CN117131424B - Training method, flow detection method, device, equipment and medium - Google Patents
Training method, flow detection method, device, equipment and medium Download PDFInfo
- Publication number
- CN117131424B CN117131424B CN202311385659.9A CN202311385659A CN117131424B CN 117131424 B CN117131424 B CN 117131424B CN 202311385659 A CN202311385659 A CN 202311385659A CN 117131424 B CN117131424 B CN 117131424B
- Authority
- CN
- China
- Prior art keywords
- domain
- flow
- network
- traffic
- capsule
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000012549 training Methods 0.000 title claims abstract description 175
- 238000000034 method Methods 0.000 title claims abstract description 114
- 238000001514 detection method Methods 0.000 title claims abstract description 77
- 239000002775 capsule Substances 0.000 claims abstract description 260
- 238000000605 extraction Methods 0.000 claims abstract description 106
- 230000008569 process Effects 0.000 claims description 51
- 230000006870 function Effects 0.000 claims description 50
- 238000010168 coupling process Methods 0.000 claims description 37
- 238000005859 coupling reaction Methods 0.000 claims description 37
- 230000008878 coupling Effects 0.000 claims description 34
- 230000003044 adaptive effect Effects 0.000 claims description 20
- 238000012545 processing Methods 0.000 claims description 20
- 230000009466 transformation Effects 0.000 description 46
- 239000013598 vector Substances 0.000 description 40
- PXFBZOLANLWPMH-UHFFFAOYSA-N 16-Epiaffinine Natural products C1C(C2=CC=CC=C2N2)=C2C(=O)CC2C(=CC)CN(C)C1C2CO PXFBZOLANLWPMH-UHFFFAOYSA-N 0.000 description 34
- 238000010586 diagram Methods 0.000 description 21
- 238000004590 computer program Methods 0.000 description 17
- 238000004891 communication Methods 0.000 description 12
- 239000011159 matrix material Substances 0.000 description 7
- 230000002159 abnormal effect Effects 0.000 description 6
- 238000004422 calculation algorithm Methods 0.000 description 6
- 239000000284 extract Substances 0.000 description 6
- 238000005457 optimization Methods 0.000 description 6
- 230000003287 optical effect Effects 0.000 description 5
- 238000012986 modification Methods 0.000 description 4
- 230000004048 modification Effects 0.000 description 4
- 230000002829 reductive effect Effects 0.000 description 4
- 230000004913 activation Effects 0.000 description 3
- 230000008485 antagonism Effects 0.000 description 3
- 238000013459 approach Methods 0.000 description 3
- 238000013527 convolutional neural network Methods 0.000 description 3
- 230000007246 mechanism Effects 0.000 description 3
- 230000005012 migration Effects 0.000 description 3
- 238000013508 migration Methods 0.000 description 3
- 230000006978 adaptation Effects 0.000 description 2
- 230000003042 antagnostic effect Effects 0.000 description 2
- 238000013461 design Methods 0.000 description 2
- 238000009826 distribution Methods 0.000 description 2
- 230000000694 effects Effects 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 230000003993 interaction Effects 0.000 description 2
- 238000013507 mapping Methods 0.000 description 2
- 238000003672 processing method Methods 0.000 description 2
- 239000004065 semiconductor Substances 0.000 description 2
- 239000007787 solid Substances 0.000 description 2
- 239000000126 substance Substances 0.000 description 2
- 238000012360 testing method Methods 0.000 description 2
- 230000009471 action Effects 0.000 description 1
- 230000004075 alteration Effects 0.000 description 1
- 238000013473 artificial intelligence Methods 0.000 description 1
- 238000013528 artificial neural network Methods 0.000 description 1
- 230000008901 benefit Effects 0.000 description 1
- 238000004364 calculation method Methods 0.000 description 1
- 230000010267 cellular communication Effects 0.000 description 1
- 230000001413 cellular effect Effects 0.000 description 1
- 238000013145 classification model Methods 0.000 description 1
- 230000001010 compromised effect Effects 0.000 description 1
- 238000013500 data storage Methods 0.000 description 1
- 230000003247 decreasing effect Effects 0.000 description 1
- 230000000670 limiting effect Effects 0.000 description 1
- 239000004973 liquid crystal related substance Substances 0.000 description 1
- 238000010801 machine learning Methods 0.000 description 1
- 239000013307 optical fiber Substances 0.000 description 1
- 230000000644 propagated effect Effects 0.000 description 1
- 239000004576 sand Substances 0.000 description 1
- 230000001953 sensory effect Effects 0.000 description 1
- 230000000007 visual effect Effects 0.000 description 1
- 230000003313 weakening effect Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/241—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
- G06F18/213—Feature extraction, e.g. by transforming the feature space; Summarisation; Mappings, e.g. subspace methods
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
- G06N3/084—Backpropagation, e.g. using gradient descent
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
- G06N3/09—Supervised learning
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
- G06N3/094—Adversarial learning
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/40—Network security protocols
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02T—CLIMATE CHANGE MITIGATION TECHNOLOGIES RELATED TO TRANSPORTATION
- Y02T10/00—Road transport of goods or passengers
- Y02T10/10—Internal combustion engine [ICE] based vehicles
- Y02T10/40—Engine management systems
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Life Sciences & Earth Sciences (AREA)
- Artificial Intelligence (AREA)
- Evolutionary Computation (AREA)
- Computer Security & Cryptography (AREA)
- Computing Systems (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Molecular Biology (AREA)
- Health & Medical Sciences (AREA)
- Biomedical Technology (AREA)
- Biophysics (AREA)
- Computational Linguistics (AREA)
- General Health & Medical Sciences (AREA)
- Software Systems (AREA)
- Mathematical Physics (AREA)
- Bioinformatics & Computational Biology (AREA)
- Evolutionary Biology (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The present disclosure provides a training method, a flow detection method, a device, equipment and a medium, where the method is used for training a flow detection model, and the flow detection model includes: the system comprises a capsule extraction network, a flow classification network and a domain countermeasure network, wherein the capsule extraction network and the flow classification network are subjected to first supervised training based on source domain flow sample data, and the capsule extraction network and the domain countermeasure network obtained by the first supervised training are subjected to second supervised training based on source domain flow sample data and target domain flow sample data. The flow detection model trained by the method can realize cross-domain detection from source domain flow to target domain flow, and the problem of flow detection accuracy reduction caused by the shift of the target domain and the source domain network scene domain is solved.
