A border-aware method for few-shot class incremental malicious traffic classification

Abstract

The application relates to a boundary perception method for few-shot class incremental malicious traffic classification, relates to the technical field of network security, improves the stability of few-shot new class representation, reduces the influence of the class increment process on the learned traffic representation, alleviates the classification score bias between the basic classes and the new classes, and improves the unified identification capability of all seen classes. Selective correction is carried out for the high-risk local class boundary, interference to the stable classification region and additional calculation overhead are reduced. In the scene of encrypted malicious traffic with invisible load content, the distinguishing capability of similar communication behavior traffic is improved. The application supports multi-round new class access and multi-agent cooperation, and adapts to the continuous evolution of the network security situation awareness demand.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and specifically to a boundary awareness method for classifying incremental malicious traffic with few samples. Background Technology

[0002] With the rapid development of cloud computing, the Internet of Things, mobile internet, and encrypted communication technologies, the scale and complexity of network traffic are constantly increasing. Network threats such as malicious program communication, botnet control, denial-of-service attacks, and covert data transmission are gradually exhibiting characteristics of encryption, dynamism, and continuous evolution. Many network communications employ transport layer security protocols, virtual private networks, proxy tunnels, or traffic obfuscation to hide application layer content, making traditional traffic detection methods that rely on fixed ports, protocol fields, feature rules, or plaintext payloads ineffective in obtaining information that characterizes traffic categories.

[0003] To identify encrypted malicious traffic when the payload content is not visible, existing technologies typically extract packet length, transmission direction, arrival time interval, traffic statistics, and contextual information from network sessions, and use machine learning or deep learning models to establish a mapping relationship between traffic features and category labels. Traffic classification methods based on deep neural networks can automatically learn complex communication behavior characteristics and have achieved good classification results in encrypted traffic identification tasks with known categories.

[0004] However, existing encrypted traffic classification methods are typically trained based on a fixed set of categories and a relatively sufficient number of labeled samples. In real-world network environments, attack tools, malware families, and communication protocols are constantly evolving, and new malicious traffic categories often only have a small number of confirmed labeled samples available in their early stages. When new traffic categories arrive, retraining the classification model using all the data from both the old and new categories would incur high costs for data storage, model training, and system updates. Conversely, directly fine-tuning the original model using only a small number of newly added category samples could alter the original feature representations and classification boundaries, leading to a decline in the model's ability to recognize already learned categories.

[0005] Few-shot incremental learning techniques attempt to gradually expand the class space of a classification model based on a small number of newly added class samples, and uniformly identify the base class, historically added classes, and the currently added class after each expansion. However, directly applying existing few-shot incremental learning methods to the classification of encrypted malicious traffic still has certain limitations. On the one hand, the number of labeled samples for newly added classes is small, and the class representation calculated based on a small number of samples is easily affected by sample selection, noisy samples, and intra-class differences, leading to instability in the representation of newly added classes. On the other hand, there is a significant difference in the number of training samples between the base class and the newly added class, which can easily cause an imbalance in classification scores between different classes, causing the newly added class to excessively attract base class samples or be suppressed by the base class and historically added classes.

[0006] Furthermore, different encrypted or obfuscated traffic may have similar packet lengths, timing variations, and communication behaviors, and their misclassifications are usually concentrated near a few closely spaced category boundaries. Existing methods that uniformly adjust all category representations, all classification boundaries, or all samples to be classified not only increase computational overhead but may also cause unnecessary interference to regions where classification results were originally stable. Therefore, how to improve the stability of newly added category representations with a small number of samples while preserving the learned traffic representations, alleviate the classification score bias between known categories, and perform targeted judgment and correction of easily confused local category boundaries remains a key technical problem to be solved in the incremental classification of encrypted malicious traffic. Summary of the Invention

[0007] In order to overcome the shortcomings of the above-mentioned technologies, this invention provides a boundary-aware method for classifying incremental malicious traffic with few samples, which overcomes the shortcomings of existing methods for classifying incremental malicious traffic with few samples.

[0008] The technical solution adopted by this invention to overcome its technical problems is: A boundary-aware method for incremental malicious traffic classification with few samples includes: S1. Construct a basic category sample set ; S2. Based on the base category sample set Training the flow feature encoder The trained traffic feature encoder is obtained. ; S3. Utilizing the trained traffic feature encoder Obtain the basic category sample set Basic category prototype memory Basic category replay candidate feature pool Basic category statistical feature prototype set ; S4. Obtain network traffic for the newly added basic category and get the new category label. Category prototype and new category tags Statistical characteristics prototype ; S5. Utilizing prototype memory based on basic categories and new category tags Category prototype Construct prior memories to obtain new category labels Adaptation category prototype ; S6. Based on Adaptive Category Prototype Obtain calibration classification score ; S7. Obtain comprehensive boundary risk using category-based and newly added basic categories. By integrating boundary risks Obtain the high-risk category boundary set ; S8. Utilizing high-risk category boundary sets The final classification result is obtained.

