Self-evolution network flow data security protection method and system

Abstract

The invention relates to a self-evolution network flow data security protection method and system, and the method comprises the steps: obtaining network flow data with a label, carrying out the preprocessing, and extracting a flow-level feature; calculating contribution degrees between the flow-level features and the labels and contribution degrees among the flow-level features, and selecting the flow-level features according to the contribution degrees to obtain a feature index set; updating the old intrusion detection model according to the feature index set and the new data set to obtain a new intrusion detection model; inputting to-be-detected network flow data into the flow length prediction model to obtain a prediction length; and selecting a corresponding new intrusion detection model according to the prediction length, inputting the network flow data to be detected into the selected new intrusion detection model, obtaining and outputting a corresponding label, and triggering a real-time defense measure according to the label. According to the method, the calculation and storage cost is effectively reduced while the detection performance is ensured, and the method is suitable for safety protection requirements in various complex network environments.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a self-evolving network traffic data security protection method and system. Background Technology

[0002] With the rapid development of network applications, network traffic volume continues to grow, and attack methods are becoming increasingly automated, diversified, and constantly evolving. Existing technologies primarily focus on using machine learning (ML) methods to detect network intrusions in order to address the security protection of network traffic data. Compared to traditional rule-based or feature-based methods, machine learning-based detection models can reduce the cost of manual rule maintenance and achieve higher detection accuracy in known attack scenarios.

[0003] However, existing machine learning-based network traffic security protection methods still face the following two prominent problems in practical deployment:

[0004] First, they lack the ability to continuously evolve. Most existing detection models are built based on offline training, and the model parameters and feature space are basically fixed after training. When the attack methods, communication patterns, or data distribution change, the model needs to collect a large number of samples and undergo complete retraining, making it difficult to adapt to new or variant attacks in a timely manner. With the rapid evolution of network attack techniques, attack samples show trends of familyization, mutation, and concealment, making it difficult for traditional static models to maintain stable detection performance over a long period.

[0005] Second, there is a lack of real-time defense and proactive interception capabilities. Currently, many network traffic detection methods rely primarily on post-event analysis, typically requiring the collection of complete network flows or sessions before features can be extracted and detection results provided. For example, typical flow-level detection methods can only complete the judgment after the flow has ended. This detection approach leads to delayed defense decisions, making it impossible to effectively intercept attacks before they are completed, and thus failing to meet the network security protection requirements with high real-time demands.

[0006] Furthermore, with the increasing number of devices deployed in the network environment and the differentiation of computing resources, the computational complexity and storage overhead of detection models have gradually become important factors restricting their practical application. High-dimensional features, complex model structures, and the storage and updating of long-term historical data will significantly increase the system burden, which is not conducive to continuous operation in resource-constrained or high-throughput network environments.

[0007] Existing technology CN120474771A primarily focuses on improving detection accuracy under multi-source network data fusion conditions. Its core lies in solving the problems of inconsistent data granularity and time asynchrony through comprehensive analysis of multi-dimensional features, and it is an overall fusion detection scheme based on a static model. This scheme does not involve the continuous learning and evolution capabilities of the model during operation. Existing technology CN119402294A mainly starts from the probability of system operating states and dynamically adjusts the defense strategy parameters. Its defense capability depends on preset thresholds and changes in state probabilities, and it does not involve continuous learning and modeling of network traffic attack characteristics, lacking the ability to adapt to new types of attacks.

[0008] Based on the above problems, this invention proposes a self-evolving network traffic data security protection method and system. Summary of the Invention

[0009] The purpose of this invention is to provide a self-evolving network traffic data security protection method and system. By introducing an incremental learning mechanism, the detection model can continuously absorb new attack features without relying on complete retraining, achieving dynamic model evolution. Simultaneously, it can make judgments and implement interception before an attack is fully successful, significantly improving the timeliness and proactiveness of defense. To reduce system resource overhead, this invention also introduces an information-rich feature selection mechanism and a memory limitation mechanism, effectively reducing computation and storage costs while ensuring detection performance, making it suitable for security protection needs in various complex network environments.

[0010] To achieve the above objectives, the present invention provides the following solution:

[0011] A self-evolving network traffic data security protection method includes:

[0012] Acquire labeled network traffic data, preprocess it, and extract flow-level features;

[0013] Calculate the contribution between each flow-level feature and the label, as well as the contribution between each flow-level feature; select the flow-level features based on the contribution to obtain a feature index set.

