Method and apparatus for updating network traffic data detection model

Abstract

This invention provides a method and apparatus for updating a network traffic data detection model, which can be applied to the fields of network security and artificial intelligence. The method includes: in response to an update in the type of network attack, generating virtual samples based on historical data features using a central node of the traffic detection model; sending a sample set consisting of the updated samples and the virtual samples to multiple peripheral nodes, so that each peripheral node adjusts the model parameters of its respective first local model based on the sample set, obtaining a second local model; updating the traffic detection model based on the model parameters of each of the multiple second local models, obtaining an updated traffic detection model, and using the updated traffic detection model to detect network traffic data and obtain detection results for the network traffic data.

Description

Technical Field

[0001] This invention relates to the fields of network security and artificial intelligence, and specifically to a method and apparatus for updating a network traffic data detection model. Background Technology

[0002] In the digital network era, the types of cyberattacks are updated extremely rapidly. Training a method to identify cyberattack traffic by learning the characteristics of cyberattack traffic data through a single node is inefficient and cannot adapt to the rapidly changing types of cyberattacks. Therefore, federated learning techniques are typically used to train local models in a distributed manner using multiple edge nodes, and then the parameters of each local model are aggregated to jointly train a global model for network traffic data detection.

[0003] In the process of implementing the present invention, it was found that the related technology has at least the following problems: after the type of network attack is updated, the local model of each edge node is trained only using samples corresponding to the new attack type. Although the trained local model learns the features of the new network attack traffic data, it forgets the features of the existing network attack traffic data that it has already learned, resulting in poor global model performance and low recognition accuracy. Summary of the Invention

[0004] In view of the above problems, the present invention provides a method and apparatus for updating a network traffic data detection model.

[0005] According to a first aspect of the present invention, a method for updating a network traffic data detection model is provided, comprising: in response to an update in the network attack type, generating virtual samples based on historical data features using a central node of the traffic detection model, wherein the traffic detection model is determined by the central node using federated learning techniques based on the respective first local models of multiple peripheral nodes, the historical data features are obtained by the peripheral nodes through feature extraction of reference samples, the reference samples are determined by the peripheral nodes from multiple local samples, and the local samples are samples corresponding to existing preset attack types used when training the first local models of the peripheral nodes; sending a sample set consisting of updated samples and virtual samples to multiple peripheral nodes respectively, so that the multiple peripheral nodes adjust the model parameters of their respective first local models based on the sample set to obtain a second local model, wherein the updated samples are samples corresponding to newly added target attack types; and updating the traffic detection model based on the model parameters of the multiple second local models to obtain an updated traffic detection model, so as to use the updated traffic detection model to detect network traffic data and obtain detection results for the network traffic data.

[0006] According to an embodiment of the present invention, multiple peripheral nodes adjust the model parameters of their respective first local models based on a sample set to obtain a second local model, including: expanding the first output dimension of the first local model based on the update label corresponding to the updated sample to obtain a second output dimension; processing each target sample in the sample set using a preset incremental model to obtain a probability distribution corresponding to the target sample, wherein the dimension of the probability distribution is consistent with the second output dimension; determining the sample weight of the target sample based on multiple probability values ​​in the probability distribution; and adjusting the model parameters of the preset incremental model based on the sample weight, the probability distribution, and the label corresponding to the target sample to obtain the second local model.

[0007] According to an embodiment of the present invention, the sample weights are determined based on the maximum value among multiple probability values; the model parameters of a preset incremental model are adjusted based on the sample weights, probability distribution, and labels corresponding to the target sample to obtain a second local model, including: determining the predicted classification of the target sample based on the probability distribution; determining the classification loss of the local model for the target sample based on the predicted classification and labels corresponding to the target sample; determining a weighted loss based on the sample weights and classification loss; and adjusting the model parameters of the preset incremental model based on the weighted loss to obtain the second local model.

[0008] According to an embodiment of the present invention, an updated traffic detection model is obtained by updating the traffic detection model based on the model parameters of multiple second local models, including: determining the node weights of multiple surrounding nodes based on the sample size of their respective sample sets; and updating the model parameters of the traffic detection model based on the node weights of the multiple surrounding nodes and the model parameters of the second local models, thereby obtaining the updated traffic detection model.

[0009] According to an embodiment of the present invention, the node weights of the multiple surrounding nodes are determined based on the number of samples in their respective sample sets, including: determining the total number of samples based on the multiple sample counts; and for each surrounding node, using the proportion of the number of samples of the surrounding node to the total number of samples as the node weight.

[0010] According to an embodiment of the present invention, the reference sample is determined in the following manner: for each local sample of the surrounding nodes, the first model parameters before adjustment using the local sample and the second model parameters after adjustment using the local sample are obtained respectively; based on the first model parameters and the second model parameters, the first contribution of the local sample to the model parameters of the first local model is determined; the third model parameters before adjustment using the local sample and the fourth model parameters after adjustment using the local sample are obtained respectively; based on the third model parameters and the fourth model parameters, the second contribution of the local sample to the model parameters of the traffic detection model is determined; based on the first contribution and the second contribution, the contribution score of the local sample to the model training process is determined; and based on the contribution scores of the multiple local samples, the reference sample is determined from the multiple local samples.

[0011] According to an embodiment of the present invention, generating virtual samples based on historical data features includes: using a virtual sample generator to generate virtual samples corresponding to the historical data features; wherein the virtual sample generator is obtained by: using an initial generator to generate initial samples based on historical data features; determining the generation loss of the initial generator based on the initial samples, historical data features, and labels corresponding to the historical data features; and adjusting the model parameters of the initial generator based on the generation loss to obtain the virtual sample generator.

[0012] According to an embodiment of the present invention, the generation loss of the initial generator is determined based on the initial sample, historical data features, and labels corresponding to the historical data features. This includes: extracting features from the initial sample to obtain sample features; determining feature consistency loss based on the sample features and historical data features; performing probability mapping on the sample features to obtain the sample probability distribution corresponding to the initial sample and the classification result corresponding to the initial sample; determining the classification loss based on the classification result and labels corresponding to the historical data features; determining the boundary loss based on the sample probability distribution and a preset confidence interval; and determining the generation loss based on the feature consistency loss, classification loss, and boundary loss.

[0013] According to an embodiment of the present invention, determining the boundary loss based on the sample probability distribution and a preset confidence interval includes: determining the boundary loss as a preset value when the maximum value in the sample probability distribution is within the preset confidence interval; and determining the boundary loss based on the boundary value between the maximum value and the preset confidence interval when the maximum value in the sample probability distribution is outside the preset confidence interval.

