IP anomaly pattern classification method and system based on multiple decision trees
Patent Information
- Application Number
- CN202610949772.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-06-29
- Publication Date
- 2026-10-23
AI Technical Summary
[0004]本发明的目的在于为了解决传统IP异常检测方法在处理大规模动态日志时存在的分类精度不足、数据集处理灵活性差以及结果缺乏实时性与可解释性等技术问题，提出一种基于多决策树的IP异常模式分类方法及系统，针对域名系统（DNS）日志数据，通过集成学习机制与自动化评估反馈体系，达到提升异常模式识别的准确率与鲁棒性，实现对异构数据的灵活适配，并为网络安全决策提供实时、详细的量化指标支持
[0017]1.本发明通过随机森林的集成学习机制，利用多棵决策树并行决策，并结合Bootstrap数据采样与特征随机选择技术，降低了模型对噪声数据的敏感度，有效提升了IP异常模式分类的准确性、稳定性和鲁棒性。
Smart Images
Figure CN122969830A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of network security technology, specifically relating to a method and system for classifying abnormal IP (Internet Protocol) patterns based on multiple decision trees. Background Technology
[0002] With the rapid development of digital technology and the evolution of internet architecture, network traffic is growing exponentially, making the cyberspace security environment increasingly complex. During the massive data transmission process, malicious traffic generated by abnormal IP addresses poses a severe challenge to the secure operation of network infrastructure. Network logs, as a key carrier of network activity, have their analysis and processing capabilities directly related to the effectiveness of threat monitoring. However, traditional anomaly detection methods often struggle to balance processing efficiency and detection accuracy when dealing with large-scale, dynamically changing, and high-dimensional log data, and lack effective means to uncover highly concealed anomalies, thus limiting the overall effectiveness of network log analysis.
[0003] Currently, IP anomaly patterns in the network environment are characterized by their diversity, rapid evolution, and high degree of concealment. Traditional manual identification methods or rule-based single-algorithm detection models are gradually becoming insufficient to meet the needs of modern network security defense. The main technical problems include: first, insufficient classification accuracy; traditional models have limited ability to extract complex and ever-changing anomaly features, making them difficult to adapt to diverse network attack behaviors; second, poor system flexibility; existing detection methods typically can only process data streams of specific formats, making them incompatible with log datasets with arbitrary numbers of fields and diverse, heterogeneous sources; and third, inadequate interpretability and real-time feedback mechanisms for detection results, often lacking detailed performance evaluation metrics and dynamic update capabilities, failing to provide timely and actionable decision-making guidance for security maintenance personnel. Summary of the Invention
[0004] The purpose of this invention is to address the technical problems of traditional IP anomaly detection methods when processing large-scale dynamic logs, such as insufficient classification accuracy, poor dataset processing flexibility, and lack of real-time and interpretability of results. This invention proposes an IP anomaly pattern classification method and system based on multiple decision trees. For Domain Name System (DNS) log data, this method improves the accuracy and robustness of anomaly pattern recognition by integrating a learning mechanism and an automated evaluation and feedback system, achieves flexible adaptation to heterogeneous data, and provides real-time and detailed quantitative indicators to support network security decisions.
[0005] To achieve the above objectives, the present invention adopts the following technical solution.
[0006] A method for classifying IP anomaly patterns based on multiple decision trees includes the following steps: Obtain DNS log data; Feature extraction is performed on the DNS log data to obtain feature information; The multi-decision tree model is trained based on the aforementioned feature information to obtain an anomaly classification model; The classification performance of the anomaly classification model is evaluated to obtain a qualified anomaly classification model; The qualified anomaly classification model is used to perform IP detection on the DNS log data under test to obtain the IP anomaly pattern classification results.
[0007] Furthermore, obtain DNS log data, including: Extract raw DNS log data from network log data; The raw DNS log data is cleaned to obtain cleaned data; Missing data in the cleaned data is uniformly filled in to obtain DNS log data.
