A multi-level cooperative attack detection method based on a multi-modal large model and a decision tree

Abstract

This invention relates to the field of network security and intrusion detection, and provides a multi-level collaborative attack detection method based on a multimodal large model and decision tree. Its features include the following steps: Step 1: Real-time monitoring and preliminary screening at the edge layer; the edge layer, as the front end of the architecture, utilizes the speed advantage of a lightweight model to process massive amounts of data; Step 2: Data aggregation and multimodal construction at the aggregation layer; the aggregation layer, as an intermediate link, is responsible for data standardization and modality conversion, preparing for core layer analysis; Step 3: In-depth multimodal analysis and alerting at the core layer; the core layer utilizes the in-depth analysis capabilities of the large model to accurately characterize complex traffic; Step 4: Multi-level feedback and adaptive model updates. This invention achieves efficient collaboration through hierarchical functional complementarity: the edge layer deploys a lightweight CART decision tree model, responsible for real-time monitoring and rapid preliminary screening, effectively reducing the pressure on subsequent processing; it also enables accurate judgment of attack types.

Description

Technical Field

[0001] This invention relates to the field of network security and intrusion detection technology, specifically to a multi-level collaborative attack detection method based on a multimodal large model and decision tree. Background Technology

[0002] In today's digital age, the internet is deeply integrated into all aspects of society, resulting in a complex and diverse network environment. While normal network traffic constitutes the main body of routine operations, network attack methods are increasingly evolving towards diversification and complexity. Advanced Persistent Threat (APT) attacks, through long-term infiltration and meticulous planning, gradually infiltrate and steal sensitive information. Their behavioral patterns are highly similar to normal activities, often evading traditional rule-based detection. Distributed Denial-of-Service (DDoS) attacks, on the other hand, use botnets to exhaust target resources, severely threatening service availability.

[0003] However, existing attack detection technologies have significant limitations in dealing with the aforementioned complex threats: The lag of rule-based detection methods: Traditional port and signature detection heavily relies on preset rules. Faced with dynamically changing attack methods (such as malware using dynamic port communication or encrypted hiding features), static rules quickly become ineffective, leading to a large number of missed detections.

[0004] Real-time performance and black-box issues in Large Language Model (LLM) detection: While LLM excels in deep parsing of system logs and text, its extremely high computational complexity and large processing latency make it unsuitable for real-time monitoring of large-scale network traffic. Furthermore, LLM demands significant computing resources, resulting in high deployment costs, and its decision-making process is like a "black box," making it difficult for security administrators to understand the basis of their judgments. More seriously, the scarcity of high-quality training data and data noise may cause the model to produce hallucinations or false alarms when facing new types of attacks.

[0005] The generalization bottleneck of traditional machine learning models: Machine learning models struggle to capture subtle differences in attack characteristics and are prone to misjudgment when malware traffic resembles normal software update traffic. Furthermore, limited by the distribution of training data, the model's generalization ability drops significantly when faced with novel, unseen attacks or environmental changes, and it suffers from computational bottlenecks under large-scale traffic.

[0006] The shortcomings of existing collaborative technologies: Existing attempts such as HorusEye have achieved binary classification detection in the switch plane, but they are difficult to deal with complex multi-class attack scenarios; Kitsune is limited by the throughput of the control plane and has detection latency; Mousika relies on a large number of high-quality anomaly datasets and is difficult to deal with unknown attacks.

[0007] In conclusion, a single detection model can no longer balance real-time performance and accuracy, and there is an urgent need for a multi-level collaborative technology that can combine the speed advantage of lightweight models with the deep analysis capabilities of large models. Summary of the Invention

[0008] To address the aforementioned technical problems, this invention aims to provide a multi-level collaborative attack detection method based on a multimodal large model and decision tree. To solve these problems, this invention employs the following technical solution: A multi-level collaborative attack detection method based on a multimodal large model and decision tree includes the following steps: Step 1: Real-time monitoring and preliminary screening of the edge layer; The edge layer, as the front end of the architecture, leverages the speed advantage of the lightweight model to process massive amounts of data; Step 2: Data aggregation and multimodal construction at the aggregation layer; the aggregation layer, as an intermediate link, is responsible for data standardization and modality transformation, preparing for core layer analysis; Step 3: Core Layer Multimodal Deep Analysis and Alarming; The core layer utilizes the deep analysis capabilities of large models to accurately characterize complex traffic. Step 4: Multi-level feedback and adaptive model update.

