Network traffic detection method, device, storage medium and program product

Abstract

Embodiments of the present application provide a network traffic detection method, device, storage medium and program product, the method comprising: performing semantic coding processing on network traffic data to obtain a first feature vector, the network traffic data comprising payload data; performing redundant feature screening and feature dimension reduction processing on the first feature vector to obtain a feature subset of the first feature vector; obtaining a local correlation feature matrix and a multi-scale feature matrix of the feature subset, wherein the local correlation feature matrix is used to represent the correlation between local features of the feature subset, and the multi-scale feature matrix is used to represent the correlation between local features of the feature subset at different scales; performing fusion processing on the local correlation feature matrix and the multi-scale feature matrix to obtain a fused feature matrix, and determining the category of the network traffic data according to the fused feature matrix.

Description

Technical Field

[0001] This application relates to the field of network security technology, specifically to a network traffic detection method, device, storage medium, and program product. Background Technology

[0002] Among related technologies, the feature selection intrusion detection system (IDS) based on metaheuristic optimization algorithms aims to improve detection efficiency and reduce feature dimensionality. However, its feature selection is only for traffic statistics and header information. Therefore, it has insufficient detection capability for payload embedding attacks, resulting in weak characterization of encrypted, obfuscated, or zero-day attack payloads, and complex attack patterns are difficult to identify accurately. Summary of the Invention

[0003] At least one embodiment of this application provides a network traffic detection method, device, storage medium, and program product to solve the problems of insufficient detection capability of existing solutions for payload-embedded attacks and difficulty in accurately identifying complex attack patterns.

[0004] To solve the above-mentioned technical problems, this application is implemented as follows:

[0005] In a first aspect, embodiments of this application provide a network traffic detection method, including:

[0006] The network traffic data is semantically encoded to obtain a first feature vector, wherein the network traffic data includes payload data;

[0007] Redundant feature removal and feature dimensionality reduction are performed on the first feature vector to obtain a feature subset of the first feature vector.

[0008] Obtain the local correlation feature matrix and the multi-scale feature matrix of the feature subset, wherein the local correlation feature matrix is ​​used to represent the correlation between local features of the feature subset, and the multi-scale feature matrix is ​​used to represent the correlation between local features of the feature subset at different scales;

[0009] The local correlation feature matrix and the multi-scale feature matrix are fused to obtain a fused feature matrix, and the category of the network traffic data is determined based on the fused feature matrix.

[0010] Optionally, redundant feature removal and feature dimensionality reduction are performed on the first feature vector to obtain a feature subset of the first feature vector, including:

[0011] Based on the first algorithm, redundant features are filtered out from the first feature vector to obtain an initial feature subset;

[0012] Based on the initial feature subset, the fitness value of the fitness function is determined, and the fitness value is used to evaluate the classification performance and low dimensionality of the feature subset;

[0013] When the iterative process based on the first algorithm satisfies the preset convergence condition, the initial feature subset that satisfies the preset convergence condition is subjected to feature dimensionality reduction processing according to the second algorithm to obtain the feature subset of the first feature vector.

[0014] Optionally, the preset convergence condition includes the improvement in the fitness value of the initial feature subset obtained after N consecutive iterations being less than a preset threshold, where N is a positive integer greater than 1.

[0015] Optionally, the first algorithm includes the Fruit Fly Algorithm (FFA), and the second algorithm includes the Antlion Algorithm (ALO).

[0016] Optionally, obtaining the local correlation feature matrix and multi-scale feature matrix of the feature subset includes:

[0017] The local correlation feature matrix is ​​obtained through convolutional attention blocks (CAB), and the multi-scale feature matrix is ​​obtained through multi-kernel blocks (MKB).

[0018] Optionally, the above methods also include:

[0019] Output a detection report based on the category of the network traffic data;

[0020] The detection report includes at least one of the following: total number of detected samples, number of normal network traffic data, number of various types of attack network traffic data, percentage information of various types of attack network traffic data, attack characteristic information of various types of attack network traffic data, overall detection accuracy, and identification accuracy of various types of attack network traffic data.

[0021] Optionally, semantic encoding is performed on the network traffic data to obtain a first feature vector, including:

[0022] The payload data in the network traffic data is processed by byte pair encoding (BPE) and sentence segmentation (SP) to obtain the word segmentation results.

[0023] The word segmentation results are embedded using a pre-trained language model to obtain an initial feature vector;

[0024] The initial feature vector is subjected to feature dimensionality reduction and feature concatenation to obtain the first feature vector.

[0025] Secondly, embodiments of this application also provide a network traffic detection device, including:

[0026] The first processing module is used to perform semantic encoding processing on network traffic data to obtain a first feature vector, wherein the network traffic data includes payload data.

[0027] The second processing module is used to perform redundant feature removal and feature dimensionality reduction on the first feature vector to obtain a feature subset of the first feature vector.

[0028] The third processing module is used to obtain the local correlation feature matrix and the multi-scale feature matrix of the feature subset, wherein the local correlation feature matrix is ​​used to represent the correlation between local features of the feature subset, and the multi-scale feature matrix is ​​used to represent the correlation between local features of the feature subset at different scales;

[0029] The fourth processing module is used to fuse the local correlation feature matrix and the multi-scale feature matrix to obtain a fused feature matrix, and to determine the category of the network traffic data based on the fused feature matrix.

[0030] Thirdly, embodiments of this application also provide an electronic device, including: a transceiver, a processor, a memory, and a program or instructions stored in the memory and executable on the processor; the processor executes the program or instructions to implement the steps of the method described above.

[0031] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method described above.

[0032] Fifthly, embodiments of this application also provide a computer program product, including computer instructions that, when executed by a processor, implement the steps of the method described above.

[0033] The above-mentioned technical solution of this application has at least the following beneficial effects:

[0034] The solution in this application embodiment performs semantic encoding on the payload data in network traffic data, so that the first feature vector can contain the relevant semantic information of the payload itself. This facilitates the detection of payload embedding attacks based on the first feature vector. Furthermore, the type of network traffic data is determined by the fused feature matrix. Since the fused feature matrix is ​​obtained by fusing the local correlation feature matrix and the multi-scale feature matrix of the feature subset of the first vector, the fused feature matrix can achieve deep fusion of local detailed features and global semantic correlation. Thus, it can achieve the recognition accuracy of complex attack patterns, such as the recognition accuracy of complex attack patterns such as variant DoS and stealthy bots. Attached Figure Description

[0035] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0036] Figure 1 This is a flowchart of a network traffic detection method according to an embodiment of this application;

[0037] Figure 2 This is a schematic diagram of data flow in an embodiment of this application;

[0038] Figure 3 This is a schematic diagram of the network traffic detection device according to an embodiment of this application;

[0039] Figure 4 This is a structural block diagram of a network traffic detection device according to an embodiment of this application. Detailed Implementation

[0040] The terms "first," "second," etc., used in this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of the same class, without limiting the number of objects; for example, the first object can be one or more. Furthermore, "or" in this application indicates at least one of the connected objects. For example, "A or B" covers three scenarios: Scenario 1: including A but not B; Scenario 2: including B but not A; Scenario 3: including both A and B. The character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0041] The term "instruction" in this application can be either a direct instruction (or explicit instruction) or an indirect instruction (or implicit instruction). A direct instruction can be understood as one in which the sender explicitly informs the receiver of specific information, the operation to be performed, or the requested result, etc.; an indirect instruction can be understood as one in which the receiver determines the corresponding information based on the instruction sent by the sender, or makes a judgment and determines the operation to be performed or the requested result, etc., based on the judgment result.

