism and a feedforward neural network. The multi-head self-attention mechanism dynamically aggregates multi-view feature information to generate a global feature representation.

[0013] Step 3, Attribute-guided mask feature reconstruction: Randomly select some features for masking, retain the basic attributes of the masked features, and use the remaining unmasked features and the basic attributes of the masked features as prompts to guide the Transformer encoder to reconstruct the mask features;

[0014] Step 4, Mask Interaction Module Processing: For behavioral quantification features, mean squared error loss function is used for reconstruction optimization; for semantic category features, cosine similarity loss function is used for reconstruction optimization.

[0015] In the downstream task phase, the pre-trained model is fine-tuned using a small amount of labeled data:

[0016] Step 5, Classifier Deployment and Training: Input the final representation output by the Transformer encoder into the fully connected classifier, and fine-tune the model parameters using labeled data to achieve the classification and detection of malicious traffic.

[0017] According to the malicious traffic detection method based on multi-view feature collaboration and correlation analysis of the present invention, the behavioral quantification features include flow duration and flow rate, and the semantic category features include port number and protocol type.

[0018] According to the malicious traffic detection method based on multi-view feature collaboration and correlation analysis of the present invention, the processing of behavioral quantification features in step 1 further satisfies the following formula:

[0019] Feature(B′ j ) = W·(Pool(Emb(A j )))·Norm(Feature(B j ))

[0020] Among them, B j Represents the j-th original behavior quantification feature, Feature(B j ) represents the original value of the quantized feature of the j-th behavior, Norm represents the normalization operation, and A j Let represent the attribute of the quantized feature of the j-th behavior, Emb denote the embedding operation, Pool denote the pooling operation, and W denote the learnable weight matrix; Feature(B′ j ) represents the final embedding representation of the j-th behavior quantization feature;

[0021] According to the malicious traffic detection method based on multi-view feature collaboration and correlation analysis of the present invention, the processing of semantic category features in step 1 further satisfies the following formula:

[0022] Feature(S′ j =W·Pool(Concat(Emb(A)) j )),Emb(Feature(S j )))

[0023] Among them, S j Represents the j-th original semantic category feature, Feature(S) j A represents the original numerical value of the j-th semantic category feature. j The attribute representing the j-th semantic category feature is: Embed represents the embedding operation, Concat represents the concatenation operation, Pool represents the pooling operation, W represents the learnable weight matrix, and Feature(S′) represents the weight matrix. j ) represents the final embedding representation of the j-th semantic category feature.

[0024] According to the malicious traffic detection method based on multi-view feature collaboration and correlation analysis of the present invention, the masking rate of the masking process in step 3 is 30%-35%, and only the feature part is replaced with mask marker, while retaining the attribute encoding of the corresponding feature.

[0025] According to the malicious traffic detection method based on multi-view feature collaboration and correlation analysis of the present invention, in step 4, the mean squared error loss function is used to reconstruct and optimize the behavior quantification features to satisfy the following formula:

[0026]

[0027] in, M represents the reconstruction loss of the behavioral quantification features. b The set of mask locations representing the quantitative features of behavior. The predicted value for the behavioral quantitative characteristics. The true value of the behavioral quantitative feature.

[0028] According to the malicious traffic detection method based on multi-view feature collaboration and correlation analysis of the present invention, in step 4, the cosine similarity loss function is used to reconstruct and optimize the semantic category features to satisfy the following formula:

[0029]

[0030] in, M represents the reconstruction loss of semantic category features. s This represents the set of mask locations representing semantic category features. The prediction vector representing the semantic category features. The true vector representing the semantic category features.

[0031] According to the malicious traffic detection method based on multi-view feature collaboration and correlation analysis of the present invention, the total loss function in step 4 further satisfies the following formula:

[0032]

[0033] Where α and β are weighting coefficients, The reconstruction loss represents the quantified behavioral features. This represents the reconstruction loss of semantic category features.

[0034] According to the malicious traffic detection method based on multi-view feature collaboration and correlation analysis of the present invention, the learning process of the adaptive classification vector in the encoder in step 2 further includes:

[0035] 1) Map the adaptive classification vector to the query vector q CLS The adaptive classification vector and traffic features are mapped to a key vector K and a value vector V.

[0036] 2) Calculate the query vector q CLS With each key vector k i dot product similarity Where d k The dimension of the key vector;

[0037] 3) Perform exponential normalization on the similarity to generate an adaptive classification vector with attention weights α for each feature. CLS,i :

[0038]

[0039] 4) Based on the attention weight α CLS,i The weighted aggregated value vector V is used to generate the updated global feature representation;

[0040] 5) The adaptive classification vector is used as the query input for the self-attention mechanism in each layer of the encoder through multiple iterations, passively aggregating the contextual information of the entire feature sequence, and finally generating the final global feature representation for downstream classification tasks.

[0041] Furthermore, the present invention also provides a system for implementing the above-mentioned malicious traffic detection method based on multi-view feature collaboration and correlation analysis, comprising:

[0042] The multi-view feature extraction unit is used to extract behavioral quantification features and semantic category features from network traffic;

[0043] An adaptive feature embedding unit is used to introduce an adaptive classification vector and generate a global feature representation;

[0044] The masked feature reconstruction unit is used to mask and reconstruct features in order to learn the correlation between features;

[0045] Mask interaction unit, used to perform differential feature reconstruction and loss calculation;

[0046] The fine-tuning and classification unit is used to fine-tune the model and perform classification and detection in downstream tasks.