[0014] A second aspect of the present invention provides an apparatus for updating a network traffic data detection model, comprising: a sample generation module, configured to generate virtual samples based on historical data features using a central node of the traffic detection model in response to an update in the network attack type, wherein the traffic detection model is determined by the central node using federated learning technology based on the first local models of multiple peripheral nodes, the historical data features are obtained by the peripheral nodes through feature extraction of reference samples, the reference samples are determined by the peripheral nodes from multiple local samples, and the local samples are samples corresponding to existing preset attack types used when training the first local models of the peripheral nodes; a sample sending module, configured to send a sample set consisting of updated samples and virtual samples to multiple peripheral nodes respectively, so that the multiple peripheral nodes adjust the model parameters of their respective first local models based on the sample set to obtain a second local model, wherein the updated samples are samples corresponding to newly added target attack types; and a model updating module, configured to update the traffic detection model based on the model parameters of the multiple second local models to obtain an updated traffic detection model, so as to use the updated traffic detection model to detect network traffic data and obtain detection results for the network traffic data.

[0015] A third aspect of the present invention provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0016] A fourth aspect of the present invention also provides a computer-readable storage medium having a computer program or instructions stored thereon, wherein the computer program or instructions, when executed by a processor, implement the steps of the above-described method.

[0017] A fifth aspect of the present invention also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method.

[0018] According to an embodiment of the present invention, when the network attack type is updated, a virtual sample is generated by the central node based on historical data features, and together with the updated sample of the new attack type, a sample set is distributed. Since the central node generates the data based on historical data features uploaded by each peripheral node, it avoids the sharing of original data among peripheral nodes, thus meeting the privacy protection requirements of federated learning. Furthermore, it allows peripheral nodes to consider historical data features during retraining, preventing the first local model of peripheral nodes from forgetting the data features of the preset attack type due to incremental training using only new samples. This ensures that the updated traffic detection model can accurately identify network traffic data of both the new and preset attack types. Attached Figure Description

[0019] The above-mentioned contents, as well as other objects, features and advantages of the present invention, will become clearer from the following description of embodiments of the present invention with reference to the accompanying drawings.

[0020] Figure 1 The diagram illustrates an application scenario of the method and apparatus for updating a network traffic data detection model according to an embodiment of the present invention.

[0021] Figure 2 A flowchart illustrating an update method for a network traffic data detection model according to an embodiment of the present invention is shown.

[0022] Figure 3 A data flow diagram for training a virtual sample generator according to an embodiment of the present invention is shown.

[0023] Figure 4 A data flow diagram is shown for adjusting the parameters of a local model of multiple peripheral nodes using a virtual sample generator according to an embodiment of the present invention.

[0024] Figure 5 A structural block diagram of an update device for a network traffic data detection model according to an embodiment of the present invention is shown.

[0025] Figure 6 A block diagram of an electronic device suitable for implementing an update method for a network traffic data detection model according to an embodiment of the present invention is shown. Detailed Implementation

[0026] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the invention. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the invention for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concept of the invention.

[0027] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the invention. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0028] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0029] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0030] In the technical solution of this invention, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, invention, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0031] In scenarios involving automated decision-making using personal information, the methods, devices, and systems provided in this invention offer users corresponding entry points for choosing to agree to or reject the automated decision-making results. If the user chooses to reject, the process proceeds to the expert decision-making stage. Here, "automated decision-making" refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests, or economic, health, and credit status through computer programs, and then making a decision. Here, "expert decision-making" refers to the activity of making decisions by personnel who specialize in a particular field, possess specialized experience, knowledge, and skills, and have reached a certain level of professional expertise.

[0032] Considering that incremental updates to the local model based solely on newly added attack types may cause the model to forget previously learned knowledge, existing network attack traffic data can be added to the incremental update dataset to ensure that the model continues to learn its previously learned knowledge during the incremental update process and avoids forgetting.

[0033] However, edge nodes in federated learning technology have limited storage space and often cannot save a large amount of historical data. Therefore, before incremental updates, it is necessary to collect additional network attack traffic data that has already been learned, which seriously affects training efficiency.

[0034] Embodiments of the present invention provide a method for updating a network traffic data detection model, comprising: responding to an update in the network attack type, generating virtual samples based on historical data features using a central node of the traffic detection model, wherein the traffic detection model is determined by the central node using federated learning technology based on the first local models of multiple peripheral nodes, the historical data features are obtained by the peripheral nodes through feature extraction of reference samples, the reference samples are determined by the peripheral nodes from multiple local samples, and the local samples are samples corresponding to existing preset attack types used when training the first local models of the peripheral nodes; sending a sample set consisting of updated samples and virtual samples to multiple peripheral nodes respectively, so that the multiple peripheral nodes adjust the model parameters of their respective first local models based on the sample set to obtain a second local model, wherein the updated samples are samples corresponding to newly added target attack types; and updating the traffic detection model based on the model parameters of the multiple second local models to obtain an updated traffic detection model, so as to use the updated traffic detection model to detect network traffic data and obtain detection results for the network traffic data.

[0035] Figure 1 The diagram illustrates an application scenario of the method and apparatus for updating a network traffic data detection model according to an embodiment of the present invention.

[0036] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0037] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0038] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0039] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0040] Peripheral nodes can be set on the first terminal device 101, the second terminal device 102, and the third terminal device 103, respectively, while the central node can be set on the server 105. The architecture of the first terminal device 101, the second terminal device 102, the third terminal device 103, the network 104, and the server 105 can be used to implement a model update method based on federated learning technology.

[0041] It should be noted that the network traffic data detection model update method provided in this embodiment of the invention can generally be executed by server 105. Correspondingly, the network traffic data detection model update device provided in this embodiment of the invention can generally be located in server 105. The network traffic data detection model update method provided in this embodiment of the invention can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the network traffic data detection model update device provided in this embodiment of the invention can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0042] It should be understood that Figure 1 The number of first terminal devices, second terminal devices, third terminal devices, networks, and servers shown in the diagram is merely illustrative. Depending on implementation needs, any number of first terminal devices, second terminal devices, third terminal devices, networks, and servers can be included.

[0043] The following will be based on Figure 1 The described scene, through Figures 2-4 The method for updating the network traffic data detection model according to an embodiment of the present invention will be described in detail.