[0014] The old intrusion detection model is updated based on the feature index set and the new dataset to obtain a new intrusion detection model, wherein the old intrusion detection model is updated using cross-entropy and distillation loss;

[0015] Input the network traffic data to be detected into the flow length prediction model to obtain the predicted length;

[0016] The new intrusion detection model is selected based on the predicted length, and the network traffic data to be detected is input into the selected new intrusion detection model. The corresponding label is obtained and real-time defense measures are triggered based on the label, wherein the label is either benign or attack type.

[0017] Optionally, labeled network traffic data can be preprocessed to extract flow-level features, including:

[0018] Based on the tagged network traffic data, a set of data packet sequences is constructed, wherein the data packets in the set of data packet sequences are represented by a 5-tuple, which includes source address, source port, destination address, destination port, and transport layer protocol.

[0019] Data packets with identical or opposite quintuples are defined as streams and the stream-level features are extracted, where each stream-level feature corresponds to a label.

[0020] Optionally, the calculation of contribution includes:

[0021] Based on the information gain between the flow-level features and the labels, the information entropy of the flow-level features, and the information entropy of the labels, the contribution degree between each flow-level feature and the label is calculated.

[0022] The contribution of each flow level feature is calculated based on the information gain and information entropy of each flow level feature.

[0023] Optionally, selecting the flow-level features based on the contribution, and obtaining the feature index set includes:

[0024] S1. If the contribution between the flow level features is greater than the maximum contribution, then the contribution between the flow level features is taken as the maximum contribution. If the contribution between the flow level features is not greater than the maximum contribution, then the next flow level feature is selected to calculate the contribution between the flow level features, until the contribution between each of the flow level features is calculated.

[0025] S2. After completing the contribution calculation between each of the flow-level features, if the contribution between the flow-level feature and the label is greater than the maximum contribution, then add the current flow-level feature to the feature set. If the evaluation of the flow-level feature is completed, then obtain the feature index set. If the evaluation of the flow-level feature is not completed, return to S1.

[0026] Optionally, updating the intrusion detection model based on the feature index set and the new dataset to obtain the final intrusion detection model includes:

[0027] A new attack fingerprint layer is introduced on the old intrusion detection model, and the new attack fingerprint layer is enhanced.

[0028] An enhanced new attack fingerprint layer is used to update the old intrusion detection model based on the cross-entropy and distillation loss;

[0029] Select the corresponding traffic feature vector that is closest to the mean vector in Euclidean distance from the new dataset as a new sample and add it to the traffic sample memory. Remove the feature vector that is farthest from the mean feature vector of each category from the sample memory to obtain the updated traffic sample memory. The initial traffic sample memory is constructed by the feature index set.

[0030] Based on the updated traffic sample memory, a general optimizer is used to fine-tune the parameters of the old intrusion detection model to obtain the new intrusion detection model.

[0031] Optionally, obtaining the prediction length includes:

[0032] len p =M(flow);

[0033] Among them, len p M represents the predicted length, M is the DNN-based flow length prediction model, and flow is the network traffic.

[0034] Optionally, based on the predicted length and the new intrusion detection model, outputting corresponding tags and triggering real-time defense measures based on the tags includes:

[0035] S1. Initialize the index of the new intrusion detection model;

[0036] S2. Add the network traffic data to be detected to the data packet set. If the length of the current data packet set reaches or exceeds the predicted length, it is allowed to pass normally. If the length of the current data packet set is less than the predicted length, the corresponding new intrusion detection model is selected for detection whenever the flow length meets a specific sampling period. If the output is 0, it is determined to be normal traffic. Otherwise, it is determined to be abnormal traffic and real-time defense measures are triggered.

[0037] Optionally, the distillation loss for:

[0038] ;

[0039] ;

[0040] Where w is a parameter, N is the number of samples in the new dataset FLnew, S is the number of original attack categories, G is the temperature hyperparameter, and z ij For the original attack fingerprint recognition layer L af The output, pdist ijThis is a soft label for old category knowledge from the old model, containing information on the relative relationships between categories, qdist ij This is a soft probability prediction for the new model that sample i belongs to category j.

[0041] This invention also provides a self-evolving network traffic data security protection system, used to implement a self-evolving network traffic data security protection method, comprising:

[0042] The traffic preprocessing module is used to acquire labeled network traffic data, preprocess it, and extract flow-level features;

[0043] The feature selection module is used to calculate the contribution between each flow-level feature and the label, as well as the contribution between each flow-level feature, and select the flow-level features based on the contribution to obtain a feature index set.

