Traffic classification method and device based on fog cloud cooperative distillation, equipment and storage medium

Abstract

The application belongs to the technical field of Internet of Things, and discloses a flow classification method and device based on fog-cloud collaborative distillation, equipment and storage medium. The original flow is input into the preset fog end model, the preset fog end model is trained based on the fog-cloud collaborative factor determined by the cloud recall rate of the preset cloud end model and the fog end recall rate of the initial fog end model, the performance difference of the preset cloud end model and the initial fog end model on various categories can be evaluated, the weak classification category of the initial fog end model can be accurately positioned, the soft label of the preset cloud end model is migrated to the weak classification category of the initial fog end model based on the fog-cloud collaborative factor, the distillation of the strong classification category is reduced or not, the weak category precision loss of the initial fog end model is compensated by the high performance of the preset cloud end model, so that the flow classification precision of the fog end model can be improved after the compression of the fog end model.

Description

Technical Field

[0001] This application relates to the field of Internet of Things (IoT) technology, and in particular to a flow classification method, apparatus, device, and storage medium based on fog-cloud co-distillation. Background Technology

[0002] In the field of intrusion detection for the Internet of Things (IoT), independent training and optimization refers to training the fog-end model and the cloud model independently, with results exchanged only through data transmission. After fog-end model compression, traditional fog-end model fine-tuning optimization involves adjusting the fog-end model using a small amount of local data, leading to a loss of accuracy in the fog-end model. Summary of the Invention

[0003] The main purpose of this application is to provide a flow classification method, apparatus, device and storage medium based on fog-cloud co-distillation, aiming to solve the technical problem of how to improve the flow classification accuracy of fog end models after fog end model compression.

[0004] To achieve the above objectives, this application provides a flow classification method based on fog-cloud co-distillation, which includes the following steps: Obtain the raw traffic corresponding to the IoT terminal; The original traffic is input into a preset fog terminal model to obtain the corresponding target traffic classification result. The preset fog terminal model is trained based on the fog-cloud co-factor determined by the cloud recall rate of the preset cloud model in each category and the fog terminal recall rate of the initial fog terminal model in each category.

[0005] Optionally, before inputting the raw traffic into a preset fog terminal model to obtain the corresponding target traffic classification result, the method further includes: Determine the sample classification result corresponding to the traffic sample; For any category in the sample classification results, determine the cloud recall rate of that category on the preset cloud model and the fog recall rate on the initial fog model; The fog-cloud synergy factor is determined based on the comparison between the cloud recall rate and the fog recall rate. A loss function is constructed based on the fog-cloud synergy factor, and the initial fog-end model is trained based on the loss function to obtain a preset fog-end model.

[0006] Optionally, determining the fog-cloud synergy factor based on the comparison result between the cloud-based recall rate and the fog-based recall rate includes: The cloud-based recall rate and the fog-based recall rate are compared to obtain the comparison result for this category; The category-level factor is determined based on the comparison results; The fog-cloud synergy factor is determined based on the category-level factor.

[0007] Optionally, determining the category-level factor based on the comparison result includes: If the comparison result shows that the fog-end recall rate is less than the cloud-end recall rate, determine the cloud-end probability output vector corresponding to the cloud-end model and the fog-end probability output vector corresponding to the fog-end model for that category. Calculate the probability output vector difference between the cloud probability output vector and the fog probability output vector, and determine the category-level factor based on the probability output vector difference; If the comparison result shows that the fog-end recall rate is greater than or equal to the cloud-end recall rate, the category-level factor is determined to be zero.

[0008] Optionally, the step of constructing a loss function based on the fog-cloud synergy factor and training the initial fog-end model based on the loss function to obtain a preset fog-end model includes: Determine the soft probability of the cloud at the preset temperature and the soft probability of the fog at the preset temperature for the preset cloud model; Differential distillation loss is determined based on the fog-cloud synergy factor, the cloud soft probability, and the fog-end soft probability; A loss function is constructed based on the differential distillation loss and cross-entropy loss; The initial fog terminal model is trained based on the loss function to obtain the preset fog terminal model.

[0009] Optionally, determining the cloud soft probability of the preset cloud model at a preset temperature and the fog soft probability of the initial fog end model at the preset temperature includes: Obtain the cloud score vector output by the preset cloud model and the fog score vector output by the initial fog model; The cloud soft probability corresponding to the preset cloud model is determined based on the cloud score vector and the preset temperature. The fog tip soft probability corresponding to the initial fog tip model is determined based on the fog tip score vector and the preset temperature.

[0010] Optionally, after inputting the raw traffic into a preset fog terminal model to obtain the corresponding target traffic classification result, the method further includes: Determine the target confidence level corresponding to the target traffic classification result; If the target confidence level is greater than or equal to a preset threshold, the target traffic classification result is taken as the final traffic classification result; If the target confidence level is less than a preset threshold, the original traffic is input into the preset cloud model to obtain the final traffic classification result.

[0011] Furthermore, to achieve the above objectives, this application also provides a flow classification device based on fog-cloud co-distillation, the flow classification device based on fog-cloud co-distillation comprising: The traffic acquisition module is used to acquire the raw traffic corresponding to the IoT terminal; The traffic classification module is used to input the raw traffic into a preset fog terminal model to obtain the corresponding target traffic classification result. The preset fog terminal model is trained based on the fog-cloud co-factor determined by the cloud recall rate of the preset cloud model in each category and the fog terminal recall rate of the initial fog terminal model in each category.

