Security detection method and device for network flow data
By performing feature extraction, sliding window processing, and hash calculation on network traffic data, the problem of low detection accuracy and efficiency in existing technologies has been solved, achieving efficient and accurate network security detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- LIAONING MOBILE COMM
- Filing Date
- 2026-01-20
- Publication Date
- 2026-05-01
AI Technical Summary
Existing network security detection methods suffer from low detection accuracy and low efficiency.
By extracting multiple preset network features from network traffic data packets, dividing the data using a sliding window, performing matrix representation and approximate ratio test value distribution, combining hash functions and bit operations to identify abnormal data, and using feature importance ranking and mode decomposition algorithms to optimize feature selection, the detection accuracy and efficiency are improved.
It improves the accuracy and efficiency of network traffic data detection, effectively identifies attack data, and reduces the false alarm rate.
Smart Images
Figure CN121966980A_ABST
Abstract
Description
A method and apparatus for secure detection of network traffic data Technical Field
[0001] This application relates to the field of network security technology, and in particular to a method and apparatus for secure detection of network traffic data. Background Technology
[0002] With the development of internet technology and the continuous improvement of social informatization, the network has gradually become an indispensable part of people's production and life. The importance of network security has received increasing attention, and various security products have been applied to the network to strengthen and maintain its secure operation.
[0003] Existing security testing methods generally suffer from low detection accuracy and low efficiency. Summary of the Invention
[0004] In view of this, this application provides a method and apparatus for security detection of network traffic data to solve the above-mentioned technical problems.
[0005] In a first aspect, embodiments of this application provide a method for security detection of network traffic data, comprising: extracting multiple preset network features from each traffic data packet in a target time period to obtain multiple evolution data; dividing the multiple evolution data in the target time period into multiple windows of data to be detected using a sliding window; processing the data to be detected in each window to obtain a matrix representation of the data to be detected; determining an approximate ratio test value distribution based on the matrix representation of the data to be detected; determining a threshold value based on the approximate ratio test value distribution and a preset false alarm probability; determining whether the data to be detected is greater than the threshold value, and if so, determining that the data to be detected is abnormal data; processing the abnormal data using a hash function and bitwise operations, and determining whether the abnormal data is attack data based on the processing result.
[0006] In one possible implementation, the plurality of preset network features include: IP layer outbound traffic bandwidth IP_OUTBPS, IP layer inbound traffic bandwidth IP_INBPS, TCP layer outbound traffic bandwidth TCP_OUTBPS, TCP layer inbound traffic bandwidth TCP_INBPS, forced disconnection by the peer node via RST packet RST_FROM_PEERS, sending a synchronization request SYN_TO_PEERS to the peer node, broadcasting / unicasting messages to the peer node using the UDP protocol UDP_TO_PEERS, the number of packets per TCP stream PKTS_PER_TCPFLOW, forced disconnection by the peer node via TCP packet TCP_FROM_PEERS, and broadcasting / unicasting messages to the peer node using RST packet RST_TO_PEERS.
[0007] In one possible implementation, the method further includes: constructing a first training set comprising multiple traffic data samples; extracting multiple network features from each traffic data sample; cleaning multiple traffic data packets using the network features of the multiple traffic data samples to obtain a second training set; determining the importance of each feature based on the network features of the multiple traffic data packets in the second training set using the BIC information criterion and the LightGBM model; sorting the multiple network features in descending order using the importance to obtain a feature sequence; and selecting the top 10 network features from the feature sequence as multiple preset features.
[0008] In one possible implementation, the data to be detected in a window is processed to obtain a matrix representation of the data; this includes: setting the data to be detected in a window to include N evolutionary data: ; Perform mode decomposition on each evolutionary data to obtain a vector representation of each evolutionary data; Based on the vector representation of each evolutionary data, construct a matrix X of the data to be detected for a window.
[0009] In one possible implementation, mode decomposition is performed on each evolutionary data point to obtain a vector representation of each evolutionary data point; this includes: adding K noise components to the evolutionary data point respectively. In the process, K signals are obtained. : ; For the first One noise component; calculate the first margin signal. :
[0010] Among them, the operator M ( () represents the local mean of the signal; Indicates taking the mean; calculates the first-order modal components. :
[0011] Calculate the j-th residual signal :
[0012] Calculate the j-th modal component :
[0013] in, ; The number of channels; each evolutionary data is represented as A combination of modal components.
