Deep learning based network anomaly traffic identification and intrusion detection method

Abstract

This invention relates to a deep learning-based method for identifying abnormal network traffic and detecting intrusions, belonging to the field of network security detection technology. The method includes: collecting network traffic; generating traffic training segments according to packet arrival order, packet direction, payload length, connection status, and request-response interval; inputting these segments into a deep learning network to obtain anomaly identification output, anomaly identification score, and feature response region; extracting a baseline segment from normal network traffic of the same service type and access direction that has not generated anomaly identification output; replacing local packet segments in the traffic training segments with the baseline segment; adjusting the training contribution weight of the local packet segments based on changes in anomaly score, output type, and feature response region position before and after replacement; updating the deep learning network; using the updated network to identify the network traffic to be detected; and outputting an intrusion detection result containing intrusion trigger segments, thereby improving the accuracy of trigger segment location and the relevance of model training.

Description

Technical Field

[0001] This invention relates to the field of network security detection technology, specifically a method for identifying abnormal network traffic and detecting intrusions based on deep learning. Background Technology

[0002] In existing technologies, network anomaly traffic identification and intrusion detection largely rely on deep learning networks to extract features, fuse and classify traffic, or calculate outliers. In recent years, Chinese patent document CN116506210A disclosed a network intrusion detection method and system based on traffic feature fusion. This method acquires the network traffic to be detected, preprocesses it, and inputs it into a trained network intrusion detection model. A parallel model then extracts first and second feature data, followed by feature fusion and classification to obtain the network intrusion detection result. The solution also points out that existing deep learning intrusion detection models suffer from problems such as a single structure, difficulty in considering features of different data types, insufficient extraction of long-term dependencies, and limited global feature extraction capabilities.

[0003] CN116933195A discloses a method and apparatus for detecting encrypted traffic anomalies based on deep learning. It captures and segments network traffic to generate a training dataset, trains it using a variational autoencoder model combined with Transformer Encoder, segments the captured network packets in real time, and calculates traffic anomaly values ​​to determine whether the real-time traffic is abnormal. The scheme also uses a predetermined number of consecutive network packets or a complete TCP session as the segmentation unit, and retains information such as IP header, TCP bytes, and arrival time in the preprocessing.

[0004] The existing technologies mentioned above can detect network traffic anomalies through deep learning, feature fusion, session segmentation, or outlier thresholding. However, their focus is usually on building model structures, expanding the range of feature inputs, or improving classification accuracy. After the anomaly identification output is generated, they lack fine-grained verification mechanisms for specific local packet segments that triggered the anomaly, whether that local packet segment still has anomaly migration capabilities within normal traffic of the same service, and how to differentiate the contribution weights of different local packet segments during training updates. These mechanisms address issues such as packet order, access direction, connection status, and request-response intervals. When facing covert intrusions, cross-session anomalies, local load disturbances, or attack packets similar to normal services, existing methods tend to only provide an overall anomaly category or probability, making it difficult to reliably trace the identification results back to an interpretable intrusion trigger segment. This affects the accuracy of subsequent model training, alarm localization, and intrusion handling. Therefore, it is necessary to provide a network anomaly traffic identification and intrusion detection method that can combine normal service baseline segment replacement verification, anomaly score changes, anomaly type changes, and feature response region location changes to adjust the training contribution of local packet segments and output network anomaly traffic identification and intrusion detection methods that include intrusion trigger segments. Summary of the Invention

[0005] The purpose of this invention is to provide a method for identifying abnormal network traffic and detecting intrusions based on deep learning, thereby addressing some of the shortcomings and deficiencies pointed out in the background art.

[0006] The present invention adopts the following technical solution to solve the above-mentioned technical problems: Network traffic is collected, and traffic training segments are generated according to packet arrival order, packet direction, payload length, connection status, and request-response interval. These traffic training segments are input into a deep learning network to obtain anomaly identification output, anomaly identification score, and corresponding feature response regions. A benchmark segment for the same service is extracted from normal network traffic that meets the same service type and access direction and does not generate anomaly identification output. This benchmark segment replaces a local packet segment in the traffic training segments to obtain a replaced training segment, which is then input into the deep learning network. Based on changes in anomaly identification score, anomaly identification output type, and feature response region position before and after replacement, the training contribution weights corresponding to the local packet segments are adjusted. The deep learning network is updated based on the adjusted training contribution weights. The updated deep learning network is then used to identify the network traffic to be detected and output an intrusion detection result containing intrusion trigger segments.

[0007] Furthermore, before replacing the local segment with the same service benchmark segment, each local segment in the traffic training segment is replaced sequentially according to the order of message arrival, and the change in anomaly identification score and the fallback position of the feature response region are read after each replacement; when the anomaly identification output of the same type as before is retained after the replacement of the previous local segment, and the anomaly identification output of the same type as before is not retained after the replacement of the next local segment, the contiguous area composed of continuous local segments between the two is taken as the candidate range of intrusion trigger segment.

[0008] Furthermore, when extracting the benchmark segment for the same service, normal network traffic is input into the deep learning network, the packet position of its feature response region is read, and a normal network traffic segment whose feature response region corresponds to the position of the local packet segment and which does not produce abnormal identification output is selected as the benchmark segment for the same service.

[0009] Furthermore, when adjusting the training contribution weight, the local message segment is first replaced with the benchmark segment of the same service, and then the local message segment is implanted into the corresponding position of the benchmark segment of the same service. When the former causes the anomaly identification score to drop below a preset weakening threshold, and the latter causes the benchmark segment of the same service to produce anomaly identification output of the same type as the anomaly identification output before replacement, the training contribution weight of the local message segment is increased.