[0044] Figure 2 A flowchart illustrating an update method for a network traffic data detection model according to an embodiment of the present invention is shown.

[0045] like Figure 2 As shown, the method for updating the network traffic data detection model in this embodiment includes operations S210 to S230.

[0046] When operating S210, in response to an update in the type of network attack, virtual samples are generated based on historical data features using the central node of the traffic detection model.

[0047] In operation S220, a sample set consisting of updated samples and virtual samples is sent to multiple peripheral nodes, so that the multiple peripheral nodes can adjust the model parameters of their respective first local models based on the sample set to obtain a second local model.

[0048] In operation S230, the traffic detection model is updated based on the model parameters of multiple second local models to obtain an updated traffic detection model. The updated traffic detection model is then used to detect network traffic data and obtain detection results for the network traffic data.

[0049] A cyberattack refers to sending malicious data traffic over a network in an attempt to damage the recipient's system, such as by stealing information or bypassing security measures. Cyberattack methods can include Distributed Denial of Service (DDoS) attacks, port scanning, and Structured Query Language (SQL) injection.

[0050] Traffic detection models can be used to detect and identify network traffic data to determine whether the network traffic data belongs to an existing type of network attack. If the network traffic data does not belong to a type of network attack, it is determined that the network traffic data is normal data and can be received and processed normally by the server.

[0051] The traffic detection model utilizes federated learning, where a central node determines the model based on the initial local models of multiple peripheral nodes. The federated learning architecture consists of a central node and multiple peripheral nodes. The central node distributes datasets to the peripheral nodes, and each peripheral node trains its local model using its own dataset to obtain its initial local model. The central node then adjusts the parameters of its central model based on the parameters of the initial local models from the peripheral nodes, resulting in the traffic detection model.

[0052] When new types of network attacks emerge in the network environment, traffic detection models may struggle to identify them, thus requiring updates to the traffic detection models.

[0053] A central node can be used to generate virtual samples based on historical data features, so that the features of the virtual samples are consistent with the features of the historical data.

[0054] Historical data features are obtained by the surrounding nodes extracting features from the reference samples. The reference samples are determined by the surrounding nodes from multiple local samples. The local samples are the samples corresponding to the existing preset attack types used when training the first local model of the surrounding nodes.

[0055] Updated samples are those corresponding to newly added target attack types. Since the characteristics of virtual samples are consistent with those of historical data, virtual samples correspond to existing preset attack types. The sample set consists of updated samples and virtual samples, thus including samples of both target and preset attack types. By adjusting the first local model of multiple peripheral nodes using the sample set, the resulting second local model can be equipped with the ability to identify both target and preset attack types.

[0056] Specifically, for each peripheral node, the central node can be used to construct a sample pool from all updated samples and all virtual samples, and then randomly select multiple samples from the sample pool to form a sample set, which is then sent to the peripheral nodes. This allows multiple peripheral nodes to adjust the model parameters of their respective first local models based on the sample set, thereby obtaining a second local model.

[0057] After multiple peripheral nodes complete their parameter adjustments, they can each send their own second local model parameters to the central node. This allows the central node to update the traffic detection model based on the individual model parameters of the multiple second local models, thus obtaining an updated traffic detection model.

[0058] The federated learning architecture can be used to aggregate the model parameters of multiple second local models to obtain updated model parameters for the traffic detection model. The updated model parameters can then be used to update the traffic detection model to obtain an updated traffic detection model.

[0059] Once the updated traffic detection model is completed, it can be used to detect network traffic data and obtain detection results for the network traffic data.

[0060] According to an embodiment of the present invention, when the network attack type is updated, a virtual sample is generated by the central node based on historical data features, and together with the updated sample of the new attack type, a sample set is distributed. Since the central node generates the data based on historical data features uploaded by each peripheral node, it avoids the sharing of original data among peripheral nodes, thus meeting the privacy protection requirements of federated learning. Furthermore, it allows peripheral nodes to consider historical data features during retraining, preventing the first local model of peripheral nodes from forgetting the data features of the preset attack type due to incremental training using only new samples. This ensures that the updated traffic detection model can accurately identify network traffic data of both the new and preset attack types.

[0061] According to an embodiment of the present invention, a reference sample can be determined in the following manner: for each local sample of a surrounding node, obtain the first model parameters of the first local model before adjustment using the local sample and the second model parameters after adjustment using the local sample; based on the first model parameters and the second model parameters, determine the first contribution of the local sample to the model parameters of the first local model; obtain the third model parameters of the traffic detection model before adjustment using the local sample and the fourth model parameters after adjustment using the local sample; based on the third model parameters and the fourth model parameters, determine the second contribution of the local sample to the model parameters of the traffic detection model; based on the first contribution and the second contribution, determine the contribution score of the local sample to the model training process; and based on the contribution scores of the multiple local samples, determine a reference sample from the multiple local samples.

[0062] For each local sample of the surrounding nodes, record the first model parameters of the first local model before training with the local sample. After training the first local model with the local sample, determine the second model parameters of the first local model.

[0063] Based on the first model parameters and the second model parameters, the norm of the gradient vector of the first model parameters before and after training with local samples can be calculated, and the first contribution of the local samples to the model parameters of the first local model can be further determined, as shown in Equation (1):

[0064] (1)

[0065] in, This represents the i-th local sample. Let represent the first contribution of the i-th local sample, and s represent the number of epochs in the training of the first local model. This represents the model parameters for the t-th epoch. This represents the loss function of the first local model. This represents the norm of the gradient vector.

[0066] For each local sample, record the third model parameter of the traffic detection model before adjustment using the local sample, and the fourth model parameter of the traffic detection model after adjustment using the local sample.

[0067] Based on the third and fourth model parameters, the changes in the model parameters of the flow detection model can be determined. As shown in equation (2):

[0068] (2)

[0069] in, This represents the fourth model parameter, and n represents the training epoch of the traffic detection model. This represents the third model parameter.

[0070] Based on the gradient vector of the first model parameters, the i-th local sample can be determined. Adjustment amount that causes the model parameters of the flow detection model to be adjusted As shown in equation (3):

[0071] (3)

[0072] Where η represents the learning rate.

[0073] Based on the change in model parameters With adjustment amount This allows us to determine the second contribution of local samples to the model parameters of the traffic detection model. As shown in equation (4):

[0074] (4)

[0075] Cosine(·,·) represents the calculation of cosine similarity.