[0042] In this application's embodiments, the term "and / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship. In this application's embodiments, the term "multiple" refers to two or more, and other quantifiers are similar.

[0043] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0044] To enable those skilled in the art to better understand the embodiments of this application, the following description will be provided first.

[0045] 1. Deep Packet Inspection (DPI) technology: As a fundamental method for network traffic analysis, DPI can parse data packets layer by layer to extract statistical information such as 5-tuples and connection duration, as well as the original content of application layer payloads (such as HTTP request lines, hexadecimal encoded payloads, etc.), providing standardized, multi-dimensional input data for Intrusion Detection Systems (IDS).

[0046] 2. Core Mechanisms of Intrusion Detection Systems: Mainstream IDS detection logic primarily falls into two categories: Anomaly detection identifies deviant behavior by establishing normal behavior models (such as those based on statistics or clustering). While it has some detection capability against zero-day attacks, its false positive rate is high. Misuse detection relies on pattern matching using a known attack signature database. It has high accuracy against known attacks but cannot identify new or variant attacks. Existing systems typically combine both to balance detection performance.

[0047] 3. Feature Selection and Metaheuristic Optimization Algorithms: To reduce the computational overhead of high-dimensional features, feature selection techniques are commonly used to filter key feature subsets. Among these, wrapper methods, which optimize classifier performance, are widely recognized as efficient metaheuristic search strategies. The Fruit Fly Algorithm (FFA), which simulates group foraging behavior, and the Antlion Optimizer (ALO), which simulates predation mechanisms, are examples of such strategies used for feature subset selection.

[0048] 4. Byte Pair Encoding (BPE) + Sentence Piece (SP) segmentation technology: BPE constructs a sub-word dictionary by iteratively merging high-frequency byte pairs to address the problem of out-of-vocabulary words; SP supports segmentation of text without spaces (such as network payloads) to avoid semantic breaks caused by special characters. The combination of the two is widely used for semantic unit partitioning of non-natural language sequences (such as protocol payloads).

[0049] 5. Convolutional Multi-Head Attention Ensemble (CMAE) Models and Pre-trained Language Models: CMAE models combine the advantages of convolutional neural networks in extracting local features with self-attention mechanisms in capturing long-range dependencies, and are often used for sequence classification tasks. Llama2, as a large-scale pre-trained language model, possesses powerful semantic representation capabilities and can be transferred to embedding representations of non-text sequences.

[0050] The disadvantages of the relevant technical solutions are as follows:

[0051] 1. Feature selection IDS based on metaheuristic optimization algorithm;

[0052] While this approach can reduce computational overhead by optimizing the algorithm to select features, it still has the following significant drawbacks:

[0053] (1) Incomplete feature representation dimensions and missing semantic information: The selected features focus on traffic statistics and header information, and fail to cover the semantic structure contained in the data packet payload (such as malicious code fragments, attack instruction sequences, etc.), resulting in a serious lack of ability to detect complex attacks based on payload obfuscation, encryption spoofing and zero-day vulnerabilities.

[0054] (2) Mismatch between optimization target and model input: The feature selection process is independent of the subsequent classification model. There is a significant gap between the low-dimensional statistical features selected and the high-dimensional semantic features required by the deep learning model. Forcibly connecting them will lead to feature semantic distortion and decreased detection accuracy.

[0055] (3) Insufficient convergence and generalization ability of the algorithm: Single metaheuristic algorithms (such as FFA or ALO) are prone to getting stuck in local optima or slow convergence in high-dimensional feature spaces, making it difficult to simultaneously take into account search efficiency and feature subset generalization performance.

[0056] 2. An encrypted traffic detection scheme based on the fusion of CNN and handcrafted features;

[0057] This approach attempts to combine traditional features with deep learning, but it still has the following inherent limitations:

[0058] (1) Feature heterogeneity and fusion noise: Handmade features and CNN deep features are in different semantic spaces and scales. Simple splicing or weighted fusion is difficult to achieve effective alignment and instead introduces noise, affecting model convergence and final recognition accuracy.

[0059] (2) Strong reliance on expert knowledge and poor adaptability: The design of handmade features relies on prior domain knowledge, which makes it difficult to adapt to the dynamic adjustment of encryption strategies and the variation of new attack methods, resulting in insufficient generalization ability of the model.

[0060] (3) System redundancy and real-time performance are difficult to guarantee: manual feature extraction and neural network inference are executed in stages, which cannot be optimized end-to-end. The computational redundancy is high, and it is difficult to meet the low latency requirements of real-time detection in a high-throughput network environment.

[0061] Based on the shortcomings of the existing technology mentioned above, this application proposes to address the following three core technical issues in order to improve IDS performance:

[0062] (1) Achieve end-to-end semantic awareness feature extraction and optimization: overcome the dependence of existing methods on manual feature engineering, design a mechanism that can automatically and efficiently extract and optimize discriminative semantic features from the original payload, avoid feature heterogeneity and information loss, and improve the detection capability against encryption and unknown attacks.

[0063] (2) Balancing the convergence speed and global optimality of feature selection: For high-dimensional semantic feature space, an efficient feature selection strategy is designed, which can significantly reduce the feature dimension without losing key discrimination information, and solve the problem of slow convergence or easy getting trapped in local optima in traditional metaheuristic algorithms.

[0064] (3) Achieve collaborative adaptation between the detection model and the feature input: ensure that the optimized feature subset can be efficiently adapted to the deep learning detection model, avoid performance loss caused by differences in feature representation, and improve the detection accuracy and inference speed of the model in complex attack scenarios to meet real-time processing requirements.

[0065] The technical solutions in this application mainly involve the following areas:

[0066] 1. Network Security: This solution belongs to the field of network intrusion detection (IDS) technology, specifically involving a malicious traffic detection method based on deep analysis of packet payloads. Addressing the issues of low detection accuracy and insufficient real-time performance of existing detection technologies in complex attack scenarios (such as zero-day attacks, encrypted traffic attacks, and polymorphic malware), it improves the ability to identify covert attack patterns and enhances system response efficiency through semantic-driven feature extraction and optimization mechanisms.

[0067] 2. Artificial Intelligence: This solution deeply integrates Natural Language Processing (NLP) with metaheuristic optimization techniques, representing an application of artificial intelligence in cybersecurity. Specifically, it includes: employing word segmentation techniques based on BPE and SentencePiece for payload semantic embedding; designing an FFA-ALO hybrid metaheuristic algorithm to achieve high-dimensional feature selection; and constructing a CMAE model for end-to-end traffic classification, demonstrating the synergistic innovation of deep learning and optimization algorithms in feature extraction, selection, and classification.

[0068] 3. Cloud Computing and Big Data Edge Computing: This solution boasts excellent computing adaptability, suitable for both centralized cloud traffic processing and lightweight edge node detection deployment modes. Through feature dimensionality reduction and model structure optimization, it significantly reduces computational and storage overhead while maintaining detection accuracy, supporting real-time security protection in multi-tenant cloud environments and localized detection needs for resource-constrained edge nodes.

[0069] In summary, this application presents a solution encompassing technologies from three major areas: network security, artificial intelligence, and cloud computing, big data, and edge computing. It is applicable to performance enhancement of intrusion detection systems in complex environments such as enterprise networks, carrier backbone networks, and cloud data centers, and is particularly suitable for complex network environments with high requirements for detection accuracy, real-time performance, and resource utilization.

[0070] To address the three core problems of existing intrusion detection technologies: first, traditional methods lack sufficient deep semantic information mining of network traffic payloads, resulting in weak characterization capabilities for encrypted, obfuscated, or zero-day attack payloads; second, high-dimensional feature spaces easily lead to model redundancy and increased computational overhead, severely impacting detection efficiency and real-time performance; and third, complex attack patterns are difficult to identify accurately. Therefore, this proposal suggests a new network traffic detection method.