[0012] Furthermore, to achieve the above objectives, this application also proposes a flow classification device based on fog-cloud co-distillation, the flow classification device based on fog-cloud co-distillation comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the flow classification method based on fog-cloud co-distillation as described above.

[0013] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the flow classification method based on fog-cloud co-distillation as described above.

[0014] This application obtains the raw traffic corresponding to IoT terminals and then inputs it into a preset fog-end model to obtain the corresponding target traffic classification results. The preset fog-end model is trained based on the fog-cloud co-factor determined by the cloud recall rate of the preset cloud model in each category and the fog-end recall rate of the initial fog-end model in each category. By inputting the raw traffic into the preset fog-end model, which is trained based on the fog-cloud co-factor determined by the cloud recall rate of the preset cloud model and the fog-end recall rate of the initial fog-end model, this application can evaluate the performance difference between the preset cloud model and the initial fog-end model in each category, accurately locate the weak classification categories of the initial fog-end model, and selectively transfer the soft labels of the preset cloud model to the weak classification categories of the initial fog-end model based on the fog-cloud co-factor. Distillation is reduced or not performed on strong classification categories. The high performance of the preset cloud model is used to compensate for the accuracy loss of the weak categories of the initial fog-end model, thereby improving the traffic classification accuracy of the fog-end model after fog-end model compression. Attached Figure Description

[0015] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0016] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a flowchart illustrating the first embodiment of the flow classification method based on fog-cloud co-distillation in this application. Figure 2 This is a flowchart illustrating the second embodiment of the flow classification method based on fog-cloud co-distillation in this application. Figure 3 This is a flowchart illustrating the third embodiment of the flow classification method based on fog-cloud co-distillation in this application. Figure 4 This is a structural block diagram of the first embodiment of the flow classification device based on fog-cloud co-distillation in this application; Figure 5 This is a schematic diagram of the structure of a flow classification device based on fog-cloud co-distillation in the hardware operating environment of the embodiment of this application.

[0018] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0019] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0020] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0021] The main solution of this application embodiment is: to obtain the raw traffic corresponding to the Internet of Things terminal; to input the raw traffic into a preset fog terminal model to obtain the corresponding target traffic classification result. The preset fog terminal model is trained based on the fog-cloud co-factor determined by the cloud recall rate of the preset cloud model in each category and the fog terminal recall rate of the initial fog terminal model in each category.

[0022] In the field of intrusion detection for the Internet of Things (IoT), independent training and optimization refers to training the fog-end model and the cloud model independently, with results exchanged only through data transmission. After fog-end model compression, traditional fog-end model fine-tuning optimization involves adjusting the fog-end model using a small amount of local data, leading to a loss of accuracy in the fog-end model.

[0023] This application obtains the raw traffic corresponding to IoT terminals and then inputs it into a preset fog-end model to obtain the corresponding target traffic classification results. The preset fog-end model is trained based on the fog-cloud co-factor determined by the cloud recall rate of the preset cloud model in each category and the fog-end recall rate of the initial fog-end model in each category. By inputting the raw traffic into the preset fog-end model, which is trained based on the fog-cloud co-factor determined by the cloud recall rate of the preset cloud model and the fog-end recall rate of the initial fog-end model, this application can evaluate the performance difference between the preset cloud model and the initial fog-end model in each category, accurately locate the weak classification categories of the initial fog-end model, and selectively transfer the soft labels of the preset cloud model to the weak classification categories of the initial fog-end model based on the fog-cloud co-factor. Distillation is reduced or not performed on strong classification categories. The high performance of the preset cloud model is used to compensate for the accuracy loss of the weak categories of the initial fog-end model, thereby improving the traffic classification accuracy of the fog-end model after fog-end model compression.

[0024] It should be noted that the executing entity of this application can be a computing service device with data processing, network communication, and program execution functions, such as a computer, or an electronic device capable of performing the above functions, such as a flow classification device based on fog-cloud co-distillation. The following description uses a flow classification device based on fog-cloud co-distillation as an example to illustrate this embodiment and the following embodiments.

[0025] Based on this, embodiments of this application provide a flow classification method based on fog-cloud co-distillation, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the flow classification method based on fog-cloud co-distillation in this application.

[0026] In this embodiment, the flow classification method based on fog-cloud co-distillation includes the following steps: Step S10: Obtain the raw traffic corresponding to the IoT terminal.

[0027] Understandably, fog-cloud collaborative distillation is a model optimization method that combines knowledge distillation with fog-cloud collaborative mechanisms. Its core objective is to enable lightweight fog-based models to maintain low-latency inference while compensating for their performance shortcomings in weak classes through guidance from large cloud models. Fog-cloud collaborative distillation = knowledge distillation + differentiated guidance (only compensating for shortcomings) + fog-cloud dynamic collaborative inference. Raw traffic destined for or originating from IoT devices can be captured from network links. IoT devices can include smart cameras, smart home devices, etc. Raw traffic refers to unprocessed, complete network data packets, containing not only the actual data content (payload) sent by the IoT device but also header information from the data link layer, network layer, and transport layer (such as source / destination IP, MAC address, port number, protocol type, etc.).