[0076] The contribution score of local samples to the model training process can be determined based on the first contribution score and the second contribution score. The local samples can be sorted according to their respective contribution scores, and reference samples can be determined from the local samples in descending order of contribution scores.

[0077] Specifically, contribution score The calculation method can be shown in equation (5):

[0078] (5)

[0079] Since the first contribution is determined based on the gradient contribution of local samples to the first local model, and the second contribution is determined based on the difference between the direction of parameter change of local samples to the traffic detection model and the direction of parameter change of the overall traffic detection model, the first contribution and the second contribution have different orders of magnitude. Determining the contribution score by multiplying the first contribution and the second contribution can make the contribution score take into account both the first contribution and the second contribution, thereby avoiding the situation where the smaller contribution is covered by the larger contribution due to the weighted summation method.

[0080] According to an embodiment of the present invention, the first contribution of local samples to the first local model and the second contribution to the global traffic detection model are calculated respectively. A comprehensive contribution score is then obtained, and reference samples are selected for subsequent extraction of historical data features. This mechanism can eliminate low-value and noisy samples, ensuring the representativeness and effectiveness of historical data features, and improving the quality of virtual sample generation from the source.

[0081] The first local model can include a classifier and multiple hidden layers. After a local sample passes through multiple hidden layers, the information output by the last hidden layer is input into the classifier to determine whether the local sample is a network attack sample.

[0082] Since peripheral nodes in a federated learning architecture typically lack data storage capabilities, once a reference sample is determined, it can be input into the first local model. The information output from the last hidden layer is used as historical data features, which are then sent to the central node for storage. Local samples from peripheral nodes are then deleted to ensure that peripheral nodes do not need to store data.

[0083] According to an embodiment of the present invention, generating virtual samples based on historical data features includes: using a virtual sample generator to generate virtual samples corresponding to the historical data features; wherein the virtual sample generator is obtained by: using an initial generator to generate initial samples based on historical data features; determining the generation loss of the initial generator based on the initial samples, historical data features, and labels corresponding to the historical data features; and adjusting the model parameters of the initial generator based on the generation loss to obtain the virtual sample generator.

[0084] The initial generator and the virtual sample generator have the same network structure, only the model parameters differ. Inputting historical data features into the initial generator yields initial samples.

[0085] Initial samples can be input into the traffic detection model to obtain initial detection results for the initial samples. Based on the initial detection results, historical data features, and labels corresponding to the historical data features, the generation loss is determined. The initial generator is then trained based on the generation loss. The trained generator is then used to generate samples again and calculate the generation loss until the generation loss converges, thus determining the virtual sample generator.

[0086] According to an embodiment of the present invention, an initial sample is generated by a generator based on historical data features, and the generator parameters are continuously optimized according to the generation loss, so that the virtual sample closely approximates the real traffic sample in terms of feature distribution and category semantics, effectively expanding the training data for new attack types and solving the problem of insufficient model updates under small sample size.

[0087] According to an embodiment of the present invention, the generation loss of the initial generator is determined based on the initial sample, historical data features, and labels corresponding to the historical data features. This includes: extracting features from the initial sample to obtain sample features; determining feature consistency loss based on the sample features and historical data features; performing probability mapping on the sample features to obtain the sample probability distribution corresponding to the initial sample and the classification result corresponding to the initial sample; determining the classification loss based on the classification result and labels corresponding to the historical data features; determining the boundary loss based on the sample probability distribution and a preset confidence interval; and determining the generation loss based on the feature consistency loss, classification loss, and boundary loss.

[0088] The traffic detection model consists of a classifier and multiple hidden layers. Initial samples are input into the traffic detection model, and the information output by the last hidden layer is used as the sample features of the initial samples.

[0089] Since the initial samples are generated based on historical data features, the feature consistency loss can be determined based on the differences between the sample features and the historical data features. As shown in equation (6):

[0090] (6)

[0091] in, Represents the sample features of the initial sample. Indicates characteristics of historical data.

[0092] The classifier of the traffic detection model can be used to process the sample features of the initial sample to perform probability mapping on the sample features, thereby obtaining the sample probability distribution corresponding to the initial sample. Based on the sample probability distribution, the classification result corresponding to the initial sample can be determined.

[0093] Based on the classification results and the labels corresponding to the features of historical data, the classification loss can be determined. As shown in equation (7):

[0094] (7)

[0095] Where c represents the c-th category, c∈[1,C], and C represents the total number of categories, which can be determined based on the number of preset attack types and the number of target attack types. Labels corresponding to historical data features can be represented using one-hot vectors. This represents the sample probability distribution corresponding to the initial sample.

[0096] A pre-defined confidence interval can be set to constrain the initial generator to synthesize high-value virtual samples that more closely approximate the decision boundary of the traffic detection model. Based on the sample probability distribution and the pre-defined confidence interval, the boundary loss can be determined.

[0097] Specifically, when the maximum value in the sample probability distribution is within a preset confidence interval, the boundary loss is determined to be a preset value, preferably 0; when the maximum value in the sample probability distribution is outside the preset confidence interval, the boundary loss is determined based on the boundary value between the maximum value and the preset confidence interval. As shown in equation (8):

[0098] (8)

[0099] in, This indicates the lower limit of the preset confidence interval. This indicates the upper limit of the preset confidence interval. This represents the overall sample probability distribution.

[0100] Based on feature consistency loss, classification loss, and boundary loss, the generation loss can be determined. As shown in equation (9):

[0101] (9)

[0102] Where λ1, λ2, and λ3 are weighting coefficients.

[0103] According to embodiments of the present invention, feature consistency loss ensures that virtual samples are consistent with the distribution of real historical features. Classification loss ensures that sample categories are learnable and distinguishable. Boundary loss constrains samples to be within a reasonable confidence interval, avoiding the generation of ambiguous or anomalous samples. Standardized loss is assigned to reasonable samples falling within the confidence interval, while loss is dynamically calculated based on the degree of deviation for low-quality samples exceeding the interval. This forces the generator to output high-confidence, high-availability virtual samples, reducing the interference of noisy samples on subsequent model training and improving the overall convergence speed and detection accuracy of federated learning. Through joint constraints of multiple losses, virtual samples become more realistic and have greater learning value, significantly improving model update performance.

[0104] Figure 3 A data flow diagram for training a virtual sample generator according to an embodiment of the present invention is shown.

[0105] like Figure 3 As shown, for multiple peripheral nodes such as the first peripheral node, ..., the Jth peripheral node, reference samples are selected from multiple local samples respectively. After determining the historical data characteristics of the reference samples, the historical data characteristics of each of the multiple peripheral nodes are sent to the central node for aggregation.