[0010] Furthermore, after using the continuation region as a candidate range for intrusion triggering segments, the local message segments are alternately reduced along the beginning and end of the continuation region, and the change in the anomaly identification score is read after each reduction; when the reduction at either end causes the anomaly identification output of the same type as before the replacement to disappear, the local message segment corresponding to that end is restored, and the restored continuation region is used as an intrusion triggering segment.

[0011] Furthermore, when reading the fallback position of the feature response region, the entry direction of the fallback position relative to the continuation region is recorded simultaneously; when the fallback position enters the continuation region from the side of the next local segment and does not cross the boundary of the side of the previous local segment, the continuation region is marked as a candidate range for subsequent successor intrusion triggering segments.

[0012] Furthermore, when multiple continuation regions exist, the order in which the anomaly identification output disappears and the fallback position of the feature response region corresponding to each continuation region are compared; the continuation region whose anomaly identification output disappears before other continuation regions, and whose message sequence number distance between the fallback position of the feature response region and the boundary of the corresponding continuation region is smaller than that of other continuation regions, is selected as the candidate range of intrusion trigger segments that are given priority to participate in the adjustment of training contribution weights.

[0013] Furthermore, after the local segment is implanted into the corresponding position of the same service reference segment, the feature response area when the same service reference segment generates an anomaly identification output of the same type as the anomaly identification output before replacement is read; when the feature response area moves back to the implantation position of the local segment and is consistent with the position of the feature response area in the traffic training segment before replacement, the local segment is marked as a migrateable intrusion trigger segment.

[0014] Furthermore, after increasing the training contribution weight of the local segment, a normal network traffic segment with a different service type but the same access direction as the baseline segment of the same service is selected for secondary implantation; when no abnormal identification output of the same type as the abnormal identification output before replacement is generated after secondary implantation, the increase in the training contribution weight is limited to a preset cross-service verification threshold; when an abnormal identification output of the same type as the abnormal identification output before replacement is still generated after secondary implantation, the local segment is recorded as a cross-service shared intrusion trigger segment.

[0015] Furthermore, before recording the local segment as a cross-service shared intrusion triggering fragment, the feature response region is read when the anomaly identification output of the same type as the anomaly identification output before replacement is generated after the secondary implantation; when the feature response region is moved back to the implantation position of the local segment in normal network traffic segments of different service types, the restriction on the contribution weight of the service type to the training of the local segment is removed, and the cross-service shared intrusion triggering fragment participates in the weight update of the deep learning network.

[0016] After collecting network traffic, this invention generates traffic training segments according to the packet arrival order, packet direction, payload length, connection status, and request-response interval. This allows the input of the deep learning network to no longer only reflect isolated statistical features, but also retain the packet continuation relationship and request-response rhythm within the session, thereby improving the stability of identifying abnormal traffic disguised in normal business processes.

[0017] This invention extracts benchmark segments from normal network traffic of the same service type and access direction that do not generate anomaly identification output, and replaces local packet segments in the traffic training segments with these benchmark segments. This allows changes in anomaly identification scores, anomaly identification output types, and feature response area locations to jointly reflect the true contribution of local packet segments to the anomaly results, avoiding mistraining caused by updating the model solely based on the overall classification results.

[0018] This invention updates the deep learning network based on the adjusted training contribution weights, and uses the updated deep learning network to identify the network traffic to be detected, outputting intrusion detection results containing intrusion trigger segments. This enables the detection results to not only characterize whether there is an anomaly, but also to point to the specific message segment that triggered the anomaly identification, thereby improving the targeting of intrusion localization, subsequent alarm interpretation, and continuous model training. Attached Figure Description

[0019] Figure 1 This is a flowchart of the network abnormal traffic identification and intrusion trigger segment location of the present invention.

[0020] Figure 2 This is a score drop-down diagram of partial message segment sequential replacement in Embodiment 1 of the present invention.

[0021] Figure 3 This is a confirmation diagram of the alternating reduction of the continuation region at the beginning and end in Embodiment 1 of the present invention.

[0022] Figure 4 This is a comparison diagram of priority values ​​of multiple continuation regions in Embodiment 1 of the present invention.

[0023] Figure 5 This is a score confirmation diagram for replacement verification and implantation verification in Embodiment 2 of the present invention.

[0024] Figure 6 This is a decomposition diagram of the training contribution weight adjustment in Embodiment 2 of the present invention.

[0025] Figure 7 This is a stability verification diagram of the cross-service secondary implantation response in Embodiment 2 of the present invention. Detailed Implementation

[0026] As attached Figure 1As shown, in this embodiment, the network abnormal traffic identification and intrusion detection process is performed by a detection server or network security analysis equipment. After the detection server connects to the network link to be analyzed, it continuously collects network traffic and organizes continuous packets according to packet arrival order, packet direction, payload length, connection status, and request-response interval to form a traffic training segment that can reflect a connection process or a service access process. The packet direction is used to distinguish the data transmission relationship between the requesting side and the responding side, the connection status is used to characterize the connection establishment, data exchange, and connection release process, and the request-response interval is used to characterize the temporal correlation between adjacent requests and responses. The start and end boundaries of the traffic training segment can be determined based on the connection establishment packet, connection release packet, service request start packet, service response end packet, or a preset maximum segment length, so that the packets within the same traffic training segment have a continuous session basis or service access basis. Through the above processing, the original network traffic is converted into time-series segment data suitable for deep learning network input.