[0009] Furthermore, step S1 includes the following steps: S1-1. Read the category labels belonging to the basic category set from the PCAP file, mirror port, and network traffic storage file of the monitored link. Basic category network traffic, to obtain basic category packet sequences , ,in, For the first Basic category data packages, The number of basic category data packets; S1-2. Using the Flowcontainer library and T Shark tool to process the... Basic category data packets The analysis was performed to extract the first... Basic category data packets The five-tuple information, arrival timestamp, transmission direction identifier, and data packet length information; S1-3. Based on the 5-tuple information of each basic class of packets, remove non-IPv4 / IPv6 TCP / UDP packets, basic class packets with missing fields, and basic class packets whose length cannot be parsed. Collect basic class packets with identical 5-tuple information, whose source and destination addresses and source and destination ports are interchanged, and whose transport protocols are the same, and group them into the same bidirectional session. Arrange the basic class packets in the same bidirectional session in ascending order of arrival timestamps to obtain the basic class session set. , ,in, For the first Basic category sessions The number of basic category sessions; S1-4. Using the NumPy function library to process the basic category session collection Each basic class of session in the process is arranged, truncated, padded, and arrayed according to the packet length, transmission direction identifier, and arrival time interval of adjacent packets. PyTorch is then used to process the arranged, truncated, padded, and arrayed packets into a single sequence. Basic category of conversations Convert to session-level traffic characteristics Basic category sample set , , Session-level traffic characteristics Corresponding category tags, .

[0010] Furthermore, step S2 includes the following steps: S2-1. Use the feature encoder in the Transformer model as the flow feature encoder. ; S2-2. Session-level traffic characteristics Input to flow feature encoder In the output, the category label is obtained. The predicted score, based on the predicted score and the category label. Calculate the cross-entropy loss and use the Adam optimizer to train the flow feature encoder using the cross-entropy loss. The trained traffic feature encoder is obtained. .

[0011] Furthermore, step S3 includes the following steps: S3-1. Session-level traffic characteristics Input into the trained traffic feature encoder In the process, the output of the feature projection layer of the feature encoder of the Transformer model is taken and normalized to obtain the first... Embedded features corresponding to each basic category of conversation ; S3-2. Label the category as The embedded features corresponding to all basic category sessions are averaged, and the average value is then normalized to obtain the category labels. Category prototype The category prototypes of all category labels constitute the basic category prototype memory. ; S3-3. When category labels When the number of corresponding embedded features is greater than 100, randomly select 100 embedded features and class labels. After association, the candidate features are placed into the base category replay pool. In the middle, when category label When the number of corresponding embedded features is less than or equal to 100, all embedded features are matched with the category label. After association, the candidate features are placed into the base category replay pool. middle, ,in, Category Labels The Middle Embedded features, Category Labels The number of corresponding embedded features; S3-4. Use the NumP library to store category labels. For each session-level traffic feature, calculate the mean, standard deviation, minimum, and maximum packet length. Use the mean, standard deviation, minimum, and maximum packet lengths of all session-level traffic features as statistical characteristics. The first dimension uses the NumP library to classify labels. For each session-level traffic feature, calculate the mean, standard deviation, minimum, and maximum value of the transmission direction indication. Use the mean, standard deviation, minimum, and maximum values ​​of all transmission direction indications as statistical features. The second dimension uses the NumP library to store category labels. For each session-level traffic feature, calculate the mean, standard deviation, minimum, and maximum arrival time intervals of adjacent data packets. Use these values ​​as statistical features. In the third dimension, statistical features are extracted using the NumP library. The first, second, and third dimensions are aggregated one by one using their respective means. The aggregated means are then normalized to obtain the category labels. Statistical characteristics prototype The statistical category prototypes corresponding to all category labels constitute the basic category statistical feature prototype set. .

[0012] Furthermore, step S4 includes the following steps: S4-1. Read the category labels belonging to the basic category set from the PCAP file, mirror port, and network traffic storage file of the monitored link. The newly added basic category network traffic is used to replace the basic category network traffic in step S1-1. Then, steps S1-1 to S1-4 are repeated to obtain the new basic category sample set. , , Session-level traffic characteristics Corresponding category tags, , The number of new basic category sessions; S4-2. Session-level traffic characteristics Input into the trained traffic feature encoder In the process, the output of the feature projection layer of the feature encoder of the Transformer model is taken and normalized to obtain the first... Embedded features corresponding to each newly added basic category of conversation ; S4-3. Embedding Features Replace the embedded features in step S3-2 Then repeat steps S3-2 to S3-4 to obtain category labels. Statistical characteristics prototype .

