An enhanced beluga optimization algorithm for feature selection

Abstract

The present application relates to a kind of enhanced beluga optimization algorithm for feature selection, belong to malicious traffic detection field, solve the problem of feature redundancy, noise and original optimization algorithm in malicious traffic detection is easy to fall into local optimum.The method first introduces dynamic nonlinear balance parameter, falling behavior strategy of global optimal guidance and failure parameter detection variation mechanism on original beluga optimization mechanism;Second, combined with XGBoost classifier, construct discrete multi-objective feature selection framework;Finally, in the iterative optimization process, with minimum fitness as the guide, output global optimal feature subset.The present application will improve swarm intelligence optimization mechanism and classification evaluation be fused, build more efficient feature screening framework, can better overcome the redundant interference of high-dimensional data and effectively jump out of local optimum, thus greatly reduce feature dimension while maintaining excellent optimization fitness, significantly improve the accuracy and detection precision of malicious traffic identification in various classification tasks.

Description

Technical Field

[0001] This invention relates to the fields of malicious traffic detection and network security technology, and in particular to an enhanced white whale optimization algorithm for feature selection. Background Technology

[0002] In network security attack and defense and detection model training, accurate identification of massive network traffic characteristics is required. The widespread use of encryption technology provides cover for the covert communication of malware, rendering traditional network traffic detection methods based on encrypted payloads ineffective. To address the problem of unparseable encrypted traffic, current research has shifted to extracting protocol-independent traffic statistical features and combining them with deep learning for anomaly detection modeling. However, in malicious traffic detection systems, directly utilizing full-flow statistical features for modeling often faces challenges of high-dimensional redundancy and noise, making the trade-off between feature dimensionality and detection performance a key research focus.

[0003] To achieve effective feature dimensionality reduction, traditional filtering methods (such as feature selection frameworks based on correlation coefficients and mutual information) reduce feature redundancy through the minimum redundancy criterion, but neglect the complex interactions between features. In recent years, swarm intelligence optimization algorithms centered on wrapper strategies have made significant progress in feature selection. For example, some studies have integrated mutual information filtering with the firefly algorithm to construct the MIFA method, or used genetic algorithms combined with logistic regression for optimal feature subset selection. The emerging augmented whale optimization algorithm has also been widely used in high-dimensional data preprocessing tasks, demonstrating high adaptability and optimization value in high-dimensional feature selection across various domains.

[0004] However, existing enhanced whale optimization algorithms still have several limitations when dealing with high-dimensional feature optimization for malicious traffic detection. First, the linear change of the balance factor is difficult to adaptively adjust with the exploration and development intensity at different search stages. Second, the traditional whale fall mechanism relies excessively on random perturbations and boundary-based step size construction, lacking guidance from a globally optimal solution. Finally, existing algorithms lack an explicit stagnation detection mechanism; when there is no improvement after multiple consecutive iterations, the algorithm continues to advance according to the same update rule, which easily leads to slow convergence and getting trapped in local optima.

[0005] Therefore, how to improve existing swarm intelligence optimization algorithms to effectively reduce data dimensionality while escaping local optima, thereby significantly enhancing the performance of malicious traffic identification, is a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0006] To address the technical challenges of training existing network security attack and defense and detection models, such as the high dimensionality, redundancy, and noise of malicious traffic feature data leading to difficulties in model training and poor real-time performance; and the shortcomings of traditional wrapped swarm intelligence optimization algorithms (such as the original White Whale Optimization Algorithm BWO) in optimizing such high-dimensional discrete feature spaces, including linearly changing balance factors that cannot be adaptively adjusted, over-reliance on random perturbations in the whale fall mechanism lacking optimal solution guidance, and the lack of an explicit stagnation-jump mechanism leading to easy getting trapped in local optima, this invention aims to propose an Enhanced White Whale Optimization Algorithm (EABWO) for feature selection. By reconstructing the underlying exploration and development mechanism of the algorithm, a discrete multi-objective feature selection framework is constructed, aiming to significantly enhance the identification performance and computational efficiency of IoT edge nodes for malicious traffic while effectively reducing data dimensionality.