[0008] Furthermore, feature extraction is performed on the DNS log data to obtain feature information, including: Extract the geographic location features, organization or autonomous system number features, access frequency features, temporal volatility features and trend features of access behavior of IP addresses from DNS log data to obtain an initial feature set; The non-numerical features in the initial feature set are encoded and transformed, and the transformed features are combined with the numerical features in the initial feature set to obtain feature information.
[0009] Furthermore, based on the aforementioned feature information, the multi-decision tree model is trained to obtain an anomaly classification model, including: Multiple sub-training sets are generated from the training dataset corresponding to the feature information by random sampling with replacement; The corresponding decision tree sub-models are trained using different sub-training sets. When splitting each node of the decision tree sub-model, some features are randomly selected from the entire feature set to participate in the optimal splitting calculation, thus obtaining the trained decision tree sub-model. An anomaly classification model is obtained by voting on the prediction results of multiple decision tree sub-models.
[0010] Furthermore, corresponding decision tree sub-models are trained using different sub-training sets. During the partitioning of each decision tree sub-model node, a subset of features is randomly selected from the entire feature set to participate in the optimal partitioning calculation, resulting in the trained decision tree sub-model, including: Calculate the first information entropy of the sample set currently participating in the node partitioning; Calculate the second information entropy of each sub-sample set obtained based on candidate features; The second information entropy is weighted and summed based on the proportion of the number of samples in each sub-sample set to the total number of samples in the sample set, to obtain the weighted total information entropy. The information gain is obtained by subtracting the weighted total information entropy from the first information entropy.
[0011] Further, the first information entropy of the sample set currently participating in the node partitioning is calculated, including: Calculate the proportion of each category of samples in the sample set; Calculate the base-2 logarithm of the proportion of samples in each category; Multiply the sample proportion of each category by its corresponding base-2 logarithmic value to obtain the product results; The first information entropy is obtained by summing the product results of all categories and taking the negative of the sum.
[0012] Furthermore, the classification performance of the anomaly classification model is evaluated to obtain a qualified anomaly classification model, including: Perform anomaly classification prediction on the test data and output the prediction results; Calculate precision and recall evaluation metrics based on the prediction results; When the recall rate is lower than a preset threshold, a new dataset is added for incremental training to obtain a qualified anomaly classification model.
[0013] Furthermore, the classification performance of the anomaly classification model is evaluated to obtain a qualified anomaly classification model, which also includes: Extract the model parameters and feature encoding rules of qualified anomaly classification models and persist them to obtain stored data; The model parameters in the stored data are loaded to support version control for multiple models to coexist, and when an anomaly occurs in the new model, it is rolled back to the historical model to obtain the anomaly classification model after rollback.
[0014] Furthermore, the qualified anomaly classification model is used to perform IP detection on the DNS log data under test to obtain IP anomaly pattern classification results, including: A qualified anomaly classification model is used to detect IP anomaly patterns in the DNS log data under test, and the prediction and evaluation results are output through the network interface. Obtain user-inputted model parameter adjustment instructions or newly input data as feedback data; The anomaly classification model is optimized and trained using the feedback data to obtain an updated anomaly classification model.
[0015] A multi-decision tree-based IP anomaly pattern classification system includes: The data acquisition module is used to acquire DNS log data; The feature extraction module is used to extract features from the DNS log data to obtain feature information; The model training module trains the multi-decision tree model based on the feature information to obtain an anomaly classification model; The model evaluation module is used to evaluate the classification performance of the anomaly classification model to obtain a qualified anomaly classification model. The anomaly detection module is used to perform IP detection on the DNS log data under test using the qualified anomaly classification model, and obtain the IP anomaly pattern classification result.
[0016] The present invention has achieved the following beneficial effects.