Description
Technical Field
The present invention relates to the field of network security technologies, and in particular, to a training method, a traffic detection method, a device, equipment, and a medium.
Background
The network abnormal flow detection is a network safety protection technology, and can analyze network flow and measure flow obviously different from normal flow, so as to discover various security threats and network attacks faced by the network in time and strive to master initiative in network space safety.
In the related art, a flow detection model trained in a source network scene can be migrated to a target network scene by using migration learning, and then the flow detection model is utilized to detect the flow of the target network. However, the network environment difference is relatively large, and it is difficult for the flow detection model to accurately detect whether the target network flow is abnormal.
Disclosure of Invention
According to an aspect of the present disclosure, there is provided a training method for training the flow detection model, the flow detection model including: a capsule extraction network, a traffic classification network, and a domain countermeasure network, the method comprising:
performing first supervised training on the capsule extraction network and the flow classification network based on source domain flow sample data, wherein the capsule extraction network is used for determining a first source domain flow high-order sample feature based on the source domain flow sample data, and the flow classification network is used for acquiring a prediction classification result of a source domain flow state based on the source domain flow high-order sample feature;
performing second supervised training on the capsule extraction network and the domain countermeasure network obtained by the first supervised training based on the source domain traffic sample data and the target domain traffic sample data, wherein the capsule extraction network obtained by the first supervised training is used for determining a second source domain traffic high-order sample feature and a target domain traffic high-order sample feature based on the source domain traffic sample data and the target domain traffic sample data, and the domain countermeasure network is used for adaptively aligning the second source domain traffic high-order sample feature and the target domain traffic high-order sample feature to obtain inter-domain adaptive alignment features and determining a prediction result of domain classification based on the inter-domain adaptive alignment features.
According to another aspect of the present disclosure, there is provided a flow detection method, applying a flow detection model trained by the method according to an exemplary embodiment of the present disclosure, the method including:
inputting the target domain flow information into a capsule extraction network to obtain the high-order characteristic of the target domain flow;
inputting the high-order characteristics of the target domain flow into a flow classification network to obtain a classification result of the target domain flow state;
and determining the traffic state of the target domain based on the classification result of the traffic state of the target domain.
According to another aspect of the present disclosure, there is provided a training device comprising:
the first training module is used for performing first supervision training on the capsule extraction network and the flow classification network based on source domain flow sample data, the capsule extraction network is used for determining first source domain flow high-order sample characteristics based on the source domain flow sample data, and the flow classification network is used for acquiring a prediction classification result of a source domain flow state based on the source domain flow high-order sample characteristics;
the second training module is configured to perform a second supervised training on the capsule extraction network and the domain countermeasure network obtained by the first supervised training based on the source domain traffic sample data and the target domain traffic sample data, where the capsule extraction network obtained by the first supervised training is configured to determine a second source domain traffic high-order sample feature and a target domain traffic high-order sample feature based on the source domain traffic sample data and the target domain traffic sample data, and the domain countermeasure network is configured to adaptively align the second source domain traffic high-order sample feature and the target domain traffic high-order sample feature to obtain an inter-domain adaptive alignment feature, and determine a prediction result of a domain classification based on the inter-domain adaptive alignment feature.
According to another aspect of the present disclosure, there is provided a flow rate detection apparatus, a flow rate detection model trained by applying the method, the apparatus including:
the extraction module is used for inputting the information of the target domain flow into the capsule extraction network to obtain the high-order characteristic of the target domain flow;
the classification module is used for inputting the high-order characteristics of the target domain flow into a flow classification network to obtain a classification result of the target domain flow state;
and the determining module is used for determining the traffic state of the target domain based on the classification result of the traffic state of the target domain.