[0009] Preferably, step one includes traffic acquisition, cleaning, and storage.

[0010] Preferably, traffic acquisition includes: acquiring network mirror traffic through a side server; Traffic scrubbing includes: parsing and dividing network mirror traffic into five-tuple connection streams; employing a multi-level storage strategy of memory and disk, using a hash table structure to store real-time stream data in memory, and combining it with a time window mechanism to release space; Traffic storage includes: disks using a distributed file system to store abnormal traffic and data to be analyzed.

[0011] Preferably, step one also includes: feature extraction and decision tree inference.

[0012] Preferably, feature extraction includes: Extracting 79-dimensional flow features X from quintuple connected flows; The 79-dimensional flow feature X includes basic attribute features, transmission rate features, and statistical features; Decision tree reasoning includes: X is input into a pre-trained CART decision tree model for binary classification reasoning. The CART decision tree model is lightweight and can quickly filter out a large amount of normal traffic. If the CART decision tree model determines that the traffic is abnormal, it will asynchronously upload the flow feature X and the flow's quintuple information to the aggregation layer via a message queue.

[0013] Preferably, step two includes: data aggregation and preprocessing, and multimodal data generation.

[0014] Preferably, the data aggregation and preprocessing includes: the aggregation layer receiving abnormal stream data from multiple edge layers from the message queue, performing noise reduction and normalization processing to reduce the overhead of the core layer in processing invalid data; Multimodal data generation includes: the convergence layer performing feature transformation operations to convert numerical streaming features into visualized streaming feature images, and concatenating the original bytes of data packets from the same stream into a streaming text sequence to construct composite input data containing visual and semantic information, which is then sent to the core layer.

[0015] Preferably, step three includes: multimodal feature fusion, Mamba encoder inference, and accurate alarm.

[0016] In a preferred embodiment of the present invention; Multimodal feature fusion includes: after the core layer receives the data, it processes it using internal components of the multimodal depth detection model; The multimodal depth detection model's internal components include the DINov2 module, the SigLIP module, and the BPE Tokenizer module; Visual features of the streaming feature image are extracted using the DINov2 and SigLIP modules, and semantic features of the streaming text are processed using the BPE Tokenizer module. Mamba encoder inference includes: inputting the fused features into the Mamba encoder for deep inference, then inputting the encoded features into the MLP classifier, and the MLP classifier performing deep feature transformation and classification on the input features to calculate the probability value of traffic belonging to different attack types. Precise alerts include: the multimodal deep detection model selects the highest probability item as the final detection result; alerts are issued for high-confidence attacks; high-risk emergency plans are triggered for new or complex attacks; and traffic with low confidence or conflicting judgments is transferred to the manual identification process.

[0017] Preferably, step four includes: feeding back data to the model through manual identification to achieve continuous system evolution; introducing a manual identification mechanism to determine the true label for traffic with conflicting or low confidence levels between the core layer and the edge layer; using the identified data to perform incremental learning on the multimodal Mamba attack detection model based on gradient accumulation and regularization to update the large model parameters; simultaneously, converting multi-class labels into binary labels and feeding them back to the edge layer to perform incremental updates and post-pruning optimization on the CART decision tree to eliminate the risk of overfitting; finally, smoothly deploying the updated decision tree model to edge devices through a canary release strategy to complete the closed-loop iteration of the system.

