A deep learning-based network traffic behavior identification method and system
By using deep learning to identify the consistency of network traffic characteristics at different behavioral granularities, the problem of redundant feature interference is solved, thereby improving the accuracy and robustness of network security identification.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- SHANGHAI FUHUA NETWORK TECH CO LTD
- Filing Date
- 2026-05-28
- Publication Date
- 2026-06-23
AI Technical Summary
In existing network traffic risk identification processes, the interference of redundant features generated by rapid fluctuations in network traffic has a significant impact on the risk identification results, leading to false security alarms. How to reduce the interference of redundant traffic features on network security identification has become an urgent problem to be solved.
By using deep learning-based methods, we can identify the consistency of traffic feature dimensions at different behavioral granularities, reduce the effective weight of redundant traffic features, and improve the robustness of network security identification.
By employing a cross-granularity feature consistency assessment and weight adaptive adjustment mechanism, the impact of redundant traffic features on security identification results is reduced, thereby improving the accuracy and robustness of network security identification.
Smart Images
Figure CN122268690A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network security technology, and more specifically, to a method and system for network traffic behavior recognition based on deep learning. Background Technology
[0002] The deep integration of 5G technology with various industry application scenarios has led to the gradual evolution of traditional, relatively closed operator networks and campus private networks towards openness and interconnection. As network boundaries continue to expand, the open network architecture, while improving business flexibility, also provides more entry points and propagation paths for potential attacks, resulting in a significant increase in network security risks.
[0003] As a crucial carrier for business interactions and the propagation of attack behaviors, the increasing scale and structural complexity of network traffic have further amplified the security challenges faced by enterprises and operators. In existing network traffic risk identification processes, the interference of redundant features generated by rapid fluctuations in network traffic can easily lead to false alarms. Therefore, how to reduce the interference of redundant traffic features on network security identification has become an urgent problem to be solved. Summary of the Invention
[0004] This application provides a network traffic behavior recognition method and system based on deep learning. By recognizing the consistency of traffic feature dimensions at different behavioral granularities, the effective weight of redundant traffic features is reduced, thereby improving the robustness of network security recognition.
[0005] In a first aspect, this application provides a network traffic behavior recognition method based on deep learning. This method can be executed by a network device, or it can be executed by a chip configured in the network device. This application does not limit the execution of this method.
[0006] Specifically, the method includes: Collect network traffic data and extract the initial traffic features of the network traffic data. Perform network behavior analysis on the initial traffic features to determine multiple network behavior granularities corresponding to the network traffic data. Dynamic feature extraction is performed on the network traffic data based on different network behavior granularities to obtain traffic feature vectors corresponding to different network behavior granularities. Obtain each dynamic feature dimension in the traffic feature vector, use a deep learning model to extract the dynamic feature consistency corresponding to each dynamic feature dimension under multi-behavior granularity conditions, and map it to the corresponding effective behavior monitoring weight. Based on the effective behavior monitoring weights corresponding to each dynamic feature dimension, behavioral security analysis is performed on the network traffic data, and the security identification results are sent to the network security center.
[0007] In conjunction with the first aspect, in certain implementations of the first aspect, extracting the initial traffic characteristics of the network traffic data specifically includes: Obtain the raw network data packets from the network traffic data; perform protocol parsing on the raw network data packets and extract structured fields; Based on the structured fields, data packets are reassembled according to preset flow division rules to construct network flow data; a sliding window is established to perform statistical analysis on the network flow data in each window and extract initial traffic characteristics.
[0008] In conjunction with the first aspect, in certain implementations of the first aspect, performing network behavior analysis on the initial traffic characteristics to determine multiple network behavior granularities corresponding to the network traffic data specifically includes: The temporal variation features, behavioral pattern transition features, and state stability features of the initial traffic features are obtained, and a behavioral change scoring function is constructed. Based on the scoring range of the behavior change scoring function, multiple scoring thresholds are set as the granularity of network behavior.
[0009] In conjunction with the first aspect, in some implementations of the first aspect, dynamic feature extraction of network traffic data based on different network behavior granularities to obtain traffic feature vectors corresponding to different network behavior granularities specifically includes: The network traffic data is segmented based on different network behavior granularities to obtain multiple sets of traffic data segments. For any set of traffic data segments corresponding to any network behavior granularity, extract multiple dynamically changing features to form a traffic feature vector.
[0010] In conjunction with the first aspect, in some implementations of the first aspect, a deep learning model is used to extract the dynamic feature consistency corresponding to each dynamic feature dimension under multi-behavioral granularity conditions, and map it to the corresponding effective behavior monitoring weights. Specifically, this includes: For any dynamic feature dimension, obtain the dynamic feature sequence under each behavior granularity segmentation condition, and perform feature resampling on the dynamic feature sequence under each granularity segmentation condition to achieve time alignment of the dynamic feature sequence. The dynamic feature sequences under each behavior granularity segmentation condition are input into a pre-trained deep learning model to identify the dynamic feature consistency parameter corresponding to the dynamic feature dimension. Obtain a preset interval mapping table, perform weight mapping based on the threshold interval where the dynamic feature consistency parameter is located, and obtain the effective behavior monitoring weight corresponding to the dynamic feature dimension.
[0011] In conjunction with the first aspect, in certain implementations of the first aspect, the behavioral security analysis of the network traffic data based on the effective behavioral monitoring weights corresponding to each dynamic feature dimension specifically includes: The network traffic data is segmented according to a preset network behavior granularity to obtain multiple traffic data segments, and multi-dimensional dynamic feature vectors are extracted based on each traffic data segment. Based on the effective behavior monitoring weights corresponding to each dynamic feature dimension, the multi-dimensional dynamic feature vector is weighted to obtain a weighted network traffic feature matrix. The network traffic feature matrix is input into a neural network model for behavioral pattern clustering, and the corresponding risk score is determined based on the clustering results.