[0071] like Figure 1 As shown in the figure, this application provides a network traffic detection method, including:

[0072] Step 101: Perform semantic encoding processing on the network traffic data to obtain the first feature vector, wherein the network traffic data includes payload data.

[0073] In some embodiments of this application, the raw network traffic data, such as PCAP format data packets, is first preprocessed to obtain the aforementioned network traffic data. This preprocessing converts the raw network traffic data into standardized data that meets the input requirements of subsequent modules, eliminating the interference of format differences, noise, and outliers on subsequent feature extraction and detection.

[0074] Optionally, the first feature vector mentioned above is a high-dimensional feature vector with deep semantic association. This high-dimensional feature vector can improve the generalization recognition capability of new variant attacks and solve the problem that traditional IDS cannot capture the semantic association of attack patterns by relying solely on statistical features.

[0075] Optionally, by semantically encoding the payload data in network traffic data to obtain the first feature vector, the problem that traditional methods are insufficient in mining the deep semantic information of network traffic payloads, resulting in weak characterization ability of encrypted, obfuscated or zero-day attack payloads can be solved.

[0076] Step 102: Perform redundant feature removal and feature dimensionality reduction on the first feature vector to obtain a feature subset of the first feature vector;

[0077] By performing redundant feature removal and feature dimensionality reduction on the first feature vector, a feature subset with strong discriminative power (i.e., a feature subset that can strongly distinguish the type of network traffic data) can be selected, reducing the computational complexity of subsequent modules and improving the accuracy of attack pattern identification.

[0078] The feature subset of the first feature vector mentioned above can also be described as the optimal feature subset.

[0079] Step 103: Obtain the local correlation feature matrix and the multi-scale feature matrix of the feature subset, wherein the local correlation feature matrix is ​​used to represent the correlation between local features of the feature subset, and the multi-scale feature matrix is ​​used to represent the correlation between local features of the feature subset at different scales.

[0080] Step 104: Perform fusion processing on the local correlation feature matrix and the multi-scale feature matrix to obtain the fused feature matrix, and determine the category of the network traffic data based on the fused feature matrix.

[0081] Optionally, the predicted label of the fused feature matrix is ​​obtained, and the category of the network traffic data is determined based on the predicted label. Optionally, the category is used to indicate whether the network traffic data is attack network traffic data. For example, the predicted label can be a normal traffic label or an attack traffic label.

[0082] The solution in this application embodiment performs semantic encoding on the payload data in network traffic data, so that the first feature vector can contain the relevant semantic information of the payload itself. This facilitates the detection of payload embedding attacks based on the first feature vector. Furthermore, the type of network traffic data is determined by the fused feature matrix. Since the fused feature matrix is ​​obtained by fusing the local correlation feature matrix and the multi-scale feature matrix of the feature subset of the first vector, the fused feature matrix can achieve deep fusion of local detailed features and global semantic correlation. Thus, it can achieve the recognition accuracy of complex attack patterns, such as the recognition accuracy of complex attack patterns such as variant DoS and stealthy bots.

[0083] In some embodiments of this application, redundant feature removal and feature dimensionality reduction are performed on the first feature vector to obtain a feature subset of the first feature vector, including:

[0084] Based on the first algorithm, redundant features are filtered out from the first feature vector to obtain an initial feature subset;

[0085] Based on the initial feature subset, the fitness value of the fitness function is determined, and the fitness value is used to evaluate the classification performance and low dimensionality of the feature subset;

[0086] When the iterative process based on the first algorithm satisfies the preset convergence condition, the initial feature subset that satisfies the preset convergence condition is subjected to feature dimensionality reduction processing according to the second algorithm to obtain the feature subset of the first feature vector.

[0087] In this embodiment of the application, a dual objective function is designed, namely the fitness function mentioned above. This fitness function is used to simultaneously optimize classification performance and low-dimensionality, thereby achieving a balance between classification performance and low-dimensionality.

[0088] Optionally, it also includes: performing noise feature filtering on the first feature vector based on the first algorithm.

[0089] As one implementation, the preset convergence condition includes the improvement in the fitness value of the initial feature subset obtained by N consecutive iterations being less than a preset threshold, where N is a positive integer greater than 1.

[0090] In this embodiment, the value of N can be adjusted or configured as needed. Of course, the aforementioned preset convergence condition can also be other convergence conditions. For example, the proportion of the number of iterations of the first algorithm to the total number of iterations is a first preset value. This total number of iterations includes the number of iterations of the first algorithm and the number of iterations of the second algorithm, i.e., the switching from the iteration process of the first algorithm to the iteration process of the second algorithm is achieved based on a fixed iteration ratio.

[0091] Optionally, the first algorithm includes the Fruit Fly Algorithm (FFA), and the second algorithm includes the Antlion Algorithm (ALO).

[0092] Optionally, the first algorithm mentioned above can also be the Grey Wolf Optimizer (GWO), and the second algorithm can be Particle Swarm Optimization (PSO). For example, in the first stage, GWO (population size 40, maximum iterations 25) is used to quickly select features. If there is no improvement in fitness after 4 consecutive iterations, the PSO stage (population size 40, maximum iterations 15) is started, and the best individual in GWO is used as the globally optimal initial value for PSO.

[0093] Of course, the first algorithm mentioned above can also be other algorithms capable of redundant feature removal, and the second algorithm mentioned above can be other algorithms capable of feature dimensionality reduction. This application does not make any specific limitations on these algorithms.

[0094] Existing feature selection schemes (such as FFA, ALO, or PSO algorithms alone) have the following drawbacks: When aiming solely for "lowest feature dimensionality," key discriminative features are easily discarded, leading to decreased detection accuracy; when aiming solely for "highest classification accuracy," redundant features are easily retained, causing a surge in computational complexity for subsequent detection modules (e.g., the inference speed of the PSO algorithm decreases by 40% when iterating on 1000-dimensional features compared to 500-dimensional features); and a single algorithm (FFA is prone to local optima, ALO converges slowly) struggles to balance optimization efficiency and global optima. In contrast, the scheme proposed in this application establishes a dual-objective fitness function, balancing the optimization objectives of "high accuracy" (e.g., weight 0.7) and "low dimensionality" (e.g., weight 0.3), thus avoiding bias from a single objective. For example, the initial feature subset is first quickly selected through the FFA stage (population size 50, maximum iterations 30) (convergence speed is 30% faster than ALO). If there is no fitness improvement after 5 consecutive iterations, the ALO stage is automatically started. The best individual in FFA is used as the initial value of elite antlions. The feature is finely optimized through ant random walk (simulating global search) and elite guidance (avoiding local optima). Finally, the optimal feature subset with dimension ≤128 is output (initial feature 1008 dimensions, compression rate over 88%).

[0095] The proposed solution avoids the "accuracy loss" or "complexity surge" problems caused by a single optimization objective, while combining the advantages of fast convergence of FFA and global search of ALO. This significantly reduces computational complexity while maintaining the classification accuracy of subsequent detection modules, achieving a dual optimization of "accuracy and efficiency." By employing the FFA-ALO hybrid meta-heuristic algorithm, the redundancy problem caused by high-dimensional features can be addressed, significantly reducing computational complexity while maintaining feature discrimination capabilities.

[0096] In some embodiments of this application, obtaining the local correlation feature matrix and multi-scale feature matrix of the feature subset includes:

[0097] The local correlation feature matrix is ​​obtained through a Convolutional Attention Block (CAB), and the multi-scale feature matrix is ​​obtained through a Multi-kernel Block (MKB).