[0018] The present invention has the following beneficial effects: Highly efficient collaboration is achieved through hierarchical functional complementarity: the edge layer deploys a lightweight CART decision tree model, responsible for real-time monitoring and rapid initial screening, effectively reducing the pressure on subsequent processing; the aggregation layer is responsible for the aggregation, cleaning, and multimodal feature construction of multi-source anomaly data, providing standardized input for deep analysis; the core layer deploys a high-performance multimodal Mamba attack detection model, performing deep semantic understanding and multimodal feature fusion on traffic to achieve accurate judgment of attack types. Furthermore, this invention introduces a closed-loop feedback update mechanism including manual identification, gradient accumulation incremental learning, post-pruning optimization of the decision tree, and canary release, ensuring that the model can continuously adapt to changes in the network environment and achieve dynamic defense against new types of attacks. Detailed Implementation

[0019] The technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] In the description of this invention, it should be noted that the addition of "a", "b", "c", "d" after the component name is for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0021] In the description of this invention, it should also be noted that, unless otherwise explicitly specified and limited, the terms "set," "install," "connect," and "link" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or a connection through an intermediate medium; and they can refer to the internal communication between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0022] This invention aims to solve two core problems in attack detection: The contradiction between recognition speed and recognition accuracy. Existing technologies struggle to balance "speed" and "depth." Traditional lightweight methods are fast at handling large volumes of traffic but have low recognition rates and are prone to false negatives; while deep analysis methods are accurate but computationally intensive and have high latency, failing to meet real-time requirements. The primary challenge is how to achieve both rapid throughput of massive amounts of data and deep semantic analysis of complex and covert attacks in resource-constrained environments.

[0023] The model suffers from insufficient adaptability to dynamic network environments and new, unknown threats. Network environments and attack methods evolve dynamically, traditional rule bases lag behind in updates, and machine learning models exhibit poor generalization ability when faced with new attacks with ambiguous features or those they have never seen before, and they struggle to adapt quickly to environmental changes. The second core issue is how to construct a mechanism that can self-evolve and continuously learn to cope with unknown threats and ever-changing attack characteristics.

[0024] A multi-level collaborative attack detection method based on a multimodal large model and decision tree includes the following steps: Step 1: Real-time monitoring and preliminary screening of the edge layer; The edge layer, as the front end of the architecture, leverages the speed advantage of the lightweight model to process massive amounts of data; Step 2: Data aggregation and multimodal construction at the aggregation layer; the aggregation layer, as an intermediate link, is responsible for data standardization and modality transformation, preparing for core layer analysis; Step 3: Core Layer Multimodal Deep Analysis and Alarming; The core layer utilizes the deep analysis capabilities of large models to accurately characterize complex traffic. Step 4: Multi-level feedback and adaptive model update.

[0025] In a preferred embodiment of the present invention, step one includes traffic acquisition, cleaning, and storage.

[0026] In a preferred embodiment of the present invention, traffic acquisition includes: acquiring network mirror traffic through a side-mounted server; Traffic scrubbing includes: parsing and dividing network mirror traffic into five-tuple connection streams; employing a multi-level storage strategy of memory and disk, using a hash table structure to store real-time stream data in memory, and combining it with a time window mechanism to release space; The five-tuple in a five-tuple connection stream consists of the source IP address, destination IP address, source port, destination port, and protocol number. Traffic storage includes: disks using a distributed file system to store abnormal traffic and data to be analyzed.

[0027] In a preferred embodiment of the present invention, step one further includes: feature extraction and decision tree reasoning.

[0028] In a preferred embodiment of the present invention, feature extraction includes: Extracting 79-dimensional flow features X from quintuple connected flows; The 79-dimensional flow feature X includes basic attribute features, transmission rate features, and statistical features; The 79-dimensional stream features X are not raw bytes, but calculated statistics, mainly divided into the following five categories:

[0029] Decision tree reasoning includes: X is input into a pre-trained CART decision tree model for binary classification reasoning. The CART decision tree model is lightweight and can quickly filter out a large amount of normal traffic. If the CART decision tree model determines that the traffic is abnormal, it will asynchronously upload the flow feature X and the flow's quintuple information to the aggregation layer via a message queue.

[0030] The five-tuple information of a flow includes the source IP address, destination IP address, source port, destination port, and protocol number.

[0031] In a preferred embodiment of the present invention, step two includes: data aggregation and preprocessing, and multimodal data generation.