[0007] To achieve the above objectives, the technical solution of the present invention is as follows: an enhanced beluga optimization algorithm for feature selection, comprising the following steps:

[0008] Step 1, Data Preprocessing and Individual Location Discretization: Using network traffic feature extraction tools, full traffic statistical features are extracted from the original traffic file (e.g., Pcap file), and the extracted feature data is normalized to eliminate dimensional differences. Based on this, the beluga whale population is initialized. Since the original beluga whale optimization algorithm operates in a continuous search space, this step introduces the Sigmoid transformation function to map the continuous individual locations generated in the enhanced beluga whale optimization algorithm to discrete binary feature selection vectors. The position vector element of the i-th beluga whale individual is strictly limited to 0 or 1. A value of 1 indicates that the corresponding traffic feature is selected, and a value of 0 indicates that the corresponding traffic feature is discarded, thus constructing a precise mapping relationship between beluga whale individuals and feature subsets.

[0009] Step 2, Fitness Function Construction and Evaluation: Feature selection is modeled as a multi-objective optimization problem, and a fitness function containing classification error rate and feature selection rate is constructed; the fitness value of the binary feature selection vector is calculated using a classifier.

[0010] Step three involves introducing a dynamic nonlinear balance control mechanism: When the population enters the iterative optimization phase, a dynamic nonlinear balance control parameter kk is introduced. This parameter is defined by combining a sine function, a nonlinear hyperbolic tangent function, and a cosine function. In each iteration, this dynamic nonlinear balance control parameter replaces the linear decreasing factor of the original algorithm to control the dynamic switching behavior of the beluga whale population between the exploration and development phases.

[0011] Step 4, Enhanced fall behavior update guided by global optimum: In the iteration, the position information of the global optimum is introduced into the position update formula; when the dynamic nonlinear balance control parameter is greater than or equal to the whale fall probability, step size mutation based on global optimum guidance is performed, otherwise position update combined with random perturbation is performed.

[0012] Step 5, Failure Parameter Verification and Mutation: A stall detection mechanism is set up to trigger mutation when no better value is found after multiple consecutive iterations. The mutation length is adaptively calculated based on the current iteration number and the maximum iteration count, generating a mutation vector which is then superimposed on the current individual position for boundary checks to complete the mutation. Through iterative iterations of the above steps, a globally optimal feature subset that balances detection accuracy and computational efficiency is ultimately output.

[0013] The technical effects achieved by each step and the overall technical solution in this invention are as follows:

[0014] In step one, discretization mapping ensures that each beluga whale individual represents a valid subset of binary features, while maintaining the algorithm's ability to explore the continuous search space.

[0015] Step 3 introduces dynamic nonlinear balance control parameters, which enhances the global search capability in the early stage of iteration and strengthens the local search capability in the later stage, thus accurately scheduling the search tendency at different iteration stages.

[0016] Step four introduces an enhanced fall strategy guided by global optimum, which makes the fall no longer completely dependent on random perturbation and greatly increases the probability of escaping local optima when the population gathers.

[0017] Step five introduces a failure parameter to check for mutations. Adaptive variable asynchronous length increases population diversity, effectively avoiding getting trapped in local optima and improving the algorithm's convergence speed. Overall, this invention constructs a discrete multi-target feature selection and detection framework combined with XGBoost, effectively achieving significant feature reduction. The detection accuracy for binary classification tasks reaches 99.99%, and it also achieves excellent performance of 99.85% and 99.95% respectively in multi-class classification tasks, significantly outperforming mainstream swarm intelligence algorithms in both dimensionality reduction and detection accuracy. Attached Figure Description

[0018] Figure 1 This is a diagram illustrating the overall architecture of the malicious traffic detection feature selection based on EABWO in this invention.

