Network malicious traffic detection method, cloud computing center, ground gateway station, medium and product

Abstract

The application provides a network malicious traffic detection method, a cloud computing center, a ground gateway station, a medium and a product, and relates to the technical field of network security. The method comprises the following steps: acquiring a satellite-ground traffic sample matrix; processing the satellite-ground traffic sample matrix based on a double-branch reconstruction model to obtain original traffic features and reconstructed traffic features; pre-training the double-branch reconstruction model based on the original traffic features and the reconstructed traffic features, and constructing a target double-branch reconstruction model for learning common features of satellite-ground traffic; determining a lightweight detection model based on the target double-branch reconstruction model, and issuing the lightweight model to a ground gateway station, so that the ground gateway station realizes network malicious traffic detection based on the lightweight detection model. The application can effectively improve the security defense capability of a core network.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method for detecting malicious network traffic, a cloud computing center, a ground gateway station, media, and products. Background Technology

[0002] With the rapid development of sixth-generation mobile communication technology (6G), building an integrated air, space, land, and sea coverage system has become a core strategic direction in the global communications field. In this system, a giant constellation of tens of thousands of low-Earth orbit satellites will generate massive amounts of heterogeneous user data. This data ultimately needs to be aggregated via satellite-to-ground links and downlinked to ground gateway stations or edge computing nodes, before entering the core network via the ground backhaul network. As core nodes connecting the air-space network and the ground core network, ground gateway stations / intermediate edge nodes bear enormous traffic throughput pressure and, due to their aggregation characteristics, have become prime targets for network attacks and sensitive areas for security defense. If malicious behavior cannot be effectively identified, distributed denial-of-service attacks, botnet control commands, or malicious scanning probes from around the world will penetrate deeply, directly impacting the operator's backbone core network and core network elements. Summary of the Invention

[0003] This invention provides a method for detecting malicious network traffic, a cloud computing center, a ground gateway station, media, and products to solve the technical problem in the prior art that the inability to effectively identify malicious behavior in massive downlink traffic in satellite-ground converged networks affects the secure and stable operation of the operator's core network.

[0004] This invention provides a method for detecting malicious network traffic, applied to a cloud computing center, comprising: Obtain the satellite-to-ground flow sample matrix; Based on the dual-branch reconstruction model, the satellite-to-ground flow sample matrix is ​​processed to obtain the original flow characteristics and the reconstructed flow characteristics. Based on the original traffic characteristics and the reconstructed traffic characteristics, the dual-branch reconstruction model is pre-trained to construct a target dual-branch reconstruction model for learning the common characteristics of satellite-ground traffic. Based on the target dual-branch reconstruction model, a lightweight detection model is determined, and the lightweight model is distributed to the ground gateway station so that the ground gateway station can detect malicious network traffic based on the lightweight detection model.

[0005] According to a method for detecting malicious network traffic provided by the present invention, the step of obtaining a satellite-to-ground traffic sample matrix includes: Based on the time window and the quintuple, the first M consecutive traffic data packets of each original satellite-to-ground traffic are obtained as traffic representative samples. The traffic representative sample is subjected to privacy desensitization processing to obtain a desensitized traffic representative sample; Align the bytes of the desensitized traffic representative sample to a fixed index position to obtain the target traffic representative sample, and then stack the target traffic representative samples vertically in order to obtain the satellite-to-ground traffic sample matrix.

[0006] According to a network malicious traffic detection method provided by the present invention, the method involves processing the satellite-to-ground traffic sample matrix based on a dual-branch reconstruction model to obtain original traffic features and reconstructed traffic features, including: The satellite-to-ground flow sample matrix is ​​divided into multiple non-overlapping local sub-blocks; Randomly mask some non-overlapping local sub-blocks in the satellite-to-ground flow sample matrix to obtain a masked flow sample matrix; Based on the dual-branch reconstruction model, the satellite-to-ground traffic sample matrix and the masked traffic sample matrix are processed to obtain the original traffic features and the reconstructed traffic features.

[0007] According to a method for detecting malicious network traffic provided by the present invention, the dual-branch reconstruction model includes a target network, an online network, and a prediction head; The process based on the dual-branch reconstruction model, which involves processing the satellite-to-ground traffic sample matrix and the masked traffic sample matrix to obtain the original traffic features and reconstructed traffic features, includes: The target network is used to process the satellite-to-ground flow sample matrix to obtain the original flow characteristics; The masked traffic sample matrix is ​​processed by the online network to obtain online projection features, and the online projection features are mapped by the prediction head to obtain reconstructed traffic features.

[0008] According to a method for detecting malicious network traffic provided by the present invention, the step of pre-training the dual-branch reconstruction model based on the original traffic features and reconstructed traffic features to construct a target dual-branch reconstruction model for learning common features of satellite-to-ground traffic includes: Based on the original traffic characteristics and the reconstructed traffic characteristics, the reconstruction loss is calculated; Based on the reconstruction loss, the network parameters of the online network are updated, and the network parameters of the target network are synchronously updated based on the updated online network using an exponential moving average mechanism. Based on the updated online network and the updated target network, a target bi-branch reconstruction model is constructed to learn the common characteristics of satellite-ground traffic.

[0009] According to a method for detecting malicious network traffic provided by the present invention, the step of determining a lightweight detection model based on the target dual-branch reconstruction model includes: The target bi-branch reconstruction model is subjected to supervised fine-tuning to obtain a lightweight detection model.

[0010] According to the present invention, a method for detecting malicious network traffic is provided, wherein the target dual-branch reconstruction model includes a multi-exit neural network structure, and the multi-exit neural network structure includes multiple exit branches and a target output layer; The step of supervising and fine-tuning the target bi-branch reconstruction model to obtain a lightweight detection model includes: The labeled samples are input into the target dual-branch reconstruction model, and the corresponding intermediate prediction results are output through the multiple exit branches, and the final prediction result is output through the target output layer. Calculate the first classification loss between each intermediate prediction result and the true label of the labeled sample, and calculate the second classification loss between the final prediction result and the true label; Calculate the target loss based on the first classification loss and the second classification loss; Based on the target loss, the target bi-branch reconstruction model is fine-tuned under supervision to obtain a lightweight detection model.

[0011] This invention also provides a method for detecting malicious network traffic, applied to a ground gateway station, comprising: The system receives a lightweight detection model from the cloud computing center. The lightweight detection model is constructed based on the satellite-to-ground traffic sample matrix, by extracting the original traffic features and reconstructing the traffic features through a dual-branch reconstruction model, and then pre-training to learn the common features of satellite-to-ground traffic. Based on the aforementioned lightweight detection model, malicious network traffic is detected in real-time satellite-to-ground traffic.

[0012] According to the present invention, a method for detecting malicious network traffic is provided, wherein the lightweight detection model includes a multi-egress neural network structure, and the multi-egress neural network structure includes multiple egress branches and a target output layer; The step of detecting malicious network traffic based on the lightweight detection model for real-time satellite-to-ground traffic includes: The real-time satellite-to-ground traffic is preprocessed to obtain a real-time satellite-to-ground traffic sample matrix; The real-time satellite-to-ground traffic sample matrix is ​​input into the lightweight detection model, and inference is performed step by step from shallow to deep according to the network depth direction. The category probability distribution vector of the current level is output through the current exit branch. Calculate the joint confidence index based on the category probability distribution vector; Based on the aforementioned joint confidence index, the malicious traffic identification result is determined.