According to another aspect of the present disclosure, there is provided an electronic device including:
a processor; the method comprises the steps of,
a memory storing a program;
wherein the program comprises instructions which, when executed by the processor, cause the processor to perform the method according to an exemplary embodiment of the present disclosure.
According to another aspect of the present disclosure, there is provided a non-transitory computer readable storage medium, characterized in that the non-transitory computer readable storage medium is configured to store computer instructions for causing the computer to perform the method according to the exemplary embodiments of the present disclosure.
In one or more technical schemes provided in the embodiments of the present disclosure, in a first supervised training process, a capsule extraction network ensures that a high-order sample feature of a first source domain flow output by the capsule extraction network fully reflects a bottom layer feature and a high layer feature of source domain flow sample data, so that a trained flow classification network can accurately detect a source domain flow state. In the second supervised training process, the capsule extraction network obtained through the first supervised training can enable the second source domain flow high-order sample characteristics extracted by the capsule extraction network obtained through the first supervised training to fully reflect the bottom-layer characteristics and the high-layer characteristics of the source domain flow sample data, and the target domain flow high-order sample characteristics can fully reflect the bottom-layer characteristics and the high-layer characteristics of the target domain flow sample data. On the basis, in the method of the exemplary embodiment of the disclosure, during the second supervised training, the domain countermeasure network is used for adaptively aligning the second source domain traffic high-order sample feature and the target domain traffic high-order sample feature, so as to obtain an inter-domain adaptive alignment feature, a prediction result of domain classification is determined based on the inter-domain adaptive alignment feature, and the domain countermeasure network maps the first source domain traffic high-order sample feature and the target domain traffic high-order sample feature to the same feature space as much as possible through a back propagation process in the training process, and distances in the feature space are gradually close.
It can be seen that the exemplary embodiments of the present disclosure can ensure that the capsule extraction network extracts as high-level features as possible from the target domain flow information and the source domain flow information through training the flow detection model. When the trained flow detection model is applied to target domain flow detection, the high-order feature of the target domain flow extracted by the capsule extraction network can be suitable for a flow classification network trained on the basis of source domain flow sample data, so that the flow classification network can accurately identify the target domain flow state.
Drawings
Further details, features and advantages of the present disclosure are disclosed in the following description of exemplary embodiments, with reference to the following drawings, wherein:
FIG. 1 shows a flow diagram of a training method of an exemplary embodiment of the present disclosure;
FIG. 2 illustrates a flow diagram of a second supervised training of an exemplary embodiment of the present disclosure;
fig. 3 shows a schematic structural diagram of a capsule extraction network according to an exemplary embodiment of the present disclosure;
FIG. 4 illustrates a schematic structural view of a capsule feature extractor of an exemplary embodiment of the present disclosure;
FIG. 5 illustrates a schematic diagram of the principle of inter-level operation of a capsule feature extractor according to an exemplary embodiment of the present disclosure;
FIG. 6 illustrates an architectural diagram of a flow detection model of an exemplary embodiment of the present disclosure;
FIG. 7 shows a flow diagram of a flow detection method of an exemplary embodiment of the present disclosure;
FIG. 8 shows a functional block diagram of a training device according to an exemplary embodiment of the present disclosure;
FIG. 9 shows a functional block diagram of a flow detection device according to an exemplary embodiment of the present disclosure;
FIG. 10 shows a schematic block diagram of a chip according to an exemplary embodiment of the disclosure;
fig. 11 illustrates a block diagram of an exemplary electronic device that can be used to implement embodiments of the present disclosure.
Detailed Description
Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While certain embodiments of the present disclosure have been shown in the accompanying drawings, it is to be understood that the present disclosure may be embodied in various forms and should not be construed as limited to the embodiments set forth herein, but are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustration purposes only and are not intended to limit the scope of the present disclosure.
It should be understood that the various steps recited in the method embodiments of the present disclosure may be performed in a different order and/or performed in parallel. Furthermore, method embodiments may include additional steps and/or omit performing the illustrated steps. The scope of the present disclosure is not limited in this respect.
The term "including" and variations thereof as used herein are intended to be open-ended, i.e., including, but not limited to. The term "based on" is based at least in part on. The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments. Related definitions of other terms will be given in the description below. It should be noted that the terms "first," "second," and the like in this disclosure are merely used to distinguish between different devices, modules, or units and are not used to define an order or interdependence of functions performed by the devices, modules, or units.
It should be noted that references to "one", "a plurality" and "a plurality" in this disclosure are intended to be illustrative rather than limiting, and those of ordinary skill in the art will appreciate that "one or more" is intended to be understood as "one or more" unless the context clearly indicates otherwise.
Before describing embodiments of the present disclosure, the following definitions are first provided for the relative terms involved in the embodiments of the present disclosure:
the capsule network can be regarded as a layer in the neural network, consisting of capsules. The capsule can be regarded as a vector which can represent both the probability of picture recognition and the characteristics of the current image (say the direction, pose, etc. of the image).