[0028] Step S20: Input the original traffic into the preset fog terminal model to obtain the corresponding target traffic classification result. The preset fog terminal model is trained based on the fog-cloud co-factor determined by the cloud recall rate of the preset cloud model in each category and the fog terminal recall rate of the initial fog terminal model in each category.

[0029] It should be understood that in this embodiment, the raw traffic corresponding to the IoT terminal can be input into a preset fog terminal model to obtain the target traffic classification result corresponding to the raw traffic, which may include normal category, attack category, etc.

[0030] Understandably, the initial fog-end model has lower accuracy due to compression. In this embodiment, the initial fog-end model can be trained in conjunction with a preset cloud model. The cloud model is a large-scale, high-performance machine learning model deployed on a central cloud server, such as ResNet-50, BERT-Base, or VGG-16. The fog-end model is a lightweight model deployed on fog computing nodes, such as edge gateways, routers, or local servers, and is obtained by distillation and compression from the cloud model, such as MobileNetV3, TinyBERT, or EfficientNet-Lite.

[0031] In the specific implementation, after obtaining the cloud recall rate of the preset cloud model in each category and the fog recall rate of the initial fog model in each category, the performance difference between the preset cloud model and the initial fog model in each category can be evaluated. Then, based on the cloud recall rate and the fog recall rate, the fog-cloud collaboration factor is determined. Then, based on the fog-cloud collaboration factor, the initial fog model is trained to obtain the preset fog model. Thus, the original traffic can be classified based on the trained preset fog model to obtain the traffic classification result.

[0032] This embodiment obtains the raw traffic corresponding to IoT terminals and inputs it into a preset fog-end model to obtain the corresponding target traffic classification results. The preset fog-end model is trained based on the fog-cloud co-factor determined by the cloud recall rate of the preset cloud model in each category and the fog recall rate of the initial fog-end model in each category. By inputting the raw traffic into the preset fog-end model, which is trained based on the fog-cloud co-factor determined by the cloud recall rate of the preset cloud model and the fog recall rate of the initial fog-end model, this embodiment can evaluate the performance difference between the preset cloud model and the initial fog-end model in each category, accurately locate the weak classification categories of the initial fog-end model, and transfer the soft labels of the preset cloud model to the weak classification categories of the initial fog-end model based on the fog-cloud co-factor. Distillation is reduced or not performed on strong classification categories. The high performance of the preset cloud model is used to compensate for the accuracy loss of the weak categories of the initial fog-end model, thereby improving the traffic classification accuracy of the fog-end model after fog-end model compression.

[0033] refer to Figure 2 , Figure 2 This is a flowchart illustrating the second embodiment of the flow classification method based on fog-cloud co-distillation in this application.

[0034] Based on the first embodiment described above, in this embodiment, before step S20, the method further includes: Step S01: Determine the sample classification result corresponding to the traffic sample.

[0035] Understandably, the traffic samples can be from the CICIDS-2017 dataset. For all traffic samples in this dataset, the corresponding categories can be labeled as the sample classification results.

[0036] Step S02: For any category in the sample classification results, determine the cloud recall rate of that category on the preset cloud model and the fog recall rate on the initial fog model.

[0037] It should be understood that the sample classification results may include several categories, for example, category A: normal traffic; category B: DDoS attack; category C: brute force attack; category D: web attack; category E: botnet.

[0038] Understandably, for any category, the cloud recall rate R_k,C on the preset cloud model and the fog recall rate R_k,F on the initial fog model can be determined. Recall rate is the number of samples correctly predicted as positive / the total number of samples that are actually positive. For example, if the actual category is B, the preset cloud model predicts 95 samples as category B and 5 samples as other categories, then the cloud recall rate is 95 / 100 = 95%. Similarly, the fog recall rate of each category on the initial fog model can be calculated in the same way.

[0039] Step S03: Determine the fog-cloud synergy factor based on the comparison result between the cloud recall rate and the fog recall rate.

[0040] It should be understood that the cloud-based recall rate and the fog-based recall rate can be compared. If the cloud-based recall rate is higher than the fog-based recall rate, it indicates that the category is a weak category, and the initial fog-based model has missed many detections in this category, requiring cloud knowledge to compensate. If the cloud-based recall rate is lower than the fog-based recall rate, it indicates that the category is not a weak category, and the initial fog-based model has met the requirements, requiring no special processing. The fog-cloud synergy factor is then determined based on the comparison results between the cloud-based and fog-based recall rates.

[0041] Furthermore, in order to calculate the fog-cloud synergy factor, in this embodiment, step S203 includes: comparing the cloud recall rate and the fog recall rate to obtain a comparison result for the category; determining a category-level factor based on the comparison result; and determining the fog-cloud synergy factor based on the category-level factor.

[0042] Understandably, cloud recall and fog recall can be compared, and category-level factors can be determined based on the comparison results for that category.

[0043] In a specific implementation, the fog-cloud synergy factor σ_i can be calculated based on the category-level factor μ_k. In one feasible embodiment, y_i is the true category label of sample i, achieving sample-level precise guidance.

