321 results about "Traffic identification" patented technology

The invention discloses a lightweight malicious network traffic detection method based on heterogeneous modal feature fusion, and mainly solves the problems of low feature extraction efficiency and insufficient single modal feature representation of the existing method. Comprising the following steps: acquiring and optimizing a network flow data set, preprocessing the network flow data set, and extracting and generating spatial feature, time sequence feature and behavior pattern feature vectors; an improved self-attention mechanism network is constructed, a lightweight heterogeneous modal feature fusion model LMF is designed, multi-modal feature deep fusion is performed through dynamic weight distribution, a lightweight classification model is trained, and the model is utilized to detect network malicious traffic. Through the lightweight heterogeneous modal feature fusion model LMF and in combination with a dynamic weight distribution mechanism, spatial distribution, time sequence dependence and behavior semantic information of network traffic are deeply mined, data processing efficiency, malicious traffic detection accuracy and system robustness are improved, and the method is suitable for efficient malicious traffic identification and defense in the field of network security.

The invention discloses an encrypted malicious traffic detection method based on a multi-scale space-time interaction graph network, and the method comprises the steps: constructing an intra-flow traffic interaction graph network based on the interaction relation of data packets between a client and a server in a flow; constructing an intra-stream flow interaction graph feature extractor, and obtaining local feature information of the stream; constructing an inter-flow space-time diagram; constructing an inter-stream space-time diagram feature extractor, and obtaining space-time feature information of the streams; obtaining multi-scale fusion features according to a multi-scale feature fusion module; obtaining a normal flow depth single classification model; obtaining a malicious traffic depth single classification model; acquiring to-be-measured traffic data, and respectively inputting the normal traffic depth single classification model and the malicious traffic depth single classification model to obtain classification results; and detecting the traffic category based on the classification result. According to the invention, the malicious traffic identification accuracy is improved.

The invention relates to the technical field of Internet of Things anomaly identification, in particular to an Internet of Things anomaly traffic identification method and system based on a deep neural network. The method comprises the following steps: collecting communication data of each piece of IoT equipment in real time from an edge gateway of the Internet of Things; preprocessing the collected communication data, and constructing a multi-dimensional feature vector; based on a convolutional neural network and a bidirectional long-short-term memory network, performing time sequence feature extraction and anomaly discrimination on the multi-dimensional feature vector to output a traffic anomaly probability; and comparing the abnormal probability output by the depth time sequence modeling neural network with a dynamic threshold value, and if the abnormal probability exceeds a preset threshold value, determining that the traffic is abnormal. A gating mechanism is introduced into a bidirectional long-short-term memory layer, a gating coefficient is calculated at a time step level, the influence weight of time step information on final output is dynamically adjusted, feature expression of key time steps is strengthened, noise or irrelevant information is suppressed, and the sensitivity of a model to time sequence data is improved.

The invention provides a safety protection method and device for an intelligent networked automobile, and the method comprises the steps: detecting a vehicle control abnormal instruction in a communication process between a target vehicle and a cloud end based on a vehicle control behavior characterization model and an abnormal behavior classification learning model; and based on the malicious traffic identification model, identifying hidden malignant traffic in the process of communication between the target vehicle and the cloud, through a deep reinforcement learning confrontation defense mode, a decision control model is trained according to a vehicle control abnormal instruction and hidden malignant flow, and the decision control model is used for carrying out safety protection on the intelligent network connection vehicle. Therefore, high-precision and high-reliability detection of attacks such as vehicle control instruction tampering attacks and strongly hidden malicious traffic under the intelligent network connection vehicle-cloud cooperation scene is realized, the attack concealment and attack efficiency are effectively improved, the robustness and generalization of the model are enhanced, and the method is suitable for the intelligent network connection vehicle-cloud cooperation scene. And the communication safety, the data safety and the driving safety of the intelligent networked automobile ecological system are improved.