[0032] In a preferred embodiment of the present invention, data aggregation and preprocessing includes: the aggregation layer receiving abnormal stream data from multiple edge layers from the message queue, performing noise reduction and normalization processing to reduce the overhead of the core layer in processing invalid data; Multimodal data generation includes: the convergence layer performing feature transformation operations to convert numerical streaming features into visualized streaming feature images, and concatenating the original bytes of data packets from the same stream into a streaming text sequence to construct composite input data containing visual and semantic information, which is then sent to the core layer.

[0033] In a preferred embodiment of the present invention, step three includes: multimodal feature fusion, Mamba encoder inference, and accurate alarm.

[0034] In a preferred embodiment of the present invention; Multimodal feature fusion includes: after the core layer receives the data, it processes it using internal components of the multimodal depth detection model; The multimodal depth detection model's internal components include the DINov2 module, the SigLIP module, and the BPE Tokenizer module; Visual features of the streaming feature image are extracted using the DINov2 and SigLIP modules, and semantic features of the streaming text are processed using the BPE Tokenizer module. Mamba encoder inference includes: inputting the fused features into the Mamba encoder for deep inference, then inputting the encoded features into the MLP classifier, and the MLP classifier performing deep feature transformation and classification on the input features to calculate the probability value of traffic belonging to different attack types. Precise alerts include: the multimodal deep detection model selects the highest probability item as the final detection result; alerts are issued for high-confidence attacks; high-risk emergency plans are triggered for new or complex attacks; and traffic with low confidence or conflicting judgments is transferred to the manual identification process.

[0035] In a preferred embodiment of the present invention, step four includes: feeding back data to the model through manual identification to achieve continuous system evolution; introducing a manual identification mechanism to determine the true label for traffic with conflicting or low confidence levels between the core layer and the edge layer; using the identified data to perform incremental learning on the multimodal Mamba attack detection model based on gradient accumulation and regularization to update the large model parameters; simultaneously, converting multi-class labels into binary labels and feeding them back to the edge layer to perform incremental updates and post-pruning optimization on the CART decision tree to eliminate the risk of overfitting; finally, smoothly deploying the updated decision tree model to edge devices through a canary release strategy to complete the closed-loop iteration of the system.

[0036] This invention provides a multi-level collaborative attack detection method based on a multimodal large model and decision tree. The architecture consists of an edge layer, a convergence layer, and a core layer, achieving efficient collaboration through hierarchical functional complementarity: the edge layer deploys a lightweight CART decision tree model for real-time monitoring and rapid initial screening, effectively reducing the burden on subsequent processing; the convergence layer is responsible for aggregating, cleaning, and constructing multimodal features from multiple sources of anomaly data, providing standardized input for deep analysis; the core layer deploys a high-performance multimodal Mamba attack detection model, performing deep semantic understanding and multimodal feature fusion on traffic to achieve accurate judgment of attack types. Furthermore, this invention introduces a closed-loop feedback update mechanism including manual identification, gradient accumulation incremental learning, post-pruning optimization of the decision tree, and canary release, ensuring that the model can continuously adapt to changes in the network environment and achieve dynamic defense against new types of attacks.

[0037] The components, modules, mechanisms, and devices in this invention that are not described in detail are all general standard parts or components known to those skilled in the art. Their structures and principles can be learned by those skilled in the art through technical manuals or conventional experimental methods.

[0038] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit the scope of protection of the present invention. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the essence and scope of the technical solutions of the present invention.

Claims

1. A multi-level collaborative attack detection method based on a multimodal large model and decision tree, characterized in that, Includes the following steps: Step 1: Real-time monitoring and preliminary screening of the edge layer; The edge layer, as the front end of the architecture, leverages the speed advantage of the lightweight model to process massive amounts of data; Step 2: Data aggregation and multimodal construction at the aggregation layer; the aggregation layer, as an intermediate link, is responsible for data standardization and modality transformation, preparing for core layer analysis; Step 3: Core Layer Multimodal Deep Analysis and Alarming; The core layer utilizes the deep analysis capabilities of large models to accurately characterize complex traffic. Step 4: Multi-level feedback and adaptive model update.