[0017] 1. This invention utilizes the ensemble learning mechanism of random forests, employs parallel decision-making across multiple decision trees, and combines Bootstrap data sampling and random feature selection techniques to reduce the model's sensitivity to noisy data, effectively improving the accuracy, stability, and robustness of IP anomaly pattern classification.
[0018] 2. This invention has high flexibility and scalability. Through a unified preprocessing and feature conversion mechanism, it can adapt to DNS log datasets with arbitrary number of fields and multi-source heterogeneous types, and supports rapid deployment in various complex network log analysis scenarios.
[0019] 3. By establishing a model performance evaluation and incremental training mechanism, this invention achieves persistent storage, version control, and fault rollback of model parameters, supports the management of multiple models coexisting, and ensures that the anomaly classification model can be continuously optimized when facing dynamic data that changes in real time.
[0020] 4. This invention achieves automated training, real-time prediction and evaluation through integrated Web interface, and can output detailed quantitative indicators such as precision and recall simultaneously, which greatly enhances the interpretability of detection results and provides network security maintenance personnel with highly operable decision support.
[0021] 5. This invention utilizes a feature random selection mechanism to avoid a single feature dominating model decision-making, and reduces sample uncertainty layer by layer through the information gain criterion, which not only improves the model's generalization ability, but also ensures classification efficiency and processing performance in large-scale network traffic environments. Attached Figure Description
[0022] Figure 1 This is a simplified flowchart of an IP anomaly pattern classification method based on multiple decision trees in this embodiment; Figure 2 This is a data flow diagram of an IP anomaly pattern classification method based on multiple decision trees in the embodiment. Figure 3This is a block diagram of an IP anomaly pattern classification system based on a multi-decision tree in an embodiment. Detailed Implementation
[0023] To make the various technical features, advantages, or effects of the present invention more apparent and understandable, detailed descriptions are provided below through embodiments.
[0024] This invention provides a method for classifying IP anomaly patterns based on multiple decision trees, such as... Figure 1 and Figure 2 As shown, the main steps include: Step S1: Obtain DNS log data.
[0025] Specifically, the system obtains raw DNS log data from network logs and network traffic and asset data through user input commands or automatic access guidance in order to construct a training dataset.
[0026] In other embodiments of the present invention, the dataset field may also adopt feature information of other different dimensions according to the actual application scenario.
[0027] In an optional embodiment of the present invention, step S1 may include the following steps: Step S11: Extract raw DNS log data from network log data by user input or automatic access guidance; Step S12: Clean the raw DNS log data to obtain cleaned data; Step S13: Fill in the missing data in the cleaned data to obtain DNS log data.
[0028] Specifically, data cleaning can handle datasets of any number and type of fields, ensuring the integrity and consistency of the input data.
[0029] Step S2: Extract features from the DNS log data to obtain feature information.
[0030] In an optional embodiment of the present invention, the dataset field can be selected with feature information of different dimensions according to the actual application scenario.
[0031] In an optional embodiment of the present invention, step S2 may include the following steps: Step S21: Extract the geographic location features, organization or autonomous system number features, access frequency features, time volatility features and trend features of access behavior of IP addresses from the DNS log data to obtain the initial feature set; Step S22: Encode and transform the non-numerical features in the initial feature set, and combine the transformed features with the numerical features in the initial feature set to obtain feature information.
[0032] Specifically, geographic location features include continent, country, and latitude and longitude. Encoding and transforming non-numerical features ensures that all features can participate in model calculations.
[0033] Step S3: Train the multi-decision tree model based on feature information to obtain an anomaly classification model.
[0034] Specifically, during the model training phase, a multi-decision tree model based on ensemble learning is used for anomaly pattern classification, with a random forest model as the core classification algorithm.
[0035] Multiple decision tree models are constructed based on preset parameters. Each decision tree model consists of several independent decision tree sub-models. Each decision tree adopts a binary tree structure, with its internal nodes used for feature determination and its leaf nodes used for outputting classification results. They are trained using different sample subsets and feature subsets.
