A 5G core network incremental small sample threat flow detection method based on dynamic branch expansion

Abstract

This invention discloses an incremental small-sample threat flow detection method for 5G core networks based on dynamic branch expansion. First, the original traffic data is preprocessed and then fed into a dynamic branch expansion module to extract basic features and supplement new category features. High-dimensional fusion features are then output through a soft attention gating mechanism. Next, an old-class threat distribution replay module is used to extract and save the statistical feature parameters of the learned categories based on a multivariate Gaussian distribution, and multivariate Gaussian pseudo-samples of the old classes are generated for replay during the incremental phase. Then, joint optimization is performed during the incremental training phase, combining cross-entropy classification loss, knowledge distillation loss, and a sparsity penalty term to collaboratively update model parameters and achieve dynamic compression of the expansion nodes. Finally, the optimized model is used to detect the traffic data to be detected. This invention effectively improves the system's continuous learning ability and alleviates the catastrophic forgetting problem in environments where new threat samples are scarce and edge storage is limited.

Description

Technical Field

[0001] This invention relates to the field of network security and intrusion detection technology, specifically to an incremental small-sample threat flow detection method based on dynamic branch expansion for 5G core networks. By constructing an adaptively expanding feature space and a feature replay mechanism based on statistical distribution, this invention aims to effectively improve the system's continuous learning capability and alleviate the problem of catastrophic forgetting in environments where novel threat samples are scarce and edge storage is limited. Background Technology

[0002] The statements in this section are merely background information relating to this disclosure, and these statements may constitute prior art. In the process of developing this invention, the inventors discovered at least the following problems in the prior art.

[0003] With the large-scale deployment of fifth-generation mobile communication technology (5G), the 5G core network adopts a service-oriented architecture, making the interaction between network elements more open. The continuous access of massive terminals further expands the network attack surface. Existing deep learning-based network intrusion detection methods face many challenges in practical applications: First, new attacks are often sudden and covert, and only a very small number of labeled samples can be obtained in the early stages. Traditional detection models are prone to overfitting under small sample conditions, making it difficult to form stable discriminative features. Second, new threat types are constantly evolving dynamically, and existing models are prone to overwriting the solidified old category weights when learning new category knowledge, resulting in severe "catastrophic forgetting." In addition, nodes such as 5G edge gateways are limited by computing and storage resources and face strict data privacy compliance constraints, making it difficult to retain a large amount of historical raw traffic (such as PCAP files) for model retraining in the long term. Among existing incremental learning methods, sample replay strategies have high storage costs, parameter isolation methods are prone to uncontrolled model expansion, and single regularization methods are prone to classification boundary shifts when dealing with high-dimensional heterogeneous signaling traffic.

[0004] While some technical solutions, such as the patent application No. 202411855149.8 entitled "A Malicious Encryption Traffic Detection Method and System Based on Incremental Learning," incorporate dynamic experience replay, stability constraints, and a two-layer meta-update mechanism, which initially mitigates performance degradation, the forgetting rate continues to rise as new categories are added. Relying solely on a small number of real sample replays makes it difficult to maintain the stability of old class boundaries in a high-dimensional feature space over the long term, and to achieve a smooth transition between old and new knowledge without preserving the original traffic. Furthermore, it fails to address the other aforementioned shortcomings: it cannot accurately capture the specific discriminative features of a small number of novel threat samples without overwriting old weights, nor can it ensure smooth expansion of network representation capacity while curbing uncontrolled parameter expansion.

[0005] Therefore, how to achieve continuous collaborative learning of novel threats with small sample sizes under low resource consumption without preserving the original traffic is a technical challenge that urgently needs to be solved. Summary of the Invention

[0006] In view of the above problems, the purpose of this invention is to solve some of the problems in the prior art, or at least alleviate these problems.

[0007] A method for incremental small-sample threat flow detection in 5G core network based on dynamic branch expansion includes the following steps:

[0008] Obtain raw traffic data, preprocess it, and construct a basic class set and a new attack class set to divide the incremental learning task stages;

[0009] A dynamic branch extension module containing a core extractor and extension branches is constructed; the basic class set and the new attack class set are fed into the dynamic branch extension module, the core extractor is used to retain the basic features, and the extension branches are adaptively instantiated to supplement the new category features. The high-dimensional fusion features are fused and output through a soft attention gating mechanism.

[0010] The high-dimensional fusion features are fed into the constructed old-class threat distribution replay module. The statistical feature parameters of the learned classes are extracted and saved based on the multivariate Gaussian distribution. In the incremental stage, multivariate Gaussian pseudo-samples of the old classes are generated for replay.

[0011] In the incremental training phase, joint optimization is performed on real samples of new classes and multivariate Gaussian pseudo samples of old classes. The model parameters are updated collaboratively by combining cross-entropy classification loss, knowledge distillation loss and sparsity penalty term, and dynamic compression of extended nodes is achieved.

[0012] The optimized model is used to detect the traffic data to be tested.

[0013] Furthermore, the raw traffic data is acquired, preprocessed, and a basic set of attack classes and a new set of attack classes are constructed, including the following steps:

[0014] The raw traffic data is filtered for invalid features, and features containing timestamps, endpoint identifiers, and leaked tags are removed.

[0015] Missing values ​​are handled by removing feature dimensions with a missing rate exceeding a set threshold, and the numerical and categorical features among the retained features are filled with median and constant labels respectively.