[0013] Furthermore, step S5 includes the following steps: S5-1. Calculate the newly added category labels respectively. Category prototype With the prototype memory of the basic category The cosine similarity between the prototypes of each category will help memorize the basic category prototypes. After sorting the prototypes of each category from highest to lowest cosine similarity, the top ones were selected. Each category prototype receives a new category label. The corresponding set of basic categories , It is a positive integer greater than or equal to 2; S5-2. Through formula Calculate the category label New category tags Search weight In the formula, To preset the search temperature parameters, , Category Labels Category prototype, , To calculate cosine similarity; S5-3. Through formula Calculate the new category label Prior memory In the formula, For normalization processing; S5-4. Through formula Calculate the new category label The fusion coefficient between the original category prototype and the memory prior In the formula, To preset the maximum fusion coefficient, , For positive part operators; S5-5. Through formula Calculate the new category label Adaptation category prototype .

[0014] Furthermore, step S6 includes the following steps: S6-1. Through formula Calculate the first Embedded features corresponding to each newly added basic category of conversation The difficulty of being confused by newly added categories during the incremental phase ,Will Difficulty level Sort by height from highest to lowest, and select the top... The embedding feature set corresponds to the difficulty level of the basic category replay feature set. middle; S6-2. Through formula Calculate the new category label Calibration classification score In the formula, For the preset fractional scale coefficient, Add new category tags The offset of the classification score; S6-3. Replay the feature set of the difficult basic category. middle The category label and basic category replay candidate feature pool corresponding to each embedded feature middle The category labels corresponding to each embedded feature are used as the real labels, and new category labels are added. Calibration classification score The cross-entropy loss is calculated using the predicted probability value, and gradient descent is used to iteratively add new class labels using the cross-entropy loss. The offset of the classification score .

[0015] Furthermore, step S7 includes the following steps: S7-1. Set the basic categories With the basic category set Merge to obtain the set of all seen categories. , to the complete set of all seen categories The Middle Category Labels With all seen category sets The Middle Category Labels Construct candidate category pairs; S7-2. Through formula Calculate the complete set of all seen categories The Middle Category Labels With all seen category sets The Middle Category Labels Prototype proximity risk In the formula, For the first Category Labels The corresponding embedded features, For the first Category Labels Corresponding embedded features; S7-3. Through formula Calculate the boundary confusion risk In the formula, For the set of all seen categories The number of category labels For the Sigmoid function, To preset a safety interval, To preset smoothing parameters, For the first Category Labels The corresponding calibration classification score, For the first Category Labels The corresponding calibration classification score; S7-4. Through formula Calculate the first Category Labels With the Category Labels The comprehensive boundary risk of the candidate category pairs In the formula, The preset prototype proximity risk weight, Preset boundary confusion risk weights; S7-5. Set all seen categories All candidate categories are sorted in descending order of comprehensive boundary risk, and the top category is selected. Each candidate category is placed into the high-risk category boundary set. middle.

[0016] Preferred, The value is 0.8. The value is 0.2. The value is 8. The value is 0.05. The value is 0.1.

[0017] Furthermore, step S8 includes the following steps: S8-1. Collect all seen categories Sort all category labels in descending order of their calibration classification scores, and select the category label with the highest calibration classification score. Select the category label with the second highest calibration classification score. Determine category labels With category labels The categories constituted Belongs to the boundary set and category labels Calibration classification score With category labels Calibration classification score Is the absolute value of the difference less than or equal to the preset classification score interval threshold? , The value is 0.05. Otherwise, proceed to step S8-2; otherwise, proceed to step S8-3. S8-2. Category Labels As the final classification result; S8-3. Through formula Calculate the category label Locally corrected classification scores In the formula, These are the preset statistical characteristic correction coefficients. The value is 0.03. Category Labels Corresponding statistical characteristics Category Labels The corresponding statistical feature prototype, through the formula Calculate the category label Locally corrected classification scores In the formula, Category Labels Corresponding statistical characteristics Category Labels The corresponding statistical feature prototypes are compared with locally corrected classification scores. Locally corrected classification scores The value of the classification score is used to determine the category label corresponding to the larger local correction score, which is then taken as the final classification result.

[0018] The beneficial effects of this invention are: 1. Improve the stability of newly added category representations with few samples and reduce the impact of the category increment process on the learned traffic representations.

[0019] Existing incremental classification methods for few-shot classes typically construct category representations directly from a small number of newly added category support samples. This is susceptible to the influence of sample selection, outliers, and intra-category differences, leading to shifts in the prototypes of newly added categories. This invention fixes the traffic feature encoder after training the basic categories and utilizes the basic category prototype memory to retrieve the basic category prototypes related to the newly added categories, constructing corresponding memory priors. Based on the similarity between the original prototypes of the newly added categories and the relevant basic category prototypes, and the retrieval weight distribution, the memory priors are adaptively fused with the original category prototypes. This allows the stable structural information from the learned basic categories to supplement the prototypes of newly added categories with few samples, improving the stability of the newly added category representations without retraining the traffic feature encoder, while avoiding significant changes to the existing traffic feature space during category expansion.