[0027] After inputting a traffic training segment into a pre-built deep learning network, the deep learning network outputs corresponding anomaly identification output, anomaly identification score, and feature response region. The anomaly identification output characterizes whether the traffic training segment contains abnormal access, malicious requests, abnormal connection persistence, or intrusion behavior, and is output as either an anomaly type or a normal type. The anomaly identification score characterizes the degree of anomaly, and the feature response region characterizes the packet position or packet range that the deep learning network prioritizes in responding to when generating the anomaly identification output. The feature response region can be determined by the packet sequence number, consecutive packet range, or corresponding business stage in the deep learning network that contributes significantly to the anomaly identification score, and the feature response region within the same traffic training segment uses the packet arrival order as the positional benchmark. Subsequently, segments from normal network traffic that satisfy the same business type, the same access direction, and do not produce anomaly type outputs are selected as benchmark segments for the same business. This ensures that the benchmark segments are comparable to the traffic training segments in terms of business semantics and access direction, and avoids errors introduced by differences in business or direction.

[0028] After obtaining a baseline segment for the same business, the local segment in the traffic training segment is replaced with the message content at the corresponding position in the baseline segment to obtain a replaced training segment, which is then input into the deep learning network again. The corresponding position is determined based on at least one of the following: message sequence number, connection state stage, relative order of request and response, and payload length range, so that the replaced content and the local segment have a comparable positional basis within the segment. The local segment can be a single message, multiple consecutive messages, or a segment of messages divided by a preset sliding window. By comparing the changes in anomaly detection score, anomaly detection output type, and feature response region position before and after replacement, the degree of influence of the replaced local segment on the anomaly detection result is determined. When the anomaly detection score decreases, the anomaly detection output type changes, or the feature response region falls back from the original position of the local segment after replacement, it indicates that the local segment has made a high contribution to anomaly detection, and the training contribution weight corresponding to the local segment is adjusted accordingly. Training contribution weights control the intensity of participation of local packet segments in the deep learning network update process. Within the same traffic training segment, the training contribution weights of each local packet segment are differentiated according to their impact on the anomaly detection output. The detection server further updates the deep learning network based on the adjusted training contribution weights, enabling the updated deep learning network to strengthen its response to real intrusion trigger segments and suppress interference from normal business segments on the anomaly detection results during subsequent identification processes. After the update is complete, the network traffic to be detected is input into the updated deep learning network to obtain intrusion detection results. The corresponding intrusion trigger segment is output in the intrusion detection results for subsequent alarm, blocking, source tracing, or policy adjustment.

[0029] Furthermore, before replacing local packet segments with the same service baseline segment, the detection server first sequentially splits the traffic training segments to ensure that each local packet segment maintains the same arrival order as the original packets. The detection server selects local packet segments sequentially according to the packet arrival order and replaces them with the packet content at the corresponding position in the same service baseline segment. After each replacement, the replaced segment is input into the deep learning network to read the change in the anomaly detection score and the fallback position of the feature response region relative to the original response position. The fallback position refers to the packet position after the feature response region shifts or deviates from the original local packet segment relative to the feature response region before replacement. By replacing segments one by one, the critical position from retention to disappearance of the anomaly detection output can be observed, thereby avoiding the misuse of complete service segments as intrusion triggers.

[0030] During the replacement process, if the previous local segment retains the same type of anomaly identification output as before the replacement, while the subsequent local segment does not retain the same type of anomaly identification output, it indicates that the anomaly identification result depends on the continuous message relationship between the two local segments. The detection server uses the contiguous region consisting of continuous local segments between the two as the candidate range for intrusion triggering segments. The contiguous region is not a single message location, but a continuous message interval that can accommodate anomaly characteristics and cause changes in anomaly identification output. Therefore, it can reflect the continuous triggering characteristics of intrusion behavior during request construction, connection maintenance, or payload changes.

[0031] After determining the continuation region, the detection server alternately reduces local packet segments along the beginning and end of the continuation region, rereading the anomaly identification score change after each reduction. When anomaly identification output of the same type as before disappears after reduction from either end, it indicates that the reduced local packet segment at that end still belongs to the packet content necessary to maintain anomaly identification output. The detection server restores the corresponding local packet segment at that end and uses the restored continuation region as the intrusion trigger segment. If anomaly identification output of the same type as before is still retained after reduction from either end, the reduced continuation region is maintained and reduction continues at the other end. By alternating reduction from the beginning and end, the packet range can be narrowed while preserving anomaly triggering capability, making the final intrusion trigger segment closer to the actual trigger location.

[0032] When reading the fallback position of the feature response region, the detection server simultaneously records the entry direction of the fallback position relative to the continuation region. If the fallback position enters the continuation region from the side of the subsequent local segment and does not cross the boundary of the side of the previous local segment, it indicates that the abnormal feature is not formed independently at the beginning of the continuation region, but is formed by the subsequent message inheriting the state of the preceding message. Based on this, the detection server marks the continuation region as a candidate range for subsequent continuation-type intrusion triggering segments, so that the subsequent training contribution weight adjustment can be used to process intrusion triggering segments with temporal continuation relationships.