[0013] According to a method for detecting malicious network traffic provided by the present invention, the step of calculating a joint confidence index based on the category probability distribution vector includes: Get the current satellite-to-ground link load rate; Calculate the information entropy of the category probability distribution vector; Based on the information entropy and the current satellite-to-ground link load rate, a joint confidence index is determined.

[0014] According to a method for detecting malicious network traffic provided by the present invention, determining the malicious traffic discrimination result based on the joint confidence index includes: Obtain the preset threshold; If the joint confidence index is less than or equal to the preset threshold, the inference calculation of the subsequent levels will be terminated, and the category probability distribution vector of the current level will be used as the malicious traffic discrimination result. If the joint confidence index is greater than the preset threshold, the next level of inference calculation will continue to be executed until the termination condition is met or the final output layer is reached. The category probability distribution vector of the corresponding level when the termination condition is met will be used as the malicious traffic discrimination result, or the prediction result output by the final output layer will be used as the malicious traffic discrimination result.

[0015] The present invention also provides a cloud computing center, including a memory, a processor, and a computer program stored on the memory and running on the processor, characterized in that the processor, when executing the computer program, implements any of the network malicious traffic detection methods described above.

[0016] The present invention also provides a ground gateway station, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the network malicious traffic detection method described above.

[0017] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the network malicious traffic detection method as described above.

[0018] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements any of the network malicious traffic detection methods described above.

[0019] This invention provides a method for detecting malicious network traffic, a cloud computing center, a ground gateway station, media, and products. The method involves acquiring a satellite-to-ground traffic sample matrix; processing the sample matrix using a dual-branch reconstruction model to obtain original and reconstructed traffic features; pre-training the dual-branch reconstruction model based on these features to construct a target dual-branch reconstruction model that learns common features of satellite-to-ground traffic; and determining a lightweight detection model based on the target model, which is then distributed to the ground gateway station to enable malicious network traffic detection. This invention solves the technical problem of the inability to effectively identify malicious behavior in massive downlink traffic in satellite-to-ground converged networks, thus affecting the secure and stable operation of the operator's core network. Compared to existing technologies, this invention forces the alignment of original and reconstructed features during pre-training of the dual-branch reconstruction model in the cloud computing center, enabling the model to autonomously learn common feature expressions that remain stable against encryption, protocol heterogeneity, and link disturbances from massive unlabeled traffic, thereby constructing a lightweight detection model with low parameter count and low complexity. This model effectively solves the problem of unstable traffic structure caused by long latency, high error rate, frequent cross-track switching and strong encryption in the space-ground integrated network. It can identify various malicious traffic with high accuracy without relying on a large number of labeled samples, significantly reducing the deployment difficulty and inference overhead of ground gateway stations, and effectively improving the security defense capability and operation efficiency of the core network. Attached Figure Description

[0020] Figure 1 This is one of the flowcharts of the network malicious traffic detection method provided by the present invention.

[0021] Figure 2 This is the second flowchart of the network malicious traffic detection method provided by the present invention.

[0022] Figure 3 This is a schematic diagram of the training of the dual-branch reconstruction model of the network malicious traffic detection method provided by the present invention.

[0023] Figure 4 This is a schematic diagram of the multi-exit neural network structure of the network malicious traffic detection method provided by the present invention.

[0024] Figure 5 This is the third flowchart of the network malicious traffic detection method provided by the present invention.

[0025] Figure 6 This is a schematic diagram of the dynamic reasoning process of the network malicious traffic detection method provided by the present invention.

[0026] Figure 7 This is a schematic diagram of the network malicious traffic detection device provided by the present invention.

[0027] Figure 8 This is a structural diagram of the cloud computing center / ground gateway station provided by the present invention. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0029] The following is combined Figure 1 , Figure 2 as well as Figure 5 The present invention describes a method for detecting malicious network traffic. This method is applicable to the detection of any malicious network traffic. The subject executing this method can be an electronic device or a malicious network traffic detection device installed in the electronic device. The malicious network traffic detection device can be implemented by software, hardware, or a combination of both.

[0030] Figure 1 This is one of the flowcharts illustrating the network malicious traffic detection method provided by the present invention. The network malicious traffic detection method is applied to a cloud computing center, such as... Figure 1 As shown, the method includes the following: Step 101: Obtain the satellite-to-ground flow sample matrix; It should be noted that the satellite-to-ground traffic sample matrix refers to a standardized numerical matrix extracted and constructed from the communication traffic of the satellite-to-ground converged network. It is used to represent the structured information of multiple consecutive data packets in a complete service flow. The rows of the satellite-to-ground traffic sample matrix correspond to multiple data packets arranged in chronological order in the same service flow, and the columns correspond to the fixed-length byte sequence of each data packet after preprocessing. Each matrix element represents a normalized value of one byte.

[0031] Step 102: Based on the dual-branch reconstruction model, process the satellite-to-ground flow sample matrix to obtain the original flow characteristics and the reconstructed flow characteristics; It should be noted that the dual-branch reconstruction model refers to a deep learning model containing two branches: an online network and a target network. This model is used to extract features from the input and reconstruct those features. The original traffic features refer to the deep feature representation extracted by the target network from the complete satellite-to-ground traffic sample matrix, without any masking interference, representing the true semantic information of the traffic. The reconstructed traffic features refer to the feature representation extracted by the online network from a randomly masked version and mapped by the prediction head, aiming to approximate the original traffic features.

[0032] Step 103: Based on the original flow characteristics and the reconstructed flow characteristics, pre-train the dual-branch reconstruction model to construct a target dual-branch reconstruction model for learning the common characteristics of satellite-ground flow. It should be noted that common features of satellite-to-ground traffic refer to the stable semantic representation of traffic behavior that remains stable under different satellite-to-ground link conditions, different protocol types, and different satellite orbits, such as the statistical patterns and temporal dependencies of encrypted traffic. The target dual-branch reconstruction model refers to a model composed of an online network and a target network that has converged after pre-training (i.e., the process of training model parameters on large-scale unlabeled data through self-supervised learning). Its encoder part has learned to extract stable common features from incomplete inputs.

[0033] Understandably, during pre-training, the cloud computing center sequentially inputs a massive matrix of unlabeled satellite-to-ground traffic samples into the dual-branch reconstruction model. For each sample, it is first randomly masked at a high ratio (e.g., masking 75% of a local sub-block), resulting in a masked version and an original version. The original version is input into the target network, and the masked version into the online network. The online network outputs reconstructed traffic features, and the target network outputs original traffic features; the two are aligned using a cosine similarity loss. By minimizing this loss, the online network is forced to infer the high-level semantics of the masked region from the visible local information. Simultaneously, the parameters of the target network do not directly participate in gradient updates but are slowly copied from the online network through an exponential moving average mechanism, thus providing a stable feature target for training. This self-supervised pre-training requires no manual annotation and relies solely on the inherent structure of the traffic data itself to drive learning. After tens of thousands of iterations, the online network encoder can output stable feature representations consistent with the complete input semantics for any mask pattern, meaning it has learned common features of satellite-to-ground traffic across link states, protocols, and orbits. At this point, the encoder portion of the online network (or target network) is saved together with the projection head and prediction head, thus forming the target dual-branch reconstruction model.