[0020] 2. Alleviate the classification score bias between basic categories and newly added categories, and improve the unified recognition capability of all seen categories.

[0021] Basic categories typically have a large number of training samples, while newly added categories have only a small number of supporting samples. Differences in sample quantity and access stages between different categories can easily lead to an imbalance in classification scores. This invention filters difficult basic category features that are easily confused by newly added categories from the basic category replay candidate feature pool, and uses these features, along with historical and current supporting features of newly added categories, as score calibration data. While keeping the traffic feature encoder and all category classification prototypes fixed, it only jointly determines the classification score offsets corresponding to all seen newly added categories. This approach reduces the possibility of newly added categories excessively attracting basic category traffic or being suppressed by other seen categories, and it eliminates the need to retrain the classification model using all historical traffic, thus balancing the preservation of existing categories with the recognition of newly added categories.

[0022] 3. Selectively correct the boundaries of high-risk local categories to reduce interference with stable classification regions and additional computational overhead.

[0023] Different encrypted or obfuscated traffic may have similar packet lengths, timing variations, and communication behaviors, and their classification errors are usually concentrated near a few closely spaced category boundaries. This invention combines the proximity of category prototypes with the degree of soft-margin violation of preserved feature evidence to perform risk assessment on candidate category pairs containing at least one new category, and filters to obtain a set of high-risk category boundaries. For network traffic to be classified, local re-ranking is performed using statistical features only when its first and second candidate categories belong to high-risk category boundaries and the interval between their calibrated classification scores is small. This eliminates the need for uniform correction of all category boundaries or all network traffic to be classified, reducing unnecessary impact on the originally stable classification result region and controlling the overhead of additional feature calculations and local decision-making.

[0024] 4. Improve the ability to distinguish between similar communication behaviors in scenarios involving encrypted malicious traffic where the payload content is not visible.

[0025] This invention addresses the challenge of directly obtaining plaintext content from encrypted malicious traffic at the application layer. It constructs a session-level traffic representation from network session data packet length, transmission direction, arrival time and timing, and contextual features. An embedded feature encoder learns embedded features for global category identification. Simultaneously, statistical feature prototypes are built for each category, and statistical features of the network traffic to be classified are used as supplementary discrimination criteria near high-risk category boundaries. These statistical features do not replace the embedded features for all-category classification but are only used for local reordering between the first and second candidate categories. This allows for the supplementation of traffic behavior information in different feature spaces without relying on the plaintext payload, improving the local distinguishing ability of similar encrypted or obfuscated traffic.

[0026] 5. Supports multiple rounds of new category access and multi-agent collaboration to adapt to the continuously evolving network security situational awareness requirements.

[0027] This invention stores only a limited number of basic category replay candidate features in each incremental stage, as well as the supporting sample embedding features, adapted category prototypes, and statistical feature prototypes obtained when a new category is first accessed. It eliminates the need to store all historical raw network traffic in the long term. Upon the arrival of a new category, the stored information can be used to construct the category prototype, calibrate classification scores, and update boundary risks, thereby supporting multiple rounds of new category access and reducing the cost of storing historical data and updating the model. Simultaneously, this invention uses a large-scale model collaborative scheduling agent to issue basic category initialization instructions and new category access instructions. An encrypted malicious traffic awareness agent completes traffic identification, boundary risk determination, and local corrections, and returns the final classification results, classification scores, boundary risks, and correction status to the large-scale model collaborative scheduling agent in a structured traffic awareness result. This facilitates the coordinated connection between category incremental updates, traffic awareness, and subsequent security agent calls. Attached Figure Description

[0028] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0029] The following is in conjunction with the appendix Figure 1 The present invention will be further described below.

[0030] A boundary-aware method for incremental malicious traffic classification with few samples includes: S1. Construct a basic category sample set .

[0031] S2. Based on the basic category sample set Training the flow feature encoder The trained traffic feature encoder is obtained. .

[0032] S3. Utilizing the trained traffic feature encoder Obtain the basic category sample set Basic category prototype memory Basic category replay candidate feature pool Basic category statistical feature prototype set .

[0033] S4. Obtain network traffic for the newly added basic category and get the new category label. Category prototype and new category tags Statistical characteristics prototype .

[0034] S5. Utilizing prototype memory based on basic categories and new category tags Category prototype Construct prior memories to obtain new category labels Adaptation category prototype .

[0035] S6. Based on Adaptive Category Prototype Obtain calibration classification score .

[0036] S7. Obtain comprehensive boundary risk using category-based and newly added basic categories. By integrating boundary risks Obtain the high-risk category boundary set .

[0037] S8. Utilizing high-risk category boundary sets The final classification result is obtained.