The dynamic routing is the key of the capsule network on the algorithm, in the dynamic routing process, the lower capsule transmits the input vector to the upper capsule, the next capsule multiplies the output of the lower capsule by the weight matrix to calculate the prediction vector, if the prediction vector and the output of the upper capsule have a larger scalar product, the coupling coefficient of the upper capsule is increased, and the coupling coefficients of other capsules are reduced.
The gradient inversion layer (Gradient Reversal Layer, GRL) automatically inverts the gradient direction mainly during back propagation and achieves identity transformation during forward propagation.
The source domain (source domain) refers to an existing prior knowledge data set, and the target domain (target domain) refers to a new knowledge data set that requires algorithm learning.
Domain adaptation (Domain adaptation), also known as Domain antagonism (Domain Adversarial), is used to eliminate feature distribution differences between different domains, with the aim of mapping data in Source Domain (Source Domain) and Target Domain (Target Domain) with different distributions to the same feature space, finding a certain metric, and making its "distance" in this space as close as possible.
In the related art, a traffic detection model may be trained on a marked offline historical dataset and then applied directly to the current new target network scenario. But this approach is poorly generalized and is not suitable for some complex scenarios. Although pre-migration learning may be used to migrate a traffic detection model trained in a source network scenario to a target network scenario, the traffic detection model includes a feature extractor and a class classification model, and the traffic detection model is used to detect target network traffic. However, the network environment difference is relatively large, and it is difficult for the flow detection model to accurately detect whether the target network flow is abnormal.
The exemplary embodiments of the present disclosure provide a training method and a traffic detection method to improve the accuracy of cross-domain network traffic detection by using domain countermeasure principle, so as to solve the problem of decreased accuracy of traffic detection caused by domain offset of a target domain network scene and a source domain network scene.
The training method provided by the exemplary embodiment of the present disclosure is used for training a flow detection model, which can organically combine a capsule network theory and a domain countermeasure theory to implement cross-domain flow detection, and is actually equivalent to adding a domain countermeasure capsule network to the flow detection model of the related art, and the domain countermeasure capsule network has two main effects:
Firstly, the high-order vector features of the data are obtained through a capsule feature extractor, and then classification is carried out, so that the multi-attribute of the data features can be well characterized, and the generalization capability of a flow detection model is better; secondly, domain classification tasks are completed through the design domain countermeasure network, so that source domain flow data and target domain flow data are aligned on the high-order vector feature level, and the flow detection model has good domain self-adaption capability.
The flow detection model includes: capsule extraction network, traffic classification network, and domain countermeasure network. When the flow detection model is trained, the method can be divided into two supervised training, the first supervised training can use source domain flow sample data as a data set, a capsule extraction network and a flow classification network are trained, the second supervised training can use source domain flow sample data and target domain flow sample data as a data set, and the capsule extraction network and a domain countermeasure network are trained, so that the domain countermeasure network can reduce the characteristic difference between the source domain flow characteristics and the target domain flow characteristics, and the problem of knowledge migration under the cross domain in abnormal flow detection is solved.
Fig. 1 shows a flow diagram of a training method of an exemplary embodiment of the present disclosure. As shown in fig. 1, the training method of the exemplary embodiment of the present disclosure may include:
step 101: the capsule extraction network and the flow classification network are first supervised trained based on source domain flow sample data. The capsule extraction network is used for determining a first source domain flow high-order sample characteristic based on the source domain flow sample data, and the flow classification network is used for acquiring a prediction classification result of the source domain flow state based on the source domain flow high-order sample characteristic. It should be appreciated that the source domain traffic state of the exemplary embodiments of the present disclosure may include a plurality of possible states, and the prediction classification result of the source domain traffic state output by the traffic classification network may include a plurality of prediction probabilities of the source domain traffic state, where the source domain traffic state with the largest prediction probability is the final prediction result of the source domain traffic state.
In the first supervised training process, the high-order sample characteristics of the first source domain flow output by the first supervised training process are guaranteed to fully reflect the bottom-layer characteristics and the high-layer characteristics of the source domain flow sample data through the capsule extraction network, so that the trained flow classification network can accurately detect the source domain flow state.
In practical application, when performing first supervised training, the exemplary embodiment of the disclosure may input source domain flow sample data into the capsule extraction network to obtain a first source domain flow high-order sample feature, and input the first source domain flow high-order sample feature into the flow classification network to obtain a prediction classification result of the source domain flow state. And when the first supervised training reaches the first convergence condition, completing the first supervised training of the capsule extraction network and the flow classification network, and if the first supervised training does not reach the first convergence condition, updating the model parameters of the capsule extraction network and the model parameters of the flow classification network based on the prediction classification result of the source domain flow state and the flow state label of the source domain flow sample data.
The first convergence condition of the exemplary embodiment of the present disclosure may include that an actual classification loss between a predicted classification result based on the source domain traffic state and a traffic state label of the source domain traffic sample data is less than or equal to a preset classification loss, or that the actual classification loss fluctuates within a certain range around a certain preset classification loss, and may further include that a number of iterations of model parameters of the first supervised training is greater than or equal to a preset number of times.