[0034] Step 104: Based on the target dual-branch reconstruction model, determine the lightweight detection model and distribute the lightweight model to the ground gateway station so that the ground gateway station can detect malicious network traffic based on the lightweight detection model.

[0035] It should be noted that the lightweight detection model refers to a model with fewer parameters and faster inference speed, obtained through supervised fine-tuning based on the target dual-branch reconstruction model, specifically designed for real-time malicious traffic detection at satellite-to-ground edge nodes. Supervised fine-tuning involves using a small number of labeled traffic samples to perform end-to-end parameter adjustments on the pre-trained encoder and its attached classification head, adapting it to a specific malicious behavior classification task.

[0036] In practice, the cloud computing center packages the trained lightweight detection model through the cloud-edge collaborative management channel and sends it to the inference acceleration unit of the ground gateway station via a secure transmission protocol. After receiving the lightweight detection model, the ground gateway station uses the lightweight detection model to detect malicious network traffic in real-time satellite-to-ground traffic.

[0037] It should be noted that the ground gateway station is a critical infrastructure node in a satellite communication system, also known as a satellite ground station or satellite gateway. Its core function is to act as a bridge between the satellite network and the terrestrial network: receiving downlink communication signals from the satellite (from space to the ground), converting them into data streams that the terrestrial network can process, and connecting them to the operator's core network; at the same time, it can also transmit uplink data from the terrestrial network to the satellite.

[0038] This invention employs a dual-branch reconstruction model to forcibly align original and reconstructed features during pre-training at a cloud computing center. This enables the model to autonomously learn common feature representations that remain stable against encryption, protocol heterogeneity, and link disturbances from massive amounts of unlabeled traffic, thereby constructing a lightweight detection model with low parameter count and low complexity. This model effectively solves the problem of unstable traffic structure caused by long latency, high bit error rate, frequent cross-track switching, and strong encryption in space-ground fusion networks. It can accurately identify various malicious traffic types without relying on a large number of labeled samples, significantly reducing the deployment difficulty and inference overhead of ground gateway stations, and effectively improving the security defense capabilities and operational efficiency of the core network.

[0039] Based on any of the above embodiments, obtaining the satellite-to-ground flow sample matrix includes: Based on the time window and the quintuple, the first M consecutive traffic data packets of each original satellite-to-ground traffic are obtained as traffic representative samples. The traffic representative sample is subjected to privacy desensitization processing to obtain a desensitized traffic representative sample; The desensitized traffic representative samples are aligned to fixed index positions to obtain target traffic representative samples, and the target traffic representative samples are vertically stacked in order to obtain a satellite-to-ground traffic sample matrix.

[0040] It should be noted that a time window refers to a preset time length threshold used to determine the time interval between data packets belonging to the same service flow; a 5-tuple refers to the combination of five fields: source IP address, destination IP address, source port, destination port, and transport layer protocol type, used to uniquely identify a network service flow. A traffic representative sample refers to the first M consecutive data packets selected from a complete network service flow, where M is a preset positive integer.

[0041] Understandably, due to the high propagation delay and jitter of satellite links, data packets from the same service flow may arrive discontinuously, making it impossible to accurately determine flow boundaries solely based on the quintuple. This invention employs a flow reassembly mechanism combining time windows and quintuple constraints: for data packets with the same quintuple, if the arrival time interval between adjacent data packets is less than a preset time window threshold, they are determined to belong to the same service flow; if the time interval exceeds the threshold, it is determined to be the start of a new flow. After flow reassembly, considering the limited computing power of satellite-to-ground edge nodes and the need for real-time detection, only the first M consecutive key data packets of each flow are extracted as representative samples, and subsequent data packets are discarded. This significantly reduces inference latency and computational load while maintaining the ability to express behavioral patterns.

[0042] It should be noted that privacy de-identification refers to the process of removing, randomizing, or anonymizing fields in traffic data packets that may reveal physical device identifiers, network location information, or node identity information. A de-identified traffic representative sample refers to the set of traffic data packets obtained after de-identification processing.

[0043] Understandably, after acquiring the raw satellite-to-ground communication traffic (i.e., representative traffic samples), data anonymization is performed before or after flow segmentation to eliminate the overfitting risk caused by physical devices, satellite nodes, and ground station identifiers. Specifically, a three-layer anonymization operation is performed on the unique identifier information in the satellite-to-ground traffic. The first layer is to remove or randomize the MAC addresses at the data link layer, because MAC addresses are bound to specific physical devices, which can easily cause the model to remember specific devices rather than learn traffic behavior patterns. The second layer is to anonymize and map the source and destination IP addresses at the network layer, for example, by replacing them with specific masks or hash values, because IP addresses are related to network topology and location, and the IP planning of different ground stations varies greatly. The third layer is to perform structure-preserving anonymization on unique identifier fields in the satellite-to-ground traffic, such as satellite node IDs. That is, the length and format characteristics of the field are preserved, but the specific value is replaced with an anonymous value. This eliminates the risk of overfitting while preserving the structural information of the field for the model to learn.

[0044] It should be noted that byte alignment refers to forcing the payload of each layer in data packets from different protocols to be placed at fixed byte index positions to eliminate feature space misalignment caused by changes in protocol header length. The target traffic representative sample refers to the set of traffic data packets after byte alignment and normalization. Vertical stacking refers to arranging the byte sequences of multiple data packets from top to bottom in their original order, forming a two-dimensional matrix.

[0045] Understandably, because multiple protocols often coexist in satellite-ground converged networks, the header lengths of different protocols vary, and even optional fields within the same protocol can cause variations in header length. If the original data packets are directly concatenated, fields with the same semantic meaning may be located at different column index positions in different data packets, preventing the neural network from learning stable feature maps. This invention first locates the offsets of each layer by parsing the header fields, determining the starting positions of the network layer, transport layer, and application layer loads. Then, it forcibly copies the contents of these layers into a fixed-length byte array, padding with zeros where the length is insufficient, thereby aligning all data packets to the same index position. Next, each byte value is divided by 255 to normalize it to the 0-1 range. Finally, the processed M data packets are stacked vertically in sequence to form a two-dimensional matrix with M rows and a fixed number of columns, serving as the satellite-ground traffic sample matrix.

[0046] The network malicious traffic detection method provided in this invention enhances flow integrity through time window and 5-tuple joint recombination, reduces the computational load on edge nodes by intercepting the first M data packets, eliminates device identifier overfitting through privacy desensitization, and improves cross-track and cross-regional generalization capabilities, and then generates a standardized two-dimensional matrix by unifying the feature space of heterogeneous protocols through byte alignment and vertical stacking. This method provides robust and unbiased traffic samples for pre-training and edge detection in cloud computing centers, effectively solves the preprocessing problem of massive encrypted traffic in satellite-ground integrated networks, and supports efficient malicious traffic identification.