[0047] The beneficial effects achieved by adopting the above technical solution are:

[0048] This invention proposes a malicious traffic detection method—PCA-Net—based on multi-view feature collaboration and correlation analysis, achieving a performance breakthrough in encrypted traffic detection through innovative design. This method first extracts traffic features collaboratively from both behavioral quantification and semantic category dimensions, fully preserving the essential characteristics of traffic data and laying the foundation for accurate detection. Then, it introduces adaptive classification vectors and dynamically aggregates global feature information using a multi-head self-attention mechanism, generating a reliable representation highly adapted to the traffic detection task, significantly improving feature utilization efficiency. Simultaneously, it designs differentiated mask reconstruction strategies for the characteristics of the two types of features, deeply mining complex dependencies between features through an optimized combination of mean squared error loss and cosine similarity loss, enhancing the model's adaptability to feature perturbations. Experimental results show that PCA-Net not only achieves efficient identification of multiple types of encrypted malicious traffic but also significantly surpasses mainstream baseline methods in detection accuracy. Attached Figure Description

[0049] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings of the embodiments of the present invention will be briefly described below. The drawings are merely illustrative of some embodiments of the present invention and are not intended to limit the scope of the present invention to all embodiments.

[0050] Figure 1 is a framework diagram of the malicious traffic detection method based on multi-view feature collaboration and correlation analysis according to an embodiment of the present invention;

[0051] Figure 2 is a flowchart of behavior-semantic multi-view feature extraction according to an embodiment of the present invention;

[0052] Figure 3 is a heatmap showing the correlation between features in an embodiment of the present invention. Detailed Implementation

[0053] The exemplary solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Unless otherwise defined, the technical or scientific terms used in this invention should have the ordinary meaning understood by one of ordinary skill in the art.

[0054] This invention discloses a malicious traffic detection method based on multi-view feature collaboration and correlation analysis, named PCA-Net. This method can preserve the original features of the data while maintaining good performance on traffic outside the training data distribution. The key mathematical symbols used in this scheme are shown in the table below:

[0055]

[0056] This method includes a pre-training phase and a downstream task phase, as shown in Figure 1. The specific steps are as follows:

[0057] In the pre-training phase, a model (referring to the Transformer encoder) is pre-trained using large-scale unlabeled data to learn general feature representations of encrypted traffic data, thereby significantly reducing the need for labeled data. Simultaneously, pre-training enables the model to adapt to traffic distributions, effectively addressing the model's strong dependence on specific data distributions and ensuring stable performance across different data scenarios. The pre-training phase specifically includes steps S101-S104.

[0058] Step S101, Behavioral-Semantic Multi-View Feature Extraction: Behavioral quantification features and semantic category features are extracted from network traffic data, and the processed features are combined as input for adaptive feature embedding. The purpose of behavioral-semantic multi-view feature extraction is to transform the data stream into processable features.

[0059] Step S102, Adaptive Feature Embedding: A learnable adaptive classification vector is added to the beginning of the combined feature sequence. The embedded features are then input into a Transformer encoder, which includes a multi-head self-attention mechanism and a feedforward neural network. The multi-head self-attention mechanism dynamically aggregates multi-view feature information to generate a global feature representation.

[0060] Step S103, Attribute-guided mask feature reconstruction: Randomly select some features for masking, retain the basic attributes of the masked features, and use the remaining unmasked features and the basic attributes of the masked features as prompts to guide the Transformer encoder to reconstruct the mask features.

[0061] Step S104, Mask Interaction Module Processing: For behavioral quantification features, a mean squared error loss function is used for reconstruction optimization; for semantic category features, a cosine similarity loss function is used for reconstruction optimization. The embedded features are then reconstructed using attribute-guided mask features, enabling the model to learn representative features from both behavioral and semantic perspectives, and capturing potential correlation attributes between features in the mask interaction module.

[0062] In the downstream task phase, the pre-trained model is fine-tuned using a small amount of labeled data, including step S105:

[0063] Step S105, Classifier Deployment and Training: The final representation output by the Transformer encoder is input into a fully connected classifier. Labeled data is used to fine-tune the model parameters to achieve the classification and detection of malicious traffic. In this downstream task, the goal is to fine-tune the model to adapt to the current traffic and to detect malicious traffic through the classifier.

[0064] Algorithm 1 describes the process of training PCA-Net.

[0065]

[0066] The five steps mentioned above will be explained in detail below.

[0067] (1) Behavioral-semantic multi-view feature extraction

[0068] To learn representative features across multiple dimensions and thus differentiate traffic categories, this approach extracts features from both behavioral and semantic aspects of traffic. Specifically, traffic data can essentially be viewed as multimodal structured data; Liu et al., in FS-Net, mentioned that a data stream can be represented as several sequences with the same length and different types (e.g., message type sequences and packet length sequences). Data streams contain both behavioral quantification features (e.g., stream duration and rate) and semantic category features (e.g., port number and protocol type). For traffic, both of these features are crucial for identifying malicious behavior. DDoS attacks cause a surge in traffic over a period of time; therefore, the extraction and use of behavioral quantification features are critical. Furthermore, attacks launched using the same tools may exhibit similar semantics. For example, a brute-force attack on an RDP service launched using tools like Hydra will continuously send a large number of TCP connection requests to the target's port 3389 and attempt to enumerate different username and password combinations, leading to a significant increase in traffic to that specific port over a period of time. Therefore, semantic category features are also indispensable in the process of malicious traffic detection.

[0069] Different processing methods are adopted for the two different types of features. First, for behavioral quantification features, which are continuous features, using them directly without processing may cause the model to be overly sensitive to certain extreme values. The detailed processing procedure for behavioral quantification features is shown in Formula 1. First, for this type of feature B... j Normalization is performed to ensure a more balanced weight distribution for each feature in the model. Then, the attribute A of the feature is... j Embedding and pooling are performed to obtain a fixed-dimensional vector. The pooled vector is then multiplied with the normalized data, which can fully preserve the continuity of behavioral quantification features.