[0012] In conjunction with the first aspect, in some implementations of the first aspect, network traffic data is collected by port mirroring deployed on the network link side.
[0013] Secondly, this application provides a deep learning-based network traffic behavior recognition system, which includes a network security recognition unit, the network security recognition unit comprising: The traffic feature acquisition unit is used to collect network traffic data, extract the initial traffic features of the network traffic data, perform network behavior analysis on the initial traffic features, and determine multiple network behavior granularities corresponding to the network traffic data. The traffic feature analysis unit performs dynamic feature extraction on the network traffic data based on different network behavior granularities to obtain traffic feature vectors corresponding to different network behavior granularities. The traffic feature analysis unit is also used to obtain each dynamic feature dimension in the traffic feature vector, use a deep learning model to extract the dynamic feature consistency corresponding to each dynamic feature dimension under multi-behavior granularity conditions, and map it to the corresponding effective behavior monitoring weight. The traffic security monitoring unit performs behavioral security analysis on the network traffic data based on the effective behavior monitoring weights corresponding to each dynamic feature dimension, and sends the security identification results to the network security center.
[0014] Thirdly, this application provides a computer terminal device, which includes a memory and a processor. The memory stores code, and the processor is configured to acquire the code and execute the aforementioned deep learning-based network traffic behavior recognition method.
[0015] Fourthly, this application provides a computer-readable storage medium storing at least one computer program, which is loaded and executed by a processor to implement the operations performed by the aforementioned deep learning-based network traffic behavior recognition method.
[0016] The technical solutions provided by the embodiments disclosed in this application have the following beneficial effects: This application provides a deep learning-based network traffic behavior recognition method and system. First, initial traffic features of network traffic data are extracted. Network behavior analysis is then performed on these initial traffic features to determine multiple network behavior granularities corresponding to the network traffic data. Dynamic features are extracted from the network traffic data based on different network behavior granularities to obtain traffic feature vectors corresponding to each granularity. Each dynamic feature dimension in the traffic feature vector is obtained, and a deep learning model is used to extract the dynamic feature consistency corresponding to each dynamic feature dimension under multi-behavior granularity conditions, mapping it to corresponding effective behavior monitoring weights. Based on the effective behavior monitoring weights corresponding to each dynamic feature dimension, behavioral security analysis is performed on the network traffic data, and the security recognition results are sent to a network security center.
[0017] Therefore, this application divides network behavior into multiple granularities based on the sensitivity of behavioral pattern changes. Then, for the same feature dimension, it identifies the feature change trend under different behavioral granularities. By performing correlation analysis on the feature change trends under different granularities, it obtains the cross-granularity consistency index of each dynamic feature dimension and maps the feature consistency to the corresponding effective behavior monitoring weight. By adjusting the monitoring weight of different dynamic feature dimensions, it identifies feature dimensions less affected by behavioral pattern changes for effective behavior monitoring, thereby reducing the impact of redundant traffic features on security identification results and improving the accuracy of network security identification.
[0018] In summary, this application improves the robustness of network security identification by enhancing the utilization of traffic stability features and suppressing redundant features through cross-granularity feature consistency evaluation and weight adaptive adjustment mechanism. Attached Figure Description
[0019] Figure 1 This is an exemplary flowchart of a deep learning-based network traffic behavior recognition method according to some embodiments of this application; Figure 2 This is an experimental data graph showing the distribution of network traffic behavior change scores according to some embodiments of this application; Figure 3 This is a schematic diagram of dynamic feature extraction results at a multi-behavior granularity, as shown in some embodiments of this application; Figure 4This is a schematic diagram of dynamic feature consistency identification and effective behavior monitoring weight mapping according to some embodiments of this application; Figure 5 This is a network risk score distribution diagram based on effective behavior monitoring weights, as shown in some embodiments of this application; Figure 6 This is a schematic diagram of the structure of a network security identification unit according to some embodiments of this application; Figure 7 This is a schematic diagram of the structure of a computer terminal device that implements a deep learning-based network traffic behavior recognition method according to some embodiments of this application. Detailed Implementation
[0020] This application extracts initial traffic features from network traffic data, performs network behavior analysis on these initial traffic features, and determines multiple network behavior granularities corresponding to the network traffic data. Based on different network behavior granularities, it performs dynamic feature extraction on the network traffic data, obtaining traffic feature vectors corresponding to different network behavior granularities. It obtains each dynamic feature dimension from the traffic feature vectors, uses a deep learning model to extract the dynamic feature consistency of each dynamic feature dimension under multiple behavior granularities, and maps it to corresponding effective behavior monitoring weights. Based on the effective behavior monitoring weights corresponding to each dynamic feature dimension, it performs behavioral security analysis on the network traffic data and sends the security identification results to a network security center. This application improves the robustness of network security identification by identifying the feature consistency of traffic feature dimensions under different behavior granularities, thereby reducing the effective weights of redundant traffic features.
[0021] To better understand the above technical solutions, a detailed description of the solutions will be provided below in conjunction with the accompanying drawings and specific implementation methods. (Reference) Figure 1 The figure is an exemplary flowchart of a deep learning-based network traffic behavior recognition method according to some embodiments of this application. The deep learning-based network traffic behavior recognition method 100 mainly includes the following steps: In step S101, network traffic data is collected, and the initial traffic features of the network traffic data are extracted. Network behavior analysis is performed on the initial traffic features to determine multiple network behavior granularities corresponding to the network traffic data.
[0022] Optionally, in some embodiments, network traffic data is collected by port mirroring deployed on the network link side. In other embodiments, it can also be achieved by traffic collection modules deployed on the network link side, host side, or gateway side. In this application, the network traffic data collection process can obtain raw network data packets based on different mechanisms such as port mirroring, link splitting, and data packet capture. This application does not limit the specific method of collecting network traffic data.