[0047] Figure 2 This is a second flowchart of the network malicious traffic detection method provided by the present invention, as shown in Figure 2. Step 102 further includes steps 1021 to 1023: Step 1021: Divide the satellite-to-ground flow sample matrix into multiple non-overlapping local sub-blocks; It should be noted that non-overlapping local sub-blocks refer to small sub-matrices obtained by dividing the satellite-to-ground traffic sample matrix into fixed sub-block sizes P×P, with no overlapping areas between them. Each sub-block corresponds to a local region in the traffic sample matrix, covering information from multiple consecutive bytes in multiple data packets.

[0048] Step 1022: Randomly mask some non-overlapping local sub-blocks in the satellite-to-ground flow sample matrix to obtain a masked flow sample matrix; It should be noted that random masking refers to randomly selecting a subset of sub-blocks from all non-overlapping local sub-blocks according to a preset masking ratio (e.g., 75%), and setting all element values ​​within these sub-blocks to masked values. The masked traffic sample matrix is ​​a new matrix obtained by replacing the selected sub-block values ​​with masked values ​​based on the original satellite-to-ground traffic sample matrix. This matrix retains the original values ​​of the unmasked sub-blocks, while the masked sub-blocks become fully masked.

[0049] It is understandable that randomly masking some non-overlapping local sub-blocks in the satellite-to-ground traffic sample matrix can simulate the incompleteness and loss of traffic data caused by signal attenuation, high bit error rate or link switching in the satellite-to-ground link, forcing the model to learn complete semantic features from partially visible information.

[0050] Step 1023: Based on the dual-branch reconstruction model, process the satellite-to-ground traffic sample matrix and the masked traffic sample matrix to obtain the original traffic features and the reconstructed traffic features.

[0051] It should be noted that the dual-branch reconstruction model refers to a deep learning model comprising two branches: a target network and an online network. The target network receives the complete satellite-to-ground traffic sample matrix and extracts deep semantic features unaffected by masking interference. The online network receives the masked traffic sample matrix and generates corresponding reconstructed feature representations based on locally visible information. Specifically, the original traffic features refer to the unmasked deep feature representations extracted by the target network from the complete satellite-to-ground traffic sample matrix; the reconstructed traffic features refer to the feature representations extracted by the online network from the masked traffic sample matrix and further mapped by the projection head and prediction head.

[0052] In the specific implementation, two different inputs (i.e., the satellite-to-ground flow sample matrix and the masked flow sample matrix) are fed into the two branches of the dual-branch model: the complete satellite-to-ground flow sample matrix is ​​input into the target network as a stable semantic reference during the model learning process; the masked flow sample matrix is ​​input into the online network as incomplete observation information containing missing regions. The online network sequentially generates reconstructed flow features through the flow encoder, projection head, and prediction head, while the target network generates the original flow features through the flow encoder and projection head. Subsequently, the reconstructed flow features output by the online network and the original flow features output by the target network are aligned in the feature space, and the difference between the two is minimized through deep feature reconstruction loss, thereby forcing the online network to recover the global semantic representation of the complete flow samples while relying only on locally visible flow information.

[0053] The network malicious traffic detection method provided in this invention divides the satellite-to-ground traffic sample matrix into non-overlapping local sub-blocks and randomly masks them at a high proportion to simulate a scenario of incomplete satellite-to-ground link data. Then, a dual-branch reconstruction model processes the complete matrix and the masked matrix separately to obtain the original and reconstructed traffic features. This method forces the model to learn global semantics from locally visible information, effectively enhancing its robustness to link packet loss, high bit error rate, and encrypted transmission, and providing a structured foundation for subsequent pre-training to learn common features of satellite-to-ground traffic.

[0054] Based on any of the above embodiments, the dual-branch reconstruction model includes a target network, an online network, and a prediction head; The process based on the dual-branch reconstruction model, which involves processing the satellite-to-ground traffic sample matrix and the masked traffic sample matrix to obtain the original traffic features and reconstructed traffic features, includes: The target network is used to process the satellite-to-ground flow sample matrix to obtain the original flow characteristics; The masked traffic sample matrix is ​​processed by the online network to obtain online projection features, and the online projection features are mapped by the prediction head to obtain reconstructed traffic features.

[0055] It should be noted that the target network is a branch of the two-branch reconstruction model, comprising a flow encoder and a projection head. The flow encoder, composed of multiple stacked neural network layers, maps the input two-dimensional flow matrix into a high-dimensional abstract feature tensor. The projection head consists of one or more fully connected layers following the encoder, further mapping the features output by the encoder to a low-dimensional feature space.

[0056] Understandably, since the satellite-to-ground traffic sample matrix is ​​unmasked and contains all protocol fields, payload bytes, and timing relationships of the traffic, the raw traffic features output by the target network can accurately reflect the original structural pattern and behavioral semantics of the traffic. The parameters of the target network are not directly updated through gradient backpropagation, but are obtained synchronously from the online network through an exponential moving average mechanism. This ensures that the target network provides stable feature targets and prevents model training collapse.

[0057] It should be noted that the online network is another branch of the two-branch reconstruction model. It shares the same encoder and projection head structure as the target network, but is equipped with an additional prediction head. The masked traffic sample matrix is ​​the incomplete traffic matrix after random masking. The online projection features refer to the intermediate feature vectors extracted by the online network from the mask matrix and mapped by the projection head. The prediction head consists of one or more fully connected layers connected after the online network's projection head, used to map the online projection features into the same feature space as the original traffic features.

[0058] Understandably, since most local sub-blocks in the masked traffic sample matrix are set to zero, the online network can only extract features based on information from a small number of visible sub-blocks. The encoder and projector of the online network progressively abstract the visible information into online projected features, and then the prediction head performs a further nonlinear transformation on these features, attempting to map the feature representation derived from the visible information to the same direction as the feature representation of the complete input. By minimizing the difference between the reconstructed traffic features and the original traffic features, the online network is forced to learn a stable feature representation across incomplete recovery.

[0059] The network malicious traffic detection method provided in this invention processes complete traffic samples and masked samples in the target network and online network respectively, and uses a prediction head to map online projected features into reconstructed features, forcing the model to align complete semantics with incomplete input in the feature space. This method enables the model to stably recover global feature representation from locally visible information, significantly improving its resistance to disturbances such as packet loss, bit errors, and encrypted traffic on satellite-to-ground links, and directly enhancing the robustness and consistency of feature extraction.

[0060] Based on any of the above embodiments, the step of pre-training the dual-branch reconstruction model based on the original traffic features and the reconstructed traffic features to construct a target dual-branch reconstruction model for learning common features of satellite-to-ground traffic includes: Based on the original traffic characteristics and the reconstructed traffic characteristics, the reconstruction loss is calculated; Based on the reconstruction loss, the network parameters of the online network are updated, and the network parameters of the target network are synchronously updated based on the updated online network using an exponential moving average mechanism. Based on the updated online network and the updated target network, a target bi-branch reconstruction model is constructed to learn the common characteristics of satellite-ground traffic. It's important to note that the reconstruction loss quantifies the difference between the reconstructed traffic features and the original traffic features. The original traffic features come from the target network and represent the semantic truth of the complete input; the reconstructed traffic features come from the online network and its prediction head and represent the semantic predictions recovered by the model from the incomplete input. The purpose of calculating the reconstruction loss is to provide an optimization objective for the model. By minimizing this loss, the features output by the online network continuously approximate the features output by the target network, thereby achieving consistent learning at the feature level.