[0044] This embodiment combines the category-level co-operation factor μ with the sample label to obtain the sample-level co-operation factor, namely the fog / cloud co-operation factor. This approach enables precise distillation guidance for each sample, allowing FM to focus on learning difficult samples within weak categories. Sample-level guidance is necessary because different samples within the same category have varying prediction difficulties. Category-level factors alone cannot accurately focus on difficult samples, such as boundary attack traffic. Sample-level factors allow FM to specifically learn samples prone to misclassification, further improving the accuracy compensation effect for weak categories. This guidance effect is significant, improving the classification accuracy of difficult samples in weak categories by more than 20%, reducing the overall misclassification rate of FM by 29%, and further improving the consistency of the fog cloud model results.

[0045] Furthermore, in order to calculate the category-level factor, in this embodiment, determining the category-level factor based on the comparison result includes: when the comparison result is that the fog-end recall rate is less than the cloud-end recall rate, determining the cloud probability output vector corresponding to the category in the cloud model and the fog-end probability output vector corresponding to the fog-end model; calculating the probability output vector difference between the cloud-end probability output vector and the fog-end probability output vector, and determining the category-level factor based on the probability output vector difference; when the comparison result is that the fog-end recall rate is greater than or equal to the cloud-end recall rate, determining the category-level factor to be zero.

[0046] It should be understood that if the fog-end recall rate is lower than the cloud-end recall rate, it indicates that the category is a weak category. The cloud-end probability output vector and the fog-end probability output vector corresponding to this category in the cloud-end model can be determined. The probability output vector refers to the probability distribution obtained by the model after normalizing the original score vector using the Softmax function. The calculation formula is: ,in, Let be the probability output vector for the j-th class. It is the original score vector of the j-th category. Given the dimension of the original score vector, the cloud probability output vector and the fog probability output vector can be calculated using this formula.

[0047] Understandably, the probability output vector difference between the cloud-based probability output vector P_i,C and the fog-end probability output vector P_i,F can be calculated, and the category-level factor μ_k can be determined based on the probability output vector difference. The calculation formula is expressed as: μ_k= , Let k be the number of samples in category k.

[0048] In practice, if the comparison result shows that the fog-end recall rate is greater than or equal to the cloud-end recall rate, the category-level factor can be determined to be zero.

[0049] This embodiment designs a fog-cloud synergy factor μ=[μ_1,μ_2,…,μ_ K+1 This design dynamically adapts to performance differences across categories, enabling targeted knowledge transfer from the cloud. The dynamic co-factor is designed because after compression of the fog-end model FM, different categories experience varying accuracy losses. For some categories, compression alleviates overfitting and improves accuracy, while for others, accuracy significantly decreases. Indiscriminate distillation wastes computational resources and yields poor results. The dynamic factor allows FM to address specific deficiencies. The calculation logic of the μ factor is as follows: for category k, if the accuracy (R_k, C) of the cloud model CM is better than the accuracy (R_k, F) of FM, then μ_k is the 2-norm average of the difference in predicted probabilities between the two models, focusing on the weaker category for reinforcement learning. If the accuracy of FM is better than CM, then μ_k = 0, no distillation is performed, and the inherent advantages of FM are preserved. This design is highly effective, improving the accuracy of FM in weaker categories by over 10%, reducing the overall accuracy loss from over 15% to below 3%, improving the consistency of fog-cloud model results by 40%, and reducing the frequency of cloud-end re-examination by 50%.

[0050] Step S04: Construct a loss function based on the fog-cloud synergy factor, and train the initial fog-end model based on the loss function to obtain a preset fog-end model.

[0051] Furthermore, in order to construct the loss function, in this embodiment, step S204 includes: determining the cloud soft probability of the preset cloud model at a preset temperature and the fog soft probability of the initial fog model at the preset temperature; determining the differential distillation loss based on the fog-cloud synergy factor, the cloud soft probability, and the fog soft probability; constructing a loss function based on the differential distillation loss and the cross-entropy loss; and training the initial fog model based on the loss function to obtain the preset fog model.

[0052] Understandably, the soft probabilities p_i,C^τ of the cloud model at a preset temperature τ and the soft probabilities p_i,F^τ of the fog tip model at a preset temperature τ can be determined. Based on the fog-cloud synergy factor σ_i, the cloud soft probabilities, and the fog tip soft probabilities, the differentiated distillation loss L_dist is determined using the following formula: .

[0053] It should be understood that the cross-entropy loss L_ce = -log(p c ), p c It represents the initial fog-end model's predicted probability of the true class.

[0054] In practical implementation, a loss function can be constructed based on the differential distillation loss and cross-entropy loss. α represents the weight, which can be set according to the actual situation, preferably 0.3. The initial fog-end model is then trained based on the loss function, iteratively optimizing the FM weights θ_F* until the model converges. The number of iterations can be set to 50. The number of iterations is chosen to be 50 because 30 iterations may not result in sufficient convergence, 70 iterations increase the risk of overfitting, and 50 iterations stabilize the FM accuracy, achieving optimal training efficiency. The expected result is that the FM weights are fully optimized, achieving optimal accuracy, and reducing training costs by 20%.