[0044] The incremental intrusion detection module is used to update the old intrusion detection model based on the feature index set and the new dataset, and obtain a new intrusion detection model, wherein the old intrusion detection model is updated by cross-entropy and distillation loss;

[0045] The real-time defense module is used to input the network traffic data to be detected into the flow length prediction model to obtain the predicted length; select the corresponding new intrusion detection model according to the predicted length, input the network traffic data to be detected into the selected new intrusion detection model, obtain the corresponding tag output, and trigger real-time defense measures according to the tag, wherein the tag is a benign or attack type.

[0046] The beneficial effects of this invention are as follows: By introducing an information richness-driven feature selection mechanism, this invention filters out a subset of features from the original feature set that contributes the most to attack identification and has the lowest feature redundancy, thereby reducing the computational complexity of the model and improving the detection generalization ability from the source. At the defense level, this invention introduces a dynamic selection mechanism between a traffic length prediction model and a classification model cluster. Based on the current evolution state of traffic, it predicts its future behavior and adaptively selects the most suitable classification model, achieving prediction-driven early detection and real-time defense, enabling the system to make decisions and implement interception before the attack is fully completed. Regarding model evolution, to address the problem of constantly emerging new attacks, this invention designs a joint loss function composed of distillation loss and cross-entropy loss. This effectively retains the ability to identify existing attack categories while learning new attack features, mitigating catastrophic forgetting during model updates. Simultaneously, through a dynamic expansion mechanism of the attack fingerprint recognition layer, the detection model can continuously expand its attack identification boundary during operation, achieving self-evolving network traffic security protection. Attached Figure Description

[0047] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0048] Figure 1 This is a flowchart of a self-evolving network traffic data security protection method according to an embodiment of the present invention;

[0049] Figure 2 This is a flowchart of the feature selection method according to an embodiment of the present invention;

[0050] Figure 3 This is a flowchart of the model update method according to an embodiment of the present invention;

[0051] Figure 4 This is a flowchart of the real-time defense method according to an embodiment of the present invention. Detailed Implementation

[0052] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0053] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0054] like Figure 1 As shown, this embodiment proposes a self-evolving network traffic data security protection method, including:

[0055] Acquire labeled network traffic data, preprocess it, and extract flow-level features;

[0056] Calculate the contribution between each flow level feature and the label, as well as the contribution between each flow level feature. Select flow level features based on the contribution and obtain a feature index set.

[0057] The old intrusion detection model is updated based on the feature index set and the new dataset to obtain the new intrusion detection model, wherein the old intrusion detection model is updated using cross-entropy and distillation loss;

[0058] Input the network traffic data to be detected into the flow length prediction model to obtain the predicted length;

[0059] Select the corresponding new intrusion detection model based on the predicted length, input the network traffic data to be detected into the selected new intrusion detection model, obtain the corresponding label output, and trigger real-time defense measures based on the label, where the label is either benign or an attack type.

[0060] Furthermore, tagged network traffic data is acquired and preprocessed to extract flow-level features, including:

[0061] Based on tagged network traffic data, a set of data packet sequences is constructed. The data packets in the set of data packet sequences are represented by a 5-tuple, which includes the source address, source port, destination address, destination port, and transport layer protocol.

[0062] Data packets with identical or opposite quintuples are defined as flows and flow-level features are extracted, where each flow-level feature corresponds to a label.

[0063] Specifically, traffic preprocessing involves collecting tagged network traffic data and constructing a set of packet sequences, denoted as... Where m is the number of packages in the package set. The specific steps include:

[0064] S11 parses data packets to construct a stream:

[0065] A stream corresponds to a series of data packets with the same or opposite 5-tuples. Let the stream be f. Each data packet is uniquely represented by a 5-tuple (source address, source port, destination address, destination port, transport layer protocol). Therefore, f is represented as:

[0066] .

[0067] For example: When data packet p arrives, use... Let p be the stream f, and let f be the stream f. Where p− represents reverse flow express.

[0068] S12 Extracts and labels flow features:

[0069] For each data packet This represents the i-th data packet. Belongs to the flow ,for Set features Each stream has n features, and each stream corresponds to a label. The label is set. The tags will be updated as the system detects new attacks. The parameters of flow f are shown in Table 1.