[0061] In the specific implementation, the formula for calculating the reconstruction loss is as follows: In the formula, This indicates the reconstruction of traffic characteristics, i.e. , Represents the masked traffic sample matrix; This represents the original flow characteristics, i.e. , This represents the satellite-to-ground flow sample matrix.

[0062] It should be noted that the network parameters of an online network refer to all weights and biases of the encoder, projector, and predictor heads in the online network. These parameters are updated directly using gradient descent. The exponential moving average mechanism is a parameter smoothing update strategy that makes the parameters of the target network follow the formula... The update is performed, where θ is the current parameter of the online network and τ is a decay coefficient close to 1. The purpose of synchronously updating the target network is to keep the output of the target network relatively stable, avoid drastic fluctuations in the online network during training, thereby forming a self-distilling stable learning loop and preventing model collapse.

[0063] It is understandable that the target dual-branch reconstruction model refers to a dual-branch model composed of an online network and a target network after pre-training and convergence. The encoder part of this model has learned to extract stable deep feature representations from incomplete satellite-to-ground traffic inputs that are semantically consistent with the complete input. These feature representations do not depend on specific link perturbations, protocol details, or data integrity, but rather reflect the common structural patterns and temporal behaviors present in satellite-to-ground traffic; therefore, they are called common features of satellite-to-ground traffic.

[0064] In specific implementations, such as Figure 3 As shown, the dual-branch reconstruction model comprises an online network and a target network. The online network consists of a flow encoder, a projection head, and a prediction head, while the target network consists of a flow encoder and a projection head. The original flow sample matrix is ​​directly input into the target network, and after processing by the flow encoder and projection head, it outputs the original flow features. The masked flow sample matrix is ​​input into the online network, and after processing by the flow encoder, projection head, and prediction head, it outputs the reconstructed flow features. The parameters of the target network are not updated via gradients, but are slowly synchronized from the parameters of the online network through an exponential moving average mechanism, forming a stable self-distillation learning loop.

[0065] The network malicious traffic detection method provided in this invention updates online network parameters by calculating the reconstruction loss between the original traffic features and the reconstructed traffic features, and synchronously updates the target network using an exponential moving average mechanism, forming a stable self-distillation learning closed loop. This pre-training mechanism forces the model to learn semantic representations consistent with complete inputs from incomplete inputs with high-proportion masks, thereby obtaining common features that are highly robust to packet loss, high bit error rates, and protocol heterogeneity in satellite-to-ground links, providing a stable and universal feature extraction foundation for subsequent edge detection.

[0066] Based on any of the above embodiments, determining the lightweight detection model based on the target dual-branch reconstruction model includes: The target bi-branch reconstruction model is subjected to supervised fine-tuning to obtain a lightweight detection model.

[0067] It should be noted that supervised fine-tuning refers to the supervised training of a pre-trained target bi-branch feature reconstruction model using labeled traffic samples, adapting it to a specific malicious traffic detection task. A lightweight detection model refers to a model obtained after fine-tuning, with a parameter size significantly smaller than a general-purpose large model, yet possessing classification capabilities. It has a small number of parameters, low computational complexity, and can be directly deployed on resource-constrained ground gateway stations or edge nodes.

[0068] In specific deployments, the lightweight detection model is packaged by the cloud computing center and distributed to the inference acceleration units of ground gateway stations or edge nodes through the cloud-edge collaborative management channel. During the initialization phase, the system loads the model weights and configuration parameters of each layer's exit, and establishes a mapping with the gateway's data plane, completing the pipeline construction from the high-speed input buffer stream to the multi-level inference engine. Considering the high concurrency and diverse protocol characteristics of satellite-to-ground link traffic, the model has already completed multi-exit structure training in the cloud, significantly reducing the parameter scale and perfectly adapting to the limited hardware resources of edge nodes, achieving line-rate processing without affecting the normal forwarding performance of the gateway station. In addition, a load probe is implanted in the gateway data plane to monitor the queue length, CPU utilization, and bandwidth utilization of the satellite-to-ground edge input buffer in real time, calculate the current satellite-to-ground link load rate L using normalization, and establish a real-time feedback control loop with the multi-level inference engine.

[0069] The network malicious traffic detection method provided in this invention, through supervised fine-tuning of a pre-trained target bi-branch reconstruction model, adapts common features to the malicious traffic detection task using only a small number of labeled samples. This fine-tuning process preserves the model's robust representation ability for incomplete and encrypted traffic while significantly improving classification accuracy, ultimately resulting in a lightweight detection model that provides efficient and accurate malicious traffic identification capabilities for resource-constrained edge nodes.

[0070] Based on any of the above embodiments, the target dual-branch reconstruction model includes a multi-exit neural network structure, which includes multiple exit branches and a target output layer; The step of supervising and fine-tuning the target bi-branch reconstruction model to obtain a lightweight detection model includes: The labeled samples are input into the target dual-branch reconstruction model, and the corresponding intermediate prediction results are output through the multiple exit branches, and the final prediction result is output through the target output layer. Calculate the first classification loss between each intermediate prediction result and the true label of the labeled sample, and calculate the second classification loss between the final prediction result and the true label; Calculate the target loss based on the first classification loss and the second classification loss; Based on the target loss, the target bi-branch reconstruction model is fine-tuned under supervision to obtain a lightweight detection model.

[0071] It should be noted that the target dual-branch reconstruction model includes a feature extraction network and a multi-egress neural network structure. The feature extraction network refers to the traffic encoder in the target dual-branch reconstruction model, which has learned to extract stable common features of satellite-to-ground traffic from incomplete, encrypted, and heterogeneous traffic during the pre-training phase. The multi-egress neural network structure refers to multiple egress branches set at different depth levels of the feature extraction network and the final output layer (i.e., the target output layer) located at the end of the network. Specifically, let the total depth of the feature extraction network be L. Bypass branches are introduced at the shallow (e.g., L / 4), middle (e.g., L / 2), and deep (e.g., 3L / 4) layers of the network, with each branch connecting to a lightweight classification egress module; the last layer of the network is retained as the target output layer. This hierarchical distribution allows the model to output decision results step-by-step from low-level satellite-to-ground protocol structural features (e.g., satellite-to-ground link control fields, traffic statistics patterns) to high-level behavioral semantic features (e.g., service patterns, attack behavior features), thereby achieving multi-granularity satellite-to-ground traffic identification capabilities. Specifically, for each access point... A lightweight egress branch is constructed to meet the low-latency, low-computing-power deployment requirements of satellite-to-ground edge nodes. The design principle of this module is to minimize computational overhead to support subsequent low-latency inference. Each egress branch contains the following processing unit: receiving data from the feature extraction network... Intermediate feature tensor of the layer (in For the number of channels, (Given the spatial dimensions of the current layer), a global average pooling operation is used to compress and aggregate the spatial dimension information to generate a global feature vector. Then, it is mapped to the category space through a fully connected layer, and finally outputs the category probability distribution vector of the current level as the prediction result.