[0014] In one possible implementation, the distribution of the approximate ratio test value is determined based on the matrix representation of the data to be detected; a threshold value is determined based on the distribution of the approximate ratio test value and a preset false alarm probability; including: based on the null hypothesis. Calculate the matrix of the data to be detected. transpose matrix The first covariance matrix Based on alternative assumptions Calculate the matrix of the data to be detected. transpose matrix The second covariance matrix Based on the first covariance matrix Second covariance matrix Determine the approximate ratio test value distribution of the evolutionary samples under the binary hypothesis. :
[0015] in, A function to calculate the determinant of a matrix; This is an approximate ratio; based on the preset false alarm probability. Through the formula Solve for the door limit value .
[0016] In one possible implementation, hash function calculations and bitwise operations are used to process the abnormal data, and the abnormal data is determined to be attack data based on the processing results. This includes: Step S1: Extracting M valid data fields from the abnormal data: Step S2: Set the initial value of m to 1; Step S3: Perform hash function calculation and bitwise operations on the m-th field to be detected to obtain g detection results; Step S4: Determine whether the values at the corresponding positions of the g detection results in the bit array are all 1. If not, proceed to step S5; otherwise, proceed to step S6; Step S5: Determine whether m is less than M. If yes, update m to m+1 and proceed to step S3; otherwise, proceed to step S7; Step S6: Determine whether the abnormal data is attack data; Step S7: Determine whether the abnormal data is normal behavior data.
[0017] Secondly, embodiments of this application provide a security detection device for network traffic data, comprising: an extraction unit for extracting multiple preset network features of each traffic data packet in a target time period to obtain evolved data; a division unit for dividing the multiple evolved data in the target time period into multiple windows of data to be detected using a sliding window; a processing unit for processing the data to be detected in each window to obtain a matrix representation of the data to be detected; a first determination unit for determining an approximate ratio test value distribution based on the matrix representation of the data to be detected; and determining a threshold value based on the approximate ratio test value distribution and a preset false alarm probability; a second determination unit for determining whether the data to be detected is greater than the threshold value, and if so, determining that the data to be detected is abnormal data; and a detection unit for processing the abnormal data using a hash function calculation and bitwise operations, and determining whether the abnormal data is attack data based on the processing result.
[0018] Thirdly, embodiments of this application provide an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method of embodiments of this application.
[0019] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer instructions that, when executed by a processor, implement the methods of embodiments of this application.
[0020] Fifthly, embodiments of this application provide a computer program product, including a computer program / instructions, which, when executed by a processor, implement the method of embodiments of this application.
[0021] This application improves the efficiency and accuracy of network traffic data detection. Attached Figure Description
[0022] To more clearly illustrate the technical solutions in the specific embodiments of this application or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.
[0023] Figure 1 is a flowchart of the network traffic data security detection provided in the embodiment of this application; Figure 2 is a functional structure diagram of the network traffic data security detection device provided in the embodiment of this application; Figure 3 is a structural diagram of the electronic device provided in the embodiment of this application. Detailed Implementation
[0024] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.
[0025] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.
[0026] The technical solutions provided in the embodiments of this application will be described below.
[0027] As shown in Figure 1, this application embodiment provides a security detection method for network traffic data, including: Step 101: Extracting multiple preset network features from each traffic data packet in the target time period to obtain multiple evolution data; Step 102: Dividing the multiple evolution data in the target time period into multiple windows of data to be detected using a sliding window; Step 103: Processing the data to be detected in each window to obtain a matrix representation of the data to be detected; Step 104: Determining the approximate ratio test value distribution based on the matrix representation of the data to be detected; determining a threshold value based on the approximate ratio test value distribution and a preset false alarm probability; Step 105: Determining whether the data to be detected is greater than the threshold value; if so, determining that the data to be detected is abnormal data; Step 106: Processing the abnormal data using a hash function and bitwise operations, and determining whether the abnormal data is attack data based on the processing result.
[0028] This embodiment improves the detection efficiency and accuracy of network traffic data.