[0036] During model construction, each decision tree is generated based on a Bootstrap data sampling mechanism and a feature random selection mechanism. The Bootstrap data sampling mechanism uses random sampling with replacement to generate multiple sub-training sets from the original training dataset. Different decision trees are trained using different sub-training sets, thereby enhancing the model's robustness to noisy data and outliers. The feature random selection mechanism randomly selects a subset of features from the entire feature set when splitting at each decision tree node, avoiding single-feature dominance in model decisions and improving the model's generalization ability. Multiple decision trees constructed in this way collectively form a random forest model, and the final output is obtained by combining the predictions of each decision tree through a voting mechanism.
[0037] During model training, the training effect is evaluated by calculating the difference between the model's predictions and the true labels. A single decision tree uses information gain as the node splitting criterion during training, progressively reducing sample uncertainty layer by layer. The entire training process can utilize the Flask framework to provide a network interface, supporting automatic triggering and management of model training, thereby improving scalability and engineering capabilities.
[0038] In an optional embodiment of the present invention, the preset parameters include the number of decision trees and the random seed.
[0039] In an optional embodiment of the present invention, step S3 may include the following steps: Step S31: Generate multiple sub-training sets from the training dataset corresponding to the feature information by random sampling with replacement; Step S32: Train the corresponding decision tree sub-models using different sub-training sets, and when splitting each decision tree sub-model node, randomly select some features from the entire feature set to participate in the optimal split calculation to obtain the trained decision tree sub-model. Step S33: Vote using the prediction results of multiple decision tree sub-models to obtain an anomaly classification model.
[0040] In an optional embodiment of the present invention, step S32 may further include the following steps: Step S321: Calculate the first information entropy of the sample set currently participating in the node partitioning; Step S322: Calculate the second information entropy of each sub-sample set obtained based on the candidate features; Step S323: Based on the proportion of the number of samples in each sub-sample set to the total number of samples in the sample set, the second information entropy is weighted and summed to obtain the weighted total information entropy. Step S324: Subtract the weighted total information entropy from the first information entropy to obtain the information gain.
[0041] Specifically, the formula for calculating information gain is as follows: in, D represents information gain; A represents the set of samples currently participating in the node partitioning; and A represents the candidate features used to partition the samples. Represents the set of all possible values for feature A; This represents the subset of samples obtained when feature A takes the value v; This represents the number of samples in the sample set D; Represents a set of subsamples The number of samples in the sample; The information entropy of the sample set D is used to measure the uncertainty of the sample class distribution. Represents a set of subsamples Information entropy.
[0042] In an optional embodiment of the present invention, step S321 may further include the following steps: (1) Calculate the proportion of each category of samples in the sample set; (2) Calculate the base-2 logarithm of the sample proportions for each category; (3) Multiply the sample proportion of each category by its corresponding base-2 logarithmic value to obtain the product results; (4) Sum the product results of all categories and take the opposite number to obtain the first information entropy.
[0043] Specifically, the information entropy of the sample set D is defined as follows: Where C represents the total number of categories in the sample; This represents the proportion of the i-th type of sample in set D.
[0044] Step S4: Evaluate the classification performance of the anomaly classification model to obtain a qualified anomaly classification model.
[0045] Specifically, multiple trained decision trees are integrated into a unified model, and model parameters and feature encoding rules are persistently stored. Evaluation metrics can be monitored periodically, and incremental datasets can be added to optimize the model based on specific business needs. Multiple models coexist and version control are supported, allowing for rollback in case of model anomalies. Training data, prediction results, and model parameters are stored in a database to ensure efficient data management and traceability. Dynamic updates to the model and data are supported to adapt to real-time changes in network logs.
[0046] In an optional embodiment of the present invention, when the recall rate is below 85%, a new dataset is added for incremental training.