[0055] This embodiment constructs a hybrid loss function combining cross-entropy loss and differential distillation loss. A balancing factor α adjusts the weights of the two types of losses, ensuring both the fit of FM to local data and fully utilizing the soft labeling advantage (cloud-based knowledge) of CM. A hybrid loss function is used because cross-entropy loss alone cannot leverage the high-performance guidance of CM, and FM struggles to compensate for the weak-class limitations caused by compression. Distillation loss alone leads to FM over-reliance on CM, losing its own adaptability to local data. The hybrid loss function preserves advantages while mitigating weaknesses. The loss function formula is as follows: Where L_dist is the differential distillation loss based on the μ factor, α=0.3, which has been experimentally verified as the optimal equilibrium value. Let p_i,C^τ and p_i,F^τ be the soft probabilities of CM and FM at temperature τ, and σ_i be the sample-level co-operation factor. This function shows significant improvement, increasing the F1 score of FM from 85% to 90.23% and improving the recall rate for rare attack categories by over 15%, avoiding missed detections of niche attacks due to compression. The loss balance factor α is set to 0.3. This value is chosen because when α=0.1, the distillation loss accounts for too high a proportion, causing FM to over-rely on CM; when α=0.5, the cross-entropy loss accounts for too high a proportion, resulting in insufficient distillation effect. 0.3 is the optimal balance value, aiming to balance the fit of FM itself and the knowledge transfer of CM, with minimal accuracy loss.

[0056] Furthermore, in order to calculate the cloud soft probability and the fog soft probability, in this embodiment, determining the cloud soft probability of the preset cloud model at a preset temperature and the fog soft probability of the initial fog model at the preset temperature includes: obtaining the cloud score vector output by the preset cloud model and the fog score vector output by the initial fog model; determining the cloud soft probability corresponding to the preset cloud model based on the cloud score vector and the preset temperature; and determining the fog soft probability corresponding to the initial fog model based on the fog score vector and the preset temperature.

[0057] Understandably, the raw outputs of the classification layer (fully connected layer) of the preset cloud model and the initial fog model can be obtained without Softmax normalization. For K categories, the score vector can be a K-dimensional vector, thus obtaining the cloud score vector and the fog score vector.

[0058] It should be understood that after dividing the cloud score vector by the preset temperature, the resulting vector is subjected to exponential operation, and then all the results are summed. Finally, each result is divided by the summation to obtain the cloud soft probability. For example, if there are 5 traffic categories, and the preset cloud model outputs a cloud score vector for a certain sample: zc=[4.5,2.0,1.2,0.5,0.1], assuming the preset temperature is 10, zc / 10=[0.45,0.20,0.12,0.05,0.01]. Then, exponential operation is performed, e... 0.45 =1.568, e 0.20 =1.221, e 0.12 =1.127, e 0.05 =1.051, e 0.01 =1.010, then sum them up: sum = 1.568 + 1.221 + 1.127 + 1.051 + 1.010 = 5.977, then divide by the sum to get the cloud soft probabilities [0.262, 0.204, 0.189, 0.176, 0.169]. Similarly, the fog soft probabilities corresponding to the initial fog model can be obtained in the same way.

[0059] The distillation temperature τ is set to 10. This value was chosen because if the temperature is too low (<5), the soft label differentiation is insufficient; if the temperature is too high (>15), the soft label noise is too large. 10 allows the soft label to retain category differences while conveying rich cloud knowledge. The expected effect is to improve the effectiveness of distillation guidance, with a more significant improvement in the accuracy of weak categories.

[0060] This embodiment determines the sample classification result corresponding to the traffic sample. For any category in the sample classification result, it determines the cloud recall rate of that category on the preset cloud model and the fog recall rate on the initial fog model. Then, it determines the fog-cloud collaboration factor based on the comparison result between the cloud recall rate and the fog recall rate. A loss function is then constructed based on the fog-cloud collaboration factor, and the initial fog model is trained based on the loss function to obtain the preset fog model. This embodiment determines the fog-cloud collaboration factor based on the comparison result between the cloud recall rate and the fog recall rate, which can improve the weak class precision of the fog model. Furthermore, constructing a loss function based on the fog-cloud collaboration factor and training the initial fog model based on the loss function can improve the precision and recall rate of the preset fog model, thereby improving overall performance.

[0061] refer to Figure 3 , Figure 3 This is a flowchart illustrating the third embodiment of the flow classification method based on fog-cloud co-distillation in this application.

[0062] Based on the above embodiments, in this embodiment, after step S20, the method further includes: Step S30: Determine the target confidence level corresponding to the target traffic classification result.

[0063] Understandably, by inputting the raw traffic into the preset fog terminal model, the corresponding target traffic classification result can be obtained, and the target confidence level of the target traffic classification result can be determined. The target confidence level can reflect the accuracy of the target traffic classification result.

[0064] Step S40: If the target confidence level is greater than or equal to a preset threshold, the target traffic classification result is taken as the final traffic classification result.

[0065] It should be understood that when the target confidence level is greater than or equal to the preset threshold, it indicates that the target traffic classification result is relatively accurate, and the target traffic classification result can be directly used as the final traffic classification result.

[0066] Step S50: If the target confidence level is less than a preset threshold, the original traffic is input into the preset cloud model to obtain the final traffic classification result.