The invention provides an abnormal network traffic identification method based on small sample data enhancement, and the method comprises the steps: S1, converting one-dimensional traffic data into a two-dimensional gray-scale map, and employing a twin network combined with a dynamic attention mechanism to analyze the differences between various types of traffic data pair by pair; parameters of an attention mechanism in the twinborn attention network are analyzed, and inter-class difference features are identified; s2, selecting a training domain by using the inter-class feature difference matrix, introducing a comparative learning method to judge the difference between real data and generated data, and generating an enhanced data set for each class of traffic; s3, after the enhanced data set issued by the central server is received, each edge server uses the enhanced data set and local sample data to train the twinborn attention network in the step S1; due to different local sample data sets, each edge server is trained to obtain a personalized abnormal traffic identification and classification model suitable for local data distribution, and abnormal traffic is effectively classified.

The invention discloses a method and a system for detecting malicious encrypted traffic of a CNN (Convolutional Neural Network) and a Swin-Transform, and relates to the technical field of network security, comprising the following steps: preprocessing encrypted traffic data, and dividing a preprocessed encrypted traffic data set into a plurality of subsets; carrying out feature extraction on the preprocessed data by utilizing a CNN (Convolutional Neural Network) and a Swindow-Transform, and carrying out feature fusion; and inputting the fused features into a full connection layer, processing and outputting a detection result. Malicious behaviors can be effectively detected without decrypting the traffic, so that the data privacy is protected and the decryption complexity is reduced; the CNN is combined to extract the local features and the Swin Transform is combined to extract the global features, so that the multi-dimensional features in the traffic can be comprehensively captured, and the detection precision and efficiency are remarkably improved. Meanwhile, the model has strong robustness and generalization ability, and can still maintain efficient malicious traffic identification in a complex network environment.

The invention discloses a traffic identification method, a traffic identification device and electronic equipment. The method comprises the following steps: acquiring encrypted traffic data in a network; packet-level feature extraction and flow-level feature extraction are carried out on the encrypted traffic data, packet-level features and flow-level features corresponding to the encrypted traffic data are obtained, and the packet-level features are used for representing attribute features of a single data packet in the encrypted traffic data; the flow level feature is used for representing the feature of the whole data flow corresponding to the encrypted flow data; fusing the packet level feature and the flow level feature to obtain a fusion feature corresponding to the encrypted flow data; and carrying out classification identification on the fusion features to obtain a classification result of the encrypted traffic data. According to the method and the device, the technical problem that the identification accuracy of the encrypted traffic application is relatively low due to the fact that the encrypted traffic content is invisible and deep information in traffic data is difficult to fully mine by a single feature extraction method in related technologies is solved.

The invention is suitable for the technical field of network security, and provides an abnormal traffic identification method, device and equipment, a medium and a computer program, and the method comprises the steps: obtaining a comprehensive traffic feature of a to-be-detected traffic; the total data amount of the to-be-detected traffic is obtained through a pre-trained algorithm distribution model, a recognition algorithm corresponding to the to-be-detected traffic is output based on the total data amount, the recognition algorithm is a first clustering algorithm or a second clustering algorithm, and the total data amount of the traffic suitable for the first clustering algorithm is larger than the total data amount of the traffic suitable for the second clustering algorithm; classifying the traffic to be detected according to the comprehensive traffic features, the recognition algorithm and a plurality of abnormal centers corresponding to the recognition algorithm; and under the condition that the to-be-detected traffic belongs to any abnormal center, determining that the to-be-detected traffic is abnormal traffic. According to the invention, anomaly identification during traffic classification for different conditions is realized, and the accuracy, efficiency and automation degree of abnormal traffic identification can be improved.

The invention discloses an LSTM (Long Short Term Memory)-based fraud-related network traffic identification method and a server, and is applied to the field of network traffic analysis. According to the method, original flow data are collected in real time through network flow collection equipment, communication feature data and behavior feature data are extracted from each communication address, and weighted combination is carried out by adopting adaptive weight coefficients based on feature matching degree and feature abnormality to obtain a suspicious degree score; and outputting an early warning result to the communication address exceeding the preset suspicious threshold. According to the technical scheme provided by the invention, a multi-layer fraud-related network flow identification architecture and a closed-loop feature evaluation mechanism are constructed, so that the identification accuracy of continuously changing fraud-related communication behaviors is effectively improved.