[0029] In some embodiments, the plurality of preset network features include: IP layer outbound traffic bandwidth IP_OUTBPS, IP layer inbound traffic bandwidth IP_INBPS, TCP layer outbound traffic bandwidth TCP_OUTBPS, TCP layer inbound traffic bandwidth TCP_INBPS, forced disconnection by the peer node via RST packet RST_FROM_PEERS, sending a synchronization request SYN_TO_PEERS to the peer node, broadcasting / unicasting messages to the peer node using the UDP protocol UDP_TO_PEERS, the number of packets per TCP stream PKTS_PER_TCPFLOW, forced disconnection by the peer node via TCP packet TCP_FROM_PEERS, and broadcasting / unicasting messages to the peer node using RST packet RST_TO_PEERS.
[0030] In some embodiments, the method further includes: constructing a first training set comprising multiple traffic data samples; extracting multiple network features from each traffic data sample; cleaning multiple traffic data packets using the network features of the multiple traffic data samples to obtain a second training set; determining the importance of each feature based on the network features of the multiple traffic data packets in the second training set using the BIC information criterion and the LightGBM model; sorting the multiple network features in descending order using the importance to obtain a feature sequence; and selecting the top 10 network features from the feature sequence as multiple preset features.
[0031] This embodiment selects a certain number of features with high feature importance values based on their relative importance values. This effectively achieves the purpose of feature ranking and dimensionality reduction, thereby improving the applicability and accuracy of subsequent data processing and effectively alleviating feature redundancy.
[0032] Specifically, based on the network features of multiple traffic packets in the second training set, the importance of each feature is determined using the BIC information criterion and the LightGBM model, including: constructing an initialization model and initializing a feature subset with feature index dimension n. The coefficient is either 0 or 1, where 0 represents the feature not appearing and 1 represents its appearance.
[0033] For random sampling, a sampling criterion is established. The penalty term introduced by the BIC information criterion considers the sample size H, which can effectively solve the problem of high model complexity caused by excessively high model accuracy when the sample size is too large. Therefore, using the BIC information criterion, a LightGBM model is established to construct the conditional transition probabilities of the Markov chain, i.e.,
[0034]
[0035] Where H is the number of samples, p is the number of parameters in the model, B is the likelihood function, and the penalty term is... Taking dimensionality into account, when the sample size is small and the dimensionality is too high, the problem of the curse of dimensionality can be addressed first. Let represent the conditional transition probability of the i-th feature. This represents all features other than the i-th feature, based on the initialized feature subset. Each feature dimension is sampled using sampling criteria.
[0036] The number of samples, H, is determined, as it determines the computational complexity of the algorithm. Using the sample size H reduces model complexity. To ensure the error between the sampled approximation and the true value of the objective function is within an acceptable range, and to guarantee the significance of the feature indicators, the standard deviation formula of Monte Carlo is used, employing a 2x criterion to control the simulation error within 5%.
[0037] We can calculate that H is not less than 400, which means that when the sample size H is greater than or equal to 400, the significance of the feature index can be guaranteed.
[0038] By sampling at least 400 data samples using Gibbs Sampling, and analyzing these H data points, the frequency of each feature is used as the feature importance, i.e., feature importance =
[0039] A feature importance value close to 0 indicates that the feature is not important, while a feature importance value closer to 1 indicates that the corresponding feature is more important.
[0040] In some embodiments, the detection data of a window is processed to obtain a matrix representation of the detection data; including: setting the detection data of a window to include N evolutionary data: ; Perform mode decomposition on each evolutionary data to obtain a vector representation of each evolutionary data; Based on the vector representation of each evolutionary data, construct a matrix X of the data to be detected for a window.
[0041] The detection of evolutionary data requires analysis of its temporal correlation based on its context. Therefore, in this embodiment, evolutionary data is selected for detection by moving the detection window. Each sliding window corresponds to one detection process, and the number N of evolutionary data in the window depends on the window size and the sliding step size.