[0067] Understandably, if the target confidence level is less than the preset threshold, it indicates that the target traffic classification result is not very accurate. In this case, the original traffic can be input into the preset cloud model so that the preset cloud model can classify the original traffic and obtain the final traffic classification result.

[0068] The application scenarios of this embodiment can include: 1. Industrial Internet of Things (IIoT) scenario: The application environment is an industrial network containing various niche industrial protocol attacks, such as Modbus data tampering and Profinet denial-of-service attacks. FM compression has low detection accuracy for these attacks, with a recall rate of <70%, requiring precise compensation. This scenario is suitable for this invention because through collaborative distillation, the recall rate of niche attacks is increased to over 85%, and the false negative rate of industrial network attacks is reduced from 8% to 1.2%, avoiding production safety accidents caused by attacks. At the same time, the consistency of the fog-cloud model is improved by 40%, and the cloud re-inspection traffic is reduced by 50%, without occupying industrial network bandwidth. 2. Smart home scenario: The application environment is a home network where common attacks, such as brute-force attacks and port scanning, coexist with rare attacks, such as device hijacking and privacy theft. FM compression has weak detection capability for rare attacks, easily resulting in false negatives. This scenario is suitable for this application because the detection accuracy of rare attacks is improved by 20%, the consistency of fog-cloud model results is improved by 40%, the proportion of cloud re-inspection traffic is reduced from 30% to 15%, bandwidth consumption is reduced by 50%, it does not affect the normal use of the home network, and high-confidence attacks are quickly alerted locally, protecting user privacy and security. 3. In smart city edge scenarios, the application environment requires edge nodes to handle more than 33 attack types, such as DDoS, DoS, and Recon. After FM compression, the accuracy of some attack categories varies greatly, with a standard deviation of up to 15%, requiring differentiated optimization. This scenario is suitable for this invention because the standard deviation of detection accuracy for each category is reduced from 15% to 5%, and the overall F1 score is improved to over 95%, adapting to complex attack scenarios. Distillation training efficiency is 30% higher than traditional distillation, reducing the training cost of edge nodes and making it suitable for large-scale deployment. In terms of accuracy, the F1 score of FM is improved from 85% to 90.23%, the accuracy of weak classes is improved by more than 10%, and the overall accuracy loss is controlled within 3%, reaching 99.5% of the accuracy of cloud models. In terms of collaborative optimization, the consistency of fog-cloud model results is improved by 40%, the proportion of cloud re-inspection traffic is reduced from 30% to 15%, bandwidth consumption is reduced by 50%, and latency is further optimized. In terms of efficiency, distillation training efficiency is 30% higher than traditional distillation, the number of iterations is reduced by 20%, the training cost is reduced, and it adapts to the limited computing resources of fog endpoints.

[0069] This embodiment determines the target confidence level corresponding to the target traffic classification result. If the target confidence level is greater than or equal to a preset threshold, the target traffic classification result is used as the final traffic classification result. If the target confidence level is less than the preset threshold, the original traffic is input into a preset cloud model to obtain the final traffic classification result. This embodiment improves the accuracy of traffic classification by comparing the target confidence level with the preset threshold and determining the final traffic classification result based on the comparison result.

[0070] Reference Figure 4 , Figure 4This is a structural block diagram of the first embodiment of the flow classification device based on fog-cloud co-distillation of this application.

[0071] like Figure 4 As shown, the flow classification device based on fog-cloud co-distillation proposed in this application includes: Traffic acquisition module 10 is used to acquire the raw traffic corresponding to the IoT terminal; Traffic classification module 20 is used to input the original traffic into a preset fog terminal model to obtain the corresponding target traffic classification result. The preset fog terminal model is trained based on the fog-cloud co-factor determined by the cloud recall rate of the preset cloud model in each category and the fog terminal recall rate of the initial fog terminal model in each category.

[0072] This embodiment obtains the raw traffic corresponding to IoT terminals and inputs it into a preset fog-end model to obtain the corresponding target traffic classification results. The preset fog-end model is trained based on the fog-cloud co-factor determined by the cloud recall rate of the preset cloud model in each category and the fog recall rate of the initial fog-end model in each category. By inputting the raw traffic into the preset fog-end model, which is trained based on the fog-cloud co-factor determined by the cloud recall rate of the preset cloud model and the fog recall rate of the initial fog-end model, this embodiment can evaluate the performance difference between the preset cloud model and the initial fog-end model in each category, accurately locate the weak classification categories of the initial fog-end model, and transfer the soft labels of the preset cloud model to the weak classification categories of the initial fog-end model based on the fog-cloud co-factor. Distillation is reduced or not performed on strong classification categories. The high performance of the preset cloud model is used to compensate for the accuracy loss of the weak categories of the initial fog-end model, thereby improving the traffic classification accuracy of the fog-end model after fog-end model compression.

[0073] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of this application. In practical applications, those skilled in the art can select some or all of it to achieve the purpose of this embodiment according to actual needs, and no restrictions are imposed here.

[0074] In addition, for technical details not described in detail in this embodiment, please refer to the flow classification method based on fog-cloud co-distillation provided in any embodiment of this application, which will not be repeated here.

