CN111970169A - Protocol flow identification method based on GRU network - Google Patents

Abstract

The invention discloses a protocol traffic identification method based on GRU network, comprising the following steps: performing data preprocessing on different protocol traffic samples to obtain a training sample set conforming to the input data format of the GRU network, and using the training sample set to identify the GRU network Model training; perform data preprocessing on unknown protocol traffic to obtain spatial location feature data with time series, and input it into the trained GRU network model; use the trained GRU network model to preprocess the unknown protocol traffic Identify, and finally get the predicted label. The present invention completes the feature extraction of data packets through data preprocessing, which can effectively overcome the difficulty of manually extracting features; moreover, the construction and use of the GRU network model effectively improves the accuracy of protocol identification; in addition, the information in the flow interaction process, Because it involves two levels of spatial location features and timing features, the effect of protocol traffic identification is more significant.

Description

A Protocol Traffic Identification Method Based on GRU Network

technical field

The invention relates to the field of computer network traffic analysis, and more particularly, to a protocol traffic identification method based on a GRU network.

Background technique

Protocol traffic identification refers to extracting key features that can identify network protocols from network traffic carried by the TCP/IP protocol through manual analysis or automated means, and then accurately identifying the protocols to which network traffic belongs based on these features. Protocol identification technology helps to analyze the composition of network traffic, and can provide data support for many research fields such as network management and maintenance, network content auditing, and network security defense. However, in the face of today's large-scale, diversified, and high-capacity network traffic, how to improve the accuracy of protocol identification is a huge challenge.

Protocol traffic identification methods mainly include protocol identification methods based on preset rules, protocol identification methods based on load characteristics, protocol identification methods based on host behavior, and protocol identification methods based on machine learning. Deep learning has advantages in classification, but the existing protocol traffic identification methods also have the problem of difficulty in manually extracting features.

In the prior art, the Chinese invention patent with publication number CN107682216A discloses a deep learning-based network traffic protocol identification method on February 9, 2018, which utilizes the similarity between network flow data and images to bypass traffic characteristics In the work of value selection and extraction, the network flow data is directly used as the input of the convolutional neural network to perform supervised learning, train the network traffic protocol recognition model, and realize the network traffic protocol recognition function. Although this scheme uses the network traffic protocol samples to be identified for the training of the convolutional neural network, and can automatically extract features that are beneficial to the classification task to a certain extent, it does not solve the difficulty of existing manual feature extraction and accurate protocol identification. Therefore, users urgently need a protocol traffic identification method based on GRU network.

SUMMARY OF THE INVENTION

In order to solve the problems that the existing manual feature extraction is difficult and the protocol identification accuracy is not high, the invention provides a protocol traffic identification method based on a GRU network.

The primary purpose of the present invention is to solve the above-mentioned technical problems, and the technical scheme of the present invention is as follows:

A method for identifying protocol traffic based on GRU network, comprising the following steps:

S1: Perform data preprocessing on traffic samples of different protocols to obtain a training sample set conforming to the GRU network input data format, and use the training sample set to train the GRU network model;

S2: Perform data preprocessing on unknown protocol traffic to obtain spatial location feature data with time series, and input them into the trained GRU network model;

S3: Use the trained GRU network model to identify the unknown protocol traffic after data preprocessing, and finally obtain the predicted label.

Preferably, the data preprocessing in steps S1 and S2 includes traffic segmentation, data packet clustering, and session data conversion.

Preferably, the basic unit of the traffic segmentation is a session.

Preferably, the data packet clustering is performed using a K-means algorithm.

Preferably, the session data conversion is to replace the content format of each data packet after traffic segmentation with a distance set, and the distance calculation formula used is:

Among them, the Max Subsequence function is the longest common continuous sequence identification algorithm between each data packet and each cluster center; D _{(x, centroid)} is the distance between each data packet and each cluster center.

Preferably, the GRU network model includes an input layer, a Masking layer, a first GRU layer, a second GRU layer, a fully connected layer, and an output layer; wherein:

The Masking layer is connected to the input layer and the first GRU layer respectively;

The second GRU layer is connected to the first GRU layer and the fully connected layer, respectively;

The output layer is connected to the fully connected layer.