[0072] Understandably, this design avoids introducing complex convolutional structures, ensuring that spaceborne or gateway nodes can perform fast inference of global feature vectors under limited computing power. The input is fed into a fully connected layer and mapped to the category space of the target task (such as service type identification, malicious traffic detection, or attribute classification). This mechanism effectively reduces response time in long-latency satellite-to-ground link scenarios and improves real-time protection capabilities.

[0073] It should be noted that labeled samples refer to a matrix of satellite-to-ground traffic samples already labeled with business categories (normal or malicious). A multi-exit neural network structure refers to setting multiple exit branches at different depths of the feature extraction network. Each exit branch is connected to an intermediate layer of the feature extraction network and is used to output prediction results in advance. The target output layer refers to the final classification output layer after the last layer of the feature extraction network. Intermediate prediction results refer to the classification probability vectors output by shallow or mid-level exit branches, and the final prediction result refers to the final classification probability vector output by the target output layer.

[0074] In the specific implementation, labeled samples are input into the target dual-branch reconstruction model, and the model performs forward propagation. The feature extraction network computes layer by layer, extracting the feature tensor of that layer at each preset exit branch position. This tensor is then passed through a lightweight classification module (such as global average pooling plus a fully connected layer) to output an intermediate prediction result. Simultaneously, the propagation continues to the end of the network, outputting the final prediction result through the target output layer. In this way, the model generates multiple predictions of different depths for the same sample: shallow predictions are based on underlying protocol structure features, while deep predictions are based on high-level behavioral semantic features. Specifically, in the feature extraction network of the target dual-branch reconstruction model, K exit branches are pre-set at shallow, intermediate, and deep layers, for example, at L / 4, L / 2, and 3L / 4 of the total layer depth L. Each exit branch contains a global average pooling layer and a fully connected classification layer. During forward propagation, when the network computes to the lk-th layer, the feature tensor output by that layer is extracted, and the intermediate prediction result is obtained through the exit branches. The network continues its calculations until it reaches the final layer, where it passes through the target output layer to obtain the final prediction result.

[0075] The network malicious traffic detection method provided in this invention introduces a multi-exit neural network structure into the target dual-branch reconstruction model, applies supervisory signals at each depth level, calculates intermediate and final classification losses, and weights and optimizes the target loss. This fine-tuning strategy enables shallow networks to effectively learn discriminative features, and the model possesses hierarchical decision-making capabilities, supporting adaptive early stopping at the edge based on sample complexity. Compared to traditional single-output models, this method significantly reduces average inference depth and computational overhead while maintaining detection accuracy, providing an efficient and lightweight solution for real-time malicious traffic detection in resource-constrained environments with limited satellite-to-ground gateways.

[0076] Figure 5 This is the third flowchart of the network malicious traffic detection method provided by the present invention. The network malicious traffic detection method is applied to a ground gateway station, as shown in Figure 5. The method includes the following: Step 201: Receive the lightweight detection model issued by the cloud computing center. The lightweight detection model is constructed based on the satellite-to-ground traffic sample matrix, by extracting the original traffic features and reconstructing the traffic features through a dual-branch reconstruction model, and then pre-training to learn the common features of satellite-to-ground traffic. It should be noted that the ground gateway station receives lightweight detection model files and related inference configuration files (such as confidence thresholds for each exit branch, model input size, etc.) from the cloud computing center through a secure management channel (usually an encrypted transmission control protocol connection). After receiving the data, the ground gateway station loads the model into the memory of its inference acceleration unit (such as a GPU, TPU, or dedicated neural network inference chip) and establishes a mapping with the gateway data plane, completing the pipeline construction from the high-speed input buffer stream to the multi-level inference engine.

[0077] Step 202: Based on the lightweight detection model, perform network malicious traffic detection on real-time satellite-to-ground traffic.

[0078] It should be noted that network malicious traffic detection refers to using a pre-loaded lightweight detection model to infer whether each piece of satellite-to-ground downlink traffic captured in real time by the gateway station belongs to normal traffic or malicious traffic (and can further distinguish specific attack types). This enables real-time security protection functions to be executed at the edge, immediately blocking detected malicious traffic and allowing normal traffic to pass.

[0079] The network malicious traffic detection method provided in this invention allows ground gateway stations to receive a lightweight detection model, pre-learned from a cloud computing center, that shares common characteristics of satellite-ground traffic. This model enables direct detection of real-time traffic without requiring complex training. This method fully leverages the robust feature representation capabilities pre-trained by the cloud computing center, achieving efficient identification of encrypted, incomplete, and heterogeneous traffic at the edge. It avoids bandwidth waste and detection latency caused by massive traffic backhauling to the core network, significantly improving the security response speed and edge detection capabilities of the satellite-ground converged network.

[0080] Based on any of the above embodiments, the lightweight detection model includes a multi-exit neural network structure, which includes multiple exit branches and a target output layer; The step of detecting malicious network traffic based on the lightweight detection model for real-time satellite-to-ground traffic includes: The real-time satellite-to-ground traffic is preprocessed to obtain a real-time satellite-to-ground traffic sample matrix; The real-time satellite-to-ground traffic sample matrix is ​​input into the lightweight detection model, and inference is performed step by step from shallow to deep according to the network depth direction. The category probability distribution vector of the current level is output through the current exit branch. Calculate the joint confidence index based on the category probability distribution vector; Based on the aforementioned joint confidence index, the malicious traffic identification result is determined.

[0081] It should be noted that real-time satellite-to-ground traffic refers to the raw data packet stream captured instantly by the ground gateway station from the satellite-to-ground link, before any analysis. The preprocessing operation includes: stream reassembly based on time windows and 5-tuples, intercepting the first M consecutive data packets, performing privacy desensitization processing, byte alignment to fixed index positions, and finally vertically stacking them into a two-dimensional matrix.

[0082] Understandably, the lightweight detection model has a multi-exit neural network structure, meaning that multiple classification exit branches are set at different depths in the forward propagation path. Specifically, inference can be performed step by step from shallow to deep layers along the network depth direction, and different levels of class probability distribution vectors are output through multiple exit branches.

[0083] In the specific implementation, the flow encoder in the lightweight detection model is used as the feature extraction network, and its total layer depth is set to L. Several intermediate layers are selected as branch access points in the depth direction of the feature extraction network, and the set of exit layers is defined: ,in Representing the The hierarchical position of each exit branch. Specifically, for the k-th inference stage, the feature extraction network's first... Layer to the first The layer extracts the feature tensor of the current stage, and then inputs the feature tensor into the corresponding k-th exit branch. After being processed by a fully connected layer and Softmax normalization, the output is the class probability distribution vector of the current layer.

[0084] It should be noted that the joint confidence index is a scalar value that integrates model prediction uncertainty (measured by information entropy) and the current satellite-to-ground link load rate. It is used to assess whether it is safe to terminate inference early at the current egress branch. Among them, information entropy reflects the flatness of the probability distribution; the lower the entropy value, the more confident the model is in the prediction. The link load rate reflects the current system's busyness; when the load is higher, the early termination condition can be appropriately relaxed to save computing power.