[0075] Based on the first embodiment of the flow classification device based on fog and cloud co-distillation described in this application, a second embodiment of the flow classification device based on fog and cloud co-distillation is proposed.

[0076] In this embodiment, the traffic classification device based on fog-cloud co-distillation further includes a model building module, used to determine the sample classification result corresponding to the traffic sample; for any category in the sample classification result, determine the cloud recall rate of the category on the preset cloud model and the fog recall rate on the initial fog model; determine the fog-cloud co-distillation factor based on the comparison result between the cloud recall rate and the fog recall rate; construct a loss function based on the fog-cloud co-distillation factor, and train the initial fog model based on the loss function to obtain the preset fog model.

[0077] Furthermore, the model building module is also used to compare the cloud recall rate and the fog recall rate to obtain the comparison result of the category; determine the category-level factor based on the comparison result; and determine the fog-cloud synergy factor based on the category-level factor.

[0078] Furthermore, the model building module is also used to determine the cloud probability output vector corresponding to the cloud model and the fog probability output vector corresponding to the fog model when the comparison result is that the fog recall rate is less than the cloud recall rate; calculate the probability output vector difference between the cloud probability output vector and the fog probability output vector, and determine the category-level factor based on the probability output vector difference; and determine the category-level factor as zero when the comparison result is that the fog recall rate is greater than or equal to the cloud recall rate.

[0079] Furthermore, the model building module is also used to determine the cloud soft probability of the preset cloud model at a preset temperature and the fog soft probability of the initial fog model at the preset temperature; determine the differential distillation loss based on the fog-cloud synergy factor, the cloud soft probability, and the fog soft probability; construct a loss function based on the differential distillation loss and the cross-entropy loss; and train the initial fog model based on the loss function to obtain the preset fog model.

[0080] Furthermore, the model building module is also used to obtain the cloud score vector output by the preset cloud model and the fog score vector output by the initial fog model; determine the cloud soft probability corresponding to the preset cloud model based on the cloud score vector and the preset temperature; and determine the fog soft probability corresponding to the initial fog model based on the fog score vector and the preset temperature.

[0081] Furthermore, the traffic classification module 20 is also used to determine the target confidence level corresponding to the target traffic classification result; if the target confidence level is greater than or equal to a preset threshold, the target traffic classification result is used as the final traffic classification result; if the target confidence level is less than the preset threshold, the original traffic is input into the preset cloud model to obtain the final traffic classification result.

[0082] Other embodiments or specific implementations of the flow classification device based on fog-cloud co-distillation in this application can be found in the above-described method embodiments, and will not be repeated here.

[0083] This application provides a flow classification device based on fog-cloud co-distillation. The flow classification device based on fog-cloud co-distillation includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the flow classification method based on fog-cloud co-distillation in the above embodiment 1.

[0084] The following is for reference. Figure 5 The diagram illustrates a structural schematic of a flow classification device based on fog-cloud co-distillation suitable for implementing embodiments of this application. The flow classification device based on fog-cloud co-distillation in the embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 5 The flow classification device based on fog cloud co-distillation shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0085] like Figure 5As shown, the flow classification device based on fog-cloud co-distillation may include a processing unit 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 1002 or a program loaded from storage device 1003 into random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the flow classification device based on fog-cloud co-distillation. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to I / O interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the flow classification device based on fog-cloud co-distillation to communicate wirelessly or wiredly with other devices to exchange data. Although the figure shows a flow classification device based on fog-cloud co-distillation with various systems, it should be understood that it is not required to implement or possess all the systems shown. More or fewer systems can be implemented alternatively.

[0086] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0087] The flow classification device based on fog-cloud co-distillation provided in this application, employing the flow classification method based on fog-cloud co-distillation in the above embodiments, can solve the technical problem of how to improve the flow classification accuracy of the fog-end model after fog-end model compression. Compared with the prior art, the beneficial effects of the flow classification device based on fog-cloud co-distillation provided in this application are the same as those of the flow classification method based on fog-cloud co-distillation provided in the above embodiments, and other technical features in this flow classification device based on fog-cloud co-distillation are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0088] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0089] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0090] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the flow classification method based on fog-cloud co-distillation in the above embodiments.

[0091] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0092] The aforementioned computer-readable storage medium may be included in a flow classification device based on fog-cloud co-distillation; or it may exist independently and not assembled into a flow classification device based on fog-cloud co-distillation.

[0093] The aforementioned computer-readable storage medium carries one or more programs. When the aforementioned one or more programs are executed by the traffic classification device based on fog-cloud co-distillation, the traffic classification device based on fog-cloud co-distillation: acquires the raw traffic corresponding to the Internet of Things terminal; inputs the raw traffic into a preset fog-end model to obtain the corresponding target traffic classification result. The preset fog-end model is trained based on fog-cloud co-distillation factors determined by the cloud recall rate of the preset cloud model in each category and the fog-end recall rate of the initial fog-end model in each category.

[0094] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include object-oriented programming languages—such as Python, Java, Smalltalk, and C++—and conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0095] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0096] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0097] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described flow classification method based on fog-cloud co-distillation. This solves the technical problem of improving the flow classification accuracy of fog-end models after fog-end model compression. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the flow classification method based on fog-cloud co-distillation provided in the above embodiments, and will not be repeated here.