[0019] Figure 2 This is a schematic diagram of the feature selection process of the EABWO algorithm in an embodiment of the present invention.

[0020] Figure 3 The figure shows the results of a binary classification experiment on the Edge-IIoT dataset according to an embodiment of the present invention, including the convergence curve, box plot and bee colony plot.

[0021] Figure 4 The figure shows the results of the binary classification experiment on the USTC-TFC2016 dataset in this embodiment of the invention, including the convergence curve, box plot and bee colony diagram.

[0022] Figure 5 The figure shows the results of a multi-class classification experiment on the Edge-IIoT dataset according to an embodiment of the present invention, including convergence curves, box plots, and bee colony plots.

[0023] Figure 6 The figure shows the results of the multi-class classification experiment on the USTC-TFC2016 dataset in this embodiment of the invention, including the convergence curve, box plot and bee colony diagram. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0025] This embodiment uses malware encrypted traffic detection as an application scenario for illustration. It should be noted that the dataset names, hardware environments, number of repeated experiments, cross-validation folds, and parameter values ​​in the following embodiments are used to illustrate one possible implementation of the present invention and do not constitute a limitation on the scope of protection of the present invention; provided that the same input, processing, and output relationships are met, those skilled in the art can adjust the corresponding parameters according to the actual network environment, computing power conditions, and traffic characteristics.

[0026] Step 1: Data Preprocessing and Individual Discretization. Specifically: Using the self-developed tools GzhuFlowmeter or CICFlowmeter, traffic statistics features are extracted from the Pcap file and normalized. Next, the Sigmoid transformation function is used to map the continuous individual location values ​​generated in the enhanced beluga optimization algorithm to a discretized binary space. The i-th beluga individual is represented as... ,in The value can be 0 or 1. This represents the total number of traffic features. Problems solved and effects achieved: It resolves the issue of inconsistent dimensions for different features, reduces the risk of overfitting, and improves memory efficiency. The discretization operation addresses the problem that the original White Whale algorithm cannot directly handle discrete feature selection, effectively achieving a mapping representation of feature subsets.

[0027] In this step, the original Pcap traffic file can originate from IoT, industrial IoT, edge computing nodes, or other network security monitoring devices. A traffic feature extraction tool performs session or flow-level statistics on the original traffic to obtain a fixed-dimensional traffic statistical feature matrix. Subsequently, the features in each dimension are normalized to ensure that features with different dimensions fall within a uniform numerical range, avoiding unreasonable influences from features with larger value scales in subsequent fitness assessments.

[0028] When initializing the beluga whale population, the dimension of the position vector for each individual is kept consistent with the total number of flow features. After mapping using the sigmoid function, if the binary value corresponding to a certain dimension is 1, the corresponding flow feature is retained in the candidate subset; if the value is 0, the corresponding flow feature is removed from the candidate subset. Therefore, a single beluga whale individual can represent a subset of candidate features that can be used for classifier training and validation.

[0029] Step 2, Fitness Function Construction and Evaluation. Specific steps: Construct a multi-objective fitness function: .in, , The accuracy of the XGBoost classifier obtained through K-fold cross-validation; The number of features currently selected; The total number of features; Set as In the iterations, the algorithm aims to minimize the fitness function value. Problem solved and effect achieved: It addresses the difficulty of balancing detection accuracy and feature dimensionality in malware detection. By setting... =0.01 prioritizes classification accuracy, while the penalty term prompts the algorithm to filter out redundant features, outputting a concise and efficient feature subset.

[0030] During fitness calculation, the algorithm first extracts a subset of candidate features from the full feature matrix based on the binary feature selection vector, and then uses this subset as the input features of the XGBoost classifier. The classifier outputs the classification accuracy through K-fold cross-validation, and obtains the classification error rate accordingly; at the same time, it calculates the ratio between the number of features contained in the current candidate feature subset and the total number of features, as the feature selection rate.