[0070] Table 1

[0071]

[0072] Furthermore, the calculation of contribution includes:

[0073] Calculate the contribution of each flow-level feature to the label based on the information gain between the flow-level features and the label, the information entropy of the flow-level features, and the information entropy of the label.

[0074] The contribution of each flow level feature is calculated based on the information gain and information entropy of each flow level feature.

[0075] Furthermore, flow-level features are selected based on their contribution, resulting in a feature index set including:

[0076] Step 1: If the contribution between flow level features is greater than the maximum contribution, then the contribution between flow level features is taken as the maximum contribution. If the contribution between flow level features is not greater than the maximum contribution, then the next flow level feature is selected to calculate the contribution between flow level features, until the contribution between each flow level feature is calculated.

[0077] The second step is to calculate the contribution between each flow level feature. If the contribution between the flow level feature and the label is greater than the maximum contribution, the current flow level feature is added to the feature set. If the evaluation of the flow level feature is completed, the feature index set is obtained. If the evaluation of the flow level feature is not completed, return to the first step.

[0078] Specifically, a feature selection algorithm is introduced to select the features optimal for the detection model and reduce redundant features, including:

[0079] S21 Feature Selection Criterion Calculation Formula:

[0080] Given the eigenvectors of flow f The formula is calculated as follows:

[0081] ;

[0082] in, Indicates information gain. Let C represent the information entropy, and C be the label variable (i.e., the attack category). This formula selects features that are more relevant to the label and have lower redundancy with other features.

[0083] Information gain φG and information entropy H are defined as follows:

[0084] ;

[0085] S22 feature selection algorithm, such as Figure 2 As shown:

[0086] 1. Given a training traffic dataset (FL, y), this algorithm aims to select informative features from all traffic features that are highly correlated with the label and have low redundancy with other features. The algorithm ultimately outputs a set of indices I for the selected features.

[0087] 2. Initialize the feature index set to I = ∅. Then, iterate through each candidate feature, processing each feature in the dataset... An evaluation is performed. To measure the redundancy of this feature, a temporary variable is set to record its maximum redundancy contribution compared to all other features, denoted as . ;

[0088] 3. Calculate the information contribution between the current feature and label C, expressed as follows:

[0089] ;

[0090] in, Indicates information gain. This represents information entropy.

[0091] 4. To measure the redundancy between this feature and other features, for all features j≠i... Calculate the information contribution between them: ;

[0092] If the currently calculated contribution Contrib f Greater than the record value Contrib maxf Then update the maximum redundancy contribution, that is, let ;

[0093] 5. After calculating all redundant contributions, determine whether the feature should be selected based on the feature selection criteria: if the information contribution between the feature and the label is greater than its maximum redundant contribution with other features, then the following condition is met: ;

[0094] Then add the feature to the feature set and update it. ;

[0095] 6. Repeat the above process until all features have been evaluated, and finally output the feature index set I.

[0096] Furthermore, the intrusion detection model is updated based on the feature index set and the new dataset to obtain the final intrusion detection model, including:

[0097] A new attack fingerprint layer is introduced on the old intrusion detection model, and the new attack fingerprint layer is enhanced.

[0098] An enhanced new attack fingerprint layer is adopted, and the old intrusion detection model is updated based on cross-entropy and distillation loss;

[0099] Select the corresponding traffic feature vector that is closest to the mean vector in Euclidean distance from the new dataset as a new sample and add it to the traffic sample memory. Remove the feature vector that is farthest from the mean feature vector of each category from the sample memory to obtain the updated traffic sample memory. The initial traffic sample memory is constructed from the feature index set.

[0100] Based on the updated traffic sample memory, a general optimizer is used to fine-tune the parameters of the old intrusion detection model to obtain a new intrusion detection model.

[0101] Specifically, construct an incremental intrusion detection solution:

[0102] The detection model consumer will use its on-site dataset to localize and update the distributed model. Assume the existing model N can identify S-1 types of network attacks {C1, C2, ..., C...}. S-1} and normal traffic C0. The new dataset FLnew contains T newly added attack categories {C}. S+1 C S+2 , …, C S+T The detection model can be a time-series modeling detection model based on a neural network (RNN) to model the time-series behavior of traffic changes over time. The RNN can be specifically implemented using LSTM.

[0103] The original attack fingerprinting layer was expanded into a new sublayer L. ' af It contains T neural units. Note that the original L... af It contains only S neural units. Subsequently, a unit consisting of L... ' k Independent softmax layers representing the characteristics are attached to L ' af superior.