[0098] The above description is only a part of the embodiments of this application and does not limit the scope of protection of this application. All equivalent structural transformations made under the technical concept of this application and using the content of this application specification and drawings, or direct / indirect applications in other related technical fields, are included in the scope of protection of this application.

Claims

1. A flow classification method based on fog-cloud synergistic distillation, characterized in that, The flow classification method based on fog-cloud co-distillation includes the following steps: Obtain the raw traffic corresponding to the IoT terminal; The original traffic is input into the preset fog terminal model to obtain the corresponding target traffic classification result. The preset fog terminal model is trained based on the fog cloud co-factor determined by the cloud recall rate of the preset cloud model in each category and the fog terminal recall rate of the initial fog terminal model in each category. The method for determining the fog-cloud synergy factor is as follows: The cloud-based recall rate and the fog-based recall rate are compared to obtain the comparison result for this category; The category-level factor is determined based on the comparison results; The fog-cloud synergy factor is determined based on the category-level factor; The step of determining the category-level factor based on the comparison result includes: If the comparison result shows that the fog-end recall rate is less than the cloud-end recall rate, determine the cloud-end probability output vector corresponding to the cloud-end model and the fog-end probability output vector corresponding to the fog-end model for that category. Calculate the probability output vector difference between the cloud probability output vector and the fog probability output vector, and determine the category-level factor based on the probability output vector difference; If the comparison result shows that the fog-end recall rate is greater than or equal to the cloud-end recall rate, the category-level factor is determined to be zero.

2. The flow classification method based on fog-cloud co-distillation as described in claim 1, characterized in that, Before inputting the raw traffic into the preset fog terminal model to obtain the corresponding target traffic classification result, the method further includes: Determine the sample classification result corresponding to the traffic sample; For any category in the sample classification results, determine the cloud recall rate of that category on the preset cloud model and the fog recall rate on the initial fog model; The fog-cloud synergy factor is determined based on the comparison between the cloud recall rate and the fog recall rate. A loss function is constructed based on the fog-cloud synergy factor, and the initial fog-end model is trained based on the loss function to obtain a preset fog-end model.

3. The flow classification method based on fog-cloud co-distillation as described in claim 2, characterized in that, The step of constructing a loss function based on the fog-cloud synergy factor and training the initial fog-end model based on the loss function to obtain a preset fog-end model includes: Determine the soft probability of the cloud at the preset temperature and the soft probability of the fog at the preset temperature for the preset cloud model; Differential distillation loss is determined based on the fog-cloud synergy factor, the cloud soft probability, and the fog-end soft probability; A loss function is constructed based on the differential distillation loss and cross-entropy loss; The initial fog terminal model is trained based on the loss function to obtain the preset fog terminal model.

4. The flow classification method based on fog-cloud co-distillation as described in claim 3, characterized in that, Determining the cloud soft probability of the preset cloud model at a preset temperature and the fog soft probability of the initial fog end model at the preset temperature includes: Obtain the cloud score vector output by the preset cloud model and the fog score vector output by the initial fog model; The cloud soft probability corresponding to the preset cloud model is determined based on the cloud score vector and the preset temperature. The fog tip soft probability corresponding to the initial fog tip model is determined based on the fog tip score vector and the preset temperature.

5. The flow classification method based on fog-cloud co-distillation as described in any one of claims 1 to 4, characterized in that, After inputting the raw traffic into the preset fog terminal model to obtain the corresponding target traffic classification result, the method further includes: Determine the target confidence level corresponding to the target traffic classification result; If the target confidence level is greater than or equal to a preset threshold, the target traffic classification result is taken as the final traffic classification result; If the target confidence level is less than a preset threshold, the original traffic is input into the preset cloud model to obtain the final traffic classification result.

6. A flow classification device based on fog-cloud co-distillation, characterized in that, The flow classification device based on fog-cloud co-distillation includes: The traffic acquisition module is used to acquire the raw traffic corresponding to the IoT terminal; The traffic classification module is used to input the original traffic into the preset fog terminal model to obtain the corresponding target traffic classification result. The preset fog terminal model is trained based on the fog cloud co-factor determined by the cloud recall rate of the preset cloud model in each category and the fog terminal recall rate of the initial fog terminal model in each category. The traffic classification device based on fog-cloud co-distillation further includes a model building module, used to compare the cloud recall rate and the fog recall rate to obtain the comparison result of the category; determine the category-level factor based on the comparison result; and determine the fog-cloud co-distillation factor based on the category-level factor. The model building module is further configured to: determine the cloud probability output vector corresponding to the cloud model and the fog probability output vector corresponding to the fog model when the comparison result is that the fog recall rate is less than the cloud recall rate; calculate the probability output vector difference between the cloud probability output vector and the fog probability output vector, and determine the category-level factor based on the probability output vector difference; and determine the category-level factor as zero when the comparison result is that the fog recall rate is greater than or equal to the cloud recall rate.

7. A flow classification device based on fog-cloud co-distillation, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the flow classification method based on fog-cloud co-distillation as described in any one of claims 1 to 5.

8. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the flow classification method based on fog-cloud co-distillation as described in any one of claims 1 to 5.

Images