[0070] Feature(B′ j ) = W·(Pool(Emb(A j )))·Norm(Feature(B j )) (1)

[0071] Among them, B j Represents the j-th original behavior quantification feature, Feature(B j) represents the original value of the quantized feature of the j-th behavior (e.g., if B j If it is the flow rate, then Feature(B) j ) = 1500), Norm represents the normalization operation, A j Let represent the attribute of the quantized feature of the j-th behavior, Emb denote the embedding operation, Pool denotes the pooling operation, and W denotes the learnable weight matrix, which can map the processed features to a unified dimensional space. Feature(B′) j ) represents the final embedding representation of the j-th behavior quantization feature.

[0072] As shown in Figure 2, for semantic category features, there is no linear relationship between these features and behavioral quantification features, while their own semantics need to be fully preserved. For example, there is no quantifiable relationship between port numbers 443 and 80, and each port has its own real semantics. Therefore, it is unreasonable to adopt the same processing method as behavioral quantification features. The detailed processing process of semantic category features is shown in formula (2). First, feature S... j and attribute A j The two parts are embedded and then concatenated, providing the model with more accurate feature information and eliminating potential ambiguity. The concatenated features are then pooled and aligned to the same dimension space, resulting in fixed-dimensional vectors. This approach fully leverages the model's semantic modeling capabilities, enabling knowledge sharing between traffic data from different sources through a unified semantic embedding space.

[0073] Feature(S′ j =W·Pool(Concat(Emb(A)) j )),Emb(Feature(S j (2)

[0074] Among them, S j Represents the j-th original semantic category feature, Feature(S) j A represents the original numerical value of the j-th semantic category feature. j The attribute representing the j-th semantic category feature is: Embed represents the embedding operation, Concat represents the concatenation operation, Pool represents the pooling operation, W represents the learnable weight matrix, and Feature(S′) represents the weight matrix. j ) represents the final embedding representation of the j-th semantic category feature.

[0075] After the above processing, a large number of feature embeddings are obtained. These embeddings are combined and used as the original input for subsequent adaptive feature embedding.

[0076] (2) Adaptive feature embedding

[0077] Traffic detection tasks typically rely on the joint analysis of a large number of features, but simply concatenating all features may result in the loss of crucial details. Therefore, an adaptive classification vector, Classification Token, is introduced into adaptive feature embedding. This vector aims to dynamically aggregate information from all features through a multi-head self-attention mechanism, adjusting the attention given to different features to generate a unified global representation, thereby capturing the interaction relationships between different features.

[0078] An adaptive classification vector is added to the beginning of all feature representation sequences during the adaptive feature embedding stage. It acts as a global aggregator, updating its parameters as the training task progresses. During forward propagation, the adaptive classification vector is added to the beginning of the feature sequence. In subsequent multi-head self-attention mechanisms, information is continuously aggregated, interacting with all other features and optimizing its parameters through backpropagation of the loss function, ultimately learning a global representation suitable for the traffic detection task. The following sections describe feature correlation modeling and the learning of the adaptive classification vector.

[0079] ① Feature correlation modeling: In order to enable the model to capture the potential correlation between features, a multi-head self-attention mechanism based on the Transformer architecture is adopted. Its core is to learn the diverse correlation patterns between features in the input sequence from the subspace through multiple parallel attention heads.

[0080] The process of multi-head self-attention mechanism is as follows: For each feature location, the attention mechanism calculates the correlation weight between that feature and all other features; the input feature sequence is projected onto the query, key, and value spaces respectively, and the query vector Q... i =F i ·W q Key vector K i =F i ·W k Sum vector V i =F i ·W v The value of W q W k and W v These represent the learnable weights in the three spaces, respectively.

[0081]

[0082] Multihead(Q,K,V)=Concat(head1,head2,…,head n W (4)

[0083] Multi-head attention mechanisms provide the model with the ability to focus on information at different levels, enhancing its performance in learning potential correlations between features. The specific learning process is as follows: Each head... i =Attention Represents the attention values ​​for different heads, where Wi i Q , and The learnable parameters for each head are represented by , Concat represents the connection operation, and the outputs of all heads are fused through a linear transformation W to integrate the learned knowledge.

[0084] ② Learning the Adaptive Classification Vector: To dynamically aggregate information from all features and adjust the level of attention given to different features, a learnable adaptive classification vector is introduced, enabling it to learn a global representation suitable for the traffic detection task. The specific learning process of this vector in the encoder is as follows:

[0085] 1) Map the adaptive classification vector to the query vector q CLS The adaptive classification vector and traffic features are mapped to key vector K and value vector V.

[0086] 2) Calculate the query vector q in the form of a dot product. CLS Key vector k of each feature i Similarity between them:

[0087]

[0088] Where, k i Let q be the key vector of the i-th feature. CLS For adaptive classification vector query vector, d k is the dimension of the key vector.

[0089] 3) Perform exponential normalization on the similarity to generate an adaptive classification vector with attention weights α for each feature. CLS,i :

[0090] q is mapped through exponential mapping CLS The scaled dot product similarity with the key vector of the i-th feature is converted into a non-negative unnormalized score to ensure numerical stability (avoiding gradient explosion or vanishing caused by high-dimensional dot products) and also to give the similarity probabilistic interpretability; while E represents the summation of the exponential values ​​over all positions and participates in the subsequent process as a normalization factor.

[0091]

[0092] Where j represents the traversal index for summation, used to traverse all feature positions; ei Together with E, they generate the global weight α of the learnable vector Classification Token. CLS,i Therefore, the Classification Token can capture feature representations from a global perspective while ensuring the stability of gradients during the learning process, thereby enhancing the robustness of the system.

[0093] 4) Based on attention weight α CLS,i The weighted aggregated value vector V generates the updated global feature representation.