[0042] In some embodiments, mode decomposition is performed on each evolutionary data to obtain a vector representation of each evolutionary data; this includes: adding K noise components to the evolutionary data respectively. In the process, K signals are obtained. : ; For the first One noise component; calculate the first margin signal. :
[0043] Wherein, the operator M is defined ( () represents the local mean of the signal; Indicates taking the mean; calculates the first-order modal components. :
[0044] Calculate the j-th residual signal :
[0045] Calculate the j-th modal component :
[0046] in, ; The number of channels; each evolutionary data is represented as A combination of modal components.
[0047] This embodiment employs an improved mode decomposition algorithm to decompose data into high- and low-frequency mode components. It uses local mean values to replace mode estimation, avoiding the influence of high-frequency noise on the mode components and improving the mode aliasing phenomenon in traditional mode decomposition methods.
[0048] In some embodiments, the distribution of approximation ratio test values is determined based on the matrix representation of the data to be detected; a threshold value is determined based on the distribution of approximation ratio test values and a preset false alarm probability; including: based on the null hypothesis. Calculate the matrix of the data to be detected. transpose matrix The first covariance matrix Based on alternative assumptions Calculate the matrix of the data to be detected. transpose matrix The second covariance matrix Based on the first covariance matrix Second covariance matrix Determine the approximate ratio test value distribution of the evolutionary samples under the binary hypothesis. :
[0049] in, A function to calculate the determinant of a matrix; This is an approximate ratio; based on the preset false alarm probability. , through Solve for the door limit value .
[0050] This embodiment uses the Generalized Likelihood Ratio Test (GLRT) to classify the detection problem into two hypotheses: the null hypothesis and the zero hypothesis. (Representing only normal traffic) and alternative assumptions (Indicating abnormal traffic), network data characteristics are detected as an evolution signal; in order to make GLRT value calculation more accurate and faster, the number of channels is balanced to control the input of GLRT, and the low-frequency small components after decomposition are processed to reduce the dimensionality of the input signal.
[0051] In some embodiments, hash function calculation and bitwise operations are used to process abnormal data, and the abnormal data is determined to be attack data based on the processing result, including: Step S1: Extracting M valid data fields from the abnormal data: For example, valid data fields include: Function Code, Address, Setpoint, Pump, Relief Value, etc. Step S2: Set the initial value of m to 1; Step S3: Perform hash function calculation and bit operation on the m-th field to be detected to obtain g detection results; Step S4: Determine whether the values at the corresponding positions of the g detection results in the bit array are all 1. If not, proceed to step S5; otherwise, proceed to step S6; Step S5: Determine whether m is less than M. If yes, update m to m+1 and proceed to step S3; otherwise, proceed to step S7; Step S6: Determine whether the abnormal data is attack data; Step S7: Determine whether the abnormal data is normal behavior data.
[0052] This embodiment improves the filter by using a single hash operation and multiple bitwise operations instead of multiple hash operations, which can increase the detection speed.
[0053] The technical solution of this application will be described in detail below with reference to a specific example.
[0054] The CICIDS2017 dataset is a network behavior dataset that includes normal traffic and the latest common attack behaviors. The dataset is collected through ports. The CICIDS2017 dataset is divided into 5 parts, and each part contains different forms of attacks: (1) The first day is normal activity and does not contain any attack behaviors; (2) The second day is FTP brute-force attack from 9:30 to 10:20 am and SSH brute-force attack from 2:00 to 3:00 pm. The attacker's IP attacks a victim's IP through a firewall and a router; (3) The third day begins DOS / DDoS attacks, which are carried out in four different time periods. The attacker's IP attacks four different IP addresses through a host; (4) The fourth day is brute-force attack and web attack. The attacker's IP attacks XSS injection and SQL injection attacks are carried out in three different time periods. The attacker's IP attacks two different IPs through a host. In the afternoon, the attacker's IP attacks Mac users and Windows users are attacked in different forms; (5) The fifth day is botnet attack, port scanning attack and DDoS attack.
[0055] The first set of experiments evaluated the detection time efficiency based on the number of detections. In the experiments, the number of detections, q, was set to 400, and the number of bit operations was set to 14. The number of detections was then progressively increased by a factor of 10 from 102 to 105. The experimental results show that the detection speed was the fastest, and the difference increased with the number of detections. The second set of experiments evaluated the algorithm's detection time efficiency based on the number of features in the intrusion feature database. In this set of experiments, the detection time was almost unaffected by the number of intrusion features. The number of intrusion features was set to 104, and then progressively increased. The experimental results show that the method in this embodiment has a short detection time and high efficiency.