[0033] When multiple contiguous regions exist within the same traffic training segment, the detection server compares the disappearance order of the anomaly identification output and the fallback position of the feature response region corresponding to each contiguous region. If the anomaly identification output corresponding to a certain contiguous region disappears before other contiguous regions, and the packet sequence number distance between the fallback position of the feature response region and the boundary of the corresponding contiguous region is smaller than that of other contiguous regions, it indicates that there is a more direct triggering relationship between this contiguous region and the anomaly identification result. The detection server uses this contiguous region as a priority candidate range for intrusion triggering segments to participate in the adjustment of training contribution weights, thereby enabling the deep learning network to prioritize the learning of the main triggering segments and reduce the interference of secondary anomaly fluctuations on the weight update process.

[0034] Furthermore, when extracting baseline segments for the same business, the detection server first selects candidate segments from the network traffic already marked as normal, those with the same business type and access direction as the training segments, and inputs these candidate segments into the deep learning network. The business type can be determined based on protocol type, service port, request object, business access path, or application layer interaction characteristics. The access direction can be determined based on the data transmission direction from the request side to the response side or from the response side to the request side. After extracting features from the candidate segments, the deep learning network outputs the corresponding feature response region. The detection server reads the packet position where the feature response region is located and compares this packet position with the position of the local packet segment to be replaced to determine whether there is a packet segment in the normal network traffic that can form a positional correspondence with the local packet segment.

[0035] When the feature response region of a candidate segment corresponds to the location of a local segment, and the candidate segment does not produce any abnormal type output, the detection server identifies the candidate segment as a baseline segment for the same service. The baseline segment for the same service corresponds to the traffic training segment in terms of service type, access direction, and feature response location, but does not carry anomaly identification results. Therefore, it can serve as a normal reference object when replacing local segments. This approach ensures that subsequent replacement operations primarily reflect the impact of the local segment itself on anomaly identification output, reducing identification bias caused by differences in service type, access direction, or response location offsets.

[0036] Furthermore, when adjusting the training contribution weights, the detection server first performs replacement verification, followed by implantation verification. During replacement verification, the detection server replaces a local segment in the traffic training segment with the message content at the corresponding position in the same business benchmark segment, and inputs the replaced segment into the deep learning network, reading the decrease in the anomaly detection score. If the anomaly detection score drops below a preset weakening threshold, it indicates that the original anomaly detection result has been significantly weakened after the local segment was replaced. Subsequently, the detection server implants the local segment into the corresponding position in the same business benchmark segment and inputs it into the deep learning network again. If the implanted business benchmark segment produces the same type of anomaly detection output as the one before replacement, it indicates that the local segment can re-trigger the same type of anomaly result in a normal business segment. Based on this, the detection server increases the training contribution weight of the local segment, enabling the deep learning network to increase the learning intensity of the anomaly features contained in the local segment in subsequent updates. If the replacement verification does not reach the preset weakening threshold, or the implantation verification does not produce the same type of anomaly detection output, the detection server does not increase the training contribution weight of the local segment and treats it as a low-contribution segment or a segment awaiting review.

[0037] After implanting the local segment into the corresponding position of the same service benchmark segment, the detection server further reads the feature response region when the same service benchmark segment generates the same type of anomaly identification output. If the feature response region moves back to the implantation position of the local segment and is consistent with the feature response region position in the traffic training segment before replacement, it indicates that the anomaly response was not triggered by other normal packets in the same service benchmark segment, but migrated to the new segment environment with the local segment. The detection server marks the local segment as a migrateable intrusion trigger segment to characterize the ability of the local segment to trigger anomaly identification output even after being removed from the original traffic training segment. Moving back to the implantation position of the local segment means that the feature response region falls within the packet sequence number range or the same service stage range of the local segment in the implanted same service benchmark segment.

[0038] After increasing the training contribution weight of a local segment, the detection server selects a normal network traffic segment with a different service type but the same access direction as the baseline segment for the same service, and implants the local segment into its corresponding position for secondary implantation verification. If no anomaly identification output of the same type as before replacement is generated after secondary implantation, it indicates that the anomaly triggering capability of the local segment is still constrained by the service type. The detection server limits the increase in training contribution weight within a preset cross-service verification threshold to avoid mistakenly extending local anomaly features within the service scenario to cross-service general features. If the same anomaly identification output of the same type as before replacement is generated after secondary implantation, it indicates that the local segment can form the same anomaly triggering effect in different service types. The detection server records the local segment as a cross-service shared intrusion triggering segment.

[0039] Before recording a local segment as a cross-service shared intrusion trigger fragment, the detection server reads the feature response region when generating the same type of anomaly identification output after secondary implantation, and verifies the response position in normal network traffic segments of different service types. If the feature response region moves back to the implantation position of the local segment in normal network traffic segments of different service types, it indicates that the cross-service anomaly response has a stable packet position basis. The detection server removes the restriction on the service type's contribution weight to the training of the local segment and participates the cross-service shared intrusion trigger fragment in the weight update of the deep learning network. If the feature response region does not move back to the implantation position of the local segment, the restriction on the service type's contribution weight to the training is retained, and the local segment is used as a service-restricted intrusion trigger fragment in subsequent verification. Through the above method, the deep learning network can distinguish between local anomaly features restricted by service type and intrusion trigger features that can migrate across services, thereby improving the accuracy of locating intrusion trigger fragments in the network traffic to be detected. Example

[0040] In this embodiment, after the detection server connects to the business access link of a certain unit, it continuously collects network traffic and generates traffic training segments according to the packet arrival order, packet direction, payload length, connection status, and request-response interval. For a complete business access process, the detection server uses the connection establishment packet as the segment starting point and the response end packet or connection release packet as the segment ending point, organizing the continuous packets into 8 local packet segments. Each local packet segment maintains the original packet arrival order and carries information on the requesting side, the responding side, the payload length range, the connection status stage, and the request-response interval.