The invention discloses a traffic checkpoint holographic recognition method and system based on multi-mode perception and a medium, and relates to the technical field of traffic management, and the method comprises the steps: collecting an original perception data set in real time through a multi-mode sensor array disposed at a target traffic checkpoint; performing time-space synchronization processing on the original sensing data set to generate a multi-modal data frame sequence; performing fusion processing on the multi-modal data frame sequence by using a deep learning model to generate a holographic feature vector of the target vehicle; and based on the holographic feature vector, target identity recognition and behavior analysis of the target vehicle are carried out, a recognition result is output, and abnormal event early warning is carried out. The technical problems of low traffic recognition precision and insufficient real-time performance caused by the fact that an existing traffic monitoring system cannot efficiently fuse various sensor data for holographic recognition are solved, and the technical effect of improving traffic management efficiency and safety through multi-modal data space-time synchronization and deep feature fusion is achieved.

The invention discloses a flow characteristic adaptive QoS intelligent prediction adjustment method, and relates to the field of network flow management, and the method comprises the steps: 1, collecting flow data in real time, and constructing a multi-dimensional characteristic vector based on protocol types, port numbers and user behavior dynamic classification; 2, high-frequency / low-frequency components are separated, and QoS parameter prediction is output through fusion of an LSTM short-term prediction module and a periodic trend analysis module; 3, solving a resource pre-allocation scheme by adopting reinforcement learning by taking minimization of packet delay as a target; and 4, executing traffic identification, speed limiting and priority queue scheduling by using NPU hardware unloading. According to the method, the precision is improved through a high-frequency / low-frequency combined prediction architecture, decision delay is compressed to a large extent through reinforcement learning and NPU cooperation, and meanwhile online model iteration is achieved through a prediction error triggering mechanism.

The invention relates to the technical field of encrypted traffic identification, and discloses a deep learning industrial malicious encrypted traffic identification method based on multi-feature fusion. According to the method, traffic basic features and traffic fingerprint features of a training sample data packet are extracted, feature fusion is carried out, the features are used as input of a deep neural network model, the deep neural network model is trained, a multi-head self-attention mechanism is adopted to carry out deep extraction on an original data packet, and global feature values are obtained; the extracted traffic feature vector has context information, and a residual network and nonlinear operation are introduced, so that the problem of gradient explosion / disappearance in the training process is solved, and the accuracy of the traffic feature vector is improved. The method has the characteristics of high detection precision and accurate identification for the industrial malicious encrypted traffic.

The invention provides a traffic jam intelligent identification method and system based on deep learning. The method comprises the steps of obtaining a multi-source traffic recognition optimized data set by obtaining and optimizing a multi-source traffic recognition data set, then constructing traffic scene label feature data, recognizing dynamic traffic scene category feature data, evaluating a traffic jam initial evaluation index, analyzing a traffic jam recognition influence factor, and optimizing to obtain a traffic jam correction index. And finally, performing threshold value comparison with a preset dynamic traffic jam identification threshold value, judging whether traffic jam exists or not according to a threshold value comparison result, analyzing and identifying a jam cause, and generating an intelligent traffic jam identification report at the same time. According to the invention, multi-source heterogeneous data is collected, data fusion and feature extraction are completed through the deep learning model, congestion identification is realized by combining dynamic scene classification and adaptive threshold determination, and congestion cause tracing analysis is completed by using the deep learning classification model, so that traffic congestion intelligent identification based on deep learning is realized.

The invention provides a network traffic identification method and system for an unknown cryptographic protocol, and relates to the technical field of network traffic analysis, and the method comprises the steps: carrying out the preprocessing of captured dynamic traffic data, and obtaining target traffic data; acquiring a multi-dimensional feature parameter set based on predetermined feature dimension collection; constructing an initial knowledge graph, and introducing a graph dimension reduction mechanism to carry out dimension reduction processing to obtain a target knowledge graph; performing clustering analysis on the network flow knowledge graph database to obtain a target class cluster; reading a predetermined clustering degree evaluation strategy, and performing clustering degree evaluation analysis to obtain a target clustering degree; and if the preset clustering degree limit value is reached, marking the target protocol type corresponding to the target class cluster as the protocol type of the target traffic data. The technical problem that in the prior art, a static feature recognition method is generally adopted, effective detection on an unknown password protocol is lacked, the requirement for continuous evolution of the protocol cannot be met, and then network security vulnerabilities are caused is solved.