[0106] The central node stores historical data features of multiple surrounding nodes, along with labels corresponding to each historical data feature. An initial generator uses these historical data features to generate initial samples, determining the sample features and corresponding classification results for each initial sample. Based on the sample features, historical data features, classification results, and labels, the loss can be determined. This loss is then used to optimize the initial generator, resulting in a virtual sample generator.

[0107] Figure 4 A data flow diagram is shown for adjusting the parameters of a local model of multiple peripheral nodes using a virtual sample generator according to an embodiment of the present invention.

[0108] like Figure 4 As shown, the trained virtual sample generator generates virtual samples corresponding to the historical data features based on the historical data features. The virtual samples and the updated samples together form a sample pool. Multiple samples are randomly selected from the sample pool to obtain a sample set, which is then sent to each of the surrounding nodes.

[0109] After receiving the first sample set, the first surrounding node uses the first sample set to train its first local model, thereby obtaining the second local model. Since the first sample set includes both virtual samples and updated samples, the trained second local model can simultaneously identify the categories corresponding to the virtual samples and the updated samples.

[0110] Similarly, after receiving the J-th sample set, the J-th surrounding node can use the J-th sample set to train its first local model to obtain the second local model. Since the J-th sample set includes both virtual samples and updated samples, the trained second local model can simultaneously identify the categories corresponding to the virtual samples and the updated samples.

[0111] According to an embodiment of the present invention, multiple peripheral nodes adjust the model parameters of their respective first local models based on a sample set to obtain a second local model, including: expanding the first output dimension of the first local model based on the update label corresponding to the updated sample to obtain a second output dimension; processing each target sample in the sample set using a preset incremental model to obtain a probability distribution corresponding to the target sample, wherein the dimension of the probability distribution is consistent with the second output dimension; determining the sample weight of the target sample based on multiple probability values ​​in the probability distribution; and adjusting the model parameters of the preset incremental model based on the sample weight, the probability distribution, and the label corresponding to the target sample to obtain the second local model.

[0112] The updated label is used to characterize the new attack type corresponding to the updated sample. Since the new attack type is different from the existing preset attack type, adding the updated sample can increase the number of categories corresponding to the classification result.

[0113] The first output dimension of the first local model is determined based on the number of preset attack types. When the number of preset attack types is t, the first output dimension can be t+1. The t dimensions of the first output dimension correspond one-to-one with the t preset attack types, and the other dimension represents the non-attack type, so that after the first local model identifies the input sample, it can accurately output the category to which it belongs.

[0114] Based on the updated label, the first output dimension is expanded so that the resulting second output dimension can not only represent the first output dimension but also additionally represent the category corresponding to the updated label. The second output dimension can be obtained by expanding the first output dimension based on the number of target attack types corresponding to the updated label. For example, if the first output dimension is t+1 and the number of target attack types corresponding to the updated label is 1, then the second output dimension is t+2.

[0115] The label corresponding to the target sample can be represented by a one-hot vector. Before introducing the updated sample, the label corresponding to the target sample can be a one-hot vector of the first output dimension. Taking the first output dimension as t+1 as an example, This includes t+1 elements. In these t+1 elements, the element at the label position corresponding to the target sample has a value of 1, and the elements at other positions have a value of 0. After introducing the updated sample, the label corresponding to the target sample can be a one-hot vector of the second output dimension. Taking the second output dimension as t+2 as an example, Includes t+2 elements, and ,Right now The element value corresponding to the (t+2)th category is 0, while the element value at the label position corresponding to the target sample is 1.

[0116] For an updated sample, its updated label can also be represented as a one-hot vector of the second output dimension, where the element at the category corresponding to the updated sample has a value of 1, and the element at other positions has a value of 0.

[0117] The preset incremental model is a model that expands the output dimension to a second output dimension based on the first local model. Therefore, when the target sample in the sample set is input into the preset incremental model, a probability distribution consistent with the second output dimension can be obtained. In this probability distribution, each element value is used to represent the probability that the classification result of the target sample is the category corresponding to the position of the element value.

[0118] For example, with a second output dimension of 3 and a probability distribution of [0.8, 0.1, 0.1] for a target sample, the probability of classifying the target sample as the first category is 0.8, the probability of classifying it as the second category is 0.1, and the probability of classifying it as the third category is 0.1.

[0119] By analyzing multiple probability values ​​in the probability distribution, the sample weights of the target samples can be determined. The sample weights can be determined based on the confidence level of the target samples in the classification process of the preset incremental model. Since the preset incremental model only expands the output dimension compared with the first local model, it still partially retains the ability to identify and classify samples of the preset attack type. The model parameters can be adjusted mainly using the target samples of the target attack type so that the preset incremental model can quickly learn the classification knowledge of the target samples.

[0120] Based on the probability distribution and the label corresponding to the target sample, the loss when performing classification using the preset incremental model can be determined. Based on this loss and the sample weights, the weights can be weighted so that the model parameters of the preset incremental model can be adjusted based on the weighted weights to obtain the second local model.

[0121] According to embodiments of the present invention, the output dimension of the model is expanded for newly added target attack types, and the target samples are processed using an incremental model to unify the probability distribution dimension. Sample weights are determined based on the probability distribution, enabling differentiated learning for samples with different confidence levels. Incremental updates avoid the need for overall model readjustment, improving local model update efficiency and enhancing the learning stability for new categories and virtual samples.

[0122] According to an embodiment of the present invention, the sample weights are determined based on the maximum value among multiple probability values; the model parameters of a preset incremental model are adjusted based on the sample weights, probability distribution, and labels corresponding to the target sample to obtain a second local model, including: determining the predicted classification of the target sample based on the probability distribution; determining the classification loss of the local model for the target sample based on the predicted classification and labels corresponding to the target sample; determining a weighted loss based on the sample weights and classification loss; and adjusting the model parameters of the preset incremental model based on the weighted loss to obtain the second local model.

[0123] Sample weights It can be determined based on the maximum value among multiple probability values, as shown in equation (10):

[0124] (10)

[0125] Where maximum(·) represents the maximum value function, and P represents the probability distribution of the target sample. When the target sample is a virtual sample of a preset attack type, P can take any value. When the target sample is the updated sample, P can take the one-hot vector corresponding to the updated sample.