2. The multi-level collaborative attack detection method based on a multimodal large model and decision tree as described in claim 1, characterized in that, Step one includes traffic acquisition, cleaning, and storage.

3. The multi-level collaborative attack detection method based on a multimodal large model and decision tree as described in claim 2, characterized in that: ； Traffic acquisition includes: acquiring network mirror traffic through a side server; Traffic scrubbing includes: parsing and dividing network mirror traffic into five-tuple connection streams; employing a multi-level storage strategy of memory and disk, using a hash table structure to store real-time stream data in memory, and combining it with a time window mechanism to release space; Traffic storage includes: disks using a distributed file system to store abnormal traffic and data to be analyzed.

4. The multi-level collaborative attack detection method based on a multimodal large model and decision tree as described in claim 3, characterized in that, Step one also includes: feature extraction and decision tree inference.

5. A multi-level collaborative attack detection method based on a multimodal large model and decision tree as described in claim 4. Its characteristic is that feature extraction includes: Extracting 79-dimensional flow features X from quintuple connected flows; The 79-dimensional flow feature X includes basic attribute features, transmission rate features, and statistical features; Decision tree reasoning includes: X is input into a pre-trained CART decision tree model for binary classification reasoning. The CART decision tree model is lightweight and can quickly filter out a large amount of normal traffic. If the CART decision tree model determines that the traffic is abnormal, it will asynchronously upload the flow feature X and the flow's quintuple information to the aggregation layer via a message queue.

6. The multi-level collaborative attack detection method based on a multimodal large model and decision tree according to claim 5, characterized in that, Step two includes: data aggregation and preprocessing, and multimodal data generation.

7. The multi-level collaborative attack detection method based on a multimodal large model and decision tree according to claim 6, characterized in that, Data aggregation and preprocessing include: the aggregation layer receives abnormal stream data from multiple edge layers from the message queue, performs noise reduction and normalization processing, and reduces the overhead of the core layer in processing invalid data; Multimodal data generation includes: the convergence layer performing feature transformation operations to convert numerical streaming features into visualized streaming feature images, and concatenating the original bytes of data packets from the same stream into a streaming text sequence to construct composite input data containing visual and semantic information, which is then sent to the core layer.

8. The multi-level collaborative attack detection method based on a multimodal large model and decision tree according to claim 7, characterized in that, Step 3 includes: multimodal feature fusion, Mamba encoder inference, and accurate alarm.

9. A multi-level collaborative attack detection method based on a multimodal large model and decision tree as described in claim 8. Its characteristics are; Multimodal feature fusion includes: after the core layer receives the data, it processes it using internal components of the multimodal depth detection model; The multimodal depth detection model's internal components include the DINov2 module, the SigLIP module, and the BPE Tokenizer module; Visual features of the streaming feature image are extracted using the DINov2 and SigLIP modules, and semantic features of the streaming text are processed using the BPE Tokenizer module. Mamba encoder inference includes: inputting the fused features into the Mamba encoder for deep inference, then inputting the encoded features into the MLP classifier, and the MLP classifier performing deep feature transformation and classification on the input features to calculate the probability value of traffic belonging to different attack types. Precise alerts include: the multimodal deep detection model selects the highest probability item as the final detection result; alerts are issued for high-confidence attacks; high-risk emergency plans are triggered for new or complex attacks; and traffic with low confidence or conflicting judgments is transferred to the manual identification process.

10. A multi-level collaborative attack detection method based on a multimodal large model and decision tree according to claim 9, characterized in that the steps are as follows: The four components are: feeding back data to the model through manual identification to achieve continuous system evolution; introducing a manual identification mechanism to determine the true label for traffic with conflicting or low confidence levels between the core and edge layers; using the identified data to perform incremental learning on the multimodal Mamba attack detection model based on gradient accumulation and regularization to update the large model parameters; simultaneously, converting multi-class labels into binary labels and feeding them back to the edge layer to perform incremental updates and post-pruning optimization on the CART decision tree to eliminate the risk of overfitting; and finally, smoothly deploying the updated decision tree model to edge devices through a canary release strategy to complete the closed-loop iteration of the system.

Images