An efficient open set encryption traffic identification method for super-large scale traffic relates to the technical field of data security, solves the technical problems of insufficient resource efficiency, feature expression and open set identification in the prior art, and comprises the following steps: S1, inputting a network traffic data set, and generating dimension reduction data of an optimal dimension through a PCA dimension reduction algorithm; s2, inputting the dimension reduction data of the optimal dimension into an improved MobileNetV3 model, and in combination with an improved SE attention mechanism and a composite structure of Dense connection and residual connection, extracting features and outputting a classification result; s3, judging whether a classification result belongs to a known category, a drift sample or an unknown category by using an open set recognition algorithm based on confidence; s4, if the classification result is a drift sample or an unknown category, incremental learning based on knowledge distillation is started, parameters of the improved MobileNetV3 model are updated, and old knowledge is reserved. According to the invention, the network security protection capability can be effectively improved.

The invention discloses a PCDN traffic identification method, apparatus and device, and a medium. The method comprises the steps of periodically obtaining multicast traffic data in a set time period; inputting the multicast traffic data into a trained PCDN traffic identification model for processing to obtain a PCDN traffic probability output by the PCDN traffic identification model; and comparing the PCDN traffic probability with a set probability threshold to obtain a comparison result, and determining whether the multicast traffic data has PCDN traffic within a set time period based on the comparison result. According to the method, the accuracy of PCDN flow identification can be improved, and the efficiency of PCDN flow identification can be improved.

The invention discloses a Tor network exit traffic identification system and method fusing a multi-scale LSTM and a Transform network, and belongs to the technical field of anonymous network traffic analysis and network security. The system comprises five core components, namely a multi-scale feature extraction module, a feature fusion module, a global dependency modeling module, a dynamic weighted aggregation module and a classification module. The multi-scale feature extraction module adopts parallel bidirectional LSTM branches with different time resolutions to capture a microcosmic burst mode and a macroscopic session behavior at the same time; the feature fusion module unifies the scale features to the same time sequence length and splices the scale features; the global dependence modeling module utilizes a multi-head self-attention mechanism to learn long-distance time sequence dependence; the dynamic weighted aggregation module highlights a key time slice through adaptive weight pooling; and the classification module outputs website category labels. According to the system, the recognition accuracy on a GTT23 data set is remarkably improved compared with that of an existing method, and good recognition capability and robustness are shown for various flow defense mechanisms.

The invention discloses a computer network security monitoring method. The method comprises the following steps: S1, data acquisition and extraction; s2, data analysis and clustering; s3, identifying and classifying potential threats; s4, dynamic monitoring and early warning are carried out; s5, an automatic response mechanism; s6, abnormal traffic analysis and identification; and S7, analyzing and optimizing. According to the invention, through feature extraction, deep clustering analysis, abnormal traffic identification, danger level endowing and automatic response strategy generation of network traffic, comprehensive monitoring and response to network security threats are realized; the flow classification accuracy is effectively improved, resources can be more accurately concentrated in real threats, the false alarm rate is reduced, the known attack can be quickly identified, unknown attack behaviors can be deduced and analyzed through deep analysis, and the flow classification efficiency is improved. The double protection means greatly improves the protection capability of the system to complex and diversified attacks.

The invention discloses a multi-source heterogeneous network security method and an intelligent terminal, and relates to the technical field of data security, and the method comprises the steps: constructing a first traffic feature sub-graph according to first network traffic data, and constructing a second traffic feature sub-graph according to second network traffic data; performing node feature remapping on the second traffic feature sub-graph according to the first traffic feature sub-graph to obtain a cross feature sub-graph; performing node feature correction on the first flow feature sub-graph according to the cross feature sub-graph to form a fusion feature sub-graph; calculating a topological correlation entropy between nodes according to the fusion feature sub-graph, updating a node connection relationship based on the topological correlation entropy to obtain a dynamic fusion feature graph, and reversely updating node features in the cross feature sub-graph according to the dynamic fusion feature graph; according to the method, the traffic structure change can be dynamically perceived, the identification capability on potential attack behaviors is enhanced, and security risk detection and abnormal traffic identification are stably and efficiently carried out in a multi-source and dynamically changed complex network environment.