[0098] For example, CAB compresses the feature dimension to “32×32” through two rounds of 1D convolution-pooling (3 kernels, 2 strides), calculates global correlation weights (such as the correlation of attack intent between different payload fragments) by combining a multi-head attention layer (2 heads), adds residual connections and layer normalization to avoid gradient vanishing, and finally outputs “1×32” local correlation features through Global Max Pooling 1D, taking into account both local details and global correlation.

[0099] For example, MKB uses three scales of 1D convolution (3, 4, and 5) to extract multi-scale features in parallel (e.g., kernel 3 captures short character sequences and kernel 5 captures long semantic units), and then concatenates them into a "1×96" multi-scale feature matrix after Global Max Pooling 1D, covering attack modes of different lengths.

[0100] The outputs of CAB and MKB are concatenated into a "1×128" fused feature, which is then classified using a two-layer feedforward network and Softmax, achieving full-dimensional capture of "local details, global correlations, and multi-scale patterns".

[0101] CAB and MKB can simultaneously and accurately capture both local details and global correlations of an attack, covering attack patterns at different scales. They significantly improve the recognition accuracy of complex attacks such as fragmented payloads and multi-type mixed attacks, outperforming single CNN, Transformer, and simple ensemble models.

[0102] Related deep learning IDS (such as single CNN or Transformer models) have architectural limitations. For example, CNNs excel at extracting local features (such as anomalous characters in the payload) but cannot capture global correlations (such as the DDoS spike pattern of "multiple short connections + specific port requests"); Transformers excel at global correlations but are less sensitive to local attack details (such as "..." in web attacks). <script>”标签片段）捕捉不足；部分集成模型仅简单拼接输出，未实现特征深度融合，导致对复杂攻击（如"碎片化payload+多端口跳转的Bot攻击”）识别精度低（准确率多低于95%）。而本申请通过设计"卷积注意力块（CAB）+多核块（MKB）”的CMAE深度检测架构，融合卷积神经网络优异的局部特征提取能力与多头注意力机制的全局关联捕捉能力，精准识别正常流量与各类攻击流量，提升对变种DoS、隐蔽Bot攻击等复杂攻击模式的识别精度。

[0103] 另外，本申请实施例中，也可以通过其他方式获取所述局部关联特征矩阵和多尺度特征矩阵，任何能够获取局部关联特征矩阵和多尺度特征矩阵都属于本申请的保护范围。

[0104] 在本申请的一些实施例中，上述方法还包括：

[0105] 根据所述网络流量数据的类别，输出检测报告；

[0106] 其中，所述检测报告包括以下至少一项：总检测样本数、正常的网络流量数据的数量、各类攻击网络流量数据的数量、各类攻击网络流量数据的占比信息、各类攻击网络流量数据的攻击特征信息、整体检测准确率、各类攻击网络流量数据的识别准确率。

[0107] 本申请实施例中，基于网络流量数据的类别进行后处理，生成直观、可解释的检测报告，并支持异常流量的实时告警。

[0108] 相关技术中，IDS多仅输出"正常 / 攻击”的简单标签，缺乏攻击特征详情与全流程数据记录，安全人员无法回溯误判原因（如将正常流量误判为攻击的关键特征），也无法基于历史数据迭代优化模型；部分支持日志输出的方案仅存储基础检测结果（如源IP、检测时间），无"预处理-特征生成-特征优化-检测”的中间结果关联，模型迭代缺乏数据支撑，长期使用后检测精度易衰减。本申请构建了全流程数据闭环+可解释性输出”机制。示例性的，包括：1）误判样本特征库：比对预测标签与真实标签，记录误判样本的关键特征（如payload语义子词、FFA-ALO筛选的特征权重），明确"漏判 / 误判”的特征根源（如某Bot攻击因"payload长度过短”被漏判）；2）可解释性报告：输出基础统计信息（准确率、FPR、FNR）与攻击特征详情，该攻击特征详情包括流量元数据（源 / 目的IP、攻击时长）、payload关键语义特征（如DoS攻击的"GET / HTTP / 1.1”子词序列）、FFA-ALO筛选的Top10特征权重（如"连接时长”权重0.15、"异常字符占比”权重0.22），直观呈现攻击判别依据；3）全流程日志存储：以JSON格式将各模块中间结果（分词日志、优化日志、检测日志）存储至Elasticsearch，保留30天并支持"时间 / 攻击类型 / 特征权重”多维度查询，为模型迭代提供完整数据链。

[0109] 通过本申请的方案，安全人员可基于报告快速定位攻击核心模式与误判原因，误判样本特征库为模型迭代提供明确方向，全流程日志可支撑长期的模型优化与安全审计，避免模型因缺乏数据支撑导致的精度衰减，提升检测系统的长期稳定性与可用性。

[0110] 另外，上述检测报告还可以通过其他形式呈现，例如，通过特征重要性热力图等。

[0111] 在本申请的一些实施例中，对网络流量数据进行语义编码处理，得到第一特征向量，包括：

[0112] 对所述网络流量数据中的载荷数据进行字节对编码BPE处理以及句子片段SP分词处理，得到分词结果；

[0113] 通过预训练语言模型对所述分词结果进行嵌入处理，得到初始特征向量；

[0114] 对所述初始特征向量进行特征降维和特征拼接处理，得到所述第一特征向量。

[0115] 可选的，上述预训练语言模型为Llama2-7B，当然，该预训练语言模型也可以为其他模型，如BERT-Base，本申请对此不做具体限定。

[0116] 现有IDS（如基于KDDCup99 / NSL-KDD数据集的传统方案）多依赖流量统计特征（如连接时长、源 / 目的字节数）或简单字符串匹配提取特征，无法识别payload中隐藏的攻击语义逻辑，例如对"DoS攻击变种的碎片化payload”"Bot攻击的隐蔽HTTP请求序列”，因缺乏语义关联挖掘能力，易出现漏判或误判，泛化性局限于已知攻击类型。本申请采用"BPE+SP混合分词+Llama2预训练嵌入”的语义特征提取机制。具体的，先通过BPE迭代合并攻击相关高频字节对（如将"DoS攻击中高频出现的‘GET / HTTP / 1.1’拆分为‘GET’‘ / ’‘HTTP / 1.1’子词），结合Sentence Piece纳入网络流量特有的特殊字符（如"\x00”"\r\n”）与未登录攻击字符组合，确保分词覆盖攻击相关语义单元。然后，加载Llama2-7B预训练嵌入层（维度4096）生成语义特征矩阵，冻结预训练参数避免小样本偏移，同时加入位置向量捕捉子词时序关联（如"GET”后接" / ”与"POST”后接" / ”的攻击意图差异），最终拼接标准化元数据特征形成初始高维特征，深度挖掘payload中的攻击语义模式。由此，可有效挖掘 payload 中隐藏的攻击语义关联，突破传统统计特征对攻击模式的捕捉局限，在含新型攻击的 UNSW-NB15 数据集与含变种攻击的 CIC-IDS2017 数据集上，对变种 DoS、隐蔽 Bot 等攻击的识别泛化性显著提升，可覆盖更多未知攻击类型。

[0117] 本申请实施例中，突破传统IDS依赖统计特征的局限性，引入BPE+SP双通道分词与Llama2嵌入相结合的语义特征提取方式，有效捕捉载荷（Payload）中隐含的攻击模式关联信息。

[0118] 可选的，在本申请的一些实施例中，还可以采用其他语义编码方案，来得到上述第一特征向量，例如，采用"Byte-LevelBPE（字节级BPE）+Word Piece”混合分词的方式。