[0094] 5) The adaptive classification vector, through multiple iterations of the encoder, serves as the query input for the self-attention mechanism in each layer, passively aggregating the contextual information of the entire feature sequence to ultimately generate the final global feature representation for downstream classification tasks. Finally, after residual connections and normalization, the output of the multi-head self-attention mechanism is added to the original input, where c... l-1 This represents the output of the previous layer.

[0095] c l =LayerNorm(c l-1 +MultiHead(Q,K,V)) (9)

[0096] Through the dynamic attention weight allocation and multi-perspective feature modeling described above, the model can capture the complex dependencies hidden between features.

[0097] (3) Attribute-guided mask feature reconstruction

[0098] In the real world, traffic detection tasks often rely on manual analysis and labeling of raw network traffic, which is a highly inefficient process. Furthermore, manually designed features can cause models to overlook potential correlations between features, resulting in poor generalization ability. Therefore, attribute-guided mask feature reconstruction is used to address these issues.

[0099] In the current step, a certain proportion of features are randomly selected for each different source of traffic data. These features (unmasked adaptive classification vectors containing only traffic features) are masked, retaining only the basic attributes of these features. The other retained features and their own basic attributes are then used as prompts to guide the model to predict and reconstruct the masked content.

[0100] Inspired by the BERT model, a mask reconstruction approach is used for training in the field of traffic detection. However, traffic data lacks meaningful context, making reconstruction via location encoding meaningless. Therefore, feature attributes are preserved, and these attributes serve as cues instead of location encoding.

[0101] Simultaneously, the model will also learn from other retained features. If the reconstruction performs well, it can be concluded that the model has sufficiently learned the latent relationships between features. Then, in subsequent downstream tasks, the latent relationships learned by the model can serve as shareable knowledge and be used in classification tasks involving traffic data from other sources.

[0102] The third part of Figure 1 illustrates the mask reconstruction method. First, when the traffic data enters the mask reconstruction module after processing, 30%-35% (preferably 35%) of the traffic data is randomly selected. For this portion of data, only the corresponding attribute codes are retained; for the feature parts, the original features are replaced with mask tags. Then, the unmasked traffic data and the masked traffic data are input into the mask interaction module for learning.

[0103] (4) Mask interaction module processing

[0104] In this step, the feature matrix after partial masking is used as input to the current module, aiming to enable the model to successfully reconstruct the original features. The fourth section of Figure 1 details the module's specific functions; the following section describes the masking interaction module's different reconstruction targets for behavioral quantization features and semantic category features.

[0105] 1) Reconstruction of behavioral quantification features: Behavioral quantification features are continuous variables. In traffic detection, the accuracy of reconstructing these continuous features directly affects the model's ability to identify abnormal traffic. Therefore, the model needs to accurately match the true values ​​during reconstruction. Thus, the method for reconstructing behavioral quantification features is to calculate the mean squared error (MSE) loss and then compare it with the original feature values.

[0106]

[0107] in, M represents the reconstruction loss of the behavioral quantification features. b The set of mask locations representing the quantitative features of behavior. The predicted value for the behavioral quantitative characteristics. The true value is the quantified feature of the behavior. The MSE loss, by directly measuring the squared difference between the predicted and true values, can impose a higher penalty on cases where the predicted and true values ​​differ greatly, thereby forcing the model to pay more attention to the accurate reconstruction of key features.

[0108] Furthermore, in traffic detection, significant numerical changes in continuous features such as time intervals and traffic volume may indicate attack behavior, and the squared penalty of MSE forces the model to focus on such anomalies. These characteristics make MSE loss well-suited for the task of reconstructing behavioral quantification features; therefore, MSE loss is chosen as the loss function.

[0109] In the calculation formula (10), firstly, for each masked numerical position j∈M b Calculate the model's predicted values Compared with the true value The squared difference between them is then calculated by dividing by the total number of mask positions |M b Normalization is performed.

[0110] 2) Reconstruction of Semantic Category Features: Compared to behavioral quantification features, semantic category features typically exist in a discrete form, and there is no explicit sequential relationship between the data. Therefore, traditional distance metrics are not applicable, meaning that Euclidean distance cannot be used to measure the similarity between features. In traffic detection, directly using the original features will cause the model to fail to capture semantic relevance, reducing the accuracy of anomaly detection. The goal of semantic category feature reconstruction is to preserve semantic relevance by focusing on the consistency of vector directions, rather than pursuing precise numerical matching. Therefore, a cosine similarity loss method is chosen to be introduced during reconstruction.

[0111]

[0112] in, M represents the reconstruction loss of semantic category features. s This represents the set of mask locations representing semantic category features. The prediction vector representing the semantic category features. The true vector representing the semantic category features.

[0113] In the calculation formula (11), firstly, for each masked category position k∈M s Calculate the model prediction vector With the true vector The cosine similarity between them is then normalized by subtracting the average similarity.

[0114] 3) Total Loss Function: The losses of local features correspond to different optimization directions, thus failing to accurately guide the model in updating weights. Furthermore, gradient conflicts may exist between different tasks, leading to instability in the training process. Therefore, a total loss function is calculated here. In the total loss function, weight coefficients α and β are used to balance the influence of different feature losses, preventing any single loss from dominating the entire optimization process due to its excessive magnitude.

[0115]

[0116] in, The reconstruction loss represents the quantified behavioral features. The loss represents the reconstruction loss of semantic category features; α and β are weight coefficients, which have been verified and determined. β = 1.