The invention provides a network abnormal traffic identification method and system applied to big data, and the method comprises the steps: receiving an original traffic data stream flowing in a network transmission link, and extracting the associated attribute information carried by the original traffic data stream; performing link association analysis processing on the original traffic data flow to obtain a traffic association map and traffic transmission link characteristics; and inputting the traffic association map and the traffic transmission link features into a preset anomaly identification network, and generating traffic anomaly association features through hierarchical interaction processing. And triggering a classification decision-making mechanism based on the traffic anomaly association features, and outputting an anomaly identification result of the network traffic. And finally, generating flow control guide information according to an abnormal identification result, and sending the flow control guide information to a flow control node to execute a control operation. According to the method, flow data are analyzed from multiple dimensions, association between features is fully mined, accurate identification and effective management and control are realized, the capability of the network to deal with abnormal flow is effectively improved, and stable operation of the network and data security are guaranteed.

The invention relates to a cross-end traffic identification and user behavior attribution analysis method and system. The method comprises the following steps: obtaining a user behavior data set according to application store advertisement click data and landing page downloading data; matching the user behavior data set through a preset equipment fingerprint database to obtain a global user identifier and real-time behavior data corresponding to the user behavior data set; classifying the users through a sliding window algorithm according to the global user identifier and the real-time behavior data to obtain new users and active users; attributing the newly-added users and the active users to obtain attribution results of the newly-added users and attribution results of the active users; and integrating the attribution result of the new user, the attribution result of the active user and the historical new attribution rule calculation result to generate the real-time inquirable channel efficiency, so that the method has the advantages of effectively avoiding the settlement misjudgment and realizing the channel efficiency optimization under the complex business scene of the specific financial field.

The invention discloses a network security-oriented abnormal traffic identification processing method. The method comprises the following steps of: constructing a traffic baseline model of target network link access equipment in different scenes and time windows based on historical traffic data; collecting flow characteristic data and bandwidth characteristic data of the equipment in real time, comparing the data with the flow baseline model, and identifying abnormal equipment through the baseline deviation degree; the content type is identified by using URL classification and deep packet inspection technologies, and the destination and the anomaly degree of the abnormal traffic are determined in combination with the attribute and traffic consumption of the known type of content and the traffic consumption and bandwidth occupation duration of the unknown type of content; and generating a detection report and pushing the detection report to an administrator terminal. Through scene-divided and multi-dimensional dynamic baseline modeling and flow feature and bandwidth feature fusion collaborative analysis, abnormal equipment and flow are accurately identified, the misjudgment rate is reduced, the network security operation and maintenance efficiency is improved, and the method is suitable for abnormal flow monitoring of various network environments.

The invention provides a VPN traffic identification method and system based on multi-model fusion, and the method comprises the steps: splicing a Pcap file traffic feature vector with a geographic feature vector, carrying out the traffic class prediction through employing a random forest model and an LSTM network model, and splicing prediction results as the input of a meta-model, and obtaining a final prediction result. According to the invention, efficient network flow monitoring, feature extraction and decision support are realized. Cooperative work among the modules provides powerful technical support for network security monitoring, and can effectively deal with complex network security threats. According to the method, the Vmess and Shadowsockets effects are researched and judged through multi-model fusion, and the effect is improved by 5% compared with the effect of a single algorithm; by obtaining the first 100 frames of the Pcap packet and abandoning the subsequent flow, the research and judgment accuracy is not reduced, and the research and judgment time is shortened to 40% of the original time.

The invention discloses an abnormal traffic monitoring method and system based on a security gateway, and the method comprises the steps: obtaining a TLS handshake feature in a traffic request in response to the traffic request of a target user, and carrying out the Hash calculation of the TLS handshake feature, and obtaining a JA3 Hash fingerprint; performing three-level cache matching on the JA3 hash fingerprints in sequence, and extracting fingerprint tags of the JA3 hash fingerprints which are not matched in three-level cache; performing feature extraction on the traffic data corresponding to the fingerprint tag to obtain traffic features; and inputting the traffic characteristics into a pre-trained abnormal traffic identification model based on Transform to obtain an abnormal traffic identification result. According to the method provided by the invention, the detection precision of the abnormal traffic is improved.

The invention relates to a PCDN traffic identification control method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the steps of obtaining traffic access records of a plurality of candidate broadband users, performing PCDN feature recognition and reasoning on the traffic access records of the plurality of candidate users to obtain PCDN traffic information, the PCDN traffic information comprising PCDN broadband user accounts and PCDN traffic identifiers, sending the PCDN traffic information to a management and control device, and sending the PCDN traffic information to the management and control device. The PCDN flow information is used for the management and control equipment to position the PCDN flow so as to manage and control the PCDN flow. The PCDN traffic can be accurately identified, the PCDN traffic is effectively controlled, and other normal service traffic of a user is not affected.