[0119] 本申请实施例的方案，首先，对原始网络流量数据进行标准化预处理，以消除数据格式差异与噪声干扰；其次，借助预训练语言模型的分词与嵌入机制，提取具有深层语义关联的流量特征；随后，采用混合元启发式算法对特征子集进行优化，剔除冗余信息并保留关键判别特征；最后，利用卷积与注意力机制相结合的深度检测模型，对优化后的特征进行分类识别，并输出检测结果。该方案通过融合语义感知分词机制、混合元启发式特征优化算法与卷积-注意力融合的检测架构，构建端到端的智能化实时检测体系，实现对网络恶意流量的高效、精准检测。

[0120] 下面对本申请实施例的整体流程进行如下说明。

[0121] 步骤一：数据预处理。

[0122] 此阶段的核心功能是将原始网络流量数据（如PCAP格式数据包）转换为符合后续模块输入要求的标准化数据，消除格式差异、噪声及异常值对后续特征提取与检测的干扰，具体流程如下：

[0123] 1、原始数据解析与提取；

[0124] 采用libpcap库解析原始PCAP数据包，提取每个网络连接的关键信息，包括：

[0125] （1）流量元数据：源IP地址、目的IP地址、源端口、目的端口、协议类型（TCP / UDP / ICMP）、连接持续时间（Duration）、双向字节数等；

[0126] （2）载荷（payload）数据：基于十六进制（Hex）格式提取数据包载荷内容，保留完整的字节序列（如"474554202f20485454502f312e310d0a”形式的HTTP请求载荷）；

[0127] （3）标签信息：依据标准数据集（CIC-IDS2017、NSL-KDD等）标注流量类型，包括正常流量（Benign）及六类攻击类型：DoS、DDoS、PortScan、BruteForce、Bot、Web攻击。

[0128] 2. 数据清洗与过滤；

[0129] 由数据清洗单元对解析后的数据进行初步过滤，剔除无效连接记录，包括payload为空、连接时长为0、协议字段异常的样本，确保输入数据的有效性与一致性。

[0130] 3. 数据格式标准化；

[0131] 3.1、Hex格式转UTF-8编码；

[0132] 将提取的Hex格式payload转换为UTF-8编码的字符串（如将Hex值"474554”转换为字符串"GET”），为后续分词模块提供统一输入格式；

[0133] 3.2特征数值归一化；

[0134] 对连续型元数据（如连接时长、字节数）采用Min-Max归一化方法，将数值映射至[0,1]区间，公式如下：

[0135] ；

[0136] 其中，为原始特征值，为该特征的最小值，为该特征的最大值，为归一化后的特征值。

[0137] 3.3离散特征编码；

[0138] 对协议类型（如TCP=1、UDP=2、ICMP=3）、连接状态（如ESTABLISHED=1、CLOSED=2）等离散特征，采用独热编码（One-Hot Encoding）转换为数值向量，避免类别间数值偏序干扰。

[0139] 4.数据增强与划分；

[0140] 4.1、payload长度统一；

[0141] 针对不同数据包payload长度差异大的问题，采用"截断-填充”策略，将payload长度统一为3000字节（若长度超过3000则截断至前3000字节，若不足则用0x00填充至3000字节），保证后续语义特征提取的输入维度一致性；

[0142] 4.2、数据集划分；

[0143] 将预处理后的数据集按8:1:1的比例划分为训练集、验证集与测试集，且保持各集内正常流量与攻击流量的类别分布一致，避免数据偏斜导致模型训练偏差。

[0144] 步骤二：双通道Llama2语义特征生成，即第一特征向量生成。

[0145] 此阶段的核心功能是基于预训练语言模型的分词处理与嵌入映射机制，将标准化后的payload数据转换为具有深层语义关联的高维特征向量，提升对新型变种攻击的泛化识别能力，解决传统IDS仅依赖统计特征无法捕捉攻击模式语义关联的问题，具体实现步骤如下：

[0146] 1.双通道分词处理；

[0147] 采用字节对编码（BPE）与SentencePiece（SP）相结合的混合分词策略，对UTF-8编码后的payload字符串进行子词（Sub-word）划分：

[0148] （1）BPE分词：首先对payload字符串进行字节级拆分（如"GET / HTTP / 1.1”拆分为"G”"E”"T”"”" / ”"”"H”"T”...），然后通过迭代合并出现频率最高的字节对（如"GE”"ET”"HT”），生成子词词典（如"GET”"HTTP”" / 1.1”等攻击相关高频子词）；

[0149] （2）SP分词优化：引入SentencePiece的无监督分词机制，将payload中的特殊字符（如"\x00”"\r\n”）及攻击特征字符（如"474554”对应"GET”的攻击请求标识）纳入子词词典，避免传统分词对特殊符号的割裂，同时支持对未登录词（如新型攻击payload中的罕见字符组合）的有效拆分；

[0150] 分词后，将每个payload字符串转换为子词序列（如"474554202f20”转换为"GET”"”" / ”"”），并映射为对应的子词ID（如"GET”对应ID=29900，" / ”对应ID=29883），形成子词ID序列。

[0151] 2.Llama2语义嵌入生成；

[0152] 引入Llama2-7B预训练语言模型的嵌入层（Embedding Layer），将子词ID序列转换为高维语义特征向量：

[0153] （1）嵌入层初始化：加载Llama2-7B模型的预训练嵌入权重（维度为4096），并固定嵌入层参数（冻结训练），避免因小样本微调导致嵌入向量分布偏移；

[0154] （2）语义向量生成：将子词ID序列输入嵌入层，每个子词ID对应一个4096维的语义向量，最终形成"样本数×3000×4096”的三维语义特征矩阵（3000为统一后的payload子词长度，4096为嵌入维度）；

[0155] （3）引入位置向量：为捕捉payload子词的时序关联信息（如攻击请求中的字符顺序差异），在语义特征矩阵中加入位置向量，公式如下：

[0156] ；

[0157] ；

[0158] 其中，为子词在序列中的位置，为嵌入维度索引，为嵌入维度，为位置向量。

[0159] 可选的，上述位置向量还可以用于自注意力层的位置偏置来替代。

[0160] 3.语义特征降维与拼接；

[0161] (1)采用1D卷积层（Conv1D）对三维语义特征矩阵进行降维：设置卷积核大小为3，输出通道数为128，通过局部特征融合将"3000×4096”的子词语义向量压缩为"1000×128”的局部语义特征向量（卷积步长为3，padding=1）；

[0162] (2)将降维后的局部语义特征向量与模块A输出的标准化元数据特征（维度为8，包含源 / 目的IP编码、协议类型、连接时长等）进行拼接，形成"1008×128”的初始高维特征矩阵，作为后续特征优化步骤的输入。

[0163] 步骤三：FFA-ALO特征优化；

[0164] 该阶段的核心功能是对步骤二输出的高维特征矩阵进行优化，剔除冗余特征与噪声特征，筛选出具有强判别性的最优特征子集，降低后续检测模块的计算复杂度，同时提升攻击模式的识别精度，具体实现步骤如下：

[0165] 1、FFA-ALO混合优化算法初始化；

[0166] 1.1、构建双目标优化函数；

[0167] 定义适应度函数（Fitness Function）综合评估特征子集的分类性能与低维程度：

[0168] ；

[0169] 其中，为特征子集在验证集上的分类准确率（采用KNN分类器初步评估），为当前特征子集维度，为初始特征维度，α、β为用于保障检测精度的权重系数，为适应度值；