[0023] Optionally, in some embodiments, extracting the initial traffic characteristics of the network traffic data specifically includes: Obtain the raw network data packets from the network traffic data; perform protocol parsing on the raw network data packets and extract structured fields; Based on the structured fields, data packets are reassembled according to preset flow division rules to construct network flow data; a sliding window is established to perform statistical analysis on the network flow data in each window and extract initial traffic characteristics.
[0024] In specific implementation, during the process of obtaining the original network data packets in the network traffic data, the original network data packets include link layer, network layer and transport layer data. The original network data packets are obtained by setting the traffic acquisition module on the network link side; then, the original network data packets are parsed layer by layer according to the network protocol layer structure to extract structured fields. The structured fields include at least the source IP address, destination IP address, source port number, destination port number, protocol type, data packet length, timestamp and transmission control flag.
[0025] In some specific embodiments of this application, during the process of reassembling data packets according to preset flow division rules based on the structured fields, the flow division rules are preset to be a consistency determination based on five-tuple information and a flow termination mechanism based on timeout. That is, a five-tuple consisting of source IP address, destination IP address, source port number, destination port number, and protocol type is used as a flow identifier. Data packets with the same five-tuple are initially classified. When the time interval between adjacent data packets exceeds a preset threshold, it is determined to be a new network flow. For example, when the time interval between adjacent data packets is less than or equal to the preset time threshold, they are classified into the same network flow. When the time interval between adjacent data packets is greater than the preset time threshold, the previous network flow is determined to have ended, and subsequent data packets are classified as new network flows.
[0026] In some embodiments, the initial traffic characteristics are represented as a feature vector, wherein each dimension of the feature vector includes at least: statistical characteristics, temporal characteristics, directional characteristics, and protocol behavior characteristics of the network flow data. The statistical characteristics include the number of data packets, total number of bytes, average data packet length, maximum data packet length, and minimum data packet length. The temporal characteristics include the mean, variance, and rate of change of time intervals between adjacent data packets. The directional characteristics include the ratio of uplink to downlink data packet counts, the byte count ratio, and the number of data transmission direction switching events. The protocol behavior characteristics include the distribution ratio of transmission control flags, the number of connection establishments, and the number of connection terminations. Specifically, the statistical characteristics are obtained by aggregating the data packet lengths within a sliding window; the temporal characteristics are obtained by calculating the adjacent time differences based on the data packet timestamp sequence; and the directional characteristics are obtained by classifying and statistically analyzing the data packet transmission direction. The specific acquisition methods for each type of statistical characteristic can also refer to existing traffic data statistics and collection methods, which will not be elaborated upon in this application.
[0027] Optionally, in some embodiments, after extracting the initial traffic features of the network traffic data, the method further includes: normalizing the initial traffic features.
[0028] It should be noted that the behavior granularity described in this application is used to characterize the sensitivity of network traffic behavior boundary detection. Optionally, in some embodiments, performing network behavior analysis on the initial traffic features to determine multiple network behavior granularities corresponding to the network traffic data specifically includes: The temporal variation features, behavioral pattern transition features, and state stability features of the initial traffic features are obtained, and a behavioral change scoring function is constructed. Based on the scoring range of the behavior change scoring function, multiple scoring thresholds are set as the granularity of network behavior.
[0029] In specific implementation, a sliding analysis window is established for the network traffic data in chronological order, and the temporal change characteristics, behavior pattern transition characteristics, and state stability characteristics within each sliding analysis window are statistically analyzed. The temporal change characteristics characterize the dynamic fluctuations of network traffic in a continuous time series, and may include the rate of change of data packet time interval, the rate of change of traffic rate, and the rate of change of data packet length. The behavior pattern transition characteristics characterize the structural changes in network communication behavior, and may include the frequency of transmission direction switching, the frequency of connection state transitions, and the rate of change of protocol interaction modes. The state stability characteristics characterize the stability of network traffic behavior within the current time window, and may include the traffic distribution entropy, statistical variance, and the degree of variance fluctuation between sliding windows.
[0030] It should be noted that the behavior change score described in this application is used to characterize the intensity of change in current network traffic behavior relative to historical behavior states. The higher the behavior change score, the more likely the current network behavior is to switch behavior patterns. Optionally, in some embodiments, the process of constructing the behavior change score function specifically includes: performing fusion calculation on various features according to preset weights to obtain the behavior change score corresponding to the current time window. The preset weights of various features can be preset based on the statistical distribution of changes of various features under normal and abnormal behavior in historical network traffic samples. For example, multiple weight levels can be preset, each corresponding to a weight value. Feature types with large changes and stable trends during behavior switching are given a large weight ratio. In some embodiments, the weights of each feature can also be iteratively updated according to the historical recognition accuracy under different network scenarios to improve the stability of the behavior boundary detection capability of the behavior change score function in different network environments. Reasonably, the sum of the weights of each feature is kept at a preset fixed value. This application does not limit the setting conditions of the preset weights.