[0016] Long-tail truncation and encoding are performed, and a low cardinality truncation strategy and one-hot encoding are applied to discrete symbolic features.

[0017] The Z-Score Gaussian normalization is introduced to smoothly scale the numerical distribution, as shown in the formula. ; where the value of a certain dimension in the original feature vector is The empirical mean of this dimension over the entire training set is The standard deviation is ;

[0018] The cleaned dataset is isolated into a basic class set. With a new set of attack types with scarce samples Both conditions are met:

[0019]

[0020] Among them, the basic class set The new attack class set encompasses common background traffic and known basic attacks that have been captured and persisted in the network environment over a long period. Simulate sudden, advanced persistent threats in edge scenarios;

[0021] The model's lifecycle is divided into a basic learning phase, Session 0 and... A continuous incremental learning phase Session The data stream sequence is as follows:

[0022]

[0023] in, This represents the initial full dataset constructed using the basic class set, used to shape the initial high-dimensional feature space and classification decision boundary of the model; This represents a new type of attack to be addressed in any subsequent incremental phase.

[0024] Furthermore, the input and output dimensions of each of the extended branches are consistent with those of the core extractor; the dynamic branch extension module adopts an incremental instantiation method for the extended branches to progressively supplement the network representation capacity, thereby avoiding overall disturbance to the original backbone structure.

[0025] Furthermore, the high-dimensional fusion features are fed into the constructed old-class threat distribution replay module, and the statistical feature parameters of the learned classes are extracted and saved based on the multivariate Gaussian distribution. In the incremental stage, multivariate Gaussian pseudo-samples of the old classes are generated for replay, including the following steps:

[0026] The intermediate hidden feature vector obtained after the basic class set and the novel attack class set are initially mapped by the underlying network. Simultaneously feed into the core extractor and the extended branch;

[0027] The core extractor extracts stable basic features shared by the task through a basic linear layer. ;

[0028] In the new incremental phase, the network adaptively instantiates new linear expansion branches with consistent input and output dimensions in parallel to extract supplementary discriminative features. Furthermore, a soft attention gating and compression mechanism is introduced after the extended branch, using the activation function to generate gating coefficients. The extracted supplementary discriminant features are compressed element by element and saliency screened to obtain extended features that have been gated and modulated.

[0029] The gated and modulated extended features are incorporated into the stable basic features in the form of residuals to generate a high-dimensional fused feature representation:

[0030]

[0031] in, This represents element-wise multiplication. This represents the Sigmoid activation function; Temperature hyperparameters for controlling gating intensity; To expand the number of branches.

[0032] Furthermore, the high-dimensional fusion features are fed into the constructed old-class threat distribution replay module, and the statistical feature parameters of the learned classes are extracted and saved based on the multivariate Gaussian distribution. In the incremental stage, multivariate Gaussian pseudo-samples of the old classes are generated for replay, including the following steps:

[0033] Extract the empirical mean of various threat features in the global space from the high-dimensional fusion features. Covariance Matrix Furthermore, a diagonal regularization term is introduced into the calculation of the covariance matrix. To alleviate rank deficiency or nondefinite problems; the obtained statistical parameters Store in the statistical memory;

[0034] When the model enters the incremental phase facing the threat of novel small samples, the system generates multivariate Gaussian pseudo-samples with historical distribution characteristics based on the saved statistical parameters. ;

[0035] The generated multivariate Gaussian pseudo-samples are replayed and fixed in a standardized input layer with fixed dimensions, and then jointly input into the model with the new class real samples of the current batch for forward propagation.

[0036] Furthermore, the threat characteristics The standard feature vector set is:

[0037]

[0038] in Indicates the first The input layer feature vector of each sample, and the multivariate Gaussian distribution parameter estimate for this category are:

[0039]

[0040]

[0041] in, This represents the empirical mean of threat features in the global space. Let covariance matrix be the variance matrix. For diagonal regular terms, The total number of samples in this category. This is the matrix transpose operator.

[0042] Furthermore, during the incremental training phase, joint optimization is performed on real samples of the new class and multivariate Gaussian pseudo samples of the old class. This involves combining cross-entropy classification loss, knowledge distillation loss, and a sparsity penalty term to collaboratively update model parameters and achieve dynamic compression of extended nodes. This includes the following steps:

[0043] Before each new incremental training phase begins, a deep copy of the previous phase model is made to build a parameter-frozen teacher model.

[0044] During the forward propagation phase, for training batches that mix real samples from the new class with pseudo-Gaussian samples from the old class, unnormalized logical outputs are generated synchronously using the teacher model and the current new model. Furthermore, a knowledge distillation loss with a temperature coefficient is calculated within the historical old class dimension. In order to maintain the smooth evolution of the topological relationships in the feature space;

[0045] Apply an L1-norm-based sparse penalty term to the node indicator vector of the dynamic branch expansion module. ;

[0046] By superimposing cross-entropy classification loss Knowledge distillation loss and sparse penalty items Constitutes the overall joint loss function This drives the updating and self-pruning of model parameters.