[0047] In an optional embodiment of the present invention, step S4 may include the following steps: Step S41: Perform anomaly classification prediction on the test data and output the prediction results; Step S42: Calculate the precision and recall evaluation metrics based on the prediction results; Step S43: When the recall rate is lower than the preset threshold, supplement with a new dataset for incremental training to obtain a qualified anomaly classification model.
[0048] Step S44: Extract the model parameters and feature encoding rules of the qualified anomaly classification model and persist them to obtain the stored data; Step S45: Load the model parameters in the stored data to support version control for multiple models coexisting, and roll back to the historical model when an anomaly occurs in the new model to obtain the anomaly classification model after rollback.
[0049] In an optional embodiment of the present invention, the preset threshold can be 85%.
[0050] Step S5: Use a qualified anomaly classification model to perform IP detection on the DNS log data under test to obtain the IP anomaly pattern classification results.
[0051] Specifically, the trained model is used to detect abnormal IP patterns. Furthermore, prediction and evaluation results are returned to the user via a network interface. The model parameters can be adjusted or new data input can be made according to user needs, and the feedback results are used to optimize the model to continuously improve classification performance.
[0052] In an optional embodiment of the present invention, step S5 may include the following steps: Step S51: Use a qualified anomaly classification model to detect IP anomaly patterns in the DNS log data under test, and output the prediction results and evaluation results through the network interface. Step S52: Obtain the user's input of model parameter adjustment instructions or newly input data as feedback data; Step S53: Optimize and train the anomaly classification model using the feedback data to obtain the updated anomaly classification model.
[0053] This invention also provides an IP anomaly pattern classification system based on multiple decision trees, such as... Figure 3 As shown, it includes: The data acquisition module is used to acquire DNS log data; The feature extraction module is used to extract features from DNS log data to obtain feature information; The model training module trains the multi-decision tree model based on feature information to obtain an anomaly classification model; The model evaluation module is used to evaluate the classification performance of anomaly classification models and obtain qualified anomaly classification models. The anomaly detection module is used to perform IP detection on the DNS log data under test using a qualified anomaly classification model, and obtain the IP anomaly pattern classification results.
[0054] Method performance testing: To verify the effectiveness and practicality of the method of the present invention, performance testing experiments were conducted in actual business scenarios.
[0055] During testing, a dataset containing 18,000 IP log entries was used for model training and predictive analysis. Experimental results show that the method of this invention performs excellently on the test set, achieving a classification accuracy of 96.4%, a recall rate of 95.1%, and an F1 score of 93.3%. In stress testing of actual deployment applications, for an anomaly pattern prediction task involving 100,000 IP addresses, the overall system response time was controlled within 3 seconds. Actual test data demonstrates that the method of this invention significantly improves classification accuracy compared to traditional detection methods when processing large-scale network log data, while also greatly reducing system response time. Furthermore, by outputting detailed quantitative evaluation indicators, this method provides network security operations personnel with highly actionable decision-making guidance, significantly enhancing network security capabilities and early warning efficiency.
[0056] Although the present invention has been disclosed above with reference to embodiments, it is not intended to limit the present invention. Appropriate modifications or equivalent substitutions made by those skilled in the art to the technical solutions of the present invention should be covered within the protection scope of the present invention, which is defined by the claims.
Claims
1. A method for classifying IP anomaly patterns based on multiple decision trees, characterized in that, Includes the following steps: Obtain DNS log data; Feature extraction is performed on the DNS log data to obtain feature information; The multi-decision tree model is trained based on the aforementioned feature information to obtain an anomaly classification model; The classification performance of the anomaly classification model is evaluated to obtain a qualified anomaly classification model; The qualified anomaly classification model is used to perform IP detection on the DNS log data under test to obtain the IP anomaly pattern classification results.
2. The method as described in claim 1, characterized in that, Obtain DNS log data, including: Extract raw DNS log data from network log data; The raw DNS log data is cleaned to obtain cleaned data; Missing data in the cleaned data is uniformly filled in to obtain DNS log data.