[0056] Based on the same inventive concept, this application provides a network traffic data security detection device. Referring to Figure 2, the network traffic data security detection device 200 provided in this application includes at least: an extraction unit 201, used to extract multiple preset network features of each traffic data packet in a target time period to obtain evolved data; a division unit 202, used to divide the multiple evolved data in the target time period into multiple windows of data to be detected using a sliding window; a processing unit 203, used to process the data to be detected in each window to obtain a matrix representation of the data to be detected; a first determination unit 204, used to determine the approximate ratio test value distribution based on the matrix representation of the data to be detected; and to determine a threshold value based on the approximate ratio test value distribution and a preset false alarm probability; a second determination unit 205, used to determine whether the data to be detected is greater than the threshold value, and if so, to determine that the data to be detected is abnormal data; and a detection unit 206, used to process the abnormal data using hash function calculation and bit operations, and to determine whether the abnormal data is attack data based on the processing result.
[0057] It should be noted that the principle of the network traffic data security detection device 200 provided in this application embodiment to solve the technical problem is similar to the method provided in this application embodiment. Therefore, the implementation of the network traffic data security detection device 200 provided in this application embodiment can refer to the implementation of the method provided in this application embodiment, and the repeated parts will not be described again.
[0058] Based on the same inventive concept, this application also provides an electronic device, as shown in FIG3, including: a memory and a processor, wherein the memory stores an executable program, and the processor executes the executable program to implement the steps of the network traffic data security detection method provided in the above embodiments.
[0059] The aforementioned processor can be a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The aforementioned PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. The general-purpose processor can be a microprocessor or any conventional processor, etc.
[0060] Since the electronic device described in this application embodiment is an electronic device equipped with a memory that implements the data flow behavior identification method based on multi-source logs disclosed in this application embodiment, those skilled in the art can understand the structure and variations of the electronic device described in this application embodiment based on the data flow behavior identification method based on multi-source logs disclosed in this application embodiment, and therefore will not be described again here.
[0061] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the network traffic data security detection method provided in the above embodiments.
[0062] The storage medium in this embodiment may be included in an electronic device; or it may exist independently and not be assembled into an electronic device. The storage medium carries one or more computer programs, which, when executed, implement the steps of the network traffic data security detection method provided in the above embodiment.
[0063] It should be understood that the various solutions in this embodiment have the same technical effects as those in the above method embodiments, and will not be repeated here.
[0064] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. Optionally, specific examples in this embodiment can refer to the examples described in any embodiment of this application, which will not be repeated here. Obviously, those skilled in the art should understand that the various modules or steps of this application described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those presented here, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, this application is not limited to any particular hardware and software combination.
[0065] This application also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the network traffic data security detection method provided in the above embodiments.
[0066] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions targeted in the blocks may occur in a different order than those targeted in the drawings. For example, two consecutively represented blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.
[0067] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. Multitasking and parallel processing may be advantageous in certain environments. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this application. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.
Claims
1. A method for securely detecting network traffic data, characterized in that, include: Multiple preset network features are extracted from each traffic data packet in the target time period to obtain multiple evolution data; The sliding window method is used to divide the multiple evolution data of the target time period into multiple windows of data to be detected; The data to be detected in each window is processed to obtain a matrix representation of the data to be detected; the distribution of approximate ratio test values is determined based on the matrix representation of the data to be detected; a threshold value is determined based on the distribution of approximate ratio test values and a preset false alarm probability; it is determined whether the data to be detected is greater than the threshold value, and if so, the data to be detected is determined to be abnormal data; the abnormal data is processed using hash function calculation and bit operations, and the abnormal data is determined to be attack data based on the processing result.