[0047] Furthermore, the cross-entropy classification loss The knowledge distillation loss function is calculated jointly based on real incremental small samples and large-scale Gaussian replay pseudo samples at the current stage; the knowledge distillation loss function is calculated only for the old category dimension, and its formula is:

[0048]

[0049] Among them, the temperature coefficient can smooth the output distribution of the Softmax function, and the product factor Used to ensure the stability of the gradient magnitude during backpropagation; includes a temperature coefficient. soft probability distribution and The calculation formula is as follows:

[0050]

[0051]

[0052] in, This indicates that the teacher model is for the first... The unnormalized logic output of each old category; This indicates that the teacher model is for the first... The unnormalized logic output of each old category; This indicates that the current new model is for the first... The unnormalized logic output of each old category; This indicates that the current new model is for the first... The unnormalized logic output of the old categories; the calculation of soft probabilities is limited to the set of historical old categories. Within the dimensional range;

[0053] gating coefficient The sparse penalty term based on the L1 norm was applied as follows:

[0054]

[0055] In the formula, This represents the total number of nodes in the expansion module; The preset target sparsity threshold;

[0056] The overall joint loss function for:

[0057]

[0058] in, These are the weighting coefficients of the knowledge distillation loss function. The weighting coefficients for the sparse penalty term.

[0059] A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the 5G core network incremental small sample threat flow detection method based on dynamic branch expansion.

[0060] The present invention has the following beneficial effects:

[0061] This invention constructs an incremental small-sample threat flow detection mechanism for 5G core networks. Through an adaptive feature capacity expansion mechanism, it progressively supplements new category discrimination information, effectively avoiding feature space congestion and representation collapse in fixed-capacity networks. The proposed multivariate Gaussian distribution statistical memory playback module completely avoids direct storage of large-scale original network traffic at the edge, compressing storage overhead to an extremely low level while meeting strict data privacy compliance requirements. Combined with an L1 norm-based sparsity constraint mechanism, this invention achieves continuous adaptive pruning of feature nodes while the model dynamically grows, forcing redundant weights to approach zero, ensuring the lightweight nature of the edge inference model, and significantly reducing the risk of overfitting under extremely small sample conditions. The multi-objective joint optimization framework constructed in this invention aligns the soft label distribution of new and old models on historical tasks through knowledge distillation, effectively anchoring the topological stability of the global feature space. Thus, driven by a small number of new class samples, it achieves efficient collaborative learning and smooth transition between new and old attack knowledge. Attached Figure Description

[0062] Figure 1 This is a diagram illustrating the overall framework of the incremental small-sample threat flow detection model based on dynamic branch expansion proposed in this invention.

[0063] Figure 2 This is a flowchart of the data preprocessing process in an embodiment of the present invention;

[0064] Figure 3 This is a topology diagram of the dynamic branch expansion and soft attention gating fusion structure in an embodiment of the present invention;

[0065] Figure 4 A graph showing the incremental forgetting rate results for the 5G-NIDD dataset at different incremental stages;

[0066] Figure 5 The graph shows the incremental forgetting rate results for the 5GC Network Threat dataset at different incremental stages;

[0067] Figure 6 The image shows the experimental results of the confusion matrix on the 5G-NIDD dataset;

[0068] Figure 7 The image shows the experimental results of the confusion matrix on the 5GC Network Threat dataset;

[0069] Figure 8 This is a heatmap of the activation states of each hidden layer node in the extended module under different training rounds. Detailed Implementation

[0070] The present invention will be further described below with reference to the accompanying drawings. The embodiments of the present invention are only used to illustrate the present invention and not to limit the present invention. Various substitutions and modifications made based on ordinary technical knowledge and common practices in the art without departing from the technical concept of the present invention should be included within the scope of the present invention.

[0071] To overcome the above-mentioned defects, such as Figure 1 As shown, this invention proposes a method for incremental small-sample threat flow detection in 5G core networks based on dynamic branch expansion, comprising the following steps:

[0072] Obtain raw traffic data, preprocess it, and construct a basic class set and a new attack class set to divide the incremental learning task stages;

[0073] A dynamic branch extension module containing a core extractor and extension branches is constructed; the basic class set and the new attack class set are fed into the dynamic branch extension module, the core extractor is used to retain the basic features, and the extension branches are adaptively instantiated to supplement the new category features. The high-dimensional fusion features are fused and output through a soft attention gating mechanism.

[0074] The high-dimensional fusion features are fed into the constructed old-class threat distribution replay module. The statistical feature parameters of the learned classes are extracted and saved based on the multivariate Gaussian distribution. In the incremental stage, multivariate Gaussian pseudo-samples of the old classes are generated for replay.

[0075] In the incremental training phase, joint optimization is performed on real samples of new classes and multivariate Gaussian pseudo samples of old classes. The model parameters are updated collaboratively by combining cross-entropy classification loss, knowledge distillation loss and sparsity penalty term, and dynamic compression of extended nodes is achieved.

[0076] The optimized model is used to detect the traffic data to be tested.

[0077] Figure 1 This diagram illustrates the overall framework of the incremental small-sample threat flow detection model based on dynamic branch expansion proposed in this invention. It fully demonstrates the complete information interaction and data flow process, from the initial heterogeneous traffic input, feature data normalization preprocessing, adaptive dynamic branch growth based on network topology, recall and playback of the spatial statistical distribution of old threat types, to the final multi-objective joint loss optimization and pruning. The diagram shows that when facing continuously evolving network threats, the system can achieve a smooth transition between old and new knowledge under the strict boundary of not storing historical plaintext traffic, through the coordinated operation of horizontal expansion and parameterized memory.