[0031] The optimization objective of the fitness function described above is to minimize the fitness value. When a subset of candidate features contains fewer features while maintaining a low classification error rate, its fitness value is smaller, making it more likely to be retained and used as the search direction for subsequent iterations. Thus, the fitness function unifies detection performance and feature compression within the same evaluation framework, avoiding the retention of too many redundant features in pursuit of accuracy, and also avoiding a decline in detection performance due to excessive feature compression.

[0032] Step 3: Dynamic Nonlinear Equilibrium Control. Specific operation: Calculate the dynamic nonlinear equilibrium parameters during population iteration. The calculation formula is: .in This represents the current iteration number. This represents the maximum number of iterations. By combining the hyperbolic tangent and sine functions of the first term with the cosine function of the second term, we achieve... This generates complex nonlinear dynamic fluctuations. The problem solved and the effect achieved: It resolves the issue of the linearly decreasing balance factor in the original White Whale algorithm, which is difficult to adaptively adjust. This allows the algorithm to increase the fluctuation amplitude in the early iterations to enhance the global search, and to stabilize the fluctuations in the later stages to enhance the local search, thus precisely scheduling the exploration and development phases.

[0033] In each iteration, the dynamic nonlinear equilibrium parameter is updated based on the current iteration number and the maximum iteration number. The periodic term in this parameter maintains the perturbation capability of the search process, while the nonlinear term adjusts the perturbation amplitude as the iteration progresses, allowing the population to exhibit different search tendencies at different stages. In the early stages of iteration, the algorithm tends to expand the search range to explore more potential feature combinations; in the later stages, the algorithm tends to focus on local exploitation around existing good solutions to improve convergence accuracy.

[0034] This control method overcomes the shortcomings of linear balance factors that change only according to a fixed trend, allowing the exploration and development phases to no longer switch mechanically, but instead exhibit more complex dynamic changes based on the iterative process. For the large number of redundant and noisy features present in the high-dimensional feature space of malicious traffic, this mechanism helps improve global search coverage and reduce premature convergence.

[0035] Step 4: Enhanced fall behavior update guided by global optimum. Specifically, in each update iteration, the whale fall probability is calculated. If the parameter Then, the mutation strategy is implemented to introduce a globally optimal solution. The updated formula is: ,in .like Then execute: Problems solved and effects: This addresses the issues of the original whale fall mechanism's over-reliance on random perturbations and lack of optimal solution guidance. By introducing potentially optimal location information, it significantly increases the probability of the population escaping local optima when trapped in local clustering.

[0036] In this step, the algorithm continuously records the individual with the smallest fitness value in the current population as the global optimum. When performing the enhanced fall behavior, the position information of this global optimum is introduced into the position update process, so that the individual to be updated is not only affected by random perturbations, but also guided by the directionality of the currently known good feature subset. The updated continuous position values ​​are then subjected to boundary constraints and subsequent discretization processing to form a new candidate feature subset.

[0037] By introducing global optimal location information, whale fall behavior is transformed from simply simulating random individual migration into a perturbation update that combines randomness and directionality. When the population becomes overcrowded in a certain area, this mechanism can use discovered favorable search directions to guide individuals away from the local clustering area, thereby increasing the probability of escaping the local optimum.

[0038] Step 5: Failure parameter verification and mutation mechanism. Specifically, a stall counter is maintained during algorithm execution. Mutation is triggered when a better fitness value is not found after multiple consecutive attempts (e.g., 10 times). The adaptive variable-length fitness calculation is as follows: Then the mutation vector is calculated: ,in Finally, Apply to the current individual and perform boundary checks: Problem solved and effects: It compensates for the original algorithm's lack of an explicit stagnation detection mechanism. By triggering large-step mutation, it effectively increases the population diversity during stagnation periods, significantly improving the algorithm's global search capability and convergence robustness.

[0039] In this step, the algorithm compares the current best fitness value with the historical best fitness value after each iteration. If no better fitness value is obtained after several consecutive iterations, the current search process is considered to have entered a stagnant state, triggering a failure parameter check mutation. The variable iteration length is adaptively determined based on the current iteration count and the maximum iteration count, allowing the algorithm to use perturbations of different intensities at different iteration stages.