[0031] In some embodiments, for example, referencing Figure 2 As shown, Figure 2 This figure shows experimental data on the distribution of network traffic behavior change scores in this embodiment of the application. It corresponds to the process of the system collecting network traffic data, extracting initial traffic features, and determining multiple network behavior granularities based on the behavior change scoring function. The test simulates protocol parsing, flow reconstruction, and sliding window statistical analysis of the original network data packets to construct temporal change features, behavior pattern transition features, and state stability features. Behavior change scores are calculated, and a scoring threshold is set as the basis for division. Specifically, 1000 sets of network traffic data are collected, and the original network data packets undergo protocol parsing and flow reconstruction to extract initial traffic features such as packet length and packet time interval. Subsequently, temporal change features, behavior pattern transition features, and state stability features are constructed through sliding window statistical analysis. Based on these features, a behavior change scoring function is constructed to quantify the dynamic fluctuation of network traffic behavior. In the figure, the horizontal axis represents the behavior change score, and the vertical axis represents the frequency of traffic samples within the corresponding scoring interval. As shown in the figure, the behavior change scores of most network traffic samples are concentrated around 0.01, corresponding to a frequency of approximately 930, indicating that most network traffic is in a stable behavior state. Samples with scores around 0.02 have a frequency of approximately 70, indicating that some network traffic exhibits a certain degree of behavioral fluctuation. A small number of traffic samples with higher scores correspond to abnormal behavior changes. This application can further divide network behavior into multiple granularities based on different scoring thresholds, realizing hierarchical monitoring and dynamic analysis of network traffic behavior.
[0032] Optionally, in some embodiments, during the process of setting multiple scoring thresholds as network behavior granularity based on the scoring range of the behavior change scoring function, the scoring results of the behavior change scoring function in historical network traffic are statistically analyzed to determine the scoring distribution range. The scoring distribution range is then divided into intervals according to a preset hierarchical rule to generate multiple scoring thresholds with different sensitivities to behavior changes. For example, the length of the scoring distribution range is obtained, and three discrete scoring thresholds (low, medium, and high) are set as network behavior granularity.
[0033] For example, in one embodiment, after statistically analyzing the behavior change scores corresponding to historical network traffic, the behavior change scores are found to be mainly distributed between 0 and 100. Based on the score distribution range, multiple score deviation thresholds are set as network behavior granularity according to preset hierarchical rules, wherein different score deviation thresholds correspond to behavior boundary detection modes with different levels of sensitivity. For example, when the rating distribution range is 0–100, rating deviation thresholds of 5, 10, and 15 are set as different network behavior granularities, where: The scoring deviation threshold of 5 corresponds to a high-sensitivity network behavior granularity. When the scoring deviation of behavior changes between adjacent time windows is greater than 5, it is determined that there is a change in the behavior boundary of the current network traffic, and behavior segmentation is performed to obtain traffic data segments with fine behavior granularity. A scoring deviation threshold of 10 corresponds to medium-sensitivity network behavior granularity. When the scoring deviation of behavior changes between adjacent time windows is greater than 10, behavior segmentation is performed to obtain traffic data segments with medium behavior granularity. A scoring deviation threshold of 15 corresponds to a low-sensitivity network behavior granularity. Behavior segmentation is only performed when the scoring deviation of behavior changes between adjacent time windows is greater than 15, thus preserving the overall behavior structure over a longer period and obtaining coarse-grained traffic data segments. For example, for a given set of raw network traffic data, the behavior change score sequence corresponding to a continuous time window is: 22, 24, 27, 35, 48, 52, 68; then the score deviations between adjacent windows are: 2, 3, 8, 13, 4, 16, respectively. At a behavior granularity with a score deviation threshold of 5, since score deviations of 8, 13, and 16 all exceed the threshold, behavior segmentation is performed at the corresponding positions, thus forming multiple fine-grained behavior segments. At a behavior granularity with a score deviation threshold of 15, only score deviation 16 exceeds the threshold, so behavior segmentation is performed only at the corresponding position, thus forming a coarser-grained behavior segment. In some implementations, when the overall distribution range of behavior change scores is small, a corresponding behavior granularity threshold can be set based on the length of the score range. For example, when behavior change scores are mainly distributed in the range of 0 to 60, score deviation thresholds of 3, 6, and 9 can be set as different network behavior granularities to adapt to the behavior boundary detection requirements in network scenarios with low change intensity. Among them, the smaller the score deviation threshold, the more sensitive it is to behavior changes, and the finer the corresponding behavior segments are formed; the larger the score deviation threshold, the less sensitive it is to behavior changes, and the coarser the corresponding behavior segments are formed.
[0034] It should be noted that, due to the hierarchical nature of network traffic behavior, different levels of sensitivity in behavior boundary detection will result in different levels of fineness in behavior segmentation. Therefore, by segmenting traffic data at different granularities based on the degree of behavior pattern transformation, multiple traffic segmentation schemes corresponding to different network behavior granularities can be obtained. By extracting the feature consistency of different feature dimensions at the behavior pattern granularity, dynamic traffic features that are less affected by behavior pattern transformation can be identified, thereby reducing the interference of irrelevant traffic features on security identification.
[0035] In step S102, dynamic feature extraction is performed on the network traffic data based on different network behavior granularities to obtain traffic feature vectors corresponding to different network behavior granularities.
[0036] Optionally, in some embodiments, dynamically extracting features from network traffic data based on different network behavior granularities to obtain traffic feature vectors corresponding to different network behavior granularities specifically includes: The network traffic data is segmented based on different network behavior granularities to obtain multiple sets of traffic data segments. For any set of traffic data segments corresponding to any network behavior granularity, extract multiple dynamically changing features to form a traffic feature vector.