The exemplary embodiments of the present disclosure may evaluate an actual classification loss between a predicted classification result of a source domain traffic state and a traffic state label of source domain traffic sample data through a class classification loss function, and may optimize model parameters of a capsule extraction network and a traffic classification network by minimizing the class classification loss function if a convergence condition is not reached by a first supervised training.
Illustratively, the traffic state label of the source domain traffic sample data of the exemplary embodiments of the present disclosure may be a label indicating whether the traffic state of the source domain traffic sample is abnormal, whereas the source domain traffic and the target domain traffic may refer to traffic of two different network scenarios, such as: the source domain traffic may include enterprise local area network traffic data and the target domain traffic data may include campus network traffic data.
Step 102: and performing a second supervised training on the capsule extraction network and the domain countermeasure network obtained by the first supervised training based on the source domain traffic sample data and the target domain traffic sample data. The capsule extraction network obtained by the first supervision training is used for determining a second source domain flow high-order sample characteristic and a target domain flow high-order sample characteristic based on the source domain flow sample data and the target domain flow sample data, and the domain countermeasure network is used for adaptively aligning the second source domain flow high-order sample characteristic and the target domain flow high-order sample characteristic to obtain inter-domain adaptive alignment characteristics and determining a prediction result of domain classification based on the inter-domain adaptive alignment characteristics.
As can be seen from the second supervised training, in the process of the second supervised training, the capsule extraction network used is the capsule extraction network obtained through the first supervised training, and because the capsule extraction network is trained in advance before the second supervised training, the capsule extraction network used in the second supervised training in the exemplary embodiment of the present disclosure already has better source domain flow high-order feature extraction. On the basis, the high-order sample characteristics of the source domain flow and the high-order sample characteristics of the target domain flow extracted by the capsule extraction network can be ensured to be gradually close to each other in the distance of the same mapping space through the training domain countermeasure network, so that the cross-domain flow detection is realized through the flow detection model after the training, the training times can be reduced, and the training efficiency is improved.
In the second supervised training process, the exemplary embodiment of the disclosure may enable the second source domain flow high-order sample feature extracted by the capsule extraction network obtained by the first supervised training to fully reflect the bottom-layer feature and the high-layer feature of the source domain flow sample data, and the target domain flow high-order sample feature may fully reflect the bottom-layer feature and the high-layer feature of the target domain flow sample data. On the basis, in the method of the exemplary embodiment of the disclosure, during the second supervised training, the domain countermeasure network is used for adaptively aligning the second source domain traffic high-order sample feature and the target domain traffic high-order sample feature, so as to obtain an inter-domain adaptive alignment feature, and a prediction result of domain classification is determined based on the inter-domain adaptive alignment feature, and the domain countermeasure network can map the first source domain traffic high-order sample feature and the target domain traffic high-order sample feature to the same feature space as much as possible through a back propagation process in the training process, and the distance between the first source domain traffic high-order sample feature and the target domain traffic high-order sample feature in the feature space is gradually close. It can be seen that the exemplary embodiments of the present disclosure can ensure that the capsule extraction network extracts as high-level features as possible from the target domain flow information and the source domain flow information through training the flow detection model.
When the trained flow detection model is applied to target domain flow detection, the high-order feature of the target domain flow extracted by the capsule extraction network can be suitable for a flow classification network trained on the basis of source domain flow sample data, so that the flow classification network can accurately identify the target domain flow state.
In an alternative manner, when performing the second supervised training, the exemplary embodiment of the present disclosure may train the capsule extraction network and the domain countermeasure network obtained by the first supervised training based on the source domain traffic sample data and the target domain traffic sample data with the domain classification label as the supervision information.
Fig. 2 shows a flow diagram of a second supervised training of an exemplary embodiment of the present disclosure. As shown in fig. 2, a second supervised training of exemplary embodiments of the present disclosure may include:
Step 201: and inputting the source domain flow sample data and the target domain flow sample data into a capsule extraction network obtained by first supervision training to obtain a second source domain flow high-order sample characteristic and a target domain flow high-order sample characteristic. Exemplary embodiments of the present disclosure may extract the second source domain traffic high order sample feature and the target domain traffic high order sample feature using a capsule extraction network parameter sharing approach.
Step 202: inputting the high-order sample characteristics of the second source domain flow and the high-order sample characteristics of the target domain flow into a domain countermeasure network to obtain a prediction result of domain classification. The domain countermeasure network not only can predict whether the target domain traffic sample data and the source domain traffic sample data belong to the same network scene based on the second source domain traffic high-order sample feature and the target domain traffic high-order sample feature, but also can adaptively and gradually align the second source domain traffic high-order sample feature and the target domain traffic high-order sample feature based on the domain countermeasure principle.