Preferably, the dimensions of the extracted feature values of the first GRU layer and the second GRU layer are both set to 64.

Preferably, the fully connected layer uses a ReLU function as an activation function.

Preferably, the fully connected layer adopts Dropout to set its ratio to 0.5.

Preferably, the output layer adopts a sigmoid function as an activation function.

Compared with the prior art, the beneficial effects of the technical solution of the present invention are:

The invention completes the feature extraction of data packets through data preprocessing, which can effectively overcome the difficulty of manually extracting features; moreover, the construction and use of the GRU network model effectively improves the accuracy of protocol identification; in addition, the information in the flow interaction process, Because it involves two levels of spatial location characteristics of data packets and timing characteristics between data packets, the effect of protocol traffic identification is more significant.

Description of drawings

Fig. 1 is the general flow chart of the present invention;

Fig. 2 is the flow chart of identifying unknown protocol traffic by GRU network model described in the present invention;

FIG. 3 is a schematic structural diagram of the GRU network model described in the present invention.

Detailed ways

In order to understand the above objects, features and advantages of the present invention more clearly, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be noted that the embodiments of the present application and the features in the embodiments may be combined with each other in the case of no conflict.

Many specific details are set forth in the following description to facilitate a full understanding of the present invention. However, the present invention can also be implemented in other ways different from those described herein. Therefore, the protection scope of the present invention is not limited by the specific details disclosed below. Example limitations.

Example 1

As shown in Figure 1, a method for identifying protocol traffic based on GRU network includes the following steps:

S1: Perform data preprocessing on traffic samples of different protocols to obtain a training sample set conforming to the GRU network input data format, and use the training sample set to train the GRU network model;

S2: Perform data preprocessing on unknown protocol traffic to obtain spatial location feature data with time series, and input them into the trained GRU network model;

S3: Use the trained GRU network model to identify the unknown protocol traffic after data preprocessing, and finally obtain the predicted label.

In the above scheme, it can be seen that the method is divided into two stages. The first stage is the training stage, using the training sample set to complete the training of the GRU network model; The processed unknown protocol traffic is identified, and the predicted label is obtained.

As shown in FIG. 2 , specifically, the data preprocessing in steps S1 and S2 includes traffic segmentation, data packet clustering, and session data conversion.

In the above scheme, data preprocessing is the basic step in the identification process of unknown protocol traffic, in which: traffic segmentation is responsible for dividing unknown protocol traffic into corresponding data sets according to a certain basis; All data packets are clustered, and the clustering center is obtained; session data conversion is responsible for converting the content of all data packets into the distance between each data packet and each clustering center; finally, according to the timing relationship of each data packet to integrate , which converts unknown protocol traffic into spatial location feature data with time series, which conforms to the input data format of the GRU network model.

Specifically, the basic unit of the traffic segmentation is a session.

In the above scheme, in the selection of traffic granularity, the session that has been studied more at present is used, which has all packets of the same quintuple (source IP, source port, destination IP, destination port, transport layer protocol), and the quintuple The source and destination addresses in the group can be interchanged.

Specifically, the data packet clustering is performed using a K-means algorithm.

In the above scheme, the K-means algorithm is not only easy to implement, but also has the function of optimization iteration, which can eliminate the unreasonable classification of the training sample set.

Specifically, the session data conversion is to replace the content format of each data packet after traffic segmentation with a distance set, and the distance calculation formula used is:

Among them, the Max Subsequence function is the longest common continuous sequence identification algorithm between each data packet and each cluster center; D _{(x, centroid)} is the distance between each data packet and each cluster center.

In the above solution, the distance calculation formula is used to complete the calculation of the distance between each data packet and each cluster center.

As shown in Figure 3, specifically, the GRU network model includes an input layer, a Masking layer, a first GRU layer, a second GRU layer, a fully connected layer, and an output layer; wherein:

The Masking layer is connected to the input layer and the first GRU layer respectively;

The second GRU layer is connected to the first GRU layer and the fully connected layer, respectively;

The output layer is connected to the fully connected layer.