[0078] The specific steps are as follows.

[0079] S1: Perform data preprocessing on the raw traffic data to construct a basic class set and a new attack class set, in order to divide the incremental learning task stages.

[0080] Figure 2 This is a flowchart of the data preprocessing process in an embodiment of the present invention, illustrating the specific steps from invalid feature filtering, missing value handling, long-tail truncated encoding to Z-Score normalization.

[0081] like Figure 2 As shown, the entire preprocessing consists of two stages: data cleaning and dataset partitioning. The data cleaning part includes the following components:

[0082] (1) Remove invalid features

[0083] Before feature preprocessing, the identity time feature set, including timestamps and endpoint identifiers SrcAddr, DstAddr, Sport, and Dport, is stripped away, along with the label leakage feature set containing prior expert rules. This forces the model to extract attack patterns from deep statistical features such as packet length and arrival intervals. Here, SrcAddr represents the source address, DstAddr represents the destination address, Sport represents the source port, and Dport represents the destination port.

[0084] (2) Missing feature imputation

[0085] Real-world edge traffic suffers from packet loss and parsing errors, so the model sets a threshold for missing values. Feature dimensions with a missing rate exceeding this threshold are removed to prevent the introduction of excessive noise. For retained features, a two-track filling strategy is used: numerical features are filled with the median, while categorical features are uniformly filled with constant labels.

[0086] (3) Encoding mapping

[0087] For discrete symbolic features in traffic feature sets, directly using one-hot encoding would lead to a combinatorial explosion of feature dimensions. Therefore, frequency statistics are first performed on categorical variables, and a low cardinality truncation strategy is adopted to retain only the core categories with the highest frequency, while the remaining long-tail categories are uniformly grouped into "others," and then one-hot encoding is performed.

[0088] (4) Normalization

[0089] Considering the significant differences in statistical magnitudes across different network layer protocols, traditional extreme value normalization methods are susceptible to outliers. Therefore, this method introduces Z-Score Gaussian normalization to smoothly scale the global numerical distribution. Assume that the value of a certain dimension in the original feature vector is... The empirical mean of this dimension over the entire training set is The standard deviation is Then the normalized eigenvalues The calculation formula is as follows:

[0090]

[0091] Through this transformation, each continuous feature is converted to a standardized scale with zero mean and unit variance in the statistical sense of the training set, thereby reducing the impact of differences in the dimensions of different features on model training.

[0092] After feature cleaning and tensor quantization, the global dataset needs to be specifically partitioned and task-constructed according to the dataset construction format for few-shot incremental learning. The entire dataset is isolated into a set of basic classes. With a new set of attack types with scarce samples Both should satisfy:

[0093]

[0094] Among them, the basic class collection It covers common background traffic and known basic attacks that have been captured and persisted in the network environment. It also includes a collection of new attack types. This simulates a sudden, advanced persistent threat in an edge scenario, where data on such attacks is usually very scarce.

[0095] The model's lifecycle is divided into a basic learning phase, Session 0 and... A continuous incremental learning phase Session The data stream sequence is as follows:

[0096]

[0097] in, This represents the initial full dataset constructed using the basic class set, used to shape the initial high-dimensional feature space and classification decision boundary of the model; This represents a new type of attack to be addressed in any subsequent incremental phase.

[0098] S2: Construct a dynamic branch extension module, retain basic features using the core extractor, and adaptively instantiate extension branches to supplement new category features. Then, use a soft attention gating mechanism to fuse and output high-dimensional fused features.

[0099] Figure 3This is a topology diagram of the dynamic branch expansion and soft attention gating fusion structure in an embodiment of the present invention. The diagram illustrates the parallel architecture between the core feature extractor branch responsible for solidifying the general mechanism and the linear expansion branch branch responsible for adaptive instantiation, as well as the subsequent cascaded soft attention gating self-compression filtering mechanism. The diagram shows that when the network encounters a small number of novel threat samples, it can accurately capture their specific discriminative features through adaptive expansion branches without overwriting old weights. Simultaneously, by utilizing a gating mechanism with scaling factors to perform dimension-wise saliency recalibration and compression of the expanded features, the network's representation capacity can be smoothly expanded while the uncontrolled expansion of parameters is curbed from a topological perspective.

[0100] The specific steps are as follows:

[0101] like Figure 1 As shown, let the intermediate hidden feature vector after the initial mapping of the underlying network be... .like Figure 3 As shown, this feature is first fed into both the core extractor and the expansion branch simultaneously. The core extractor consists of basic linear layers used to extract stable basic features shared by the task, and its output is:

[0102]

[0103] in, This represents the mapping function of the core extractor. This submodule mainly retains the common discrimination information learned in historical tasks, providing stable basic feature support for subsequent incremental stages.

[0104] When the model enters a new incremental learning phase, to adapt to the feature representation requirements of the newly added threat categories, the network adaptively instantiates new linear expansion branches in parallel. The input and output dimensions of each expansion branch are consistent with the core extractor, and it is used to learn the supplementary discriminative features required for the new categories in the current incremental task. The following equation is the... Output of each extended branch:

[0105]

[0106] in, Indicates the first The mapping function for each extension branch. Unlike directly widening the hidden layers, this paper uses an incremental instantiation method for extension branches to progressively supplement the network representation capacity, thereby avoiding overall perturbation to the original backbone structure.