[0170] 需要说明的是，上述适应度函数仅为举例说明，能够评估特征子集的分类性能与低维程度的双目标优化函数均属于本申请的保护范围。

[0171] 1.2初始化种群参数：

[0172] （1）FFA种群：设置果蝇种群规模为50，最大迭代次数（Max SubIt FFA）为30，初始种群位置随机生成（每个位置对应一个特征选择掩码，1表示选中该特征，0表示剔除）；

[0173] （2）ALO种群：设置蚂蚁与蚁狮种群规模均为50，最大迭代次数（Max SubIt ALO）为20，初始种群位置与FFA种群一致，精英蚁狮（Elite Antlion）初始值设为FFA种群中的最优个体。

[0174] 2.FFA阶段特征初步筛选；

[0175] 2.1果蝇搜索方向与距离计算；

[0176] 对每个果蝇个体（特征选择掩码），随机生成搜索方向与距离，更新其位置（特征选择状态），公式如下：

[0177] ；

[0178] ；

[0179] 其中，为第i个果蝇的位置坐标，为种群中心坐标，为0-1随机数；

[0180] 2.2气味浓度计算；

[0181] 将果蝇位置映射为特征选择掩码，计算该掩码对应的特征子集在适应度函数中的值（气味浓度），公式如下：

[0182] ；

[0183] ；

[0184] ；

[0185] 其中，为果蝇到种群中心的距离，为气味判断值，为最终气味浓度（适应度值）；

[0186] 2.3最优果蝇选择与种群更新；

[0187] 筛选出气味浓度最高（适应度值最大）的果蝇个体，将其位置设为新的种群中心，其余果蝇向该中心移动，重复上述步骤至FFA迭代次数达到Max SubIt FFA，输出FFA阶段的最优特征子集（初步剔除50%以上冗余特征）。若FFA阶段连续5次迭代无适应度提升，则启动ALO阶段。

[0188] 3.ALO阶段特征精细优化；

[0189] 3.1蚂蚁随机游走生成；

[0190] 对每个蚂蚁个体（特征选择掩码），基于随机游走模型更新其位置，模拟蚂蚁在特征空间中的搜索行为，公式如下：

[0191] ；

[0192] ；

[0193] 其中，为第i个蚂蚁的随机游走路径，为随机步长函数，为迭代次数；

[0194] 3.2蚁狮陷阱与精英引导；

[0195] 通过轮盘赌选择策略（Roulette Wheel）选择蚁狮个体，蚂蚁在蚁狮周围的"陷阱区域”内搜索（限制特征选择的局部空间），同时引入精英蚁狮的位置引导，使蚂蚁向全局最优方向移动，公式如下：

[0196]

[0197] 其中，为第t次迭代时第i个蚂蚁的位置，为选中蚁狮的位置，为精英蚁狮的位置；

[0198] 3.3蚁狮更新与最优特征确定；

[0199] 若蚂蚁的适应度值高于对应蚁狮，则更新蚁狮位置为蚂蚁位置；若蚁狮适应度值高于精英蚁狮，则更新精英蚁狮位置。重复上述步骤至ALO迭代次数达到Max SubIt ALO，输出最终最优特征子集（维度降至128以下，保留关键判别特征）。

[0200] 步骤四：MAE流量检测；

[0201] 该步骤的核心功能是对步骤三输出的最优特征子集进行深度分类，融合卷积神经网络的局部特征提取能力与多头注意力的全局关联捕捉能力，精准识别正常流量与各类攻击流量，具体实现步骤如下：

[0202] 1.卷积注意力块（CAB）构建；

[0203] 1.1、1D卷积与池化；

[0204] 对最优特征子集（维度为128×128）进行两轮1D卷积-池化操作：

[0205] 第一轮：卷积核大小为3，输出通道数为64，激活函数采用GELU，随后通过MaxPooling 1D（池化核大小为2，步长为2）将特征维度压缩为64×64；

[0206] 第二轮：卷积核大小为3，输出通道数为32，激活函数采用GELU，随后通过MaxPooling 1D将特征维度压缩为32×32；

[0207] 1.2、多头注意力层：将池化后的特征输入多头注意力层（头数h=2，模型维度d_model=32），计算特征间的全局关联权重，公式如下：

[0208] ；

[0209] ；

[0210] 其中，Q、K、V分别为查询、键、值矩阵，为单头维度，为输出投影矩阵；

[0211] 1.3残差连接与归一化；

[0212] 在注意力层前后加入残差连接（Residual Connection）与归一化层（Normalization Layer），避免梯度消失，公式如下：

[0213] ；

[0214] 其中，X为注意力层输入特征，Output为注意力层输出特征；

[0215] 1.4全局池化；

[0216] 通过Global Max Pooling 1D将注意力层输出的32×32特征压缩为1×32的局部关联特征向量。

[0217] 2.多核块（MKB）构建；

[0218] 2.1、采用多尺度1D卷积并行提取特征：设置卷积核大小分别为3、4、5，输出通道数均为32，激活函数采用GELU，对最优特征子集进行并行卷积操作；

[0219] 2.2、对每个尺度的卷积输出分别进行Global Max Pooling 1D，得到3个1×32的多尺度特征向量；

[0220] 2.3、将3个多尺度特征向量拼接，形成1×96的多尺度特征矩阵。

[0221] 3、集成块（Ensemble Block）与分类输出；

[0222] 3.1、特征集成；

[0223] 将CAB输出的1×32局部关联特征与MKB输出的1×96多尺度特征进行拼接，形成1×128的融合特征向量；

[0224] 3.2前馈网络（FFN）处理；

[0225] 将融合特征输入两层前馈网络，第一层输出维度为64（激活函数GELU），第二层输出维度为7（对应7类流量标签），公式如下：

[0226] ；

[0227] 其中，、为权重矩阵，、为偏置项；

[0228] 3.3分类概率计算；

[0229] 通过Softmax函数将前馈网络输出转换为各类流量的概率分布，公式如下：

[0230]

[0231] 其中，为样本X属于第i类流量的概率，为前馈网络对第i类的输出值，最终选取概率最大的类别作为样本的预测标签。

[0232] 步骤五：流量检测结果输出；

[0233] 该模块的核心功能是对步骤四输出的预测结果进行后处理，生成直观、可解释的检测报告，并支持异常流量的实时告警，具体实现步骤如下：

[0234] 1.检测结果后处理；

[0235] 1.1结果验证与修正；

[0236] 将步骤四输出的预测标签与样本真实标签（若有）进行比对，对验证集上误判的样本（如将正常流量误判为Bot攻击、将DDoS攻击漏判为正常流量），记录其特征分布（如payload语义特征、优化后的关键特征权重），形成"误判样本特征库”，用于后续模型迭代优化；

[0237] 1.2置信度筛选；

[0238] 设置置信度阈值（默认0.9），对预测概率低于阈值的样本标记为"可疑流量”，需进一步人工审核；对预测概率高于阈值的样本，直接确定为"正常流量”或对应类型的"攻击流量”。

[0239] 2.检测报告生成；

[0240] 2.1基础统计信息输出；

[0241] 生成检测周期内（如1小时、24小时）的基础统计报告，包括：

[0242] （1）总检测样本数、正常流量数、各类攻击流量数及占比；

[0243] （2）整体检测准确率、各类攻击的识别准确率（如DoS攻击识别准确率、Bot攻击识别准确率）、误判率（False Positiveate）、漏判率（False Negative Rate），计算公式参考如下：

[0244] ；

[0245] ；

[0246] ;