[0085] In specific implementations, such as Figure 6 As shown, firstly, real-time traffic samples (i.e., real-time satellite-to-ground traffic) are captured and the current level k=1 is initialized. For the k-th level, the joint confidence index H( of the exit branches of that level) is calculated. If the joint confidence index is less than or equal to a preset threshold, the system determines that the features at the current level are sufficient to support a high-confidence classification decision, immediately terminates subsequent level calculations, and outputs the category probability distribution vector of the current exit branch. As a result of malicious traffic identification, early termination is implemented. If the joint confidence index is greater than a preset threshold, then k=k+1, and the next level of feature extraction and confidence calculation continues. The above process is repeated until the early termination condition is met (i.e., the joint confidence index of a certain level is less than or equal to the preset threshold) or the final output layer is reached. If the early termination condition is not met when the final output layer is reached, the prediction result of the final output layer is used as the malicious traffic identification result. Through this dynamic early termination mechanism, the system can adaptively adjust the inference depth according to the sample complexity and link status, achieving energy efficiency optimization and resource release while ensuring detection accuracy.

[0086] The network malicious traffic detection method provided in this invention constructs a lightweight detection model containing a multi-egress neural network structure. During inference, it performs calculations step-by-step from shallow to deep layers according to the network depth direction, and calculates a joint confidence index based on the category probability distribution vector output by the current egress branch, adaptively deciding whether to terminate the inference early. This method enables simple samples with obvious features to be quickly classified and output results at shallow egress points, while complex samples automatically enter deeper networks for fine-grained analysis. This significantly reduces the average inference depth and computational overhead while maintaining overall detection accuracy, effectively improving the real-time response capability and resource utilization efficiency of ground gateway stations in high-concurrency, high-traffic scenarios.

[0087] Based on any of the above embodiments, calculating the joint confidence index based on the category probability distribution vector includes: Get the current satellite-to-ground link load rate; Calculate the information entropy of the category probability distribution vector; Based on the information entropy and the current satellite-to-ground link load rate, a joint confidence index is determined.

[0088] It should be noted that the current satellite-to-ground link load rate L is a real-time changing value, ranging from 0 to 1, used to quantify the urgency of the current processing pressure on the gateway station. This load rate can be calculated by monitoring indicators such as the queue depth of the input buffer, CPU utilization, memory utilization, or bandwidth utilization of the satellite-to-ground feeder link, and then normalizing them. The purpose of this parameter is to introduce external state information into the dynamic early shutdown decision-making process, enabling the inference process to perceive the current resource busyness, thus more proactively exiting the system early under high load and pursuing higher accuracy under low load. Information entropy is a measure of the uncertainty of random variables in information theory.

[0089] In practice, the formula for calculating the joint confidence index is as follows: In the formula, Let A represent the probability that the predicted sample of the k-th exit branch belongs to the c-th class, where A is the total number of categories in the classification task, and L is the current satellite-to-ground link load rate. Information entropy is used to predict probability distributions and measures the uncertainty of the model regarding the current prediction results; the lower the entropy value, the sharper the probability distribution and the higher the model confidence.

[0090] Understandably, the information entropy is added to the current satellite-to-ground link load rate to obtain the joint confidence index. This index comprehensively considers the uncertainty of the model itself and the external network operating status. When the index falls below a preset threshold, early stopping is triggered, thereby reducing the average inference depth while ensuring detection accuracy.

[0091] The network malicious traffic detection method provided in this invention obtains the current satellite-to-ground link load rate and calculates the information entropy of the category probability distribution vector, combining the two to obtain a joint confidence index. This achieves a joint measurement of model prediction uncertainty and real-time network operating status. This method enables ground gateway stations to adaptively adjust early stop decisions based on current channel conditions and prediction reliability, effectively reducing average inference depth and computational overhead while ensuring detection accuracy, thus improving the real-time performance and resource utilization efficiency of edge detection in satellite-to-ground fusion networks.

[0092] Based on any of the above embodiments, determining the malicious traffic identification result based on the joint confidence index includes: Obtain the preset threshold; If the joint confidence index is less than or equal to the preset threshold, the inference calculation of the subsequent levels will be terminated, and the category probability distribution vector of the current level will be used as the malicious traffic discrimination result. If the joint confidence index is greater than the preset threshold, the next level of inference calculation will continue to be executed until the termination condition is met or the final output layer is reached. The category probability distribution vector of the corresponding level when the termination condition is met will be used as the malicious traffic discrimination result, or the prediction result output by the final output layer will be used as the malicious traffic discrimination result.

[0093] It should be noted that the preset threshold is a pre-configured value used as a benchmark for the joint confidence index. This threshold can be a static global configuration or updated online through dynamic adjustment strategies (such as based on time period, business priority, or real-time load rate). Its function is to serve as a threshold for early termination decisions: when the joint confidence index is less than or equal to this threshold, the output of the current exit branch is considered sufficiently reliable, and inference can be terminated early.

[0094] In the specific implementation, during the execution of segmented inference, a preset threshold for global confidence judgment is set. For the current export branch k (k ranges from 1 to K-1, where K is the total number of exports), after the export calculation for each level of classification is completed, the following logical judgment is executed: like This indicates that the features upon which the current exit branch is based are sufficient to support a reliable classification decision. Continuing to compute deeper layers will not significantly improve accuracy; instead, it will waste valuable computational resources and time. Therefore, the model should immediately terminate subsequent deep networks (i.e., the first...). All computational tasks after the current layer will output the current exit branch. As the final identification result (i.e., the result of malicious traffic identification).

[0095] like This indicates that the features upon which the current exit branch is based are insufficient to support a high-confidence classification decision, and the model is in an uncertain state. At this point, the system does not immediately output a result, but retains the current intermediate state and activates the next-level encoder module to continue the inference computation of the (k+1)th stage. The model starts from the current exit branch... The process continues forward, calculating subsequent network layers in turn, until the next exit branch is reached. Layer. Via The layer performs inference calculations again until the termination condition is met (i.e., the joint confidence index of a certain exit branch is less than or equal to the preset threshold) or the final output layer is reached.

[0096] The network malicious traffic detection method provided in this invention achieves dynamic early termination decision based on confidence level by comparing a preset threshold with a joint confidence index. For samples with obvious features and high confidence, inference can be terminated and results output at a shallow exit, significantly reducing computational load; for complex samples, inference continues at a deeper level until conditions are met or the output layer is reached. This method significantly reduces the average inference depth and processing latency while ensuring detection accuracy, improving the real-time response capability and resource utilization efficiency of ground gateway stations in high-concurrency traffic scenarios.

[0097] The network malicious traffic detection device provided by the present invention is described below. The network malicious traffic detection device described below can be referred to in correspondence with the network malicious traffic detection method described above. Figure 7 As shown, the network malicious traffic detection device includes: Module 10 is used to acquire the satellite-to-ground flow sample matrix; Processing module 20 is used to process the satellite-to-ground flow sample matrix based on the dual-branch reconstruction model to obtain the original flow characteristics and the reconstructed flow characteristics. Module 30 is used to pre-train the dual-branch reconstruction model based on the original traffic features and the reconstructed traffic features, and to construct a target dual-branch reconstruction model to learn the common features of satellite-ground traffic. The determination module 40 is used to determine a lightweight detection model based on the target dual-branch reconstruction model, and to distribute the lightweight model to the ground gateway station so that the ground gateway station can detect malicious network traffic based on the lightweight detection model.