[0037] In specific implementation, based on the scoring deviation threshold corresponding to different network behavior granularities, behavior boundary detection is performed on the behavior change scoring sequence in the network traffic data. When the behavior change scoring deviation between adjacent time windows exceeds the scoring deviation threshold of the corresponding network behavior granularity, data segmentation is performed at the corresponding position to obtain multiple traffic data segment sets. For any set of traffic data segments corresponding to any network behavior granularity, dynamic feature extraction is performed on each traffic data segment in chronological order to obtain the corresponding traffic feature vector. For example, for a set of traffic data segments obtained for a high-sensitivity network behavior granularity, there are three consecutive data segments D1, D2, and D3, where the time range of D1 is 0–2s, the time range of D2 is 2–3s, and the time range of D3 is 3–3.5s. Then, the sequence relationship of D1, D2, and D3 is constructed in chronological order. A local sliding analysis window is established within any traffic data segment, and dynamic feature extraction is performed on the data packet sequence within the window to obtain the feature corresponding to that data segment. The process of dynamic feature extraction includes: statistical analysis of data packets within a traffic data segment to extract packet quantity, average packet length, and traffic rate; differential calculation of data packet timestamp sequences to extract the rate of change of adjacent data packet intervals and traffic burst intensity; statistical analysis of data packet transmission direction and protocol interaction status to extract uplink / downlink ratio and state switching frequency; statistical modeling of traffic data distribution to calculate packet length distribution entropy and time distribution entropy; normalization of various dynamic features, using them as dynamic feature dimensions for corresponding labels, and concatenating them according to preset feature arrangement rules to generate the dynamic feature vector corresponding to the current traffic data segment.
[0038] In some embodiments, for example, referencing Figure 3 As shown, Figure 3 This diagram illustrates the dynamic feature extraction results at multiple behavior granularities in some embodiments of this application. During testing, network traffic data is divided into multiple behavior granularities based on behavior change scoring results, and the traffic data is segmented according to fine-grained, medium-grained, and coarse-grained levels. Dynamic feature vectors are extracted from traffic data segments under different granularity conditions. The dynamic features include statistical features such as mean packet size, variance of packet size, mean time interval, variance of time interval, and skewness of time interval. The left side of the diagram shows the differences in dynamic features of packet size under different network behavior granularities, and the right side shows the changes in dynamic features of time interval under different network behavior granularities. The test results show that the traffic features corresponding to the fine-grained region are relatively stable overall, with small fluctuations in packet size and time interval; while the traffic features corresponding to the coarse-grained region show significantly increased fluctuations, with a significant increase in the mean and variance of packet size, and more drastic changes in time interval features, corresponding to the sudden behavior characteristics of abnormal attack traffic. By extracting dynamic features at different network behavior granularities, this application can enhance the system's ability to distinguish abnormal network behavior and improve the accuracy of subsequent network behavior security identification.
[0039] In step S103, each dynamic feature dimension in the traffic feature vector is obtained, and a deep learning model is used to extract the dynamic feature consistency corresponding to each dynamic feature dimension under the multi-behavior granularity condition, and map it to the corresponding effective behavior monitoring weight.
[0040] It should be noted that because the same network traffic data can result in segmentations of varying fineness at different network behavior granularities, the traffic feature vectors at each granularity differ in temporal coverage, behavior segment length, and local structural representation. This leads to different numerical response sequences for the same dynamic feature dimension at different granularities. For key feature dimensions that truly reflect the essential changes in network behavior, they typically maintain a relatively stable trend or similar distribution structure under different granularity segmentation conditions, exhibiting high consistency. However, for feature dimensions that are significantly affected by local noise, segmentation boundary perturbations, and occasional traffic, their performance under different granularity conditions often fluctuates greatly, lacking a stable correspondence, thus exhibiting low consistency.
[0041] Optionally, in some embodiments, the use of a deep learning model to extract the dynamic feature consistency corresponding to each dynamic feature dimension under multi-behavioral granularity conditions and mapping it to the corresponding effective behavior monitoring weights specifically includes: For any dynamic feature dimension, obtain the dynamic feature sequence under each behavior granularity segmentation condition, and perform feature resampling on the dynamic feature sequence under each granularity segmentation condition to achieve time alignment of the dynamic feature sequence. The dynamic feature sequences under each behavior granularity segmentation condition are input into a pre-trained deep learning model to identify the dynamic feature consistency parameter corresponding to the dynamic feature dimension. Obtain a preset interval mapping table, perform weight mapping based on the threshold interval where the dynamic feature consistency parameter is located, and obtain the effective behavior monitoring weight corresponding to the dynamic feature dimension.
[0042] In specific implementation, for any dynamic feature dimension, network traffic data is segmented by behavior under the scoring deviation threshold conditions corresponding to different network behavior granularities to obtain a set of traffic data segments under multiple granularities, and the dynamic feature sequence corresponding to the dynamic feature dimension is extracted based on each set of traffic data segments; wherein, the dynamic feature sequence represents the time evolution value sequence of the dynamic feature dimension in different traffic data segments.
[0043] It should be noted that the process of resampling the dynamic feature sequences under various granularity segmentation conditions in this application is to avoid the problem of inconsistent time labels after behavioral granularity segmentation that is unique to this application, so that the feature sequences under different granularity conditions are consistent in time index labels. In some embodiments, the time alignment process can be completed by interpolation reconstruction with a uniform time step, or it can be selectively implemented by sampling after segmented mean aggregation. This application does not limit the specific implementation method of feature resampling.
[0044] In some embodiments, for example, referencing Figure 4 As shown, Figure 4 This diagram illustrates the dynamic feature consistency recognition and effective behavior monitoring weight mapping in some embodiments of this application. During testing, multiple dynamic feature dimensions in network traffic, including packet size variance, time interval variance, flow duration, flag count, and load entropy, are extracted for their corresponding dynamic feature sequences under different network behavior granularities. Time alignment is achieved through feature resampling. The aligned dynamic feature sequences are then input into a deep learning model to obtain the dynamic feature consistency parameters corresponding to each dynamic feature dimension. The bar chart in the diagram represents the consistency parameter values for different dynamic feature dimensions, and the line chart represents the effective behavior monitoring weights obtained based on the consistency parameter mapping. The test results show that the load entropy value maintains high consistency across different network behavior granularities, with a consistency parameter of 0.92, thus receiving a high monitoring weight of 1.0. In contrast, the flag count fluctuates significantly across different granularities, with a consistency parameter of only 0.15, resulting in a monitoring weight reduced to 0.2. This application, through dynamic feature consistency analysis and weight mapping mechanisms, reduces the interference of redundant traffic features and noise features on behavior recognition results, improving the accuracy and robustness of network traffic behavior security recognition.