[0041] The detection server inputs the traffic training segment into a pre-built deep learning network to obtain anomaly identification output, anomaly identification score, and feature response region. In this embodiment, the anomaly identification output corresponding to the traffic training segment is abnormal connection persistence, the anomaly identification score is 0.91, and the feature response region is concentrated in the 5th local segment to the 6th local segment. The anomaly identification score is used to characterize the strength of the abnormal behavior corresponding to the traffic training segment, and the feature response region is used to characterize the packet position or continuous packet interval that the deep learning network focuses on responding to when outputting the abnormal connection persistence result.

[0042] The detection server selects candidate segments from the network traffic already marked as normal, which have the same service type and access direction as the traffic training segments. These candidate segments are then input into the deep learning network, and the packet location of the candidate segment's feature response region is read. When a candidate segment does not generate anomaly identification output, and its feature response region can form a correspondence with the local packet segment to be replaced in terms of packet sequence number or connection state stage, the detection server determines the candidate segment as a baseline segment for the same service. Therefore, the normal reference object used in subsequent replacement processes has the same service basis as the original traffic training segments, reducing replacement errors caused by differences in service type or access direction.

[0043] Before replacing a local packet segment with the benchmark segment of the same service, the detection server sequentially selects each local packet segment in the traffic training segment according to the packet arrival order, and replaces it with the packet content at the corresponding position in the benchmark segment of the same service. Each replacement yields a replacement training segment. The detection server inputs each replacement training segment into the deep learning network and reads the changes in anomaly detection score, anomaly detection output type, and the fallback position of the feature response region relative to its original position after replacement. The fallback position refers to the packet position after replacement where the feature response region deviates from the original local packet segment or moves from the original response interval to another packet position. (The corresponding figure number is...) Figure 2The figure uses eight local message segments as the horizontal replacement sequence, and synchronously displays the message segments where the anomaly identification score, the score before replacement, the weakening reference line, and the characteristic response area are located, so that the formation process of the continuation area can correspond to the score decrease and the response position fall back.

[0044] In this embodiment, after the first to third local segments are replaced sequentially, the anomaly identification output still shows that the abnormal connection is maintained, with anomaly identification scores of 0.89, 0.86, and 0.82 respectively, and the feature response region remains near the sixth local segment. After the fourth local segment is replaced, the anomaly identification output still shows that the abnormal connection is maintained, the anomaly identification score drops to 0.74, and the feature response region falls back to the fifth local segment. After the fifth local segment is replaced, the anomaly identification output still shows that the abnormal connection is maintained, and the anomaly identification score drops to 0.62. After the sixth local segment is replaced, the anomaly identification output no longer retains the same type of anomaly identification output, the anomaly identification score drops to 0.43, and the feature response region falls back to the fourth local segment. Figure 2 The fifth and sixth local segments are marked as a contiguous region, which visually reflects the critical point where the output of the same type of anomaly identification changes from being retained to disappearing. Therefore, it can be seen that the same type of anomaly identification output is still retained after the fifth local segment is replaced, while it is not retained after the sixth local segment is replaced. The detection server uses the contiguous region consisting of consecutive local segments between the fifth and sixth local segments as the candidate range for intrusion triggering segments.

[0045] In order to correlate the contribution of the continuation region with both score decline and response drop, the detection server calculates the continuation region trigger contribution value:

[0046] Where A represents the trigger contribution value of the continuation region, s0 represents the anomaly identification score of the traffic training segment before replacement, sv represents the anomaly identification score obtained after replacement to the end of the continuation region, D represents the distance of the fallback segment of the feature response region relative to the position before replacement, and r represents the total number of local segments within the traffic training segment. The calculation formula incorporates both the decrease rate of the anomaly identification score and the fallback degree of the feature response region, ensuring that the selection of the continuation region depends not only on whether the anomaly identification output disappears but also on whether the anomaly response position has moved away from the original trigger interval. In this embodiment, s0 is 0.91, sv is 0.43, D is 2, and r is 8. Substituting these values, we get:

[0047] Since the contribution value of the continuation area has reached the preset contribution requirement, the detection server retains the 5th local segment to the 6th local segment as the candidate range for intrusion triggering segments.

[0048] After determining the continuation region, the detection server alternately reduces local message segments along the beginning and end of the continuation region, and rereads the anomaly identification score change and anomaly identification output type after each reduction. (The corresponding figure number is...) Figure 3 The diagram arranges the initial connection area, the shortened beginning segment, the restored beginning segment, and the shortened end segment in processing order, and places the retention status of the same type of abnormal output and the anomaly identification score after shortening in the same coordinate system to indicate whether the segment at both the beginning and end is still necessary to maintain the abnormal output. First, after shortening the 5th local segment from the beginning of the connection area, the anomaly identification output disappears, and the anomaly identification score is 0.38, indicating that the 5th local segment is still necessary to maintain the abnormal connection output, and the detection server restores the 5th local segment. Then, after shortening the 6th local segment from the end of the connection area, the anomaly identification output also disappears, and the anomaly identification score is 0.36, indicating that the 6th local segment is also necessary to maintain the anomaly identification output, and the detection server restores the 6th local segment. After alternating shortening from the beginning and end, the detection server identifies the restored 5th to 6th local segments as the intrusion trigger segment.