[0247] 其中，TP为真阳性（攻击流量正确识别），TN为真阴性（正常流量正确识别），FP为假阳性（正常流量误判为攻击），FN为假阴性（攻击流量漏判为正常）；

[0248] 2.2攻击特征详情输出；

[0249] 对识别出的攻击流量，输出其关键特征详情，包括：

[0250] （1）流量元数据：源IP、目的IP、源端口、目的端口、攻击发生时间、持续时长；

[0251] （2）payload关键语义特征：如DoS攻击中高频出现的"GET / HTTP / 1.1”子词序列、Bot攻击中特有的"485454502f312e31”（对应"HTTP / 1.1”）请求标识；

[0252] （3）优化后的关键特征权重：FFA-ALO算法筛选出的Top10特征及其权重（如"连接时长”特征权重0.15、"payload中异常字符占比”特征权重0.22），帮助安全人员定位攻击核心模式。

[0253] 3.实时告警与日志存储；

[0254] 3.1告警触发机制；

[0255] 当检测到攻击流量（尤其是高风险攻击，如DDoS、Brute Force）或可疑流量数量超过设定阈值（如1分钟内超过50条可疑流量）时，触发实时告警，告警方式包括：

[0256] （1）系统弹窗告警：在IDS管理界面弹出告警窗口，显示攻击类型、发生时间、源IP等关键信息；

[0257] （2）邮件 / 短信告警：向预设的安全管理员邮箱或手机发送告警信息，附带检测报告链接；

[0258] 3.2日志存储与查询；

[0259] 将所有检测结果（包括样本特征、预测标签、置信度、告警记录）以JSON格式存储至日志数据库（如Elasticsearch），支持按时间范围、攻击类型、源IP等维度进行查询与回溯分析，日志保留周期默认30天，满足安全审计需求。

[0260] 本申请中各步骤通过标准化的数据接口实现协同工作，数据流转流程情况如图2所示，具体的，包括：

[0261] 1.步骤一将预处理后的标准化数据（含payload字符串、元数据特征、标签）以"样本ID-特征矩阵-标签”的格式，通过RESTful API传输至步骤二；

[0262] 2.步骤二对payload进行BPE+SP双通道分词与Llama2嵌入处理，生成初始高维特征矩阵，附加实"分词日志”（如子词划分结果、嵌入维度信息）后，传输至步骤三；

[0263] 3.步骤三通过FFA-ALO算法对高维特征矩阵进行优化，输出最优特征子集及"优化日志”（如迭代次数、适应度变化曲线、特征选择掩码），传输至步骤四；

[0264] 4.步骤四基于CMAE模型对最优特征子集进行分类，输出预测标签、置信度及"检测日志”（如各模块输出特征、分类概率分布），传输至步骤五；

[0265] 5.步骤五对检测结果进行后处理，生成检测报告与告警信息，同时将全流程数据（含各模块中间结果）存储至数据仓库，用于模型迭代与安全审计。

[0266] 本申请的方案中，将BPE字节对编码（迭代合并高频字节对生成攻击相关子词）与SentencePiece无监督分词（纳入特殊字符与攻击特征字符）结合，形成混合分词策略，增强对网络流量中碎片化、非常规字符组合的语意捕捉能力；同时结合冻结的Llama2-7B预训练嵌入层（维度4096）生成语义特征矩阵，实现无需微调即可迁移大模型语义知识；另外再加入位置向量捕捉子词时序关联，最终拼接标准化元数据特征形成初始高维特征。该机制可深度挖掘payload中的攻击语义模式，解决传统特征对新型变种攻击泛化识别能力弱的问题；

[0267] 本申请的方案，构建双目标适应度函数，先通过FFA阶段（种群规模50、最大迭代30次）快速筛选初始特征子集，若连续5次迭代无适应度提升，则启动ALO阶段（种群规模50、最大迭代20次），以FFA最优个体为精英蚁狮初始值，通过蚂蚁随机游走与精英引导实现特征精细优化，最终输出维度≤128的最优特征子集。该方案融合FFA的快速收敛优势与ALO的强全局搜索能力，在保证特征判别性的同时将初始高维特征（1008维）压缩60%以上，显著降低后续检测模块的计算负载。

[0268] 本申请的方案中，CMAE检测模块包含两大核心块，（1）卷积注意力块（CAB）：通过两轮1D卷积-池化（核3、步长2）压缩特征维度，结合多头注意力层（头数2）计算全局关联权重，加入残差连接与层归一化避免梯度消失，最终通过GlobalMaxPooling1D输出局部关联特征；（2）多核块（MKB）：采用3 / 4 / 5三种尺度1D卷积并行提取多尺度特征，经GlobalMaxPooling1D后拼接为多尺度特征矩阵。这种双路径结构能够实现局部细节特征与全局语义关联的深度融合；并通过多尺度卷积与注意力机制协同工作，显著提升对变种DoS、隐蔽Bot等复杂攻击的识别精度。

[0269] 本申请的方案中，检测结果输出模块包含三大功能，（1）误判样本特征库构建：比对预测标签与真实标签，记录误判样本的特征分布（如payload语义特征、关键特征权重）；（2）可解释性报告生成：输出基础统计信息（准确率、FPR、FNR）与攻击特征详情（源 / 目的IP、payload关键语义子词、FFA-ALO筛选的Top10特征权重）；（3）全流程日志存储：以JSON格式将各模块中间结果（分词日志、优化日志、检测日志）存储至Elasticsearch，保留30天并支持多维度查询。这种"检测-反馈-优化”闭环机制，提升系统可维护性与可解释性；通过全流程日志留存，为后续模型升级与威胁情报挖掘提供数据支撑。

[0270] 以上介绍了本申请实施例的各种方法。下面将进一步提供实施上述方法的相关设备。

[0271] 请参考图3，本申请实施例还提供一种网络流量检测设备，包括：

[0272] 第一处理模块301，用于对网络流量数据进行语义编码处理，得到第一特征向量，所述网络流量数据包括载荷数据；

[0273] 第二处理模块302，用于对所述第一特征向量进行冗余特征筛除和特征降维处理，得到第一特征向量的特征子集；

[0274] 第三处理模块303，用于获取所述特征子集的局部关联特征矩阵和多尺度特征矩阵，其中，所述局部关联特征矩阵用于表示所述特征子集的局部特征之间的关联关系，所述多尺度特征矩阵用于所述特征子集在不同尺度下的局部特征之间的关联关系；

[0275] 第四处理模块304，用于对所述局部关联特征矩阵和多尺度特征矩阵进行融合处理，得到融合后的特征矩阵，并根据融合后的特征矩阵，确定所述网络流量数据的类别。

[0276] 可选的，所述第二处理模块，用于：

[0277] 基于第一算法对所述第一特征向量进行冗余特征筛除处理，得到初始特征子集；

[0278] 根据所述初始特征子集，确定适应度函数的适应度值，所述适应度值用于评估特征子集的分类性能和低维程度；

[0279] 当基于第一算法的迭代过程满足预设收敛条件时，根据第二算法对满足预设收敛条件的初始特征子集进行特征降维处理，得到所述第一特征向量的特征子集。

[0280] 可选的，所述预设收敛条件包括连续N次迭代得到的初始特征子集的适应度值的提升量小于预设阈值，N为大于1的正整数。

[0281] 可选的，所述第一算法包括果蝇算法FFA，所述第二算法包括蚁狮优化算法ALO。

[0282] 可选的，本申请实施例的设备，所述第三处理模块，用于：

[0283] 通过卷积注意力块CAB获取所述局部关联特征矩阵，并通过多核块MKB获取所述多尺度特征矩阵。

[0284] 可选的，本申请实施例的设备，还包括：

[0285] 第五处理模块，用于根据所述网络流量数据的类别，输出检测报告；

[0286] 其中，所述检测报告包括以下至少一项：总检测样本数、正常的网络流量数据的数量、各类攻击网络流量数据的数量、各类攻击网络流量数据的占比信息、各类攻击网络流量数据的攻击特征信息、整体检测准确率、各类攻击网络流量数据的识别准确率。