[0045] In some embodiments, the deep learning model preferably employs a feature encoding network based on a contrastive learning mechanism. The following is a specific embodiment of this application using a feature encoding network as a pre-trained deep learning model to identify dynamic feature consistency parameters: The aligned dynamic feature sequences under each behavioral granularity condition are input into a pre-trained deep learning model for feature encoding to obtain the corresponding high-dimensional feature representations. The pre-trained deep learning model is a feature encoding network with a Transformer encoding structure. During the model encoding process, the dynamic feature sequences under different behavioral granularities are mapped to corresponding feature representation vectors. Based on the feature representation vectors under different behavioral granularities, the cross-correlation coefficient between each feature representation vector is calculated and used as the dynamic feature consistency parameter for that dynamic feature dimension.
[0046] In specific implementation, after using the cross-correlation coefficient as the dynamic feature consistency parameter corresponding to the dynamic feature dimension, a preset interval mapping table is obtained. This table pre-defines multiple consistency intervals and their corresponding weight mapping relationships. Based on the threshold interval where the dynamic feature consistency parameter is located, the corresponding weight mapping relationship is searched in the interval mapping table, and the dynamic feature consistency parameter is mapped to the corresponding effective behavior monitoring weight. The mapping relationship is used to characterize the correspondence between the stability and importance of dynamic features under multi-behavioral granularity conditions. Dynamic feature dimensions in high-consistency intervals maintain a stable trend under different segmentation conditions, are insensitive to behavior segmentation methods, and thus possess strong stability and generalization ability. They have higher reliability as network behavior representation features and correspond to high-effective behavior monitoring weights, used to strengthen their contribution in subsequent network behavior identification processes. Dynamic feature dimensions in low-consistency intervals have weak expression stability under different behavioral granularities, contain redundant traffic information, and have poor representation ability for real network behavior. Their effectiveness and reliability are relatively low, and they correspond to low-effective behavior monitoring weights to reduce their impact on security identification.
[0047] In some preferred embodiments, the interval mapping table can be constructed offline using historical network traffic sample statistics and updated adaptively according to the behavioral distribution characteristics of different network environments.
[0048] In step S104, based on the effective behavior monitoring weights corresponding to each dynamic feature dimension, behavioral security analysis is performed on the network traffic data, and the security identification results are sent to the network security center.
[0049] In some embodiments, for example, referencing Figure 5 As shown, Figure 5 This document presents a network risk score distribution map based on effective behavior monitoring weights, as shown in some embodiments of this application. During testing, a multi-dimensional dynamic feature vector containing normal and abnormal network traffic is constructed. Based on the aforementioned dynamic feature consistency analysis results, each dynamic feature dimension is assigned a corresponding effective behavior monitoring weight. The original network traffic features are weighted using a weight matrix to construct a weighted network traffic feature matrix, which is then input into a neural network model for behavior pattern clustering analysis. In the network traffic risk score distribution results, most normal traffic corresponds to low-risk scores, while only a small number of abnormal traffics correspond to high-risk scores. High-risk behavior samples are identified based on a preset high-risk threshold. This application, through the weight-based behavior security analysis mechanism, reduces the interference of redundant traffic features on the clustering results, thereby improving the accuracy and robustness of network behavior security identification.
[0050] Preferably, in some embodiments, the behavioral security analysis of the network traffic data based on the effective behavioral monitoring weights corresponding to each dynamic feature dimension specifically includes: The network traffic data is segmented according to a preset network behavior granularity to obtain multiple traffic data segments, and multi-dimensional dynamic feature vectors are extracted based on each traffic data segment. Based on the effective behavior monitoring weights corresponding to each dynamic feature dimension, the multi-dimensional dynamic feature vector is weighted to obtain a weighted network traffic feature matrix. The network traffic feature matrix is input into a neural network model for behavioral pattern clustering, and the corresponding risk score is determined based on the clustering results.
[0051] In specific implementation, the network traffic data is segmented according to a preset network behavior granularity to obtain multiple traffic data segments, and multi-dimensional dynamic feature vectors are extracted based on each traffic data segment. The different dimensions of the dynamic feature vectors include time-series change features, behavior pattern transition features, state stability features, and associated dynamic features. The effective behavior monitoring weights corresponding to each dynamic feature dimension are introduced into the feature representation process, and the multi-dimensional dynamic feature vectors are weighted to obtain a weighted network traffic feature matrix. The weighting process involves performing a dimension-wise multiplication operation between the feature values of each dynamic feature dimension and the corresponding effective behavior monitoring weight. The weighted network traffic feature matrix is arranged according to the order of traffic data segments to construct a two-dimensional feature input matrix, which is then input into a convolutional neural network for feature learning. The convolutional neural network includes an input layer, convolutional layers, pooling layers, and a fully connected output layer. Specifically: the convolutional layers are used to extract local features from the weighted network traffic feature matrix by sliding the convolutional kernel along the time and feature dimensions to extract local behavioral pattern features; the pooling layers are used to reduce the dimensionality of the convolutional layer output; and the fully connected output layer is used to integrate the extracted high-dimensional features and output the network behavior security analysis results. In some implementations, a pre-constructed network traffic sample and corresponding risk score results are used as the training set. The weighted network traffic feature matrix is input into a convolutional neural network for supervised training, enabling the convolutional neural network to learn the differential distribution of normal and abnormal network behaviors in the weighted feature space. During training, the loss function between the risk score results output by the convolutional neural network and the risk score label results is calculated, and the convolutional kernel parameters and fully connected layer weights are updated via backpropagation to gradually optimize the model's classification ability. After the model training is completed, the network traffic data to be analyzed is input into the trained convolutional neural network, and the corresponding risk score is output based on the behavior security classification results. When the output abnormal behavior probability exceeds a preset security threshold, the current network traffic data is determined to have security risk behavior, and corresponding security alarm information is generated.