[0107] However, directly superimposing or splicing the features extracted from the newly added branches with the main features can easily disrupt the existing feature topology and may lead to redundant expansion and overfitting under extremely small sample conditions. Therefore, this invention introduces a soft attention gating and compression mechanism after expanding the branches to adaptively filter and recalibrate the expanded features. Among these... The gating coefficients for each extended branch are defined as follows:

[0108]

[0109] in, This represents the Sigmoid activation function; Temperature hyperparameters for controlling gating strength. Gating vector. It acts as a soft attention weight, used to compress and screen the significance of extended features element by element, so that the new dimensions with strong discriminative power participate in the fusion with higher weights, while the dimensions with weaker contributions or greater noise are suppressed, thereby controlling the network expansion speed and reducing the risk of overfitting.

[0110] After obtaining the gating coefficients, the extended features are gated and modulated, then fused with the basic features to form a high-dimensional fused feature representation. If the current incremental stage has accumulated... If there are several extended branches, then the fused features are:

[0111]

[0112] in, This represents element-wise multiplication. Instead of unconstrained superposition of newly added features, it utilizes soft attention gating to modulate the saliency of each extended branch, then integrates it into the basic feature space as a residual. This method maintains the stability of the basic representation while continuously injecting controllable incremental discriminative information into new categories, thereby alleviating the feature crowding and representation collapse problems caused by the saturation of the fixed feature space during incremental learning.

[0113] S3: Construct a module for replaying the distribution of old threat categories. Extract and save the statistical feature parameters of the learned categories based on the multivariate Gaussian distribution, and generate pseudo-samples of old categories for replay during the incremental stage.

[0114] like Figure 1 As shown, at the end of each learning cycle, the model does not save specific feature vectors, but instead extracts the empirical mean and covariance matrix of various threat features in the global space. Threat Categories The standard feature vector set is:

[0115]

[0116] in Indicates the first Given the input layer feature vectors of each sample, the multivariate Gaussian distribution parameters of that category are estimated as follows:

[0117]

[0118]

[0119] in, This represents the empirical mean of threat features in the global space. Let covariance matrix be the variance matrix. For diagonal regular terms, The total number of samples in this category. This is the matrix transpose operator. To mitigate the potential rank deficiency or non-positive definiteness of the covariance matrix under extremely small sample conditions, a diagonal regularization term is introduced during computation. Full covariance modeling can accurately describe the complex correlations between different traffic feature dimensions, thus preserving more complete feature structure information.

[0120] When the model enters a new incremental phase and faces the threat of novel small samples, the following formula represents the system's response based on the saved statistical parameters. Generate multivariate Gaussian pseudo-samples with historical distribution characteristics:

[0121]

[0122] In traditional latent space replay methods, the hidden layer feature capacity of the model is in a state of dynamic expansion, which easily leads to dimensional misalignment and semantic decoupling between the old class statistical features and the new network feature space. Therefore, this paper's method fixes the multivariate Gaussian pseudo-sample replay on a standardized input layer with fixed dimensions. Because the generated multivariate Gaussian pseudo-samples... Having the same original feature dimension space as real traffic samples, they can be directly mixed into the current batch for forward propagation. This design not only avoids the dimension filling overhead caused by on-demand network expansion, but also ensures the consistency of old and new category samples in forward inference.

[0123] S4: Joint optimization is performed during the incremental training phase, combining cross-entropy classification loss, knowledge distillation loss, and sparsity penalty term to collaboratively update model parameters and achieve dynamic compression of extended nodes.

[0124] Before each new incremental training phase begins, the system performs a deep copy of the model trained in the previous phase to construct a teacher model with completely frozen parameters. During the forward propagation phase of joint training, for training batches consisting of a mixture of real samples from the new class and Gaussian pseudo-samples from the old class, the currently dynamically evolving new model and the frozen teacher model will synchronously generate corresponding Logits outputs.

[0125] Assumption and These represent the unnormalized logical outputs of the teacher model and the current new model, respectively. Since the teacher model only contains prior knowledge of historical categories, to avoid dimensionality mismatch, the calculation of soft probabilities is limited to the set of historical categories. Within the dimensional range. Includes a temperature coefficient. soft probability distribution and The calculation formula is as follows:

[0126]

[0127]

[0128] The knowledge distillation loss function is calculated only for the old category dimension, and its formula is as follows:

[0129]

[0130] Among them, temperature coefficient It can smooth the output distribution of the Softmax function, enabling the model to learn not only absolute class labels but also the probability distribution relationships between different classes that are not the target class. (Product factor) This constraint, which performs soft label matching along the aligned dimension, is used to ensure the stability of the gradient magnitude during backpropagation. It prevents severe shifts in the feature manifold structure, enabling the model to smoothly transition when incorporating new feature spaces.

[0131] In the feature capacity adaptive expansion mechanism described above, the network dynamically grows lightweight branches to accommodate novel threat features. However, if the model expands without restraint, it will not only lead to a surge in the number of parameters but also exacerbate the risk of overfitting to new types of samples under extremely small sample conditions. To curb the expansion trend caused by dynamic network expansion, this method uses a gating coefficient in the jointly optimized loss function. A sparsity penalty term based on the L1 norm was applied:

[0132]

[0133] In the formula, This represents the total number of nodes in the expansion module; The target sparsity threshold is set. This function calculates the mean L1 norm of all activation weights in the current batch. When the overall activation rate exceeds the threshold, a linear penalty gradient is generated. This sparsity constraint mechanism plays a continuous network pruning role during backpropagation. Based on the contribution of features, it continuously forces the activation weights of redundant expansion nodes to approach zero, ensuring that the feature extractor remains highly compact while introducing new knowledge.