3. The method as described in claim 1, characterized in that, Feature extraction is performed on the DNS log data to obtain feature information, including: Extract the geographic location features, organization or autonomous system number features, access frequency features, temporal volatility features and trend features of access behavior of IP addresses from DNS log data to obtain an initial feature set; The non-numerical features in the initial feature set are encoded and transformed, and the transformed features are combined with the numerical features in the initial feature set to obtain feature information.
4. The method as described in claim 1, characterized in that, Based on the aforementioned feature information, a multi-decision tree model is trained to obtain an anomaly classification model, including: Multiple sub-training sets are generated from the training dataset corresponding to the feature information by random sampling with replacement; The corresponding decision tree sub-models are trained using different sub-training sets. When splitting each node of the decision tree sub-model, some features are randomly selected from the entire feature set to participate in the optimal splitting calculation, thus obtaining the trained decision tree sub-model. An anomaly classification model is obtained by voting on the prediction results of multiple decision tree sub-models.
5. The method as described in claim 4, characterized in that, The corresponding decision tree sub-models are trained using different sub-training sets. During the partitioning of each decision tree sub-model node, a subset of features is randomly selected from the entire feature set to participate in the optimal partitioning calculation, resulting in the trained decision tree model, including: Calculate the first information entropy of the sample set currently participating in the node partitioning; Calculate the second information entropy of each sub-sample set obtained based on candidate features; The second information entropy is weighted and summed based on the proportion of the number of samples in each sub-sample set to the total number of samples in the sample set, to obtain the weighted total information entropy. The information gain is obtained by subtracting the weighted total information entropy from the first information entropy.
6. The method as described in claim 5, characterized in that, Calculate the first information entropy of the sample set currently participating in the node partitioning, including: Calculate the proportion of each category of samples in the sample set; Calculate the base-2 logarithm of the proportion of samples in each category; Multiply the sample proportion of each category by its corresponding base-2 logarithmic value to obtain the product results; The first information entropy is obtained by summing the product results of all categories and taking the negative of the sum.
7. The method as described in claim 1, characterized in that, The classification performance of the aforementioned anomaly classification model is evaluated to obtain a qualified anomaly classification model, including: Perform anomaly classification prediction on the test data and output the prediction results; Calculate precision and recall evaluation metrics based on the prediction results; When the recall rate is lower than a preset threshold, a new dataset is added for incremental training to obtain a qualified anomaly classification model.
8. The method as described in claim 1, characterized in that, The evaluation of the classification performance of the anomaly classification model to obtain a qualified anomaly classification model further includes: Extract the model parameters and feature encoding rules of qualified anomaly classification models and persist them to obtain stored data; The model parameters in the stored data are loaded to support version control for multiple models to coexist, and when an anomaly occurs in the new model, it is rolled back to the historical model to obtain the anomaly classification model after rollback.
9. The method as described in claim 1, characterized in that, The qualified anomaly classification model is used to perform IP detection on the DNS log data under test, and the IP anomaly pattern classification results are obtained, including: A qualified anomaly classification model is used to detect IP anomaly patterns in the DNS log data under test, and the prediction and evaluation results are output through the network interface. Obtain user-inputted model parameter adjustment instructions or newly input data as feedback data; The anomaly classification model is optimized and trained using the feedback data to obtain an updated anomaly classification model.
10. An IP anomaly pattern classification system based on multiple decision trees, characterized in that, include: The data acquisition module is used to acquire DNS log data; The feature extraction module is used to extract features from the DNS log data to obtain feature information; The model training module trains the multi-decision tree model based on the feature information to obtain an anomaly classification model; The model evaluation module is used to evaluate the classification performance of the anomaly classification model to obtain a qualified anomaly classification model. The anomaly detection module is used to perform IP detection on the DNS log data under test using the qualified anomaly classification model, and obtain the IP anomaly pattern classification result.