[0052] In some preferred embodiments of this application, convolutional neural network input samples can be constructed according to different network behavior granularities, and the multi-granularity analysis results can be fused to improve the accuracy of network behavior security identification. This application will not elaborate on this. The security identification results mentioned in this application include: risk score values corresponding to network traffic data.
[0053] Furthermore, in another aspect of this application, in some embodiments, this application provides a network traffic behavior recognition system based on deep learning, the system including a network security recognition unit, referencing... Figure 6 The figure is a schematic diagram of the exemplary hardware and / or software structure of a network security identification unit according to some embodiments of this application. The network security identification unit 200 includes: a traffic feature acquisition unit 201, a traffic feature analysis unit 202, and a traffic security monitoring unit 203, which are described below: Traffic feature acquisition unit 201 is used to acquire network traffic data, extract initial traffic features of the network traffic data, perform network behavior analysis on the initial traffic features, and determine multiple network behavior granularities corresponding to the network traffic data. The traffic feature analysis unit 202 performs dynamic feature extraction on the network traffic data based on different network behavior granularities to obtain traffic feature vectors corresponding to different network behavior granularities. The traffic feature analysis unit 202 is also used to obtain each dynamic feature dimension in the traffic feature vector, use a deep learning model to extract the dynamic feature consistency corresponding to each dynamic feature dimension under multi-behavior granularity conditions, and map it to the corresponding effective behavior monitoring weight. The traffic security monitoring unit 203 performs behavioral security analysis on the network traffic data based on the effective behavior monitoring weights corresponding to each dynamic feature dimension, and sends the security identification results to the network security center.
[0054] The foregoing has provided a detailed example of a network traffic behavior recognition method and system based on deep learning, as provided in the embodiments of this application. It is understood that the corresponding device includes hardware structures and / or software modules for performing each function in order to achieve the above functions.
[0055] Those skilled in the art should readily recognize that, based on the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a certain function in the application is executed in a manner that drives hardware or computer software depends on the specific application and design constraints of the technical solution. Therefore, those skilled in the art can use different methods to implement the described function for each specific application, but such implementation should not be considered to be beyond the scope of this application.
[0056] In addition, this application also provides a computer terminal device, which includes a memory and a processor. The memory stores code, and the processor is configured to acquire the code and execute the above-described deep learning-based network traffic behavior recognition method.
[0057] In some embodiments, reference Figure 7 The figure is a schematic diagram of the structure of a computer terminal device implementing a deep learning-based network traffic behavior recognition method according to some embodiments of this application. The deep learning-based network traffic behavior recognition method in the above embodiments can... Figure 7 The computer terminal device 300 shown is used to implement this, and the computer terminal device 300 includes at least one communication bus 301, communication interface 302, processor 303 and memory 304.
[0058] The processor 303 may be a general-purpose central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more devices used to control the execution of a deep learning-based network traffic behavior recognition method in this application.
[0059] The communication bus 301 may include a path for transmitting information between the aforementioned components.
[0060] Memory 304 may be read-only memory (ROM) or other types of static storage devices capable of storing static information and instructions, random access memory (RAM) or other types of dynamic storage devices capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disks or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. Memory 304 may exist independently and be connected to processor 303 via communication bus 301. Memory 304 may also be integrated with processor 303.
[0061] The memory 304 stores program code that executes the scheme of this application, and its execution is controlled by the processor 303. The processor 303 executes the program code stored in the memory 304. The program code may include one or more software modules. In the above embodiments, the determination of the effective behavior monitoring weight can be achieved by the processor 303 and one or more software modules in the program code in the memory 304.
[0062] Communication interface 302 uses any transceiver-like device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area network (WLAN), etc.
[0063] Optionally, the computer terminal device 300 may also include a power supply 305 for providing power to various devices or circuits in the real-time computer terminal device.
[0064] In a specific implementation, as one example, a computer terminal device may include multiple processors, each of which may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. Here, a processor may refer to one or more devices, circuits, and / or processing cores used to process data (e.g., computer program instructions).
[0065] The aforementioned computer terminal device can be a general-purpose computer terminal device or a dedicated computer terminal device. In specific implementations, the computer terminal device can be a desktop computer, a portable computer, a network server, a handheld digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, a communication device, or an embedded device. This application does not limit the type of computer terminal device.
[0066] In addition, other aspects of this application provide a computer-readable storage medium storing at least one computer program, which is loaded and executed by a processor to perform the operations described above in a deep learning-based network traffic behavior recognition method.
[0067] In summary, the deep learning-based network traffic behavior recognition method and system disclosed in this application first extracts the initial traffic features of network traffic data, performs network behavior analysis on the initial traffic features, and determines multiple network behavior granularities corresponding to the network traffic data; based on different network behavior granularities, dynamic features are extracted from the network traffic data to obtain traffic feature vectors corresponding to different network behavior granularities; each dynamic feature dimension in the traffic feature vector is obtained, and a deep learning model is used to extract the dynamic feature consistency corresponding to each dynamic feature dimension under multiple behavior granularities, and map it to the corresponding effective behavior monitoring weights; based on the effective behavior monitoring weights corresponding to each dynamic feature dimension, behavioral security analysis is performed on the network traffic data, and the security recognition results are sent to the network security center. This application reduces the effective weights of redundant traffic features and improves the robustness of network security recognition by recognizing the feature consistency of traffic feature dimensions under different behavior granularities.