[0049] When reading the fallback position of the feature response region, the detection server simultaneously records the entry direction of the fallback position relative to the continuation region. In this embodiment, after the 6th local segment is replaced, the feature response region falls back from the side of the 6th local segment to the side of the 5th local segment, and does not cross the first boundary of the 5th local segment. This result indicates that the abnormal feature is not formed solely by the single message content at the beginning of the continuation region, but rather by the 6th local segment inheriting the connection maintenance state, request-response interval, or payload continuation relationship of the 5th local segment. Based on this, the detection server marks the continuation region as a candidate range for subsequent continuation-type intrusion triggering segments.

[0050] When multiple contiguous regions exist within the same traffic training segment, the detection server further compares the disappearance order of the anomaly identification output and the fallback position of the feature response region corresponding to each contiguous region. In this embodiment, in addition to the first contiguous region formed by the 5th to 6th local segments, the 3rd to 4th local segments also form a second contiguous region. After the first contiguous region is replaced by the 6th local segment, the anomaly identification output of the same type disappears, and the message sequence number distance between the fallback position of the feature response region and the boundary of the contiguous region is 1. After the second contiguous region is replaced by the 4th local segment, it only causes a decrease in the anomaly identification score. It is only when it is subsequently replaced by the 5th local segment that the anomaly identification output is significantly weakened, and the message sequence number distance between the fallback position of the feature response region and the boundary of the contiguous region is 3. (The corresponding figure number is...) Figure 4This figure uses a bar chart comparing the priority values ​​of two candidate continuation regions, along with textual annotations of boundary distance and output disappearance order, to demonstrate why the first continuation region is prioritized for training and contributes to weight adjustment.

[0051] The detection server calculates the priority value of the connection area according to the following formula:

[0052] Where Q represents the priority value of the continuation region, u represents the order in which the corresponding continuation region causes the output of the same type of anomaly to disappear, and D represents the message sequence number distance between the feature response region's fallback position and the boundary of the corresponding continuation region. In this calculation formula, the earlier the anomaly identification output disappears, the smaller u is, and the higher the priority value of the continuation region; the closer the fallback position is to the boundary of the continuation region, the smaller D is, and the higher the priority value of the continuation region. In this embodiment, u is 1 and D is 1 for the first continuation region, and u is 2 and D is 3 for the second continuation region. Substituting these values ​​into the formula yields:

[0053]

[0054] Because the priority of the first continuation region is higher than that of the second continuation region, and Figure 4 The first continuation region falls into the priority processing area, and the detection server will use the first continuation region as a candidate range for intrusion trigger segments that will be given priority to participate in the adjustment of training contribution weights.

[0055] After determining the priority continuation region, the detection server increases the training contribution weights corresponding to the 5th and 6th local segments, and temporarily suspends the second continuation region from participating in this round of weight updates as a secondary review object. The increase in training contribution weights is used to strengthen the deep learning network's learning intensity regarding the connection maintenance anomalies, request-response delays, and continuous load changes exhibited by the 5th and 6th local segments during subsequent updates, while reducing the response to fluctuations in other normal service packets.

[0056] After weight adjustment, the detection server updates the deep learning network based on the adjusted training contribution weights and inputs the network traffic to be detected into the updated deep learning network. If the network traffic to be detected again exhibits subsequent continuation-type abnormal triggering characteristics that are the same or similar to those of the 5th to 6th local segment packets, the updated deep learning network outputs the corresponding intrusion detection result and marks the intrusion trigger segment in the intrusion detection result. Through the above implementation method, the detection server can locate the actual trigger position in a continuous segment of packets while preserving the temporal relationship of the business, avoiding the misuse of complete business segments or single isolated packets as the basis for intrusion triggering. Example

[0057] In this embodiment, after the detection server connects to the network security analysis link of a certain unit, it generates traffic training segments according to the packet arrival order, packet direction, payload length, connection status, and request-response interval. These traffic training segments are then input into a deep learning network to obtain anomaly identification output, anomaly identification score, and feature response region. In this embodiment, the anomaly identification output corresponding to the traffic training segment is a malicious request; the anomaly identification score before replacement is 0.88, and the feature response region is located in the fourth local packet segment.

[0058] The detection server extracts a baseline segment from the network traffic already marked as normal, which shares the same service type and access direction as the training traffic segment. This baseline segment does not generate any anomaly identification output, and its corresponding position corresponds to the fourth local segment in terms of request-response order and connection state stage. Therefore, the detection server uses the fourth local segment as a local segment to be verified and performs replacement verification and implantation verification on it.

[0059] During the replacement verification, the detection server replaces the fourth local segment with the normal message content at the corresponding position in the same service benchmark segment to obtain a replacement training segment, which is then input into the deep learning network. In this embodiment, the anomaly detection score after replacement decreases from 0.88 to 0.39, which is lower than the preset weakening threshold of 0.45, and the original malicious request type output is no longer stably maintained. This result indicates that after the fourth local segment is removed, the original anomaly detection result is significantly weakened. (See attached figure number...) Figure 5 The verification score confirmation diagram compares the anomaly identification scores of the three stages before replacement, after replacement, and after implantation, and uses the preset weakening threshold and the same type of output confirmation value as a reference, so that the score weakening state after the removal of the fourth local segment can correspond to the same type of re-triggering state after subsequent implantation.