[0038] In one embodiment of the present invention, step S1 includes the following steps: S1-1. Read the category labels belonging to the basic category set from the PCAP file, mirror port, and network traffic storage file of the monitored link. Basic category network traffic, to obtain basic category packet sequences , ,in, For the first Basic category data packages, The number of basic category data packets.

[0039] S1-2. Using the Flowcontainer library and T Shark tool to process the... Basic category data packets The analysis was performed to extract the first... Basic category data packets The five-tuple information, arrival timestamp, transmission direction identifier, and data packet length information.

[0040] S1-3. Based on the 5-tuple information of each basic class of packets, remove non-IPv4 / IPv6 TCP / UDP packets, basic class packets with missing fields, and basic class packets whose length cannot be parsed. Collect basic class packets with identical 5-tuple information, whose source and destination addresses and source and destination ports are interchanged, and whose transport protocols are the same, and group them into the same bidirectional session. Arrange the basic class packets in the same bidirectional session in ascending order of arrival timestamps to obtain the basic class session set. , ,in, For the first Basic category sessions, The number of sessions based on the basic category.

[0041] S1-4. Using the NumPy function library to process the basic category session collection Each basic class of session in the process is arranged, truncated, padded, and arrayed according to the packet length, transmission direction identifier, and arrival time interval of adjacent packets. PyTorch is then used to process the arranged, truncated, padded, and arrayed packets into a single sequence. Basic category of conversations Convert to session-level traffic characteristics Basic category sample set , , Session-level traffic characteristics Corresponding category tags, .

[0042] In one embodiment of the present invention, step S2 includes the following steps: S2-1. Use the feature encoder in the Transformer model as the flow feature encoder. .

[0043] S2-2. Session-level traffic characteristics Input to flow feature encoder In the output, the category label is obtained. The predicted score, based on the predicted score and the category label. Calculate the cross-entropy loss and use the Adam optimizer to train the flow feature encoder using the cross-entropy loss. The trained traffic feature encoder is obtained. .

[0044] In one embodiment of the present invention, step S3 includes the following steps: S3-1. Session-level traffic characteristics Input into the trained traffic feature encoder In the process, the output of the feature projection layer of the feature encoder of the Transformer model is taken and normalized to obtain the first... Embedded features corresponding to each basic category of conversation .

[0045] S3-2. Label the category as The embedded features corresponding to all basic category sessions are averaged, and the average value is then normalized to obtain the category labels. Category prototype The category prototypes of all category labels constitute the basic category prototype memory. .

[0046] S3-3. When category labels When the number of corresponding embedded features is greater than 100, randomly select 100 embedded features and class labels. After association, the candidate features are placed into the base category replay pool. In the middle, when category label When the number of corresponding embedded features is less than or equal to 100, all embedded features are matched with the category label. After association, the candidate features are placed into the base category replay pool. middle, ,in, Category Labels The Middle Embedded features, Category Labels The number of corresponding embedded features.

[0047] S3-4. Use the NumP library to store category labels. For each session-level traffic feature, calculate the mean, standard deviation, minimum, and maximum packet length. Use the mean, standard deviation, minimum, and maximum packet lengths of all session-level traffic features as statistical characteristics. The first dimension uses the NumP library to classify labels. For each session-level traffic feature, calculate the mean, standard deviation, minimum, and maximum value of the transmission direction indication. Use the mean, standard deviation, minimum, and maximum values ​​of all transmission direction indications as statistical features. The second dimension uses the NumP library to store category labels. For each session-level traffic feature, calculate the mean, standard deviation, minimum, and maximum arrival time intervals of adjacent data packets. Use these values ​​as statistical features. In the third dimension, statistical features are extracted using the NumP library. The first, second, and third dimensions are aggregated one by one using their respective means. The aggregated means are then normalized to obtain the category labels. Statistical characteristics prototype The statistical category prototypes corresponding to all category labels constitute the basic category statistical feature prototype set. .

[0048] In one embodiment of the present invention, step S4 includes the following steps: S4-1. Read the category labels belonging to the basic category set from the PCAP file, mirror port, and network traffic storage file of the monitored link. The newly added basic category network traffic is used to replace the basic category network traffic in step S1-1. Then, steps S1-1 to S1-4 are repeated to obtain the new basic category sample set. , , Session-level traffic characteristics Corresponding category tags, , The number of new basic category sessions.

[0049] S4-2. Session-level traffic characteristics Input into the trained traffic feature encoder In the process, the output of the feature projection layer of the feature encoder of the Transformer model is taken and normalized to obtain the first... Embedded features corresponding to each newly added basic category of conversation .

[0050] S4-3. Embedding Features Replace the embedded features in step S3-2 Then repeat steps S3-2 to S3-4 to obtain category labels. Statistical characteristics prototype .