[0104] S31 distillation loss function and cross-entropy calculation:

[0105] To update the model, a two-part cross-distillation loss function was constructed: cross-entropy and distillation loss. The cross-entropy is:

[0106] ;

[0107] Where w represents all parameters in the model, and N is the FL. new The number of samples in p ij It is the one-hot encoding of the actual tag. ij It is L t and L kThe estimated probability for each attack category. Cross-entropy ensures the model can identify new attack categories and adapt to new datasets.

[0108] New dataset FL new The number of samples included from old attack categories and normal cases is very limited. Distillation is introduced to address this issue. The distillation process is performed as follows:

[0109] ;

[0110] ;

[0111] Where w is a parameter, and N is the new dataset FL new The number of samples in the sample, S is the number of original attack categories, and L is the number of attack fingerprint layers. af The output dimension is expanded, where G is a hyperparameter of temperature. The higher the temperature, the weaker the probability distribution of each level. ij For the original attack fingerprint recognition layer L af The output, i.e., the pdist for sample i in the j-th attack category. ij This is a temperature-smoothed soft label of the old model's knowledge of old categories, containing information on the relative relationships between categories. qdist ij This is the soft probability prediction of the new model for sample i belonging to class j. That is, the result is the unit of the maximum output, derived from the original attack fingerprinting layer L. af The impact of [the first unit] decreases the final probability, while other units will have a greater impact. This advantage allows the algorithm to learn clearer boundaries between different traffic categories. The cross-distillation loss function can be expressed as:

[0112] ;

[0113] Here, l represents the number of attack fingerprint layers. After training, these two separate softmax layers will be merged into one.

[0114] Updating the detection model not only adds new detection capabilities but also retains existing knowledge. This requires storing old samples (traffic feature vectors) that are used for subsequent fine-tuning. Since most IoT edge devices running this detection model have limited storage space, memory must be limited.

[0115] Assuming that IoT edge devices can store at most K traffic feature vectors, the model can identify at most S classes of IoT traffic. Subsequently, each class can have a space of (K / S) samples. After completing incremental learning, data should be extracted from the dataset FL. new The process of selecting and adding (K / S+T) samples into memory is accomplished by the following steps:

[0116] ;

[0117] This equation indicates that the flow feature vector corresponding to the mean vector in terms of Euclidean distance (K / S+T) should be selected. With the addition of new samples, the number of samples to be retained in each old class needs to be adjusted from [K / S] to [K / S+T] based on the actual situation, where T is the number of newly added neurons. Similarly, the feature vector furthest from the mean feature vector of each class is removed.

[0118] ;

[0119] in, It is category S i The set of original memory feature vectors, It is its mean eigenvector.

[0120] S32 model update algorithm:

[0121] Old model: ;

[0122] Old traffic: ;

[0123] New model added: ;

[0124] FL: Traffic characteristic representation; y: Corresponding attack category label; S: Number of old attack categories; T: Total number of attack categories after update. The intrusion detection model before the update; For the final softmax classification layer; To attack the fingerprint layer; This is the feature extraction and representation learning layer; It serves as a memory for old traffic, storing representative samples of historical attack categories and normal traffic. For the corresponding The true label sequences of all samples in the dataset; Let be the label of the i-th sample. The model update algorithm flow is as follows: Figure 3 As shown.

[0125] Step 1: Model Structure Expansion:

[0126] ;

[0127] Based on the old intrusion detection model, a new attack fingerprint layer is introduced to extend the model structure and support the characterization and modeling of new attack types.

[0128] Step 2: Enhance the attack fingerprint layer by adding a softmax layer to the new attack fingerprint layer:

[0129] ;

[0130] in, For the new attack fingerprint layer's softmax header, This is a newly introduced attack fingerprint layer.

[0131] For the newly added attack categories, an independent individual attack fingerprint layer is constructed to characterize the differences in traffic behavior and interaction patterns of the new attacks, thereby enhancing the model's ability to capture attack features.

[0132] Step 3: Initial update of model parameters:

[0133] Using the new dataset to be updated, the model parameters are trained and updated according to a predefined loss function, so that the newly added attack fingerprint layer and the existing model structure gradually converge.

[0134] .

[0135] Step 4: Update the classification layer structure:

[0136] ;

[0137] The original multiple independent Softmax classification layers in the model are integrated and replaced to form a unified classification output layer, thereby completing the local update of the model's classification structure and supporting the joint recognition of new and old attack categories.