[0098] Figure 8 This example illustrates a schematic diagram of the physical structure of a cloud computing center / ground gateway station, such as... Figure 8 As shown, the cloud computing center / ground gateway station may include: a processor 810, a communications interface 820, a memory 830, and a communication bus 840. The processor 810, communications interface 820, and memory 830 communicate with each other via the communication bus 840. The processor 810 can call logical instructions in the memory 830 to execute methods for detecting malicious network traffic.

[0099] Furthermore, the logical instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0100] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the network malicious traffic detection methods provided by the above methods.

[0101] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the network malicious traffic detection methods provided by the above methods.

[0102] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0103] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0104] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting malicious network traffic, characterized in that, Applications in cloud computing centers include: Obtain the satellite-to-ground flow sample matrix; Based on the dual-branch reconstruction model, the satellite-to-ground flow sample matrix is ​​processed to obtain the original flow characteristics and the reconstructed flow characteristics. Based on the original traffic characteristics and the reconstructed traffic characteristics, the dual-branch reconstruction model is pre-trained to construct a target dual-branch reconstruction model for learning the common characteristics of satellite-ground traffic. Based on the target dual-branch reconstruction model, a lightweight detection model is determined, and the lightweight model is distributed to the ground gateway station so that the ground gateway station can detect malicious network traffic based on the lightweight detection model.

2. The network malicious traffic detection method according to claim 1, characterized in that, The acquisition of the satellite-to-ground flow sample matrix includes: Based on the time window and the quintuple, the first M consecutive traffic data packets of each original satellite-to-ground traffic are obtained as traffic representative samples. The traffic representative sample is subjected to privacy desensitization processing to obtain a desensitized traffic representative sample; Align the bytes of the desensitized traffic representative sample to a fixed index position to obtain the target traffic representative sample, and then stack the target traffic representative samples vertically in order to obtain the satellite-to-ground traffic sample matrix.

3. The method for detecting malicious network traffic according to claim 1, characterized in that, The bi-branch reconstruction model processes the satellite-to-ground flow sample matrix to obtain the original flow characteristics and the reconstructed flow characteristics, including: The satellite-to-ground flow sample matrix is ​​divided into multiple non-overlapping local sub-blocks; Randomly mask some non-overlapping local sub-blocks in the satellite-to-ground flow sample matrix to obtain a masked flow sample matrix; Based on the dual-branch reconstruction model, the satellite-to-ground traffic sample matrix and the masked traffic sample matrix are processed to obtain the original traffic features and the reconstructed traffic features.

4. The network malicious traffic detection method according to claim 3, characterized in that, The dual-branch reconstruction model includes a target network, an online network, and a prediction head; The process based on the dual-branch reconstruction model, which involves processing the satellite-to-ground traffic sample matrix and the masked traffic sample matrix to obtain the original traffic features and reconstructed traffic features, includes: The target network is used to process the satellite-to-ground flow sample matrix to obtain the original flow characteristics; The masked traffic sample matrix is ​​processed by the online network to obtain online projection features, and the online projection features are mapped by the prediction head to obtain reconstructed traffic features.

5. The network malicious traffic detection method according to claim 4, characterized in that, The process of pre-training the dual-branch reconstruction model based on the original and reconstructed traffic features to construct a target dual-branch reconstruction model for learning common features of satellite-to-ground traffic includes: Based on the original traffic characteristics and the reconstructed traffic characteristics, the reconstruction loss is calculated; Based on the reconstruction loss, the network parameters of the online network are updated, and the network parameters of the target network are synchronously updated based on the updated online network using an exponential moving average mechanism. Based on the updated online network and the updated target network, a target bi-branch reconstruction model is constructed to learn the common characteristics of satellite-ground traffic.

6. The method for detecting malicious network traffic according to claim 1, characterized in that, The determination of the lightweight detection model based on the target dual-branch reconstruction model includes: The target bi-branch reconstruction model is subjected to supervised fine-tuning to obtain a lightweight detection model.

7. The network malicious traffic detection method according to claim 6, characterized in that, The target dual-branch reconstruction model includes a multi-exit neural network structure, which includes multiple exit branches and a target output layer. The step of supervising and fine-tuning the target bi-branch reconstruction model to obtain a lightweight detection model includes: The labeled samples are input into the target dual-branch reconstruction model, and the corresponding intermediate prediction results are output through the multiple exit branches, and the final prediction result is output through the target output layer. Calculate the first classification loss between each intermediate prediction result and the true label of the labeled sample, and calculate the second classification loss between the final prediction result and the true label; Calculate the target loss based on the first classification loss and the second classification loss; Based on the target loss, the target bi-branch reconstruction model is fine-tuned under supervision to obtain a lightweight detection model.

8. A method for detecting malicious network traffic, characterized in that, Applications to ground gateway stations include: The system receives a lightweight detection model from the cloud computing center. The lightweight detection model is constructed based on the satellite-to-ground traffic sample matrix, by extracting the original traffic features and reconstructing the traffic features through a dual-branch reconstruction model, and then pre-training to learn the common features of satellite-to-ground traffic. Based on the aforementioned lightweight detection model, malicious network traffic is detected in real-time satellite-to-ground traffic.

9. The method for detecting malicious network traffic according to claim 8, characterized in that, The lightweight detection model includes a multi-exit neural network structure, which includes multiple exit branches and a target output layer. The step of detecting malicious network traffic based on the lightweight detection model for real-time satellite-to-ground traffic includes: The real-time satellite-to-ground traffic is preprocessed to obtain a real-time satellite-to-ground traffic sample matrix; The real-time satellite-to-ground traffic sample matrix is ​​input into the lightweight detection model, and inference is performed step by step from shallow to deep according to the network depth direction. The category probability distribution vector of the current level is output through the current exit branch. Calculate the joint confidence index based on the category probability distribution vector; Based on the aforementioned joint confidence index, the malicious traffic identification result is determined.

10. The method for detecting malicious network traffic according to claim 9, characterized in that, The calculation of the joint confidence index based on the category probability distribution vector includes: Get the current satellite-to-ground link load rate; Calculate the information entropy of the category probability distribution vector; Based on the information entropy and the current satellite-to-ground link load rate, a joint confidence index is determined.

11. The method for detecting malicious network traffic according to claim 9, characterized in that, The determination of malicious traffic identification results based on the joint confidence index includes: Obtain the preset threshold; If the joint confidence index is less than or equal to the preset threshold, the inference calculation of the subsequent levels will be terminated, and the category probability distribution vector of the current level will be used as the malicious traffic discrimination result. If the joint confidence index is greater than the preset threshold, the next level of inference calculation will continue to be executed until the termination condition is met or the final output layer is reached. The category probability distribution vector of the corresponding level when the termination condition is met will be used as the malicious traffic discrimination result, or the prediction result output by the final output layer will be used as the malicious traffic discrimination result.

12. A cloud computing center, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the network malicious traffic detection method as described in any one of claims 1 to 7.

13. A ground gateway station, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the network malicious traffic detection method as described in any one of claims 8 to 11.

14. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the network malicious traffic detection method as described in any one of claims 1 to 11.

15. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the network malicious traffic detection method as described in any one of claims 1 to 11.

Images