[0126] The predicted classification of a target sample can also be determined based on the maximum value among multiple probability values. For example, if the probability distribution of a target sample is [0.8, 0.1, 0.1], the predicted classification of the target sample can be determined as the attack category corresponding to the probability value 0.8.

[0127] Based on the difference between the predicted classification and the label corresponding to the target sample, the classification loss of the local model for the target sample can be determined. For example, the Euclidean distance between the predicted classification and the label corresponding to the target sample can be used as the classification loss.

[0128] Based on sample weights Classification loss can be used to analyze the classification loss. Perform weighted processing to obtain the weighted loss. As shown in equation (11):

[0129] (11)

[0130] In one embodiment, the model parameters of a preset incremental model can be adjusted based on weighted loss to obtain a second local model.

[0131] In another embodiment, a comprehensive classification loss can be determined based on the weighted loss and the knowledge distillation loss, and the model parameters of the preset incremental model can be adjusted based on the comprehensive classification loss to obtain a second local model. Preferably, the knowledge distillation loss can use relative entropy (Kullback-Leibler Divergence, KLD) loss.

[0132] According to embodiments of the present invention, the maximum probability value reflects the sample confidence level and weights are dynamically allocated, giving higher learning intensity to high-confidence samples. A classification loss is constructed by combining predicted classification and labels, and then a weighted loss is obtained through sample weights. This allows the model to focus more on high-quality samples with a limited number of samples, reducing interference from noisy virtual samples and improving classification accuracy for new attack types.

[0133] According to an embodiment of the present invention, an updated traffic detection model is obtained by updating the traffic detection model based on the model parameters of multiple second local models, including: determining the node weights of multiple surrounding nodes based on the sample size of their respective sample sets; and updating the model parameters of the traffic detection model based on the node weights of the multiple surrounding nodes and the model parameters of the second local models, thereby obtaining the updated traffic detection model.

[0134] Since the sample sets of each of the multiple peripheral nodes are randomly selected by the central node from all updated samples and all virtual samples, the samples in the sample sets of the multiple peripheral nodes can be different, and the number of samples can also be different. The node weights of the multiple peripheral nodes can be determined based on the number of samples included in the sample sets of the multiple peripheral nodes.

[0135] Specifically, the total number of samples can be determined based on multiple sample counts; and for each surrounding node, the proportion of the number of samples of the surrounding nodes to the total number of samples can be used as the node weight. As shown in equation (12):

[0136] (12)

[0137] in, This represents the node weight of the j-th surrounding node. This represents the number of samples in the sample set of the j-th surrounding node. This represents the total number of samples. Let J represent the number of samples in the sample set of the u-th surrounding node, and J represent the total number of surrounding nodes.

[0138] Based on the node weights of multiple surrounding nodes and the model parameters of the second local model, the adjustment amount of the second local model of each surrounding node on the parameters of the traffic detection model is determined, and the model parameters of the traffic detection model are updated based on the multiple adjustment amounts to obtain the updated traffic detection model.

[0139] According to embodiments of the present invention, the proportion of each node's sample size in the total sample size is calculated and used as its weight. This method has low computational overhead, is easy to deploy, and objectively reflects the data contribution of each node, making the global model update more consistent with the actual data distribution and improving the model's applicability in multi-node heterogeneous scenarios. The node weights are calculated based on the sample size of each surrounding node, and these weights are used to perform weighted fusion of the parameters of each second local model. This ensures that nodes with more abundant and representative data contribute more to the global model, guaranteeing stronger generalization and more stable updates of the global model, and avoiding performance fluctuations caused by simple average aggregation.

[0140] Based on the above-described method for updating the network traffic data detection model, this invention also provides a device for updating the network traffic data detection model. The following will be combined with... Figure 5 The device is described in detail.

[0141] Figure 5 A structural block diagram of an update device for a network traffic data detection model according to an embodiment of the present invention is shown.

[0142] like Figure 5 As shown, the network traffic data detection model update device 500 of this embodiment includes a sample generation module 510, a sample sending module 520, and a model update module 530.

[0143] The sample generation module 510 is used to generate virtual samples in response to updates in network attack types by utilizing the central node of the traffic detection model and based on historical data features. The traffic detection model is determined by the central node using federated learning techniques, based on the first local models of multiple peripheral nodes. The historical data features are obtained by peripheral nodes extracting features from reference samples. The reference samples are determined by the peripheral nodes from multiple local samples. The local samples are samples corresponding to existing preset attack types used when training the first local models of the peripheral nodes. In one embodiment, the sample generation module 510 can be used to perform the operation S210 described above, which will not be repeated here.

[0144] The sample sending module 520 is used to send a sample set consisting of updated samples and virtual samples to multiple peripheral nodes, so that the multiple peripheral nodes can adjust the model parameters of their respective first local models based on the sample set to obtain a second local model. The updated samples are samples corresponding to newly added target attack types. In one embodiment, the sample sending module 520 can be used to perform the operation S220 described above, which will not be repeated here.

[0145] The model update module 530 is used to update the traffic detection model based on the model parameters of each of the multiple second local models, thereby obtaining an updated traffic detection model. This updated model is then used to detect network traffic data and obtain detection results for the network traffic data. In one embodiment, the model update module 530 can be used to perform the operation S230 described above, which will not be repeated here.

[0146] According to an embodiment of the present invention, the network traffic data detection model update device 500 further includes a dimension expansion module, a sample processing module, a weight determination module, and a parameter adjustment module.

[0147] The dimension expansion module is used to expand the first output dimension of the first local model based on the updated label corresponding to the updated sample, so as to obtain the second output dimension.

[0148] The sample processing module is used to process each target sample in the sample set using a preset incremental model to obtain the probability distribution corresponding to the target sample, wherein the dimension of the probability distribution is consistent with the second output dimension.

[0149] The weight determination module is used to determine the sample weight of the target sample based on multiple probability values ​​in the probability distribution.

[0150] The parameter adjustment module is used to adjust the model parameters of the preset incremental model based on the sample weights, probability distributions, and labels corresponding to the target samples to obtain the second local model.

[0151] According to an embodiment of the present invention, the parameter adjustment module includes a category determination submodule, a loss determination submodule, a loss weighting submodule, and a parameter adjustment submodule.

[0152] The category determination submodule is used to determine the predicted classification of the target sample based on the probability distribution.

[0153] The loss determination submodule is used to determine the classification loss of the local model for the target sample based on the predicted classification and the label corresponding to the target sample.

[0154] The loss weighting submodule is used to determine the weighted loss based on the sample weights and classification loss.