[0068] The above descriptions are merely embodiments of this application, and common knowledge such as specific technical solutions or characteristics in the solutions are not described in detail here. It should be noted that those skilled in the art can make several modifications and improvements without departing from the technical solutions of this application, and these should also be considered within the scope of protection of this application, without affecting the effectiveness of the implementation of this application or the practicality of the patent.
[0069] The scope of protection claimed in this application shall be determined by the content of its claims. The specific embodiments described in the specification can be used to interpret the content of the claims. Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of the invention. Therefore, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application also intends to include these modifications and variations.
Claims
1. A network traffic behavior recognition method based on deep learning, characterized in that, include: Collect network traffic data and extract the initial traffic features of the network traffic data. Perform network behavior analysis on the initial traffic features to determine multiple network behavior granularities corresponding to the network traffic data. Dynamic feature extraction is performed on the network traffic data based on different network behavior granularities to obtain traffic feature vectors corresponding to different network behavior granularities. Obtain each dynamic feature dimension in the traffic feature vector, use a deep learning model to extract the dynamic feature consistency corresponding to each dynamic feature dimension under multi-behavior granularity conditions, and map it to the corresponding effective behavior monitoring weight. Based on the effective behavior monitoring weights corresponding to each dynamic feature dimension, behavioral security analysis is performed on the network traffic data, and the security identification results are sent to the network security center.
2. The method as described in claim 1, characterized in that, Extracting the initial traffic characteristics of the network traffic data specifically includes: Obtain the raw network data packets from the network traffic data; perform protocol parsing on the raw network data packets and extract structured fields; Based on the structured fields, data packets are reassembled according to preset flow division rules to construct network flow data; a sliding window is established to perform statistical analysis on the network flow data in each window and extract initial traffic characteristics.
3. The method as described in claim 1, characterized in that, Performing network behavior analysis on the initial traffic characteristics to determine multiple network behavior granularities corresponding to the network traffic data specifically includes: The temporal variation features, behavioral pattern transition features, and state stability features of the initial traffic features are obtained, and a behavioral change scoring function is constructed. Based on the scoring range of the behavior change scoring function, multiple scoring thresholds are set as the granularity of network behavior.
4. The method as described in claim 1, characterized in that, Dynamic feature extraction is performed on the network traffic data based on different network behavior granularities to obtain traffic feature vectors corresponding to different network behavior granularities, specifically including: The network traffic data is segmented based on different network behavior granularities to obtain multiple sets of traffic data segments. For any set of traffic data segments corresponding to any network behavior granularity, extract multiple dynamically changing features to form a traffic feature vector.
5. The method as described in claim 1, characterized in that, A deep learning model is used to extract the dynamic feature consistency of each dynamic feature dimension under multi-behavioral granularity conditions, and map it to the corresponding effective behavior monitoring weights, specifically including: For any dynamic feature dimension, obtain the dynamic feature sequence under each behavior granularity segmentation condition, and perform feature resampling on the dynamic feature sequence under each granularity segmentation condition to achieve time alignment of the dynamic feature sequence. The dynamic feature sequences under each behavior granularity segmentation condition are input into a pre-trained deep learning model to identify the dynamic feature consistency parameter corresponding to the dynamic feature dimension. Obtain a preset interval mapping table, perform weight mapping based on the threshold interval where the dynamic feature consistency parameter is located, and obtain the effective behavior monitoring weight corresponding to the dynamic feature dimension.
6. The method as described in claim 1, characterized in that, Based on the effective behavior monitoring weights corresponding to each dynamic feature dimension, the behavioral security analysis of the network traffic data specifically includes: The network traffic data is segmented according to a preset network behavior granularity to obtain multiple traffic data segments, and multi-dimensional dynamic feature vectors are extracted based on each traffic data segment. Based on the effective behavior monitoring weights corresponding to each dynamic feature dimension, the multi-dimensional dynamic feature vector is weighted to obtain a weighted network traffic feature matrix. The network traffic feature matrix is input into a neural network model for behavioral pattern clustering, and the corresponding risk score is determined based on the clustering results.
7. The method as described in claim 1, characterized in that, Network traffic data is collected by port mirroring deployed on the network link side.
8. A deep learning-based network traffic behavior recognition system, comprising a network security recognition unit, wherein the network security recognition unit is used to execute the deep learning-based network traffic behavior recognition method according to any one of claims 1 to 7, characterized in that, The network security identification unit includes: The traffic feature acquisition unit is used to collect network traffic data, extract the initial traffic features of the network traffic data, perform network behavior analysis on the initial traffic features, and determine multiple network behavior granularities corresponding to the network traffic data. The traffic feature analysis unit performs dynamic feature extraction on the network traffic data based on different network behavior granularities to obtain traffic feature vectors corresponding to different network behavior granularities. The traffic feature analysis unit is also used to obtain each dynamic feature dimension in the traffic feature vector, use a deep learning model to extract the dynamic feature consistency corresponding to each dynamic feature dimension under multi-behavior granularity conditions, and map it to the corresponding effective behavior monitoring weight. The traffic security monitoring unit performs behavioral security analysis on the network traffic data based on the effective behavior monitoring weights corresponding to each dynamic feature dimension, and sends the security identification results to the network security center.
9. A computer terminal device, characterized in that, The computer terminal device includes a memory and a processor. The memory stores code, and the processor is configured to acquire the code and execute a deep learning-based network traffic behavior recognition method as described in any one of claims 1 to 7.
10. A computer-readable storage medium storing at least one computer program, characterized in that, The computer program is loaded and executed by a processor to perform the operations described in any one of claims 1 to 7 of the deep learning-based network traffic behavior recognition method.