[0117] The behavior quantization feature loss uses mean squared error, targeting normalized scalar predictions, making it a relatively "easy" task to optimize. Semantic category feature loss, on the other hand, uses cosine distance, measuring the directional consistency between high-dimensional semantic vectors. This requires the model to reconstruct complex semantic structures and relationships between features, making it a more challenging task. Furthermore, the learning signal provided by the semantic category loss is often more representative—it forces the model to understand the deeper semantics of the data, thus providing greater assistance to downstream tasks. Directly adding the two losses will quickly reduce the mean squared error, but this training dilutes the signal from the semantic category loss, causing the model to fall into shallow learning. Therefore, setting the weight of the behavior quantization loss to 0.5 intentionally weakens its influence, preventing its gradient from "drowning" the learning signal from the complex semantic category loss.

[0118] (5) Classifier Deployment and Training

[0119] In the model's classification task, the overall processing flow begins with the preprocessing of the input data. First, the embedding layer is responsible for converting the raw input traffic data to be classified into a vector form that the model can process. The goal of this stage is to transform the raw data into a vector representation of a uniform dimension, laying the foundation for subsequent feature modeling.

[0120] Then, the adaptive classification vector, Classification Token, is inserted at the beginning of the input sequence; the classification vector is loaded with weights through a pre-trained model, so that it can be associated with features at all positions in the multi-head self-attention mechanism, so that its final output vector can aggregate global information of the entire input sequence.

[0121] Subsequently, the encoder gradually extracts the complex dependencies between features through a multi-head self-attention mechanism and a feedforward neural network. After iterative processing by multiple encoders, the input features are abstracted into a multi-level semantic representation, which preserves local details while integrating the global structure.

[0122] Once the encoder outputs its data, the fully connected classifier uses the global features extracted by the encoder to make the final classification decision based on the adaptive classification vector. Specifically, the adaptive classification vector first undergoes a non-linear mapping through the first layer of the fully connected network, and then the output is converted into a probability distribution using the Softmax function.

[0123] Finally, the output layer selects the final category based on the classifier's probability distribution. The Softmax function converts the output layer's score into probability values, and then the argmax function selects the category with the highest probability as the prediction result.

[0124] Corresponding to the above method, embodiments of the present invention also disclose a malicious traffic detection system based on multi-view feature collaboration and correlation analysis, the system comprising:

[0125] The multi-view feature extraction unit is used to extract behavioral quantification features and semantic category features from network traffic;

[0126] An adaptive feature embedding unit is used to introduce an adaptive classification vector and generate a global feature representation;

[0127] The masked feature reconstruction unit is used to mask and reconstruct features in order to learn the correlation between features;

[0128] Mask interaction unit, used to perform differential feature reconstruction and loss calculation;

[0129] The fine-tuning and classification unit is used to fine-tune the model and perform classification and detection in downstream tasks.

[0130] To verify the effectiveness of this scheme, further explanations and illustrations are provided below based on experimental data.

[0131] (I) Experimental Setup

[0132] 1) Dataset: The experimental dataset is divided into two parts.

[0133] Pre-training datasets: For pre-training, four datasets were used: CSE-CIC-IDS2018, CIC-DDoS2019, CIC-UNSW-NB15, and Malicious_TLS. These four datasets provide the model with broad coverage of attack types and large-scale data support, thus ensuring the effectiveness of the model's pre-training. Table 1 summarizes the specific details of these datasets.

[0134] The CSE-CIC-IDS2018 dataset, released by the Canadian Cyber ​​Security Institute (CIC), is a benchmark dataset for intrusion detection systems. It includes various attack types (such as DoS, port scanning, U2R, R2L) and real network traffic. Its core advantage lies in its broad attack type coverage and simulation of real network environments, making it suitable for training general intrusion detection models. It is particularly adept at capturing hierarchical representations of traffic statistics (such as packet rate and protocol distribution) and attack patterns.

[0135] CIC-DDoS2019 focuses on DDoS attack detection tasks. This dataset provides high-precision traffic features (such as flow duration and window size) by simulating large-scale traffic attacks such as SYN Flood and UDP Flood, which can enhance the model's ability to identify protocol abuse and traffic surges.

[0136] The CIC-UNSW-NB15 dataset, a collaboration between the University of New South Wales (UNSW) and CIC, is notable for its comprehensive coverage of complex attack types and rich structured features. Generated using the IXIA PerfectStorm tool, the dataset provides 44 structured features (such as IP address, port, and protocol type), with a total data size of approximately 100GB. This dataset includes nine attack types, such as fuzzers, exploits, and APTs, enabling the training of models to identify covert attack behaviors and multi-stage attack patterns.

[0137] The Malicious_TLS dataset is specifically designed for detecting encrypted malicious traffic, containing both normal traffic and encrypted malicious traffic based on real-world network environments. This dataset covers 22 real-world scenarios of encrypted malicious traffic, encompassing active malicious traffic (such as ransomware and remote access trojans) from 2018 to 2021. All traffic is encrypted using the TLS protocol, simulating common encryption attack scenarios in modern networks. The dataset contains 130,716 traffic records, with a total size of 21.6 GB, and is suitable for researching algorithms for detecting encrypted malicious traffic under noise labels.

[0138] Table 1. Detailed information about the pre-trained dataset.

[0139]

[0140] Classification task datasets: The learning performance of the model was validated on the NSL-KDD and CIC-IDS2017 datasets.

[0141] The NSL-KDD dataset is a revised version of the KDDCup 99 dataset. It consists of four sub-datasets and includes various types of attacks such as DoS, probes, U2R, and R2L.

[0142] The CIC-IDS-2017 dataset, jointly released by the Canadian Cyber ​​Security Institute (CIC) and the Communications Security Agency (CSE), serves as a benchmark dataset for network intrusion detection systems, covering a variety of real-world network attack scenarios and normal traffic. This dataset includes 14 common attack types such as DoS, DDoS, FTP brute-force attacks, SSH brute-force attacks, Heartbleed attacks, web attacks, and penetration attacks, as well as normal user behavior traffic, aiming to simulate real-world network threat environments.