2. The method according to claim 1, characterized in that, The preset network characteristics include: IP layer outbound traffic bandwidth IP_OUTBPS, IP layer inbound traffic bandwidth IP_INBPS, TCP layer outbound traffic bandwidth TCP_OUTBPS, TCP layer inbound traffic bandwidth TCP_INBPS, forced disconnection by the peer node via RST packet RST_FROM_PEERS, sending a synchronization request to the peer node SYN_TO_PEERS, broadcasting / unicasting messages to the peer node using the UDP protocol UDP_TO_PEERS, the number of packets per TCP stream PKTS_PER_TCPFLOW, forced disconnection by the peer node via TCP packet TCP_FROM_PEERS, and broadcasting / unicasting messages to the peer node using RST packet RST_TO_PEERS.
3. The method according to claim 2, characterized in that, The method further includes: constructing a first training set comprising multiple traffic data samples; extracting multiple network features from each traffic data sample; cleaning multiple traffic data packets using the network features of the multiple traffic data samples to obtain a second training set; determining the importance of each feature based on the network features of the multiple traffic data packets in the second training set using the BIC information criterion and the LightGBM model; sorting the multiple network features in descending order using the importance to obtain a feature sequence; and selecting the top 10 network features from the feature sequence as multiple preset features.
4. The method according to claim 1, characterized in that, The detection data of a window is processed to obtain a matrix representation of the detection data; this includes: setting the detection data of a window to include N evolutionary data: ; Perform mode decomposition on each evolutionary data to obtain a vector representation of each evolutionary data; Based on the vector representation of each evolutionary data, construct a matrix X of the data to be detected for a window.
5. The method according to claim 4, characterized in that, Modal decomposition is performed on each evolutionary data point to obtain a vector representation of each data point; this includes adding K noise components to the evolutionary data. In the process, K signals are obtained. ： ； For the first One noise component; calculate the first margin signal. ： Among them, the operator M ( () represents the local mean of the signal; This indicates taking the mean; calculating the first-order modal components. ： Calculate the j-th residual signal ： Calculate the j-th modal component ： in, ； The number of channels; each evolutionary data is represented as A combination of modal components.
6. The method according to claim 4, characterized in that, The distribution of the approximation ratio test value is determined based on the matrix representation of the data to be detected; the threshold value is determined based on the distribution of the approximation ratio test value and the preset false alarm probability; including: based on the null hypothesis. Calculate the matrix of the data to be detected. transpose matrix The first covariance matrix Based on alternative assumptions Calculate the matrix of the data to be detected. transpose matrix The second covariance matrix Based on the first covariance matrix Second covariance matrix Determine the approximate ratio test value distribution of the evolutionary samples under the binary hypothesis. : in, A function to calculate the determinant of a matrix; This is an approximate ratio; based on the preset false alarm probability. Through the formula Solve for the door limit value 。 7. The method according to claim 1, characterized in that, The abnormal data is processed using hash functions and bitwise operations. The result is used to determine whether the abnormal data is malicious. This includes: Step S1: Extracting M valid data fields from the abnormal data. Step S2: Set the initial value of m to 1; Step S3: Perform hash function calculation and bitwise operations on the m-th field to be detected to obtain g detection results; Step S4: Determine whether the values at the corresponding positions of the g detection results in the bit array are all 1. If not, proceed to step S5; otherwise, proceed to step S6; Step S5: Determine whether m is less than M. If yes, update m to m+1 and proceed to step S3; otherwise, proceed to step S7; Step S6: Determine whether the abnormal data is attack data; Step S7: Determine whether the abnormal data is normal behavior data.
8. A network traffic data security detection device, characterized in that, include: The extraction unit is used to extract multiple preset network features of each traffic data packet in the target time period to obtain evolution data; The segmentation unit is used to divide the multiple evolutionary data of the target time period into multiple windows of data to be detected using a sliding window; The processing unit is used to process the data to be detected in each window to obtain a matrix representation of the data to be detected; the first determining unit is used to determine the distribution of the approximation ratio test value based on the matrix representation of the data to be detected; and to determine the threshold value based on the distribution of the approximation ratio test value and the preset false alarm probability. The second determining unit is used to determine whether the data to be detected is greater than a threshold value. If it is, the data to be detected is determined to be abnormal data. The detection unit is used to process abnormal data using hash function calculations and bitwise operations, and to determine whether the abnormal data is attack data based on the processing results.
9. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the method as claimed in any one of claims 1-7.
10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the method as described in any one of claims 1-7.