[0287] 可选的，所述第一处理模块，用于：

[0288] 对所述网络流量数据中的载荷数据进行字节对编码BPE处理以及句子片段SP分词处理，得到分词结果；

[0289] 通过预训练语言模型对所述分词结果进行嵌入处理，得到初始特征向量；

[0290] 对所述初始特征向量进行特征降维和特征拼接处理，得到所述第一特征向量。

[0291] 需要说明的是，该实施例中的设备是与上述方法对应的设备，上述各实施例中的实现方式均适用于该设备的实施例中，也能达到相同的技术效果。本申请实施例提供的上述设备，能够实现上述方法实施例所实现的所有方法步骤，且能够达到相同的技术效果，在此不再对本实施例中与方法实施例相同的部分及有益效果进行具体赘述。

[0292] 本申请另一实施例的一种网络流量检测设备，如图4所示，包括收发器410、处理器400、存储器420及存储在所述存储器420上并可在所述处理器400上运行的程序或指令；所述处理器400执行所述程序或指令时实现上述方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。

[0293] 所述收发器410，用于在处理器400的控制下接收和发送数据。

[0294] 其中，在图4中，总线架构可以包括任意数量的互联的总线和桥，具体由处理器400代表的一个或多个处理器和存储器420代表的存储器的各种电路链接在一起。总线架构还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路链接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。总线接口提供接口。收发器410可以是多个元件，即包括发送机和接收机，提供用于在传输介质上与各种其他装置通信的单元。针对不同的用户设备，用户接口430还可以是能够外接内接需要设备的接口，连接的设备包括但不限于小键盘、显示器、扬声器、麦克风、操纵杆等。

[0295] 处理器400负责管理总线架构和通常的处理，存储器420可以存储处理器400在执行操作时所使用的数据。

[0296] 本申请实施例还提供一种计算机可读存储介质，所述计算机可读存储介质上存储计算机程序，所述计算机程序被处理器执行时实现上述方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。其中，所述的计算机可读存储介质，如只读存储器（Read-Only Memory，ROM）、随机存取存储器（Random Access Memory，RAM）、磁碟或者光盘等。

[0297] 本申请实施例还提供一种计算机程序产品，包括计算机指令，所述计算机指令被处理器执行时实现上述方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。

[0298] 本申请实施例另提供了一种芯片，所述芯片包括处理器和通信接口，所述通信接口和所述处理器耦合，所述处理器用于运行程序或指令，实现上述方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。

[0299] 应理解，本申请实施例提到的芯片还可以称为系统级芯片，系统芯片，芯片系统或片上系统芯片等。

[0300] 需要说明的是，在本文中，术语"包括”、"中包含”或者其任何其他变体意在涵盖非排他性的中包含，从而使得包括一系列要素的过程、方法、物品或者装置不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者装置所固有的要素。在没有更多限制的情况下，由语句"包括一个……”限定的要素，并不排除在包括该要素的过程、方法、物品或者装置中还存在另外的相同要素。

[0301] 通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到上述实施例方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，所述计算机软件产品存储在一个存储介质（如ROM / RAM、磁碟、光盘）中，包括若干指令用以使得一台终端（可以是手机，计算机，服务器，空调器，或者网络设备等）执行本申请各个实施例所述的方法。

[0302] 上面结合附图对本申请的实施例进行了描述，但是本申请并不局限于上述的具体实施方式，上述的具体实施方式仅仅是示意性的，而不是限制性的，本领域的普通技术人员在本申请的启示下，在不脱离本申请宗旨和权利要求所保护的范围情况下，还可做出很多形式，均属于本申请的保护之内。< / script>

Claims

1. A network traffic detection method, characterized in that, include: The network traffic data is semantically encoded to obtain a first feature vector, wherein the network traffic data includes payload data; Redundant feature removal and feature dimensionality reduction are performed on the first feature vector to obtain a feature subset of the first feature vector. Obtain the local correlation feature matrix and the multi-scale feature matrix of the feature subset, wherein the local correlation feature matrix is ​​used to represent the correlation between local features of the feature subset, and the multi-scale feature matrix is ​​used to represent the correlation between local features of the feature subset at different scales; The local correlation feature matrix and the multi-scale feature matrix are fused to obtain a fused feature matrix, and the category of the network traffic data is determined based on the fused feature matrix.

2. The method according to claim 1, characterized in that, Redundant feature removal and feature dimensionality reduction are performed on the first feature vector to obtain a feature subset of the first feature vector, including: Based on the first algorithm, redundant features are filtered out from the first feature vector to obtain an initial feature subset; Based on the initial feature subset, the fitness value of the fitness function is determined, and the fitness value is used to evaluate the classification performance and low dimensionality of the feature subset; When the iterative process based on the first algorithm satisfies the preset convergence condition, the initial feature subset that satisfies the preset convergence condition is subjected to feature dimensionality reduction processing according to the second algorithm to obtain the feature subset of the first feature vector.

3. The method according to claim 2, characterized in that, The preset convergence condition includes the improvement in the fitness value of the initial feature subset obtained after N consecutive iterations being less than a preset threshold, where N is a positive integer greater than 1.

4. The method according to claim 2, characterized in that, The first algorithm includes the Fruit Fly Algorithm (FFA), and the second algorithm includes the Antlion Algorithm (ALO).

5. The method according to claim 1, characterized in that, The step of obtaining the local correlation feature matrix and multi-scale feature matrix of the feature subset includes: The local correlation feature matrix is ​​obtained through convolutional attention blocks (CAB), and the multi-scale feature matrix is ​​obtained through multi-kernel blocks (MKB).

6. The method according to claim 1, characterized in that, Also includes: Output a detection report based on the category of the network traffic data; The detection report includes at least one of the following: total number of detected samples, number of normal network traffic data, number of various types of attack network traffic data, percentage information of various types of attack network traffic data, attack characteristic information of various types of attack network traffic data, overall detection accuracy, and identification accuracy of various types of attack network traffic data.

7. The method according to claim 1, characterized in that, Semantic encoding is performed on network traffic data to obtain the first feature vector, which includes: The payload data in the network traffic data is processed by byte pair encoding (BPE) and sentence segmentation (SP) to obtain the word segmentation results. The word segmentation results are embedded using a pre-trained language model to obtain an initial feature vector; The initial feature vector is subjected to feature dimensionality reduction and feature concatenation to obtain the first feature vector.

8. A network traffic detection device, characterized in that, include: The first processing module is used to perform semantic encoding processing on network traffic data to obtain a first feature vector, wherein the network traffic data includes payload data. The second processing module is used to perform redundant feature removal and feature dimensionality reduction on the first feature vector to obtain a feature subset of the first feature vector. The third processing module is used to obtain the local correlation feature matrix and the multi-scale feature matrix of the feature subset, wherein the local correlation feature matrix is ​​used to represent the correlation between local features of the feature subset, and the multi-scale feature matrix is ​​used to represent the correlation between local features of the feature subset at different scales; The fourth processing module is used to fuse the local correlation feature matrix and the multi-scale feature matrix to obtain a fused feature matrix, and to determine the category of the network traffic data based on the fused feature matrix.

9. An electronic device, characterized in that, include: Transceiver, processor, memory, and programs or instructions stored in the memory and executable on the processor; When the processor executes the program or instructions, it implements the steps of the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method as described in any one of claims 1 to 7.

11. A computer program product, characterized in that, Includes computer instructions that, when executed by a processor, implement the steps of the method as described in any one of claims 1 to 7.

Images