[0134] To coordinate new feature learning, dynamic network structure compression, and robust preservation of historical knowledge, this model constructs a joint optimization objective with multi-dimensional constraints. During forward and backward propagation in incremental training cycles, the overall joint loss function consists of three superimposed parts:

[0135]

[0136] in, These are the weighting coefficients of the knowledge distillation loss function. The weighting coefficients for the sparse penalty term.

[0137] Cross-entropy classification loss Based on the joint calculation of real incremental small samples and large-scale Gaussian replay pseudo samples at the current stage, while anchoring the historical category judgment boundary, the network is driven to learn new threat knowledge:

[0138]

[0139] In the formula, This represents the current training batch, which consists of a mixture of the new class of real samples and Gaussian pseudo-samples. This represents the total number of samples in the current training batch. For the sample True category labels or pseudo labels; This is the set of all threat categories that have been identified up to the current stage; This is an indicator function that takes the value 1 when the condition inside the parentheses is true, and 0 otherwise; Indicates the current model's predicted samples Category The probability output.

[0140] Knowledge distillation loss As a soft-label regularization term, it can anchor the stability of the global feature space topology under the premise of no dead ends in parameter updates. Sparse expansion penalty The model is allowed to expand moderately to learn new features, but a strict expansion penalty is imposed, driving the self-pruning of the network structure.

[0141] S5: Use the optimized model to detect the traffic data to be detected and output the detection results.

[0142] A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of a method for detecting incremental small-sample threat flows in a 5G core network based on dynamic branch expansion.

[0143] Simulation experiment:

[0144] Figure 4The figure shows the incremental forgetting rate results for the 5G-NIDD dataset at different incremental stages. This figure illustrates the forgetting rate changes of each model at different incremental stages, reflecting performance changes during continuous learning. As a baseline model without an anti-forgetting mechanism, Ft-CNN exhibits a rapid increase in forgetting rate after the first incremental task, demonstrating significant catastrophic forgetting. PN-ER, which incorporates empirical replay, initially mitigates performance degradation, but its forgetting rate continues to rise as new categories are added, indicating that relying solely on a small number of real sample replays makes it difficult to maintain the stability of old class boundaries in a high-dimensional feature space over the long term. In contrast, this invention maintains a low forgetting rate throughout the entire incremental process, with a relatively smooth curve change. With only 5 samples, its performance fluctuation in the later stages of incremental learning is less than that of SPIDER, which relies on unlabeled semi-supervised data, indicating that the proposed method has a better inhibitory effect on overfitting during multi-stage learning.

[0145] Figure 5 The graph shows the incremental forgetting rate results for the 5GC Network Threat dataset at different incremental stages. The SPIDER method shows a significant increase in slope after Session 3, while this invention maintains a stable evolution. The performance of the SPIDER model in the later stages of incremental processing relies on a large amount of unlabeled or weakly labeled data, while this invention only relies on 5 real labeled samples. This robustness under data constraints indicates that this method has better feature extraction and preservation capabilities for sparse features.

[0146] Figure 6 The figure shows the experimental results of the confusion matrix on the 5G-NIDD dataset. This figure demonstrates that the present invention achieves a high recognition rate for most categories. Specifically, the recognition rates for categories 2, 3, and 7 are all 95.0%, while category 5 reaches 98.0%. This indicates that in the final incremental stage, the present invention still has a good ability to preserve the feature representations of most learned categories. However, some misclassifications still exist between a few categories. These misclassifications are mainly concentrated between a few closely related categories, rather than misclassifying them as normal traffic categories. This shows that the present invention generally retains a relatively clear category structure; however, fine-grained differentiation remains somewhat difficult between some threat categories due to similar traffic behavior patterns or statistical characteristics.

[0147] Figure 7 The figure shows the experimental results of the confusion matrix on the 5GC Network Threat dataset. This figure demonstrates that the proposed method maintains good overall classification performance. Specifically, the recognition rates for classes 1, 2, and 3 are 96.2%, 93.5%, and 89.8%, respectively, while those for classes 4 and 5 are 85.3% and 82.1%, respectively, indicating that the model has good recognition ability for the learned threat categories. This demonstrates that the proposed method effectively balances new knowledge learning with the retention of old knowledge during incremental learning.

[0148] Figure 8 This is a heatmap showing the activation states of hidden layer nodes in the extended module at different training epochs. The figure illustrates that in the early stages of training, to adapt to new category features, many nodes in the network are in a highly activated state, represented by large bright areas in the heatmap. As training progresses and the L1 sparsity constraint continues to apply, node activation gradually shrinks, and the heatmap shows a clear sparsity trend. After 150 epochs of training, the activation weights of most nodes have been compressed, retaining only a small number of key nodes with high activation levels. This result indicates that sparsity constraints can, to some extent, suppress the continuous activation of redundant nodes in the extended network, enabling this invention to introduce new category representation capabilities while avoiding ineffective parameter growth. By retaining a small number of highly discriminative nodes, the extended module can complete feature representation with lower structural overhead, which is significant for model deployment in resource-constrained scenarios. Furthermore, with only 5 samples, sparse representation also helps to reduce the model's overfitting to local noise and random patterns, thereby improving the model's generalization ability to new categories and potential variant attacks.