[0060] After the replacement verification is completed, the detection server implants the fourth local segment into the corresponding position of the benchmark segment of the same service and re-inputs it into the deep learning network. In this embodiment, the benchmark segment of the same service after implantation generates malicious request output of the same type as before the replacement, and the anomaly identification score is 0.82, which is higher than the confirmation value of 0.70 for the same type of output. This shows that the fourth local segment can re-trigger the same type of abnormal result in normal service segments, and is not an incidental response caused solely by other packets in the original traffic training segment. Figure 5 The score after replacement is lower than the preset weakening threshold, while the score after implantation is higher than the confirmation value of the same type of output. This indicates that both replacement verification and implantation verification meet the prerequisite of increasing the training contribution weight.

[0061] The detection server calculates the adjusted values ​​of the training contribution weights based on the replacement verification and implantation verification results:

[0062] Where W represents the adjusted training contribution weight, Wb represents the base training contribution weight before adjustment, M represents the weight increase adjustment coefficient, P0 represents the anomaly detection score before replacement, Pr represents the anomaly detection score after replacement, Pi represents the anomaly detection score after implanting the same business benchmark segment, and Pe represents the confirmation value of the same type of output. This calculation formula incorporates both the weakening degree after replacement and the re-triggering strength after implantation into the weight adjustment process, making the increase in training contribution weight dependent on both the effectiveness of removal and the effectiveness of migration triggering. (See attached figure number...) Figure 6 The training contribution weight adjustment decomposition diagram displays the basic training contribution weight, replacement weakening contribution, implantation triggering contribution, and adjusted training contribution weight in an additive path. This is used to illustrate that the training contribution weight is not determined solely by the increase in the anomaly identification score, but is formed by the combined effects of replacement weakening and implantation re-triggering.

[0063] In this embodiment, Wb is 1.00, M is 0.40, P0 is 0.88, Pr is 0.39, Pi is 0.82, and Pe is 0.70. Substituting these values, we get:

[0064] Therefore, the detection server increases the training contribution weight of the fourth local segment from 1.00 to 1.29, enabling the deep learning network to increase the learning intensity of the malicious request features contained in this local segment in subsequent updates. If the anomaly identification score does not drop below the preset weakening threshold after replacement, or if no similar anomaly identification output is generated after implantation, the detection server does not increase the training contribution weight of the local segment and treats it as a segment to be reviewed.

[0065] After the fourth local segment is implanted into the corresponding position of the same service baseline segment, the detection server further reads the feature response region when a malicious request is generated after implantation. If the feature response region moves back to the implantation position of the fourth local segment and is consistent with the feature response region position in the traffic training segment before replacement, the detection server confirms that the abnormal response has migrated to the new segment environment along with the fourth local segment. In this embodiment, the implanted feature response region is still located in the fourth local segment, and the detection server marks this local segment as a migrateable intrusion trigger segment.

[0066] After increasing the training contribution weight of the fourth local segment, the detection server selects normal network traffic segments of different service types but with the same access direction as the baseline segment for secondary implantation verification. These normal network traffic segments of different service types originate from file access, API call, and session persistence services, respectively, and none generate anomaly identification output. After implanting the fourth local segment into the corresponding position of each normal network traffic segment, the detection server reads the anomaly identification output, anomaly identification score, and feature response region position. (See attached figure number...) Figure 7 The cross-business secondary implantation response stability verification chart simultaneously presents the secondary implantation scores and response location verification results of three different business type segments. It is used to indicate whether the fourth local message segment can still generate the same type of malicious request output in different business environments, and to verify whether the abnormal responses have all been moved back to the implantation location.

[0067] In this embodiment, after the fourth local segment is implanted into the interface to call the service fragment, it generates a malicious request of the same type, with an anomaly identification score of 0.79. After the file access service fragment and session persistence service fragment are implanted again, they also generate malicious request outputs of the same type, with anomaly identification scores of 0.76 and 0.81, respectively. The characteristic response regions in the three different service type fragments are all moved back to the implantation position of the fourth local segment, indicating that the anomaly triggering capability of this local segment does not depend on a single service type. Figure 7 The scores for the three secondary implantation anomaly identification items are all higher than the output confirmation values ​​of the same type, and the response location verification results are all 1, which corresponds to the record basis that supports cross-business sharing of intrusion trigger fragments.

[0068] The testing server performs stability checks on the response locations under different business types:

[0069] Where B represents the stable value of the cross-service response position, C represents the number of different service types participating in the secondary implantation verification, and Em represents the response position verification result of the m-th service type segment. When the m-th service type segment generates the same type of anomaly identification output after secondary implantation, and the feature response region shifts back to the implantation position of the local message segment, Em is set to 1; otherwise, Em is set to 0. This calculation formula is used to verify whether the cross-service anomaly response has a stable message position basis, avoiding the removal of service type restrictions simply because of an occasional increase in the anomaly score of a certain service segment.

[0070] In this embodiment, C is 3, and the response position verification result of the three types of service fragments is 1. Substituting this, we get:

[0071] Since B has reached the preset stability requirement, the detection server records the fourth local segment as a cross-service shared intrusion trigger fragment and removes the restriction on the service type's contribution weight to the training of this local segment, allowing it to participate in the weight update of the deep learning network. If no abnormal identification output of the same type as before the replacement is generated after the second implantation, the detection server limits the increase in the training contribution weight to within the preset cross-service verification threshold of 0.12; if the same type of abnormal identification output is generated but the feature response area does not move back to the implantation position, the detection server retains the service type restriction and continues to verify this local segment as a service-restricted intrusion trigger fragment.