[0051] In one embodiment of the present invention, step S5 includes the following steps: S5-1. Calculate the newly added category labels respectively. Category prototype With the prototype memory of the basic category The cosine similarity between the prototypes of each category will help memorize the basic category prototypes. After sorting the prototypes of each category from highest to lowest cosine similarity, the top ones were selected. Each category prototype receives a new category label. The corresponding set of basic categories , It is a positive integer greater than or equal to 2.

[0052] S5-2. Through formula Calculate the category label New category tags Search weight In the formula, To preset the search temperature parameters, , Category Labels Category prototype, , To calculate cosine similarity.

[0053] S5-3. Through formula Calculate the new category label Prior memory In the formula, This is for normalization purposes.

[0054] S5-4. Through formula Calculate the new category label The fusion coefficient between the original category prototype and the memory prior In the formula, To preset the maximum fusion coefficient, , It is a positive part operator.

[0055] S5-5. Through formula Calculate the new category label Adaptation category prototype .

[0056] In one embodiment of the present invention, step S6 includes the following steps: S6-1. Through formula Calculate the first Embedded features corresponding to each newly added basic category of conversation The difficulty of being confused by newly added categories during the incremental phase ,Will Difficulty level Sort by height from highest to lowest, and select the top... The embedding feature set corresponds to the difficulty level of the basic category replay feature set. middle.

[0057] S6-2. Through formula Calculate the new category label Calibration classification score In the formula, The preset fractional scale coefficient, Add new category tags The offset of the classification score.

[0058] S6-3. Replay the feature set of the difficult basic category. middle The category label and basic category replay candidate feature pool corresponding to each embedded feature middle The category labels corresponding to each embedded feature are used as the real labels, and new category labels are added. Calibration classification score The cross-entropy loss is calculated using the predicted probability value, and gradient descent is used to iteratively add new class labels using the cross-entropy loss. The offset of the classification score .

[0059] In one embodiment of the present invention, step S7 includes the following steps: S7-1. Set the basic categories With the basic category set Merge to obtain the set of all seen categories. , to the complete set of all seen categories The Middle Category Labels With all seen category sets The Middle Category Labels This forms a candidate category pair.

[0060] S7-2. Through formula Calculate the complete set of all seen categories The Middle Category Labels With all seen category sets The Middle Category Labels Prototype proximity risk In the formula, For the first Category Labels The corresponding embedded features, For the first Category Labels The corresponding embedding features.

[0061] S7-3. Through formula Calculate the boundary confusion risk In the formula, For the set of all seen categories The number of category labels For the Sigmoid function, To preset a safety interval, To preset smoothing parameters, For the first Category Labels The corresponding calibration classification score, For the first Category Labels The corresponding calibration classification score.

[0062] S7-4. Through formula Calculate the first Category Labels With the Category Labels The comprehensive boundary risk of the candidate category pairs In the formula, The preset prototype proximity risk weight, The pre-defined boundary confusion risk weights are used.

[0063] S7-5. Set all seen categories All candidate categories are sorted in descending order of comprehensive boundary risk, and the top category is selected. Each candidate category is placed into the high-risk category boundary set. middle.

[0064] In this embodiment, preferably, The value is 0.8. The value is 0.2. The value is 8. The value is 0.05. The value is 0.1.

[0065] In one embodiment of the present invention, step S8 includes the following steps: S8-1. Collect all seen categories Sort all category labels in descending order of their calibration classification scores, and select the category label with the highest calibration classification score. Select the category label with the second highest calibration classification score. Determine category labels With category labels The categories constituted Belongs to the boundary set and category labels Calibration classification score With category labels Calibration classification score Is the absolute value of the difference less than or equal to the preset classification score interval threshold? , The value is 0.05. Otherwise, proceed to step S8-2; otherwise, proceed to step S8-3.

[0066] S8-2. Category Labels As the final classification result.

[0067] S8-3. Through formula Calculate the category label Locally corrected classification scores In the formula, These are the preset statistical characteristic correction coefficients. The value is 0.03. Category Labels Corresponding statistical characteristics Category Labels The corresponding statistical feature prototype, through the formula Calculate the category label Locally corrected classification scores In the formula, Category Labels Corresponding statistical characteristics Category Labels The corresponding statistical feature prototypes are compared with locally corrected classification scores. Locally corrected classification scores The value of the classification score is used to determine the category label corresponding to the larger local correction score, which is then taken as the final classification result.