[0155] The parameter adjustment submodule is used to adjust the model parameters of the preset incremental model based on the weighted loss to obtain the second local model.

[0156] According to an embodiment of the present invention, the model update module 530 includes a weight determination submodule and a model update submodule.

[0157] The weight determination submodule is used to determine the node weights of each of the multiple surrounding nodes based on the number of samples in their respective sample sets.

[0158] The model update submodule is used to update the model parameters of the traffic detection model based on the node weights of multiple surrounding nodes and the model parameters of the second local model, so as to obtain the updated traffic detection model.

[0159] According to an embodiment of the present invention, the weight determination submodule includes a quantity determination unit and a weight determination unit.

[0160] The quantity determination unit is used to determine the total number of samples based on multiple sample counts.

[0161] The weight determination unit is used to determine the weight of each neighboring node as the proportion of the number of samples of the neighboring nodes to the total number of samples.

[0162] According to an embodiment of the present invention, the network traffic data detection model update device 500 further includes a first parameter acquisition module, a first contribution determination module, a second parameter acquisition module, a second contribution determination module, a comprehensive contribution determination module, and a sample determination module.

[0163] The first parameter acquisition module is used to acquire, for each local sample of the surrounding nodes, the first model parameters before adjustment using the local samples and the second model parameters after adjustment using the local samples.

[0164] The first contribution determination module is used to determine the first contribution of local samples to the model parameters of the first local model based on the first model parameters and the second model parameters.

[0165] The second parameter acquisition module is used to acquire the third model parameters of the traffic detection model before adjustment using local samples and the fourth model parameters after adjustment using local samples.

[0166] The second contribution determination module is used to determine the second contribution of local samples to the model parameters of the traffic detection model based on the third and fourth model parameters.

[0167] The comprehensive contribution determination module is used to determine the contribution score of local samples to the model training process based on the first contribution score and the second contribution score.

[0168] The sample determination module is used to determine a reference sample from multiple local samples based on the contribution scores of each local sample.

[0169] According to an embodiment of the present invention, the sample generation module 510 includes a sample generation submodule, an initial sample generation submodule, a loss determination submodule, and a generator adjustment submodule.

[0170] The sample generation submodule is used to generate virtual samples corresponding to historical data features based on historical data features using a virtual sample generator.

[0171] The initial sample generation submodule is used to generate initial samples based on historical data features using the initial generator.

[0172] The loss determination submodule is used to determine the generation loss of the initial generator based on the initial samples, historical data features, and labels corresponding to the historical data features.

[0173] The generator tuning submodule is used to adjust the model parameters of the initial generator based on the generation loss to obtain a virtual sample generator.

[0174] According to an embodiment of the present invention, the loss determination submodule includes a feature extraction unit, a first loss determination unit, a classification unit, a second loss determination unit, a third loss determination unit, and a total loss determination unit.

[0175] The feature extraction unit is used to extract features from the initial sample to obtain the sample features of the initial sample.

[0176] The first loss determination unit is used to determine the feature consistency loss based on sample features and historical data features.

[0177] The classification unit is used to perform probability mapping on sample features to obtain the sample probability distribution corresponding to the initial sample and the classification result corresponding to the initial sample.

[0178] The second loss determination unit is used to determine the classification loss based on the classification results and the labels corresponding to the features of historical data.

[0179] The third loss determination unit is used to determine the boundary loss based on the sample probability distribution and a pre-set confidence interval.

[0180] The total loss determination unit is used to determine the generation loss based on feature consistency loss, classification loss, and boundary loss.

[0181] According to an embodiment of the present invention, the third loss determination unit includes a first value determination subunit and a second value determination subunit.

[0182] The first numerical determination subunit is used to determine the boundary loss as a preset value when the maximum value in the sample probability distribution is within a preset confidence interval.

[0183] The second numerical determination subunit is used to determine the boundary loss based on the boundary value between the maximum value and the preset confidence interval when the maximum value in the sample probability distribution is outside the preset confidence interval.

[0184] According to embodiments of the present invention, any plurality of modules in the sample generation module 510, sample transmission module 520, and model update module 530 may be combined into one module, or any one of these modules may be split into multiple modules. Alternatively, at least a portion of the functionality of one or more of these modules may be combined with at least a portion of the functionality of other modules and implemented in one module. According to embodiments of the present invention, at least one of the sample generation module 510, sample transmission module 520, and model update module 530 may be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the sample generation module 510, sample transmission module 520, and model update module 530 may be at least partially implemented as a computer program module, which, when run, can perform corresponding functions.

[0185] Figure 6 A block diagram of an electronic device suitable for implementing an update method for a network traffic data detection model according to an embodiment of the present invention is shown.

[0186] like Figure 6 As shown, an electronic device 600 according to an embodiment of the present invention includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage portion 608 into a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present invention.

[0187] RAM 603 stores various programs and data required for the operation of electronic device 600. Processor 601, ROM 602, and RAM 603 are interconnected via bus 604. Processor 601 executes various operations of the method flow according to embodiments of the present invention by executing programs in ROM 602 and / or RAM 603. It should be noted that the programs may also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 may also execute various operations of the method flow according to embodiments of the present invention by executing programs stored in said one or more memories.

[0188] According to an embodiment of the present invention, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to a bus 604. The electronic device 600 may also include one or more of the following components connected to the input / output (I / O) interface 605: an input section 606 including a keyboard, mouse, etc.; an output section 607 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 610 as needed so that computer programs read from it can be installed into the storage section 608 as needed.

[0189] The present invention also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of the present invention.

[0190] According to embodiments of the present invention, a computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of the present invention, a computer-readable storage medium may include ROM 602 and / or RAM 603 and / or one or more memories other than ROM 602 and RAM 603 described above.

[0191] Embodiments of the present invention also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the methods provided in the embodiments of the present invention.

[0192] When the computer program is executed by the processor 601, it performs the functions defined in the system / apparatus of this invention. According to embodiments of the invention, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0193] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 609, and / or installed from the removable medium 611. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0194] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, it performs the functions defined in the system of this embodiment of the invention. According to embodiments of the invention, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0195] According to embodiments of the present invention, program code for executing the computer programs provided in the embodiments of the present invention can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0196] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0197] Those skilled in the art will understand that the features described in the various embodiments of the present invention can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in the present invention. In particular, the features described in the various embodiments of the present invention can be combined and / or combined in various ways without departing from the spirit and teachings of the present invention. All such combinations and / or combinations fall within the scope of the present invention.