[0149] As can be seen from the above, the present invention is significantly superior to the existing benchmark scheme in terms of improving the accuracy of multi-stage incremental detection and reducing the incremental forgetting rate. It also has a good suppression effect on overfitting during multi-stage learning, and has better feature extraction and preservation capabilities for sparse features. While taking into account both new knowledge learning and old knowledge preservation, it can also improve the model's generalization ability to new categories and potential variant attacks, which has significant advantages.

[0150] This invention presents an incremental small-sample threat flow detection method for 5G core networks based on dynamic branch expansion. This method achieves continuous learning of new threat categories without preserving historical raw traffic by adaptively expanding the feature space and constructing a feature statistical replay mechanism based on a multivariate Gaussian distribution, effectively mitigating the catastrophic forgetting problem. Addressing the characteristics of continuously evolving new threats and the scarcity of early labeled samples in 5G core network scenarios, this invention constructs an adaptive feature capacity expansion mechanism to generate relatively independent feature subspaces for new categories, and utilizes soft attention gating and sparse regularization to suppress redundant nodes. Regarding historical knowledge preservation, this invention designs a statistical memory replay module that does not require preserving plaintext traffic, extracting and preserving the multivariate Gaussian distribution statistical parameters of learned categories, ensuring effective distribution replay by generating pseudo-samples of old categories during incremental training. Simultaneously, this invention constructs a multi-objective joint optimization framework by fusing cross-entropy classification loss, L1-norm-based sparse penalty terms, and knowledge distillation techniques for old categories, achieving the coordinated evolution of new and old feature spaces and dynamic adaptive compression of network topology.

[0151] This invention overcomes the shortcomings of existing detection models, such as catastrophic forgetting, overfitting under extremely small samples, and high storage overhead of edge gateways due to the reliance on storing historical original data. It alleviates the conflict between the feature space of new and old categories by using an adaptive feature capacity expansion mechanism, maintains the historical old category distribution information by using multivariate Gaussian distribution feature playback, and combines a multi-objective joint optimization framework to effectively improve the continuous learning capability of dynamic threat detection in 5G core networks without retaining the original network traffic.

[0152] The above description describes specific embodiments of the present invention and the technical principles employed. Any changes made in accordance with the concept of the present invention that do not exceed the spirit of the specification and drawings should still fall within the protection scope of the present invention.

Claims

1. A method for incremental small-sample threat flow detection in 5G core network based on dynamic branch expansion, characterized in that, Includes the following steps: Obtain raw traffic data, preprocess it, and construct a basic class set and a new attack class set to divide the incremental learning task stages; Build a dynamic branching extension module that includes a core extractor and extended branches; The basic class set and the novel attack class set are fed into the dynamic branch expansion module. The core extractor retains the basic features, and the expansion branch is adaptively instantiated to supplement the new category features. The high-dimensional fusion features are fused and output through a soft attention gating mechanism. The high-dimensional fusion features are fed into the constructed old-class threat distribution replay module. The statistical feature parameters of the learned classes are extracted and saved based on the multivariate Gaussian distribution. In the incremental stage, multivariate Gaussian pseudo-samples of the old classes are generated for replay. In the incremental training phase, joint optimization is performed on real samples of new classes and multivariate Gaussian pseudo samples of old classes. The model parameters are updated collaboratively by combining cross-entropy classification loss, knowledge distillation loss and sparsity penalty term, and dynamic compression of extended nodes is achieved. The optimized model is used to detect the traffic data to be tested.

2. The 5G core network incremental small-sample threat flow detection method based on dynamic branch expansion according to claim 1, characterized in that, The process involves acquiring raw traffic data, preprocessing it, and constructing a basic set of attack classes and a new set of attack classes, including the following steps: The raw traffic data is filtered for invalid features, and features containing timestamps, endpoint identifiers, and leaked tags are removed. Missing values ​​are handled by removing feature dimensions with a missing rate exceeding a set threshold, and the numerical and categorical features among the retained features are filled with median and constant labels respectively. Long-tail truncation and encoding are performed, and a low cardinality truncation strategy and one-hot encoding are applied to discrete symbolic features. The Z-Score Gaussian normalization is introduced to smoothly scale the numerical distribution, as shown in the formula. ; where the value of a certain dimension in the original feature vector is The empirical mean of this dimension over the entire training set is The standard deviation is ; The cleaned dataset is isolated into a basic class set. A new set of attack types with scarce samples Both conditions are met: Among them, the basic class set The new attack class set encompasses common background traffic and known basic attacks that have been captured and persisted in the network environment over a long period. Simulate sudden, advanced persistent threats in edge scenarios; The model's lifecycle is divided into a basic learning phase, Session 0 and... A continuous incremental learning phase Session The data stream sequence is as follows: in, This represents the initial full dataset constructed using the basic class set, used to shape the initial high-dimensional feature space and classification decision boundary of the model; This represents a new type of attack to be addressed in any subsequent incremental phase.

3. The 5G core network incremental small-sample threat flow detection method based on dynamic branch expansion according to claim 1, characterized in that, The input and output dimensions of each of the extended branches are consistent with those of the core extractor; the dynamic branch extension module adopts an incremental instantiation method for the extended branches to progressively supplement the network representation capacity, thereby avoiding overall disturbance to the original backbone structure.