[0068] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A boundary-aware method for incremental malicious traffic classification with few samples, characterized in that, include: S1. Construct a basic category sample set ; S2. Based on the base category sample set Training the flow feature encoder The trained traffic feature encoder is obtained. ; S3. Utilizing the trained traffic feature encoder Obtain the basic category sample set Basic category prototype memory Basic category replay candidate feature pool Basic category statistical feature prototype set ; S4. Obtain network traffic for the newly added basic category and get the new category label. Category prototype and new category tags Statistical characteristics prototype ; S5. Utilizing prototype memory based on basic categories and new category tags Category prototype Construct prior memories to obtain new category labels Adaptation category prototype ; S6. Based on Adaptive Category Prototype Obtain calibration classification score ; S7. Obtain comprehensive boundary risk using category-based and newly added basic categories. By comprehensively considering boundary risks Obtain the high-risk category boundary set ; S8. Utilizing high-risk category boundary sets The final classification result is obtained; Step S7 includes the following steps: S7-1. Set the basic categories With the basic category set Merge to obtain the set of all seen categories. , to the complete set of all seen categories The Middle Category Labels With all seen category sets The Middle Category Labels Construct candidate category pairs; S7-2. Through formula Calculate the complete set of all seen categories The Middle Category Labels With all seen category sets The Middle Category Labels Prototype proximity risk In the formula, For the first Category Labels The corresponding embedded features, For the first Category Labels Corresponding embedded features; S7-3. Through formula Calculate the boundary confusion risk In the formula, For the set of all seen categories The number of category labels For the Sigmoid function, To preset a safety interval, To preset smoothing parameters, For the first Category Labels The corresponding calibration classification score, For the first Category Labels The corresponding calibration classification score; S7-4. Through formula Calculate the first Category Labels With the Category Labels The comprehensive boundary risk of the candidate category pairs In the formula, The preset prototype proximity risk weight, Preset boundary confusion risk weights; S7-5. Set all seen categories All candidate categories are sorted in descending order of comprehensive boundary risk, and the top category is selected. Each candidate category is placed into the high-risk category boundary set. middle; Step S8 includes the following steps: S8-1. Collect all seen categories Sort all category labels in descending order of their calibration classification scores, and select the category label with the highest calibration classification score. Select the category label with the second highest calibration classification score. Determine category labels With category labels The categories constituted Belongs to the boundary set and category labels Calibration classification score With category labels Calibration classification score Is the absolute value of the difference less than or equal to the preset classification score interval threshold? , The value is 0.

05. Otherwise, proceed to step S8-2; otherwise, proceed to step S8-3. S8-2. Category Labels As the final classification result; S8-3. Through formula Calculate the category label Locally corrected classification scores In the formula, These are the preset statistical characteristic correction coefficients. The value is 0.

03. Category Labels Corresponding statistical characteristics Category Labels The corresponding statistical feature prototype, through the formula Calculate the category label Locally corrected classification scores In the formula, Category Labels Corresponding statistical characteristics Category Labels The corresponding statistical feature prototypes are compared with locally corrected classification scores. Locally corrected classification scores The value of the classification score is used to determine the category label corresponding to the larger local correction score, which is then taken as the final classification result.

2. The boundary-aware method for incremental malicious traffic classification with few samples as described in claim 1, characterized in that, Step S1 includes the following steps: S1-1. Read the category labels belonging to the basic category set from the PCAP file, mirror port, and network traffic storage file of the monitored link. Basic category network traffic, to obtain basic category packet sequences , ,in, For the first Basic category data packages, The number of basic category data packets; S1-2. Using the Flowcontainer library and T Shark tool to process the... Basic category data packets The analysis was performed to extract the first... Basic category data packets The five-tuple information, arrival timestamp, transmission direction identifier, and data packet length information; S1-3. Based on the 5-tuple information of each basic class of packets, remove non-IPv4 / IPv6 TCP / UDP packets, basic class packets with missing fields, and basic class packets whose length cannot be parsed. Collect basic class packets with identical 5-tuple information, whose source and destination addresses and source and destination ports are interchanged, and whose transport protocols are the same, and group them into the same bidirectional session. Arrange the basic class packets in the same bidirectional session in ascending order of arrival timestamps to obtain the basic class session set. , ,in, For the first Basic category sessions, The number of basic category sessions; S1-4. Using the NumPy function library to process the basic category session collection Each basic class of session in the process is arranged, truncated, padded, and arrayed according to the packet length, transmission direction identifier, and arrival time interval of adjacent packets. PyTorch is then used to process the arranged, truncated, padded, and arrayed packets into a single sequence. Basic category of conversations Convert to session-level traffic characteristics Basic category sample set , , Session-level traffic characteristics Corresponding category tags, .

3. The boundary-aware method for incremental malicious traffic classification with few samples as described in claim 1, characterized in that, Step S2 includes the following steps: S2-1. Use the feature encoder in the Transformer model as the flow feature encoder. ; S2-2. Session-level traffic characteristics Input to flow feature encoder In the output, the category label is obtained. The predicted score, based on the predicted score and the category label. Calculate the cross-entropy loss and use the Adam optimizer to train the flow feature encoder using the cross-entropy loss. The trained traffic feature encoder is obtained. .