[0040] After mutation is triggered, the algorithm generates a mutation vector and superimposes it onto the current beluga whale's position vector. Boundary checks are then performed to ensure the updated position remains within the allowed search space. This mechanism provides an additional source of perturbation for stagnant populations, enabling the algorithm to re-search for insufficiently explored feature combinations, thereby improving global search capabilities and convergence robustness.

[0041] Overall execution results: as shown in the attached document. Figures 3 to 6As shown, the improved EABWO algorithm was validated on the Edge-IIoTset and USTC-TFC2016 datasets. Ultimately, EABWO only needs to retain 3 to 13 core features to complete the detection. It achieved a peak classification accuracy of 99.99% in binary classification and 99.85% and 99.95% accuracy in multi-class classification tasks, respectively. By trading offline computing power for online efficiency, it significantly reduces the real-time detection burden on IoT edge nodes, demonstrating high value for industrial deployment.

[0042] In one specific embodiment, the experimental setup can use a CPU i5-12400F, 32GB of RAM, and a 3060Ti 8GB graphics card; the population size can be set to 30, the maximum number of iterations can be set to 50, the feature penalty coefficient α can be set to 0.01, and the random seed can be fixed at 42. To reduce the influence of chance, multiple independent repeated experiments can be conducted, and a cross-validation strategy can be used in the classifier evaluation stage to evaluate the generalization ability of the candidate feature subset.

[0043] In another specific embodiment, the invention was validated using the Edge-IIoTset dataset and the USTC-TFC2016 dataset. Evaluation metrics included classification accuracy, precision, recall, F1 score, best fitness score, average fitness score, number of feature selections, and fitness variance or standard deviation. These metrics reflect both the classification and detection performance, as well as the simplification of the feature subset and the stability of the optimization process.

[0044] Experimental results show that this invention, through the synergistic effect of dynamic nonlinear balance control, globally optimal guided fall behavior, and failure parameter verification mutation mechanism, maintains strong global search capability and stable convergence performance in complex high-dimensional traffic feature spaces. Compared with comparative algorithms such as GA, PSO, ABC, BA, and the original BWO, this invention can achieve lower fitness values ​​and higher detection performance with fewer features, making it suitable for offline feature selection and deployment to edge detection nodes with high real-time requirements.

[0045] To further verify the effectiveness of the EABWO algorithm proposed in this invention, it was compared with existing multi-swarm intelligence optimization algorithms (including GA, PSO, ABC, BA, and BWO) on two public datasets. The test metrics included best fitness, number of features selected, precision, recall, and F1 score for binary and multi-class classification tasks. The specific comparison results are shown in Table 1.

[0046] Table 1 compares the feature selection performance of each algorithm on the Edge-IIoT and USTC-TFC2016 datasets.

[0047]

[0048] As shown in Table 1, in binary classification tasks, the embodiments of the present invention achieved a classification accuracy of 99.99% on both datasets, with optimal fitness values ​​as low as 0.00066667 and 0.00038961, respectively. This demonstrates a high detection accuracy while achieving lower fitness values ​​and fewer features. In multi-class classification tasks, the detection accuracy also reached the highest levels of 99.95% and 99.85%, respectively. Compared to the original BWO algorithm and other baseline algorithms, the present invention effectively reduces the feature dimension (retaining only 3 to 13 core features).

[0049] Furthermore, to verify the stability and differences between the method of this invention and existing swarm intelligence optimization algorithms, this embodiment conducted nonparametric statistical tests on the fitness results of each algorithm under different datasets and classification tasks. The test results show that, except for the Edge-IIoT binary classification task where the difference between the method of this invention and the original BWO algorithm was not significant, the method of this invention showed statistically significant differences compared to GA, PSO, ABC, BA, and the original BWO in all other test tasks. This result indicates that, under the experimental conditions of this embodiment, the dynamic nonlinear balance control, globally optimal guided fall behavior, and failure parameter verification mutation mechanism can improve the convergence stability and robustness of the feature selection process.