4. The incremental small-sample threat flow detection method for 5G core network based on dynamic branch expansion according to claim 1 or 3, characterized in that, The high-dimensional fusion features are fed into the constructed old-class threat distribution replay module. Statistical feature parameters of the learned classes are extracted and saved based on a multivariate Gaussian distribution. In the incremental stage, multivariate Gaussian pseudo-samples of the old classes are generated for replay, including the following steps: The intermediate hidden feature vector obtained after the basic class set and the novel attack class set are initially mapped by the underlying network. Simultaneously feed into the core extractor and the extended branch; The core extractor extracts stable basic features shared by the task through a basic linear layer. ; In the new incremental phase, the network adaptively instantiates new linear expansion branches with consistent input and output dimensions in parallel to extract supplementary discriminative features. Furthermore, a soft attention gating and compression mechanism is introduced after the extended branch, using the activation function to generate gating coefficients. The extracted supplementary discriminant features are compressed element by element and saliency screened to obtain extended features that have been gated and modulated. The gated and modulated extended features are incorporated into the stable basic features in the form of residuals to generate a high-dimensional fused feature representation: in, This represents element-wise multiplication. This represents the Sigmoid activation function; Temperature hyperparameters for controlling gating intensity; To expand the number of branches.

5. The 5G core network incremental small-sample threat flow detection method based on dynamic branch expansion according to claim 1, characterized in that, The high-dimensional fusion features are fed into the constructed old-class threat distribution replay module. Statistical feature parameters of the learned classes are extracted and saved based on a multivariate Gaussian distribution. In the incremental stage, multivariate Gaussian pseudo-samples of the old classes are generated for replay, including the following steps: Extract the empirical mean of various threat features in the global space from the high-dimensional fusion features. Covariance Matrix Furthermore, a diagonal regularization term is introduced into the calculation of the covariance matrix. To alleviate rank deficiency or nondefinite problems; the obtained statistical parameters Store in the statistical memory; When the model enters the incremental phase facing the threat of novel small samples, the system generates multivariate Gaussian pseudo-samples with historical distribution characteristics based on the saved statistical parameters. ; The generated multivariate Gaussian pseudo-samples are replayed and fixed in a standardized input layer with fixed dimensions, and then jointly input into the model with the new class real samples of the current batch for forward propagation.

6. The 5G core network incremental small-sample threat flow detection method based on dynamic branch expansion according to claim 5, characterized in that, The threat characteristics The standard feature vector set is: in Indicates the first The input layer feature vector of each sample, and the multivariate Gaussian distribution parameter estimate for this category are: in, This represents the empirical mean of threat features in the global space. Let covariance matrix be the variance matrix. For diagonal regular terms, The total number of samples in this category. This is the matrix transpose operator.

7. The 5G core network incremental small-sample threat flow detection method based on dynamic branch expansion according to claim 1, characterized in that, In the incremental training phase, joint optimization is performed on real samples of the new class and multivariate Gaussian pseudo samples of the old class. By combining cross-entropy classification loss, knowledge distillation loss and sparsity penalty term, the model parameters are updated collaboratively and the dynamic compression of the expanded nodes is achieved. The steps include: Before each new incremental training phase begins, a deep copy of the previous phase model is made to build a parameter-frozen teacher model. During the forward propagation phase, for training batches that mix real samples from the new class with pseudo-Gaussian samples from the old class, unnormalized logical outputs are generated synchronously using the teacher model and the current new model. Furthermore, a knowledge distillation loss with a temperature coefficient is calculated within the historical old class dimension. In order to maintain the smooth evolution of the topological relationships in the feature space; Apply an L1-norm-based sparse penalty term to the node indicator vector of the dynamic branch expansion module. ; By adding cross-entropy classification loss Knowledge distillation loss and sparse penalty items Constitutes the overall joint loss function This drives the updating and self-pruning of model parameters.

8. The 5G core network incremental small-sample threat flow detection method based on dynamic branch expansion according to claim 7, characterized in that, The cross-entropy classification loss The knowledge distillation loss function is calculated jointly based on real incremental small samples and large-scale Gaussian replay pseudo samples at the current stage; the knowledge distillation loss function is calculated only for the old category dimension, and its formula is: Among them, temperature coefficient It can smooth the output distribution of the Softmax function, product factor Used to ensure the stability of the gradient magnitude during backpropagation; includes a temperature coefficient. soft probability distribution and The calculation formula is as follows: in, This indicates that the teacher model is for the first... The unnormalized logic output of each old category; This indicates that the teacher model is for the first... The unnormalized logic output of each old category; This indicates that the current new model is for the first... The unnormalized logic output of each old category; This indicates that the current new model is for the first... The unnormalized logic output of the old categories; the calculation of soft probabilities is limited to the set of historical old categories. Within the dimensional range; gating coefficient The sparse penalty term based on the L1 norm was applied as follows: In the formula, This represents the total number of nodes in the expansion module; The target sparsity threshold is set. The overall joint loss function for: in, These are the weighting coefficients of the knowledge distillation loss function. The weighting coefficients for the sparse penalty term.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the 5G core network incremental small sample threat flow detection method based on dynamic branch expansion as described in any one of claims 1 to 8.

Images