[0198] The embodiments of the present invention have been described above. However, these embodiments are merely illustrative and not intended to limit the scope of the invention. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of the invention, and all such substitutions and modifications should fall within the scope of the invention.

Claims

1. A method for updating a network traffic data detection model, characterized in that, The method includes: In response to updates in network attack types, virtual samples are generated using the central node of the traffic detection model based on historical data features. The traffic detection model is determined by the central node using federated learning techniques based on the first local models of multiple peripheral nodes. The historical data features are obtained by the peripheral nodes through feature extraction of reference samples. The reference samples are determined by the peripheral nodes from multiple local samples. The local samples are samples corresponding to existing preset attack types used when training the first local models of the peripheral nodes. A sample set consisting of the updated sample and the virtual sample is sent to multiple surrounding nodes, so that each of the surrounding nodes adjusts the model parameters of its respective first local model based on the sample set to obtain a second local model. The updated sample is a sample corresponding to a newly added target attack type. Based on the model parameters of each of the multiple second local models, the traffic detection model is updated to obtain an updated traffic detection model, so as to use the updated traffic detection model to detect network traffic data and obtain detection results for the network traffic data.

2. The method according to claim 1, characterized in that, The plurality of surrounding nodes adjust the model parameters of their respective first local models based on the sample set to obtain a second local model, including: Based on the updated label corresponding to the updated sample, the first output dimension of the first local model is expanded to obtain the second output dimension; For each target sample in the sample set, the target sample is processed using a preset incremental model to obtain a probability distribution corresponding to the target sample, wherein the dimension of the probability distribution is the same as the second output dimension; Based on multiple probability values ​​in the probability distribution, the sample weight of the target sample is determined; and Based on the sample weights, the probability distribution, and the labels corresponding to the target samples, the model parameters of the preset incremental model are adjusted to obtain the second local model.

3. The method according to claim 2, characterized in that, The sample weight is determined based on the maximum value among the plurality of probability values; The step of adjusting the model parameters of the preset incremental model based on the sample weights, the probability distribution, and the label corresponding to the target sample to obtain the second local model includes: Based on the probability distribution, the predicted classification of the target sample is determined; Based on the predicted classification and the label corresponding to the target sample, the classification loss of the local model for the target sample is determined; Based on the sample weights and the classification loss, a weighted loss is determined; and Based on the weighted loss, the model parameters of the preset incremental model are adjusted to obtain the second local model.

4. The method according to claim 1, characterized in that, The step of updating the traffic detection model based on the model parameters of each of the multiple second local models to obtain an updated traffic detection model includes: Based on the sample size of each of the surrounding nodes' sample sets, the node weights of each of the surrounding nodes are determined; and Based on the node weights of the surrounding nodes and the model parameters of the second local model, the model parameters of the traffic detection model are updated to obtain the updated traffic detection model.

5. The method according to claim 4, characterized in that, The step of determining the node weights of each of the multiple surrounding nodes based on the number of samples in their respective sample sets includes: The total number of samples is determined based on the multiple sample counts mentioned above; and For each of the surrounding nodes, the proportion of the number of samples of the surrounding nodes to the total number of samples is used as the node weight.

6. The method according to claim 1, characterized in that, The reference sample is determined in the following way: For each local sample of the surrounding nodes, obtain the first model parameters before adjustment using the local samples and the second model parameters after adjustment using the local samples; Based on the first model parameters and the second model parameters, determine the first contribution of the local sample to the model parameters of the first local model; Obtain the third model parameters of the traffic detection model before adjustment using the local samples and the fourth model parameters after adjustment using the local samples, respectively. Based on the third model parameters and the fourth model parameters, the second contribution of the local sample to the model parameters of the traffic detection model is determined; Based on the first contribution and the second contribution, the contribution score of the local sample to the model training process is determined; as well as The reference sample is determined from the multiple local samples based on their respective contribution scores.

7. The method according to claim 1, characterized in that, The process of generating virtual samples based on historical data features includes: Using a virtual sample generator, virtual samples corresponding to the historical data features are generated based on the historical data features. The virtual sample generator is obtained in the following way: Using an initial generator, initial samples are generated based on the features of the historical data; Based on the initial samples, the historical data features, and the labels corresponding to the historical data features, the generation loss of the initial generator is determined; and The model parameters of the initial generator are adjusted based on the generation loss to obtain the virtual sample generator.

8. The method according to claim 7, characterized in that, The step of determining the generation loss of the initial generator based on the initial sample, the historical data features, and the labels corresponding to the historical data features includes: Feature extraction is performed on the initial sample to obtain the sample features of the initial sample; Based on the sample features and the historical data features, determine the feature consistency loss; The sample features are subjected to probability mapping to obtain the sample probability distribution corresponding to the initial sample and the classification result corresponding to the initial sample; Based on the classification results and the labels corresponding to the historical data features, the classification loss is determined; Based on the sample probability distribution and the preset confidence interval, determine the boundary loss; and The generation loss is determined based on the feature consistency loss, the classification loss, and the boundary loss.

9. The method according to claim 8, characterized in that, The step of determining the boundary loss based on the sample probability distribution and the preset confidence interval includes: If the maximum value in the sample probability distribution falls within the preset confidence interval, the boundary loss is determined to be a preset value; and If the maximum value in the sample probability distribution is outside the preset confidence interval, the boundary loss is determined based on the boundary value between the maximum value and the preset confidence interval.

10. An update device for a network traffic data detection model, characterized in that, The device includes: The sample generation module is used to generate virtual samples in response to updates in network attack types by utilizing the central node of the traffic detection model and based on historical data features. The traffic detection model is determined by the central node using federated learning techniques based on the first local models of multiple peripheral nodes. The historical data features are obtained by the peripheral nodes through feature extraction of reference samples. The reference samples are determined by the peripheral nodes from multiple local samples. The local samples are samples corresponding to existing preset attack types used when training the first local models of the peripheral nodes. A sample sending module is used to send a sample set consisting of updated samples and the virtual samples to multiple peripheral nodes, so that the multiple peripheral nodes can adjust the model parameters of their respective first local models based on the sample set to obtain a second local model, wherein the updated samples are samples corresponding to the newly added target attack type; and The model update module is used to update the traffic detection model based on the model parameters of each of the multiple second local models to obtain an updated traffic detection model, so as to use the updated traffic detection model to detect network traffic data and obtain detection results for the network traffic data.

Images