[0143] 2) Environment settings:

[0144] The experiments were based on the Transformer architecture, with the default Transformer layer count set to 3, attention heads to 8, hidden layer dimension to 128, and feedforward network dimension to 256. To avoid overfitting, a dropout rate of 0.15 was used in the attention and feedforward layers. For the two different learning stages of pre-training and fine-tuning, the learning rates were set to 3e-4 and 1e-4, respectively, the maximum training epochs were set to 500 and 200, respectively, and the early stopping tolerance value was set to 30. In the mask reconstruction process, the mask ratio is a key parameter; experiments verified that a mask ratio of 0.3 achieved optimal results in most tasks.

[0145] 3) Baseline: To verify the model's performance, an existing anomaly detection model was selected as the baseline:

[0146] KitNET is an ensemble model consisting of multiple autoencoders that distinguishes normal from abnormal network traffic online in an unsupervised manner. This model significantly improves detection efficiency and scalability by processing multiple feature subspaces in parallel.

[0147] DAGMM is an anomaly detection algorithm that combines a deep autoencoder with a Gaussian mixture model (GMM). It reduces the dimensionality and reconstructs the input data through an autoencoder and uses a GMM to probabilistically model the representation in the latent space, thereby jointly optimizing the reconstruction error and the likelihood probability of the samples, demonstrating superior performance in multiple anomaly detection tasks.

[0148] DiFF-RF is a semi-supervised ensemble learning model based on random partitioning trees. This model identifies anomalies by constructing multiple random binary trees and combining weighted distance with frequency ratio, exhibiting excellent performance in terms of computational complexity and parallelizability.

[0149] ET-Bert is a pre-trained model that learns a general traffic representation by constructing a transport bootstrapping structure. The model is designed with two innovative self-supervised pre-training tasks: Masked BURST Model and Same-origin BURST Prediction. It can effectively capture the byte-level and BURST-level contextual relationships in encrypted traffic, thus demonstrating excellent performance in traffic detection.

[0150] YaTC is a pre-trained model based on masked autoencoders. It captures hierarchical information of raw traffic data by designing a multi-level flow representation (MFR) matrix and introduces packet-level and flow-level attention mechanisms to achieve more efficient feature extraction and lower computational complexity, providing an efficient and accurate solution for traffic detection.

[0151] TrafficFormer is a traffic data pre-training model that incorporates fine-grained multi-classification tasks and randomized field initialization augmentation techniques. The model uses the SODF task to explicitly learn the source, direction, and flow relationships of traffic, and achieves data augmentation through randomized field initialization. It also demonstrates good performance in protocol understanding tasks.

[0152] FlowletFormer is a pre-trained model that employs a word-based segmentation strategy and innovatively introduces a protocol stack alignment embedding layer. By explicitly encoding protocol layer semantics and designing novel pre-training tasks, it effectively captures the hierarchical structure and protocol-specific behavior of network traffic, thereby achieving significant performance improvements in various network traffic classification tasks.

[0153] WE-AE DNN is a model that achieves feature representation sharing across networks by transferring the encoding layer weights of a pre-trained autoencoder to the fully connected hidden layers of a deep neural network. It can effectively alleviate the overfitting problem in high-dimensional network traffic data, thereby improving classification accuracy and accelerating model convergence in intrusion detection tasks.

[0154] WE-AE CNN is a model that uses pre-trained autoencoder weights to initialize the convolutional layers of a convolutional neural network to fully leverage the CNN's ability to capture local spatial features. It is specifically optimized for the temporal and spatial correlation of network traffic data, significantly enhancing the model's detection robustness and computational efficiency under complex attack modes.

[0155] (II) Comparison with other methods

[0156] To demonstrate that the method of this invention has the ability to transfer knowledge across different scenarios, different datasets were used for both the pre-training and test sets in the experiment. The specific datasets used are shown in Table 2:

[0157] Table 2 shows the pre-training and test sets used.

[0158]

[0159] Table 3 summarizes the detection performance metrics of PCA-Net and compares it with other baseline models on the NSL-KDD and CIC-IDS-2017 datasets.

[0160] Table 3 compares the performance (AUC) of PCA-Net with other baseline methods.

[0161]

[0162] The NSL-KDD dataset is characterized by an imbalanced attack type, with a scarcity of U2R and R2L attack samples, posing a challenge to detection models. KitNET's multi-autoencoder ensemble structure is prone to misclassifying U2R attacks (which have a limited number of samples) as normal traffic, resulting in a relatively low accuracy of 0.9283. The DAGMM model, employing an autoencoder and Gaussian mixture model structure, effectively captures data distribution but is dependent on reconstruction errors. Due to the limited features in the dataset, some attack samples may overlap with normal traffic features in the latent space, thus limiting model performance. DiFF-RF identifies anomalies through random partitioning trees and weighted distance, offering significant computational efficiency, but its sensitivity to high-dimensional features is insufficient, failing to fully capture the nonlinear relationships between features in the dataset, leading to limited generalization ability. In contrast, the method of this invention automatically adjusts the attention weights for different features based on the dataset characteristics, effectively capturing the potential correlations between features and thus exhibiting better performance.