[0072] After completing cross-service verification, the detection server updates the deep learning network based on the training contribution weights after removing restrictions, and inputs the traffic to be detected into the updated deep learning network. Through this method, the detection server can first confirm the necessity of local packet segments for the original anomaly identification results through replacement verification, then confirm its re-triggering capability in normal service segments through implantation verification, and further distinguish between service-restricted anomaly features and cross-service shared intrusion triggering features through secondary implantation verification, thereby improving the accuracy of the deep learning network in locating intrusion triggering segments.

Claims

1. A method for identifying abnormal network traffic and detecting intrusions based on deep learning, characterized in that, Collect network traffic, generate traffic training segments according to packet arrival order, packet direction, payload length, connection status and request-response interval, input the traffic training segments into a deep learning network, and obtain anomaly identification output, anomaly identification score and corresponding feature response region; Extract the same service benchmark segment from normal network traffic that meets the same service type, same access direction and does not generate abnormal identification output, replace the local packet segment in the traffic training segment with the same service benchmark segment to obtain the replaced training segment, and input the replaced training segment into the deep learning network; Based on the changes in anomaly identification score, anomaly identification output type, and feature response region location before and after replacement, the training contribution weights corresponding to the local message segments are adjusted. The deep learning network is updated based on the adjusted training contribution weights. The updated deep learning network is used to identify the network traffic to be detected and output an intrusion detection result containing intrusion trigger fragments.

2. The network anomaly traffic identification and intrusion detection method based on deep learning according to claim 1, characterized in that, Before replacing the local segment with the same service benchmark segment, each local segment in the traffic training segment is replaced sequentially according to the order of packet arrival, and the change in anomaly identification score and the fallback position of the feature response region are read after each replacement; when the anomaly identification output of the same type as before is retained after the replacement of the previous local segment, and the anomaly identification output of the same type as before is not retained after the replacement of the next local segment, the contiguous area composed of continuous local segments between the two is taken as the candidate range of intrusion trigger segment.

3. The network anomaly traffic identification and intrusion detection method based on deep learning according to claim 1, characterized in that, When extracting the benchmark segment for the same service, normal network traffic is input into the deep learning network, the packet position of its feature response region is read, and a normal network traffic segment whose feature response region corresponds to the position of the local packet segment and does not produce abnormal identification output is selected as the benchmark segment for the same service.

4. The network anomaly traffic identification and intrusion detection method based on deep learning according to claim 1, characterized in that, When adjusting the training contribution weight, the local segment is first replaced with the benchmark segment of the same service, and then the local segment is implanted into the corresponding position of the benchmark segment of the same service. When the former causes the anomaly identification score to drop below a preset weakening threshold, and the latter causes the benchmark segment of the same service to produce anomaly identification output of the same type as the anomaly identification output before replacement, the training contribution weight of the local segment is increased.

5. The network anomaly traffic identification and intrusion detection method based on deep learning according to claim 2, characterized in that, After selecting the continuation region as a candidate range for intrusion triggering segments, the local message segments are alternately reduced along the beginning and end of the continuation region, and the change in the anomaly identification score is read after each reduction; when the reduction at any end causes the anomaly identification output of the same type as before the replacement to disappear, the local message segment corresponding to that end is restored, and the restored continuation region is used as the intrusion triggering segment.

6. The network anomaly traffic identification and intrusion detection method based on deep learning according to claim 2, characterized in that, When reading the fallback position of the feature response region, the entry direction of the fallback position relative to the continuation region is recorded simultaneously; when the fallback position enters the continuation region from the side of the next local segment and does not cross the boundary of the side of the previous local segment, the continuation region is marked as a candidate range for subsequent successor intrusion triggering segments.

7. The network anomaly traffic identification and intrusion detection method based on deep learning according to claim 2, characterized in that, When multiple continuation regions exist, the order in which the anomaly identification output disappears and the fallback position of the feature response region corresponding to each continuation region are compared. The continuation region whose anomaly identification output disappears before other continuation regions and whose message sequence number distance between the fallback position of the feature response region and the boundary of the corresponding continuation region is smaller than that of other continuation regions is selected as the candidate range of intrusion trigger segments that are given priority to participate in the adjustment of training contribution weights.

8. The network anomaly traffic identification and intrusion detection method based on deep learning according to claim 4, characterized in that, After the local segment is implanted into the corresponding position of the same service benchmark segment, the feature response area of ​​the same service benchmark segment when it generates an anomaly identification output of the same type as the anomaly identification output before replacement is read; when the feature response area moves back to the implantation position of the local segment and is consistent with the position of the feature response area in the traffic training segment before replacement, the local segment is marked as a migrateable intrusion trigger segment.

9. The network anomaly traffic identification and intrusion detection method based on deep learning according to claim 4, characterized in that, After increasing the training contribution weight of the local segment, a normal network traffic segment with a different service type but the same access direction as the baseline segment of the same service is selected for secondary implantation; when no abnormal identification output of the same type as the abnormal identification output before replacement is generated after secondary implantation, the increase of the training contribution weight is limited to a preset cross-service verification threshold; when an abnormal identification output of the same type as the abnormal identification output before replacement is still generated after secondary implantation, the local segment is recorded as a cross-service shared intrusion trigger segment.

10. The network anomaly traffic identification and intrusion detection method based on deep learning according to claim 9, characterized in that, Before recording the local segment as a cross-service shared intrusion triggering fragment, read the feature response region when the anomaly identification output of the same type as the anomaly identification output before replacement is generated after the secondary implantation; when the feature response region moves back to the implantation position of the local segment in normal network traffic segments of different service types, remove the restriction on the contribution weight of the service type to the training of the local segment, and participate the cross-service shared intrusion triggering fragment in the weight update of the deep learning network.

Images