Step 203: and if the prediction result of the domain classification and the actual domain classification loss between the domain classification labels meet the convergence condition, obtaining a capsule extraction network and a domain countermeasure network after training is completed. It should be understood that, the prediction result of the domain classification according to the exemplary embodiment of the present disclosure may reflect whether the source domain traffic data and the target domain traffic data predicted by the domain countermeasure network are from the same network scene, and the domain classification tag may include a real case indicating whether the source domain traffic data and the target domain traffic data are from the same network scene.
In practical applications, exemplary embodiments of the present disclosure may evaluate the actual domain classification loss between the prediction result of the domain classification and the domain classification label using the domain classification loss function. The fact that the field classification loss satisfies the convergence condition may mean that the field classification loss is smaller than the preset field classification loss, or that the field classification loss fluctuates around the preset field classification loss within a certain range.
When the actual domain classification loss does not meet the convergence condition, the updating manner of the domain countermeasure network model parameter and the capsule extraction network model parameter obtained by the first supervised training in the second supervised training according to the exemplary embodiment of the present disclosure includes: the model parameters of the domain countermeasure network and the model parameters of the capsule extraction network obtained by the first supervised training are updated in an alternating iterative mode.
That is, in the current iteration process, the model parameters of the domain countermeasure network may be updated, i.e., the model parameters of the capsule extraction network obtained by the first supervised training may not be updated, i.e., the capsule extraction network obtained by the first supervised training may be fixed. The capsule obtained by the first supervision training is updated next time to extract the model parameters of the network, and the model parameters of the domain countermeasure network are not updated, namely, the model parameters of the domain countermeasure network are kept fixed. The model parameter updating mode is balanced in a game mode, and whether the source domain traffic sample data and the target domain traffic sample data come from the same network scene can be accurately judged while the domain countermeasure network can perform the Ji Dier source domain traffic high-order sample feature and the target domain traffic high-order sample feature.
The updating mode of the model parameters of the domain countermeasure network is an iteration mode of minimizing the domain classification loss function, and the updating mode of the model parameters of the capsule extraction network obtained by the first supervision training is an iteration mode of maximizing the domain classification loss function.
When the model parameters of the domain countermeasure network are updated by minimizing the domain classification loss function, the trained domain countermeasure network can be ensured to accurately predict whether the source domain flow sample data and the target domain flow sample data of the input capsule extraction network come from the same network scene. And model parameters of the capsule extraction network are updated through the maximized domain classification loss function, so that the capsule extraction network after training can be ensured to extract the second source domain flow high-order sample characteristics and the target domain flow high-order sample characteristics which are difficult to distinguish. Based on this, when the flow detection model trained by the training method of the exemplary embodiment of the present disclosure is applied to target domain flow detection, the high-order features of the target domain flow which are as similar to or even identical to the high-order features of the source domain as possible can be extracted from the target domain flow information by the capsule extraction network, so that the flow classification network trained by using the source domain flow sample data can accurately obtain the flow state of the target domain from the high-order features of the target domain flow, and realize cross-domain detection from the source domain flow to the target domain flow, thereby weakening the problem of reduced flow detection accuracy caused by domain offset of the target domain network scene and the source domain network scene.
As can be seen, in the method of the exemplary embodiment of the present disclosure, the label used in the first supervised training is a traffic state label of source domain traffic sample data, and the label used in the second supervised training is a domain classification label, and the traffic state label of target domain traffic sample data is not required to be used.
Fig. 3 shows a schematic structural diagram of a capsule extraction network according to an exemplary embodiment of the present disclosure. As shown in fig. 3, a capsule extraction network 300 of an exemplary embodiment of the present disclosure may include: a first feature extractor 301, a second feature extractor 302, and a capsule feature extractor 303. It should be appreciated that the first feature extractor 301 and the second feature extractor 302 of the exemplary embodiments of the present disclosure may be conventional convolutional network extractors, which are not described in detail herein.
In practical applications, as shown in fig. 3, the first feature extractor 301 and the second feature extractor 302 architectures of the exemplary embodiments of the present disclosure may be the same. In this case, after the first supervised training is completed, the model parameters of the first feature extractor obtained by the first supervised training may be migrated to the second feature extractor 302, thereby improving the training efficiency of the second feature extractor.
The first feature extractor 301 may be configured to determine a first basic feature of the source domain traffic based on the source domain traffic sample data during the first supervised training process, and the capsule feature extractor 303 may be configured to determine a first source domain traffic high order sample feature based on the first basic feature of the source domain traffic during the first supervised training process.
The second feature extractor 302 may also be configured to determine a second base feature of the source domain traffic based on the source domain traffic sample data during the second supervised training process, and the second feature extractor 302 may be configured to determine a base feature of the target domain traffic based on the target domain traffic sample data during the second supervised training process.
The capsule feature extractor 303 is further configured to determine, in a second supervised training process, a second source domain traffic high order sample feature based on a second basic feature of the source domain traffic, and determine a target domain traffic high order sample feature based on the basic feature of the target domain traffic. In this process, the capsule feature extractor 303 determines the second source domain traffic high order sample feature and the target domain traffic high order sample feature by means of parameter sharing. That is, the capsule feature extractor 303 does not merge the process of determining the second source domain traffic high order sample feature based on the second source domain traffic basic feature and the target domain traffic basic feature, but determines the target domain traffic high order sample feature based on the target domain traffic basic feature in parallel.