[0163] In the CIC-IDS-2017 dataset, Monday's dataset consists entirely of benign network traffic, lacking attack samples, making it unreflective of the model's actual classification and detection capabilities. Therefore, it is meaningless in terms of classification performance. Testing was conducted on mixed network traffic (including benign traffic and attacks) from Tuesday to Friday. Overall, except for Thursday, the AUC values ​​on Tuesday, Wednesday, and Friday all reached above 0.97. However, on Thursday, the performance of all models dropped significantly, mainly due to the superposition of multiple types of attacks that day, making the traffic pattern more complex. This resulted in KitNET's performance dropping to 0.6220, and DAGMM to 0.7701. Several pre-training methods used in comparison maintained relatively high performance under these circumstances, indicating that pre-trained models are less affected by complex traffic patterns. Among them, the PCA-Net of this invention achieved an AUC value of 0.8530, demonstrating relatively excellent robust performance. PCA-Net performed best on Tuesday's dataset, reaching 0.9987. On Wednesday's dataset, the model of this invention achieved a detection accuracy of 0.9904. Considering the performance on several days of datasets, the average performance of the model in this invention reached 0.9602, demonstrating superior detection performance compared to other models. The experiments above show that the method of this invention has higher accuracy and stability in various attack scenarios. This advantage stems from PCA-Net's direct modeling of the inherent data distribution, enabling it to accurately capture the features of attack samples while effectively avoiding the negative impacts of feature redundancy and class imbalance on detection. Furthermore, the method proposed in this invention demonstrates its ability to transfer knowledge under scene switching conditions.

[0164] (III) Interactions between features

[0165] The current experiment was designed to demonstrate the ability of the method of this invention to identify potential relationships between features. In the analysis of correlations between features, the number of traffic samples directly affects the model's ability to capture interaction patterns. Different numbers of traffic samples may cause the model to fail to capture potential relationships between features. Therefore, the number of traffic samples was fixed at 10,000, while keeping other parameters constant.

[0166] The main objective of this experiment is to observe the dependencies between data features by visualizing the correlations between feature pairs in the interactive module. Figure 3 shows the correlation matrix between features calculated by the feature interactive module when trained on different datasets. Different colors in the figure represent different correlations between features, with darker colors indicating a higher potential dependency between two features. This experiment further demonstrates that PCA-Net can capture the complex dependencies implicit in features.

[0167] (iv) Robustness Testing

[0168] The current experimental objective is to demonstrate that the method of this invention possesses a certain degree of noise resistance; therefore, the robustness of PCA-Net is evaluated. Gaussian noise with a mean of 0 is used in the evaluation, and the specific formula is as follows:

[0169]

[0170] CIC-IDS-2017 was chosen as the robustness test dataset, and the test results are shown in Table 4. Firstly, it can be observed that an increase in the noise standard deviation reduces the model's detection performance. A larger noise standard deviation means stronger interference with the original data, thus leading to the experimental results. Simultaneously, it can be observed that when the noise standard deviation is less than 0.2, the impact on the system's detection performance is relatively small. The system performs well on the Wednesday dataset; even with a standard deviation of 0.5, the detection performance still reaches 0.9138. This is attributed to the feature reconstruction module in the system, which enables the system to accurately grasp the potential relationships between features. The system can determine data perturbations based on correlations and perform a certain degree of reconstruction. This also demonstrates that the method of this invention has a certain degree of noise resistance.

[0171] Table 4 shows the robustness test results of PCA-Net on the CIC-IDS-2017 dataset under different noise levels.

[0172]

[0173] (V) Ablation Test

[0174] In this experiment, ablation experiments were conducted on the designed modules to evaluate the actual performance of each module in the system by removing different modules. The ablation experiments were performed on the NSL-KDD dataset, and the experimental results are shown in Table 5.

[0175] Table 5. Performance Comparison of PCA-Net Ablation Experiments (NSL-KDD Dataset)

[0176]

[0177] Experimental results show that the performance of the complete PCA-Net reaches 0.9950. When the DPE module is removed, the performance drops to 0.9486. The DPE module is the system's multi-view feature module. The experimental results show a significant decrease in model accuracy. The fundamental reason is that the DPE module ensures that the system can learn the data representation system from multiple dimensions. Removing the current module will cause the system to lose this collaborative optimization mechanism of dual-dimensional features. This may cause behavioral features to be overly sensitive to abnormal traffic surges due to non-normalization, and semantic features to be misjudged due to lack of embedding and concatenation. It may also lead to the inability to effectively capture the interaction relationship between behavioral and semantic features.

[0178] Removing the Feature Reconstruction (FR) module further reduced performance to 0.8362. The FR module, the system's feature reconstruction module, uses an attribute-guided mask feature reconstruction mechanism to capture the potential correlation between behavioral quantification features and semantic category features in traffic data. Removing this module causes the system to lose its ability to capture such correlations. Without the accurate reconstruction provided by the FR module, the system directly uses the original features, which prevents it from identifying anomalies and significantly reduces its ability to detect attacks such as DDoS attacks. Furthermore, the FR module enhances the system's generalization ability across different traffic data sources by using the potential correlations captured by mask reconstruction as shareable knowledge. After removing the module, the system's performance on the test set dropped significantly. This drop is not only in the detection of known attack types but also in its adaptability to unknown attack types, as the system loses its ability to capture the potential correlations between features, resulting in a significant performance degradation.

[0179] The experiments above show that each module in the system is effective. Removing the DPE module causes the system to lose its collaborative mechanism of two-dimensional features, while the absence of the FR module causes the system to lose its ability to capture potential correlations between features. Considering the respective advantages of the DPE and FR modules, effectively combining the two is highly effective.

[0180] In summary, this invention proposes a malicious traffic detection method—PCA-Net—based on multi-view feature collaboration and correlation analysis. First, the system collaboratively processes traffic data from two dimensions: behavioral quantification features and semantic category features, effectively preserving the essential characteristics of the traffic. Then, an adaptive classification vector is introduced, and global information is dynamically aggregated through a multi-head self-attention mechanism, enabling the model to learn a representation highly adapted to the traffic detection task. Furthermore, differentiated mask reconstruction strategies are designed for different feature types to deeply explore the complex dependencies between features. The system's performance is evaluated on two datasets used for traffic detection. Experimental results show that the proposed method achieves effective detection of encrypted traffic, while demonstrating higher accuracy and generalization ability than baseline methods.