[0138] Step 5: Prune the old samples in the old traffic memory before the update:

[0139] ;

[0140] in, These are the samples selected for deletion in all of the older attacks.

[0141] Historical samples in the old traffic sample memory are pruned, and redundant or less representative samples are deleted to control the sample size and reduce storage and computational overhead. The initial old traffic memory is constructed based on the feature index set I.

[0142] Step 6: Adding new samples:

[0143] ;

[0144] in, This is a new attack sample.

[0145] The traffic samples obtained from the new dataset are added to the traffic sample memory, thereby expanding and updating the traffic memory.

[0146] Step 7: Joint model fine-tuning:

[0147] .

[0148] Based on the updated traffic sample memory, a general optimizer is used to fine-tune the model parameters to obtain the final updated intrusion detection model.

[0149] Furthermore, based on the predicted length and the new intrusion detection model, corresponding tags are output, and real-time defense measures are triggered based on these tags, including:

[0150] The first step is to initialize the index of the new intrusion detection model;

[0151] The second step is to add the network traffic data to be detected to the data packet set. If the length of the current data packet set reaches or exceeds the predicted length, it is allowed to pass normally. If the length of the current data packet set is less than the predicted length, the corresponding new intrusion detection model is selected for detection whenever the flow length meets a specific sampling period. If the output is 0, it is determined to be normal traffic; otherwise, it is determined to be abnormal traffic and real-time defense measures are triggered.

[0152] Specifically, construct a real-time defense model:

[0153] This embodiment proposes an ultra-long suppression prediction model based on the characteristics of the first packet of traffic. These characteristics include the duration of traffic, the minimum byte length (min_bytes_bi) of the bidirectional stream, and the maximum byte length (max_bytesin) of the input stream.

[0154] S41 flow length prediction model:

[0155] The prediction model is based on a DNN, where the cost function is customized as follows:

[0156] ;

[0157] .

[0158] Where n is the number of training samples, each sample (x i y i) Features x extracted from the first data packet i It consists of the true length i, where i is the predicted length. α is a hyperparameter used to adjust the penalty for ultra-long predictions and to control the threshold for determining ultra-long predictions, where α∈[0,1), e∈(0,∞).

[0159] Furthermore, the large dispersion of long traffic flows can mislead prediction models because these flows contain thousands of packets. This invention treats these samples as outliers in length prediction. To remove these outliers, the Isolation Forest (IF) algorithm is employed. This cutoff point determines that the detection model can only observe a portion of the entire flow, which is quite different from previous post-hoc analyses that could capture the complete flow. That is, for a given flow, its flow-level feature vector can only be extracted from packets before the cutoff point. Therefore, the evolving detection model also needs to be trained on data containing incomplete flows. Since the cutoff points vary greatly between flows, a universal value cannot be found. This problem is addressed by training a set of models that use flow-level features extracted from the first n packets. n is a variable with a fixed incrementing step size (e.g., 10). With the aid of the traffic length prediction model and the detection model library, a preventative mode can be activated. After observing a new network traffic event, the prediction model calculates its traffic length level (e.g., 50). Subsequently, models trained to detect packets with lengths shorter than predicted values ​​(e.g., 10, 20, 30, 40) will be invoked for detection. If any model issues an attack alert, the traffic will be blocked.

[0160] S42 Real-Time Defense Algorithm:

[0161] This algorithm utilizes the flow length prediction model M and the intrusion detection model family N. i (i=1,2,3,…n), perform real-time detection and defense on ongoing network traffic flow=(pkt1,pkt2,…), and output the security action A for this flow. flow ∈{0,1}, where 0 indicates normal access and 1 indicates triggering defense. The intrusion detection model family includes specific neural network detection models for traffic of different lengths. Real-time defense algorithms include... Figure 4 As shown.

[0162] Step 1: When the flow reaches the fixed n-tuple used for length prediction, the algorithm calls the flow length prediction model M to obtain the predicted length of the flow:

[0163] len p =M(flow);

[0164] Step 2: Initialize the detection model index to Index N =1. As new data packets continue to be added to the flow, the algorithm processes each packet as follows, where the index refers to the detection stage number of the current network traffic during the traffic length evolution, which is the intrusion detection model N that should be activated at the moment. i The number.

[0165] If the current stream (packet set) length reaches or exceeds the predicted length len p Set the output action directly to A flow =0 means it is considered a normal release and the testing process is terminated.