In the second supervised training process, the second source domain flow high-order sample characteristic and the target domain flow high-order sample characteristic are determined in a parameter sharing mode, so that the capsule feature extractor can independently extract the second source domain flow high-order sample characteristic and the target domain flow high-order sample characteristic which are as close as possible when model parameters of the capsule feature extractor are updated. Based on this, after the flow detection model of the exemplary embodiment of the present disclosure is trained, the second feature extractor and the capsule feature extractor may be utilized to extract the target domain flow feature, and ensure that the target domain flow feature also exists in the source domain flow information, so that the flow classification network may accurately detect the flow state of the target domain across domains.
In one alternative, the first source domain traffic high order sample feature of an exemplary embodiment of the present disclosure comprises a plurality of first capsule sample features of source domain traffic. The second source domain traffic high order sample feature comprises a plurality of second capsule sample features of source domain traffic and the target domain traffic high order sample feature comprises a plurality of capsule sample features of target domain traffic.
Fig. 4 shows a schematic structural view of a capsule feature extractor of an exemplary embodiment of the present disclosure. As shown in fig. 4, the capsule feature extractor 400 of an exemplary embodiment of the present disclosure may include: a main capsule layer 401 and a digital capsule layer 402.
As shown in fig. 4, the main capsule layer 401 is configured to initialize a first basic feature of the source domain flow in a first supervised training process, so as to obtain a plurality of first capsule input features of the source domain flow; the digital capsule layer 402 is configured to perform affine transformation on a plurality of first capsule input features of the source domain flow in a first supervised training process, obtain a plurality of first affine transformation results of the source domain flow, and couple the plurality of first affine transformation results of the source domain flow by using a first coupling coefficient, so as to obtain a first source domain flow high-order sample feature.
In practical application, when the main capsule layer initializes a plurality of first basic features of the source domain flow, the first basic features of the source domain flow are actually fused, so that the information content of each obtained first capsule input feature is relatively comprehensive. And the digital capsule layer performs affine transformation on the plurality of first capsule input features so that the first affine transformation result can embody various relations between the high-level features and the bottom-level features of the source domain flow.
When the first source domain traffic high order sample feature includes a plurality of first capsule sample features of the source domain traffic, the number of digital capsule layers may be plural, each digital capsule layer may output a first capsule sample feature of one attribute, and each first capsule sample feature may be regarded as a capsule sample feature obtained by coupling a first affine transformation result of the plurality of attributes through a first coupling coefficient. In this case, the digital capsule layer may implement full concatenation of the plurality of first affine transformation results, thereby obtaining a first source domain traffic high order sample feature. It should be appreciated that each first affine transformation result of the source domain traffic may correspond to one first coupling parameter, where the sum of the first coupling parameters corresponding to the respective first affine transformation results of the source domain traffic may be 1.
Similarly, the main capsule layer is further configured to initialize a plurality of second basic features of the source domain flow in the second supervised training process, obtain a plurality of second capsule input features of the source domain flow, initialize a plurality of basic features of the target domain flow, and obtain a plurality of capsule input features of the target domain flow;
the digital capsule layer is further used for carrying out affine transformation on a plurality of second capsule input features of the source domain flow in a second supervision training process to obtain a plurality of second affine transformation results of the source domain flow, and coupling the plurality of second affine transformation results of the source domain flow by using a second coupling coefficient to obtain a second source domain flow high-order sample feature; affine transformation is carried out on a plurality of capsule input features of the target domain flow, a plurality of affine transformation results of the target domain flow are obtained, and the second coupling coefficient is utilized to couple the plurality of affine transformation results of the target domain flow, so that a high-order sample feature of the target domain flow is obtained. The role of the main capsule layer and the digital capsule layer in the second supervised training process according to the exemplary embodiments of the present disclosure may refer to the description of the first supervised training process, which is not described herein.
It should be noted that, each second affine transformation result of the source domain flow and each capsule sample feature of the target domain flow correspond to one second coupling parameter, and each second affine transformation result of the source domain flow and each affine transformation result of the target domain flow share one second coupling coefficient, and a sum of the second coupling parameters corresponding to each capsule sample feature of the source domain flow and each capsule sample feature of the target domain flow is 1. Whether the first coupling coefficient or the second coupling coefficient, the iteration may be performed by means of dynamic routing.
In addition, unlike convolutional neural networks, which only pay attention to the existence of specific features (scalar features) and ignore the correlation between the features, the capsule feature extractor of the exemplary embodiment of the disclosure can vector the basic features extracted by the first feature extractor and the second feature extractor, and the obtained high-order sample features are vectorized features, and the vectorized features consider the information of the missing positions, directions and the like of the scalar features, so that the capsule feature extractor has strong capability of identifying multi-attribute correlations in the features and can effectively assist in processing the cross-domain flow features.