The invention discloses a method and a system for identifying general overseas VPN (Virtual Private Network) proxy traffic based on a TCP (Transmission Control Protocol). The method comprises the following steps: S1, carrying out switch TCP traffic mirroring and session SYN related time delay calculation; s2, performing hash table interaction and time delay calculation under downlink message load distinguishing; s3, on the basis of judgment of the time delay # imgabs0 # and a threshold value D, counting and logic insertion are carried out on the HashVPS hash table; s4, periodically triggering HashVPS traversal and VPS proxy service affirmation in a timing manner; the system is suitable for the general overseas VPN proxy traffic identification method based on the TCP protocol. Aiming at various TCP transmission VPN protocols, the method breaks through conventional identification limitation, is not afraid of encryption, disguising and mining proxy traffic characteristic differences, constructs a complete identification closed loop, accurately screens out proxy traffic, and builds a network security defense line.

The invention is suitable for the field of vehicle information security, and provides a CAN intrusion detection method based on a signal relation graph Transform, which comprises the following steps: converting a frame sequence of a CAN network into a signal sequence, deeply mining key signal features in a message, systematically analyzing complex relevance between signals, and constructing a signal node feature representation system. In order to further improve the detection precision, the method uses a graph attention network and a Transform model, and optimizes the extraction and learning process of input signal features, thereby significantly reducing the false alarm rate in abnormal traffic recognition. By accurately capturing abnormal behaviors in the CAN network, the method can effectively cope with potential network attacks, meets the requirements of the advanced intelligent networked vehicle for functional security and network security, and provides important technical support for realizing a high-reliability and high-security vehicle-mounted communication system.

The invention discloses a time fine-grained network flow identification method and system, and belongs to the technical field of communication networks, and the method comprises the steps: firstly collecting a data flow generated by a communication data network, and compressing the data flow to obtain compressed network flow data; performing segmentation and data cleaning according to the quintuple, standardizing the length of the network flow data of each flow, and converting the standardized network data flow into a gray image in a binary form; and finally, cooperatively carrying out network traffic joint identification on the generated grayscale image through an HMAT algorithm and a network traffic identification method combined with LSTM improved space-time vision Transform, and obtaining an identification result. The method not only improves the precision and efficiency of traffic classification, but also can adapt to diversified requirements in a complex network environment in real time, and provides powerful technical support for network security management and service quality optimization.

The invention relates to the technical field of Internet of Things, in particular to an Internet of Things card abnormal traffic identification and multistage response control system, which comprises a quantum key distribution and generation module, a data acquisition and preprocessing module, an abnormal traffic identification module, a multistage response execution module and a quantum security management module. According to the method, the preprocessed traffic features are converted into low-dimensional core fingerprints, high-robustness detection of encrypted traffic anomalies is realized by combining a quantum heuristic CNN and gradient mask adversarial training hybrid intelligent model, and the detection accuracy is guaranteed by matching risk score quantification anomaly degree and baseline dynamic update. According to the method, the pain points that in traditional encrypted traffic detection, identification is difficult without decryption, and adversarial attack is likely to happen are effectively solved, and the security, robustness and reliability of Internet of Things card traffic management and control are remarkably improved.

The invention discloses a real-time isolation method and device based on AI traffic anomaly recognition, and relates to the technical field of network security and artificial intelligence, and the method comprises the steps: collecting network traffic data based on a preset traffic path, fusing communication protocol data, timestamp data, source address data and target address data, and obtaining a fusion result; the method comprises the steps of generating a traffic behavior model, analyzing the traffic behavior model, determining abnormal features in traffic behaviors and a distribution mode of the abnormal features, and switching a current traffic processing task to an isolation task when the distribution mode of the abnormal features meets a preset isolation condition. And generating an isolation area and an isolation signal according to the distribution mode of the abnormal characteristics, and executing an isolation task based on the isolation area and the isolation signal. By means of the mode, the technical problem that in the prior art, the processing efficiency of abnormal flow recognition and isolation is low is solved.