[0166] If the predicted length has not yet been reached, a detection is triggered every time the flow length satisfies a specific sampling period (i.e., len(flow)moditvl=0). At this point, the first... An intrusion detection model is used for detection, where len(flow) is the number of packets received in the current flow and itvl is the detection trigger interval, i.e., an intrusion detection is triggered once every itvl packets received. Regarding the output of this detection model, if the output is 0, it is considered normal traffic; otherwise, the traffic is considered abnormal.

[0167] Step 3: Once the detection result indicates that the current traffic is an attack flow (i.e., let the intrusion detection model N...), i The output is y i ∈{0,1},y i ∈{0,1}, where 1 represents attack and 0 represents normal. When y i When =1, the current traffic is determined to be an attack flow. The algorithm then sets the action to A. flow =1 indicates that real-time defense measures are triggered and the algorithm process is immediately terminated.

[0168] Step 4: The above process continues until the traffic is clearly classified as normal or an attack, at which point the algorithm finally outputs the corresponding action A. flow .

[0169] This embodiment also provides a self-evolving network traffic data security protection system, including:

[0170] The traffic preprocessing module is used to acquire labeled network traffic data, preprocess it, and extract flow-level features;

[0171] Specifically, this module captures network traffic data files, preprocesses the raw traffic tracing data, extracts flow-level features from it, and provides a unified input for subsequent feature selection and detection analysis.

[0172] The feature selection module is used to calculate the contribution between each flow level feature and the label, as well as the contribution between each flow level feature. Based on the contribution, the flow level features are selected to obtain a feature index set.

[0173] Specifically, this module evaluates the extracted flow-level features, calculates the contribution of each feature to flow label identification, and analyzes the information redundancy relationships between features. Only features that meet the following conditions are retained:

[0174] (1) Features that contribute more to traffic label identification than to the information redundancy between them and other features;

[0175] (2) Features that contribute significantly more to label relevance than features with redundant information between features.

[0176] This process constructs a feature subset with higher information density and lower redundancy.

[0177] The incremental intrusion detection module is used to update the old intrusion detection model based on the feature index set and the new dataset, and obtain the new intrusion detection model. The old intrusion detection model is updated using cross-entropy and distillation loss.

[0178] Specifically, this module constructs a set of attack fingerprinting layers to fingerprint and identify different types of network attack behaviors. It also designs a joint loss function composed of distillation loss and cross-entropy loss, and establishes a memory bank to store historical representative samples to support stable updates of the model during incremental learning, absorbing features from new attack samples while avoiding forgetting existing attack identification capabilities.

[0179] The real-time defense module is used to input the network traffic data to be detected into the flow length prediction model to obtain the predicted length; select the corresponding new intrusion detection model based on the predicted length, input the network traffic data to be detected into the selected new intrusion detection model, obtain the corresponding label output, and trigger real-time defense measures based on the label, where the label is either benign or an attack type.

[0180] Specifically, this module predicts the future behavior of current traffic based on its evolutionary state, and combines the classifier output to make defense decisions before the attack is completed, thereby achieving real-time interception and proactive protection against network attacks.

[0181] The embodiments described above are merely preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Various modifications and improvements made to the technical solutions of the present invention by those skilled in the art without departing from the spirit of the present invention should fall within the protection scope defined by the claims of the present invention.

Claims

1. A self-evolving network traffic data security protection method, characterized in that, include: Acquire labeled network traffic data, preprocess it, and extract flow-level features; Calculate the contribution between each flow-level feature and the label, as well as the contribution between each flow-level feature; select the flow-level features based on the contribution to obtain a feature index set. The old intrusion detection model is updated based on the feature index set and the new dataset to obtain a new intrusion detection model, wherein the old intrusion detection model is updated using cross-entropy and distillation loss; Input the network traffic data to be detected into the flow length prediction model to obtain the predicted length; The new intrusion detection model is selected based on the predicted length, and the network traffic data to be detected is input into the selected new intrusion detection model. The corresponding label is obtained and real-time defense measures are triggered based on the label, wherein the label is either benign or attack type.

2. The self-evolving network traffic data security protection method according to claim 1, characterized in that, Acquire labeled network traffic data and preprocess it to extract flow-level features, including: Based on the tagged network traffic data, a set of data packet sequences is constructed, wherein the data packets in the set of data packet sequences are represented by a 5-tuple, which includes source address, source port, destination address, destination port, and transport layer protocol. Data packets with identical or opposite quintuples are defined as streams and the stream-level features are extracted, where each stream-level feature corresponds to a label.