4. The boundary-aware method for incremental malicious traffic classification with few samples as described in claim 2, characterized in that, Step S3 includes the following steps: S3-1. Session-level traffic characteristics Input into the trained traffic feature encoder In the process, the output of the feature projection layer of the feature encoder of the Transformer model is taken and normalized to obtain the first... Embedded features corresponding to each basic category of conversation ; S3-2. Label the category as The embedded features corresponding to all basic category sessions are averaged, and the average value is then normalized to obtain the category labels. Category prototype The category prototypes of all category labels constitute the basic category prototype memory. ; S3-3. When category labels When the number of corresponding embedded features is greater than 100, randomly select 100 embedded features and class labels. After association, the candidate features are placed into the base category replay pool. In the middle, when category label When the number of corresponding embedded features is less than or equal to 100, all embedded features are matched with the category label. After association, the candidate features are placed into the base category replay pool. middle, ,in, Category Labels The Middle Embedded features, Category Labels The number of corresponding embedded features; S3-4. Use the NumP library to store category labels. For each session-level traffic feature, calculate the mean, standard deviation, minimum, and maximum packet length. Use the mean, standard deviation, minimum, and maximum packet lengths of all session-level traffic features as statistical characteristics. The first dimension uses the NumP library to classify labels. For each session-level traffic feature, calculate the mean, standard deviation, minimum, and maximum value of the transmission direction indication. Use the mean, standard deviation, minimum, and maximum values ​​of all transmission direction indications as statistical features. The second dimension uses the NumP library to store category labels. For each session-level traffic feature, calculate the mean, standard deviation, minimum, and maximum arrival time intervals of adjacent data packets. Use these values ​​as statistical features. In the third dimension, statistical features are extracted using the NumP library. The first, second, and third dimensions are aggregated one by one using their respective means. The aggregated means are then normalized to obtain the category labels. Statistical characteristics prototype The statistical category prototypes corresponding to all category labels constitute the basic category statistical feature prototype set. .

5. The boundary-aware method for incremental malicious traffic classification with few samples as described in claim 4, characterized in that, Step S4 includes the following steps: S4-1. Read the category labels belonging to the basic category set from the PCAP file, mirror port, and network traffic storage file of the monitored link. The newly added basic category network traffic is used to replace the basic category network traffic in step S1-1. Then, steps S1-1 to S1-4 are repeated to obtain the new basic category sample set. , , Session-level traffic characteristics Corresponding category tags, , The number of new basic category sessions; S4-2. Session-level traffic characteristics Input into the trained traffic feature encoder In the process, the output of the feature projection layer of the feature encoder of the Transformer model is taken and normalized to obtain the first... Embedded features corresponding to each newly added basic category of conversation ; S4-3. Embedding Features Replace the embedded features in step S3-2 Then repeat steps S3-2 to S3-4 to obtain category labels. Statistical characteristics prototype .

6. The boundary-aware method for incremental malicious traffic classification with few samples as described in claim 5, characterized in that, Step S5 includes the following steps: S5-1. Calculate the newly added category labels respectively. Category prototype With the prototype memory of the basic category The cosine similarity between the prototypes of each category will be used to memorize the basic category prototypes. After sorting the prototypes of each category from high to low according to their cosine similarity scores, the top ones are selected. Each category prototype receives a new category label. The corresponding set of basic categories , It is a positive integer greater than or equal to 2; S5-2. Through formula Calculate the category label New category tags Search weight In the formula, To preset the search temperature parameters, , Category Labels The category prototype, , To calculate cosine similarity; S5-3. Through formula Calculate the new category label Prior memory In the formula, For normalization processing; S5-4. Through formula Calculate the new category label The fusion coefficient between the original category prototype and the memory prior In the formula, To preset the maximum fusion coefficient, , For positive part operators; S5-5. Through formula Calculate the new category label Adaptation category prototype .

7. The boundary-aware method for incremental malicious traffic classification with few samples as described in claim 6, characterized in that, Step S6 includes the following steps: S6-1. Through formula Calculate the first Embedded features corresponding to each newly added basic category of conversation The difficulty of being confused by newly added categories during the incremental phase ,Will Difficulty level Sort by height from highest to lowest, and select the top... The embedding feature set corresponds to the difficulty level of the basic category replay feature set. middle; S6-2. Through formula Calculate the new category label Calibration classification score In the formula, For the preset fractional scale coefficient, Add new category tags The offset of the classification score; S6-3. Replay the feature set of the difficult basic category. middle The category label and basic category replay candidate feature pool corresponding to each embedded feature middle The category labels corresponding to each embedded feature are used as the real labels, and new category labels are added. Calibration classification score The cross-entropy loss is calculated using the predicted probability value, and gradient descent is used to iteratively add new class labels using the cross-entropy loss. The offset of the classification score .

8. The boundary-aware method for incremental malicious traffic classification with few samples as described in claim 1, characterized in that: The value is 0.

8. The value is 0.

2. The value is 8. The value is 0.

05. The value is 0.1.

Images