In the above scheme, first, the Masking layer skips the supplemented data in the training sample set; secondly, the GRU gated recurrent unit of two consecutive layers, the parameter return_sequences=TRUE of the first GRU layer, outputs the results of each time step In the second GRU layer, in the calculation process, due to the existence of update gate and reset gate mechanism in the GRU network, the state information of the previous moment can be retained and transferred to the current moment, and brought to the same extent, which can fully extract the session flow. In addition, the fully connected layer has 256 neurons to ensure the nonlinear expression ability of the learning ability of the GRU network model; finally, the output layer will output the recognition results.

Specifically, the dimensions of the feature values extracted by the first GRU layer and the second GRU layer are both set to 64.

In the above scheme, the set dimension can ensure that the two-layer GRU gated recurrent unit finds the most effective features, achieves the effect of dimensionality reduction, and avoids redundancy.

Specifically, the fully connected layer uses the ReLU function as the activation function.

In the above scheme, the ReLU function is used as the activation function, which not only has lower time and space complexity, but also avoids the problem of gradient disappearance.

Specifically, the fully connected layer adopts Dropout to set its ratio to 0.5.

In the above scheme, the Dropout mechanism is adopted to lose 50% of the features, which can greatly simplify the structure, prevent the problem of neural network overfitting, and avoid excessive time consumption.

Specifically, the output layer uses a sigmoid function as an activation function.

In the above scheme, only one output node is set in the output layer, and the output result is the probability that the unknown protocol traffic belongs to a certain protocol type, and the sigmoid function is used as the activation function, so that the output value is between 0 and 1, which meets the requirements of binary classification. .

Obviously, the above-mentioned embodiments of the present invention are only examples for clearly illustrating the present invention, and are not intended to limit the embodiments of the present invention. For those of ordinary skill in the art, changes or modifications in other different forms can also be made on the basis of the above description. There is no need and cannot be exhaustive of all implementations here. Any modifications, equivalent replacements and improvements made within the spirit and principle of the present invention shall be included within the protection scope of the claims of the present invention.

Claims (10)

1. a protocol traffic identification method based on GRU network, is characterized in that, comprises the following steps: S1: Perform data preprocessing on traffic samples of different protocols to obtain a training sample set conforming to the GRU network input data format, and use the training sample set to train the GRU network model; S2: Perform data preprocessing on unknown protocol traffic to obtain spatial location feature data with time series, and input them into the trained GRU network model; S3: Use the trained GRU network model to identify the unknown protocol traffic after data preprocessing, and finally obtain the predicted label. 2 . The method for identifying protocol traffic based on a GRU network according to claim 1 , wherein the data preprocessing in steps S1 and S2 includes traffic segmentation, data packet clustering, and session data conversion. 3 . 3 . The method for identifying protocol traffic based on a GRU network according to claim 2 , wherein the basic unit of the traffic segmentation is a session. 4 . 4 . The method for identifying protocol traffic based on a GRU network according to claim 2 , wherein the data packet clustering is performed using a K-means algorithm. 5 . 5. a kind of protocol flow identification method based on GRU network according to claim 2, is characterized in that, described session data conversion is to replace the content format of each data packet after the flow segmentation into distance set, adopted The distance calculation formula is:

Among them, the Max Subsequence function is the longest common continuous sequence identification algorithm between each data packet and each cluster center; D _{(x, centroid)} is the distance between each data packet and each cluster center. 6. a kind of protocol traffic identification method based on GRU network according to claim 1 is characterized in that, described GRU network model comprises input layer, Masking layer, first GRU layer, second GRU layer, fully connected layer, output layer; where: The Masking layer is connected to the input layer and the first GRU layer respectively; The second GRU layer is connected to the first GRU layer and the fully connected layer, respectively; The output layer is connected to the fully connected layer. 7 . The method for identifying protocol traffic based on a GRU network according to claim 6 , wherein the dimensions of the feature values extracted by the first GRU layer and the second GRU layer are both set to 64. 8 . 8 . The method for identifying protocol traffic based on a GRU network according to claim 6 , wherein the fully connected layer adopts a ReLU function as an activation function. 9 . 9 . The method for identifying protocol traffic based on a GRU network according to claim 6 , wherein the fully connected layer adopts Dropout to set its ratio to 0.5. 10 . 10 . The method for identifying protocol traffic based on a GRU network according to claim 6 , wherein the output layer adopts a Sigmoid function as an activation function. 11 .

Images