3. The self-evolving network traffic data security protection method according to claim 1, characterized in that, The calculation of contribution includes: Based on the information gain between the flow-level features and the labels, the information entropy of the flow-level features, and the information entropy of the labels, the contribution degree between each flow-level feature and the label is calculated. The contribution of each flow level feature is calculated based on the information gain and information entropy of each flow level feature.

4. The self-evolving network traffic data security protection method according to claim 1, characterized in that, Selecting flow-level features based on their contribution, and obtaining a feature index set includes: S1. If the contribution between the flow level features is greater than the maximum contribution, then the contribution between the flow level features is taken as the maximum contribution. If the contribution between the flow level features is not greater than the maximum contribution, then the next flow level feature is selected to calculate the contribution between the flow level features, until the contribution between each of the flow level features is calculated. S2. After completing the contribution calculation between each of the flow-level features, if the contribution between the flow-level feature and the label is greater than the maximum contribution, then add the current flow-level feature to the feature set. If the evaluation of the flow-level feature is completed, then obtain the feature index set. If the evaluation of the flow-level feature is not completed, return to S1.

5. The self-evolving network traffic data security protection method according to claim 1, characterized in that, The intrusion detection model is updated based on the feature index set and the new dataset to obtain the final intrusion detection model, including: A new attack fingerprint layer is introduced on the old intrusion detection model, and the new attack fingerprint layer is enhanced. An enhanced new attack fingerprint layer is used to update the old intrusion detection model based on the cross-entropy and distillation loss; Select the corresponding traffic feature vector that is closest to the mean vector in Euclidean distance from the new dataset as a new sample and add it to the traffic sample memory. Remove the feature vector that is farthest from the mean feature vector of each category from the sample memory to obtain the updated traffic sample memory. The initial traffic sample memory is constructed by the feature index set. Based on the updated traffic sample memory, a general optimizer is used to fine-tune the parameters of the old intrusion detection model to obtain the new intrusion detection model.

6. The self-evolving network traffic data security protection method according to claim 1, characterized in that, Obtaining the predicted length includes: len p =M(flow); Among them, len p M represents the predicted length, M is the DNN-based flow length prediction model, and flow is the network traffic.

7. The self-evolving network traffic data security protection method according to claim 1, characterized in that, Based on the predicted length and the new intrusion detection model, outputting corresponding tags and triggering real-time defense measures based on the tags includes: S1. Initialize the index of the new intrusion detection model; S2. Add the network traffic data to be detected to the data packet set. If the length of the current data packet set reaches or exceeds the predicted length, it is allowed to pass normally. If the length of the current data packet set is less than the predicted length, the corresponding new intrusion detection model is selected for detection whenever the flow length meets a specific sampling period. If the output is 0, it is determined to be normal traffic. Otherwise, it is determined to be abnormal traffic and real-time defense measures are triggered.

8. The self-evolving network traffic data security protection method according to claim 1, characterized in that, distillation loss for: ； ； Where w is a parameter, N is the number of samples in the new dataset FLnew, S is the number of original attack categories, G is the temperature hyperparameter, and z ij For the original attack fingerprint recognition layer L af The output, pdist ij This is a soft label for old category knowledge from the old model, containing information on the relative relationships between categories, qdist ij This is a soft probability prediction for the new model that sample i belongs to category j.

9. A self-evolving network traffic data security protection system, used to implement the self-evolving network traffic data security protection method according to any one of claims 1-8, characterized in that, include: The traffic preprocessing module is used to acquire labeled network traffic data, preprocess it, and extract flow-level features; The feature selection module is used to calculate the contribution between each flow-level feature and the label, as well as the contribution between each flow-level feature, and select the flow-level features based on the contribution to obtain a feature index set. The incremental intrusion detection module is used to update the old intrusion detection model based on the feature index set and the new dataset, and obtain a new intrusion detection model, wherein the old intrusion detection model is updated by cross-entropy and distillation loss; The real-time defense module is used to input the network traffic data to be detected into the flow length prediction model to obtain the predicted length; select the corresponding new intrusion detection model according to the predicted length, input the network traffic data to be detected into the selected new intrusion detection model, obtain the corresponding tag output, and trigger real-time defense measures according to the tag, wherein the tag is a benign or attack type.

Images