[0181] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A malicious traffic detection method based on multi-view feature collaboration and correlation analysis, characterized in that, The process includes a pre-training phase and a downstream task phase. The pre-training phase uses large-scale unlabeled traffic data to train the model: Step 1, Behavioral-Semantic Multi-View Feature Extraction: Behavioral quantization features and semantic category features are extracted from network traffic data, and the processed features are combined as input for adaptive feature embedding. Step 2, Adaptive Feature Embedding: A learnable adaptive classification vector is added to the beginning of the combined feature sequence. The embedded features are then input into a Transformer encoder, which includes a multi-head self-attention mechanism and a feedforward neural network. The multi-head self-attention mechanism dynamically aggregates multi-view feature information to generate a global feature representation. Step 3, Attribute-Guided Masking... Code Feature Reconstruction: Randomly select some features for masking, retaining the basic attributes of the masked features. Use the remaining unmasked features and the basic attributes of the masked features as prompts to guide the Transformer encoder to reconstruct the masked features; Step 4, Masking Interaction Module Processing: For behavioral quantization features, the mean squared error loss function is used for reconstruction optimization, and for semantic category features, the cosine similarity loss function is used for reconstruction optimization; In the downstream task stage, a small amount of labeled data is used to fine-tune the pre-trained model; Step 5, Classifier Deployment and Training: Input the final representation output by the Transformer encoder into the fully connected classifier, and use labeled data to fine-tune the model parameters to achieve the classification and detection of malicious traffic.

2. The malicious traffic detection method based on multi-view feature collaboration and correlation analysis according to claim 1, characterized in that, The behavioral quantification features include flow duration and flow rate, and the semantic category features include port number and protocol type.

3. The malicious traffic detection method based on multi-view feature collaboration and correlation analysis according to claim 1, characterized in that, The processing of behavioral quantification features in step 1 satisfies the following formula: Feature(B j ′)=W·(Pool(Emb(A j )))·Norm(Feature(B j ))in, B j Represents the j-th original behavior quantification feature, Feature(B j ) represents the original value of the quantized feature of the j-th behavior, Norm represents the normalization operation, and A j Let represent the attribute of the quantized feature of the j-th behavior, Emb denote the embedding operation, Pool denote the pooling operation, and W denote the learnable weight matrix; Feature(B j ′) represents the final embedding representation of the j-th behavior quantization feature.

4. The malicious traffic detection method based on multi-view feature collaboration and correlation analysis according to claim 1, characterized in that, The semantic category feature processing in step 1 satisfies the following formula: Feature(S j ′)=W·Pool(Concat(Emb(A j )),Emb(Feature(S j )))in, S j Represents the j-th original semantic category feature, Feature(S) j A represents the original numerical value of the j-th semantic category feature. j The attribute representing the j-th semantic category feature is: Embed represents the embedding operation, Concat represents the concatenation operation, Pool represents the pooling operation, W represents the learnable weight matrix, and Feature(S) represents the weight matrix. j ′) represents the final embedding representation of the j-th semantic category feature.

5. The malicious traffic detection method based on multi-view feature collaboration and correlation analysis according to claim 1, characterized in that, In step 3, the masking rate is 30%-35%, and only the feature parts are masked and replaced, while the attribute encoding of the corresponding features is preserved.

6. The malicious traffic detection method based on multi-view feature collaboration and correlation analysis according to claim 1, characterized in that, In step 4, the mean squared error loss function is used to reconstruct and optimize the behavioral quantification features, satisfying the following formula: in, M represents the reconstruction loss of the behavioral quantification features. b The set of mask locations representing the quantitative features of behavior. The predicted value for the behavioral quantitative characteristics. The true value of the behavioral quantitative feature.

7. The malicious traffic detection method based on multi-view feature collaboration and correlation analysis according to claim 6, characterized in that, In step 4, the cosine similarity loss function is used to reconstruct and optimize the semantic category features, satisfying the following formula: in, M represents the reconstruction loss of semantic category features. s This represents the set of mask locations representing semantic category features. The prediction vector representing semantic category features. The true vector representing the semantic category features.

8. The malicious traffic detection method based on multi-view feature collaboration and correlation analysis according to claim 7, characterized in that, The total loss function in step 4 satisfies the following formula: Where α and β are weighting coefficients, The reconstruction loss represents the quantified behavioral features. This represents the reconstruction loss of semantic category features.

9. The malicious traffic detection method based on multi-view feature collaboration and correlation analysis according to claim 1, characterized in that, The learning process of the adaptive classification vector in the encoder in step 2 includes: 1) mapping the adaptive classification vector to the query vector q. CLS 1) Map the adaptive classification vector and traffic features to a key vector K and a value vector V; 2) Calculate the query vector q CLS With each key vector k i dot product similarity Where d k 3) Perform exponential normalization on the similarity to generate an adaptive classification vector with attention weights α for each feature. CLS,i : 4) Based on the attention weight α CLS,i The weighted aggregated value vector V generates the updated global feature representation; 5) The adaptive classification vector, through the multi-layer iteration of the encoder, serves as the query input for the self-attention mechanism in each layer, passively aggregating the contextual information of the entire feature sequence, and finally generating the final global feature representation for downstream classification tasks.

10. A system for implementing the malicious traffic detection method based on multi-view feature collaboration and correlation analysis as described in any one of claims 1-9, characterized in that, include: The multi-view feature extraction unit is used to extract behavioral quantification features and semantic category features from network traffic; An adaptive feature embedding unit is used to introduce an adaptive classification vector and generate a global feature representation; mask The feature reconstruction unit is used to mask and reconstruct features in order to learn the relationships between features; The masking interaction unit is used to perform differentiated feature reconstruction and loss calculation; the fine-tuning and classification unit is used to fine-tune the model and perform classification and detection in downstream tasks.

Images