Claims

1. An enhanced beluga optimization algorithm for feature selection, characterized in that, The enhanced beluga optimization algorithm for feature selection includes: The preprocessing step involves using a traffic extraction tool to extract traffic features from the original traffic file and then normalizing the extracted features. The discretization step constructs a continuous search space for the beluga whale optimization algorithm, and a transformation function is used to map the continuous individual beluga whale positions into discrete binary feature selection vectors. The fitness calculation step involves constructing a fitness function by combining the classification error rate and the feature selection rate, and inputting the binary feature selection vector into the classifier to calculate the fitness value of the individual beluga whale. The optimization iterative process initializes the beluga whale population. During the iterative optimization process, dynamic nonlinear balance control parameters are used to control the search behavior. An enhanced fall behavior strategy guided by the global optimal solution is used to update the position of individual beluga whales. A mutation mechanism that checks for failure parameters is used to trigger mutations to escape local optima when the iteration stops. Finally, a subset of global optimal features is output.

2. The enhanced beluga optimization algorithm for feature selection according to claim 1, characterized in that, The preprocessing steps include: using the CICFlowmeter tool to extract traffic statistics features from the Pcap file and performing normalization to unify the feature dimensions, wherein the normalized feature dimensions correspond one-to-one with the individual location dimensions of the beluga whale population.

3. The enhanced beluga optimization algorithm for feature selection according to claim 1, characterized in that, The discretization step includes: mapping continuous values ​​to a discretized binary space using the Sigmoid transformation function, where the i-th beluga whale individual is represented as... , The value can be 0 or 1. This represents the total number of traffic characteristics.

4. The enhanced beluga optimization algorithm for feature selection according to claim 1, characterized in that, The fitness calculation step includes: the fitness function is... ,in For false alarm rate, , The classification accuracy of the XGBoost classifier. The number of features currently selected. The total number of traffic features, The set value is a balance coefficient of 0.

01.

5. The enhanced beluga optimization algorithm for feature selection according to claim 1, characterized in that, The dynamic nonlinear equilibrium control parameters in the optimization iteration step The defining formula is: ,in This represents the current iteration number. This represents the maximum number of iterations.

6. The enhanced beluga optimization algorithm for feature selection according to claim 5, characterized in that, The enhanced fall behavior strategy in the optimization iteration step includes: using the global optimal solution location to guide the beluga whale population to find a new location, when the dynamic nonlinear equilibrium control parameters... The probability of a whale fall is greater than or equal to a linearly decreasing probability. Execute step-size mutation based on global optimal guidance when Less than Position updates are performed in conjunction with random perturbations.

7. The enhanced beluga optimization algorithm for feature selection according to claim 6, characterized in that, The specific position update formula for the step-size mutation based on global optimal guidance is as follows: ,in , For the current number The location of the individual beluga whale For the updated number The location of the individual beluga whale This represents the position of the global optimal solution in the current iteration. This is the enhancement coefficient.

8. The enhanced beluga optimization algorithm for feature selection according to claim 1, characterized in that, The failure parameter verification and mutation mechanism in the optimization iteration step includes: triggering mutation when a better fitness value is not found after multiple consecutive iterations; and adjusting the mutation based on the current iteration number. and maximum number of iterations Adaptively calculate the variable length; calculate the mutation vector and apply it to the beluga whale's position for boundary checks.

9. The enhanced beluga optimization algorithm for feature selection according to claim 8, characterized in that, The formula for adaptively calculating variable asynchronous length is: ,in As the upper limit boundary, As the lower boundary, To generate A standard normal distribution random vector.

10. The enhanced beluga optimization algorithm for feature selection according to claim 9, characterized in that, The formula for calculating the mutation vector and applying it to the beluga whale's location is: Mutation Vector ,in Updated location .

Images