Compared with a full connection layer, the capsule feature extractor of the exemplary embodiment of the disclosure can extract deeper and wider attribute features in the features, and the parameter quantity is reduced through a dynamic routing algorithm, so that the exemplary embodiment of the disclosure performs primary extraction on source domain flow sample data and target domain flow sample data in a second supervision training process by using two convolutional neural networks as the first feature extractor and the second feature extractor, so as to obtain a plurality of second basic features of source domain flow and a plurality of basic features of target domain flow, and performs secondary extraction on the plurality of second basic features of source domain flow and the plurality of basic features of target domain flow by using the capsule feature extractor, thereby ensuring that a trained flow detection model has better generalization and improving the accuracy of cross-domain abnormal flow detection.
In an alternative manner, the traffic classification network of the exemplary embodiment of the present disclosure may be used to perform nonlinear processing on the high-order sample features of the first source domain traffic in the first supervised training to obtain the prediction classification result of the source domain traffic state. It should be appreciated that the exemplary pair of non-linearities of the present disclosure may be implemented by an activation function.
For example, when the first source domain traffic high order sample feature includes a plurality of attribute first capsule sample features of source domain traffic, it may be considered that the first capsule sample feature of each attribute is substantially nonlinear, so that the predicted classification result of the source domain traffic state includes a nonlinear result of the plurality of first capsule sample features, and the nonlinear result of each first capsule sample feature may correspond to a likelihood of the source domain traffic state.
When the nonlinear processing of the first capsule sample feature is realized through the activation function, the exemplary embodiment of the disclosure may use the squaring function to perform the nonlinear processing on the first capsule sample feature, so that the nonlinear result of the first capsule sample feature is between 0 and 1, and then use the first capsule sample feature corresponding to the result with the largest value in the nonlinear results of the first capsule sample features as the final result of the source domain flow state.
The flow classification network can be used for obtaining a prediction classification result of the source domain flow state after carrying out nonlinear processing on the high-order sample characteristics of the first source domain flow in the first supervision training, so that the aim of updating each first coupling coefficient is indirectly achieved.
Various coupling parameters involved in the digital capsule layer of the exemplary embodiments of the present disclosure may be determined by a dynamic routing mechanism. For example: the routing parameters corresponding to different affine transformation results can be determined through a dynamic routing mechanism, and then the routing parameters corresponding to the affine transformation results are obtained through a softmax function.
Fig. 5 shows a schematic diagram of the principle of the operation between layers of the capsule feature extractor according to an exemplary embodiment of the present disclosure. As shown in fig. 5, the main capsule layer may outputKInput vector of each capsuleu 1 、u 2 、……、u K ) Number of digital capsule layersMOne or more may be used, and may be determined according to actual conditions, for the firstjDigital capsule layer, each capsule input vectoru 1 、u 2 、……、u K ) Through affine transformation matrixW 1j 、W 2j 、……、W Kj ) Carrying out affine transformation, and then carrying out affine transformation on the input characteristics of each capsule、/>、……、/>) Through the corresponding coupling parametersc 1j 、c 2j 、……、c Kj ) Weighted summation is carried out to obtain the first jPredictive vector for digital capsule layers j Finally throughsquashFunction pair capsule sample vectors j Normalizing to obtain the firstjOutput vector of each capsule feature extractor outputv j 。
u i Output of the main capsule layeri（iRepresents greater than or equal to 1 and less than or equal toKIs the integer of (2)A number) of capsule input vectors, which may be represented in vector form, for example: when (when)iWhen the number of the codes is =1,u 1 the 1 st capsule input vector representing the output of the main capsule layer wheniWhen the number of the codes is =2,u 2 representing the 2 nd capsule input vector of the main capsule layer,u K representing the first capsule layerKA plurality of capsule delivery vectors;represent the firstjDigital capsule layer numberiAffine transformation matrix, wheniWhen the number of the codes is =1,W 1j represent the firstjThe 1 st affine transformation matrix of the digital capsule layer wheniWhen the number of the codes is =2,W 2j represent the firstjThe 2 nd affine transformation matrix of the digital capsule layer wheni=KIn the time-course of which the first and second contact surfaces,W Kj represent the firstjDigital capsule layer numberKThe number of affine transformation matrices is chosen,jthe serial number of the digital capsule layer is indicated.
Represent the firstjDigital capsule layer numberiAffine transformation result->One can refer to a calculation:
one (I)
When (when)iWhen the number of the codes is =1,represent the firstjThe 1 st affine transformation result of the digital capsule layer wheniWhen=2,>represent the firstjThe 2 nd affine transformation result of the digital capsule layer when i=KWhen (I)>Represent the firstjDigital capsule layer numberKAnd (5) affine transformation results.
c ij Represent the firstjDigital capsule layer numberiA coupling coefficient which can couple the firstjDigital capsule layer numberiThe affine transformation results are weighted. It should be understood that exemplary embodiment of the present disclosure, item ijEach coupling coefficient of the digital capsule layerc 1j 、c 2j 、……、c Kj ) The iteration may be performed by a dynamic routing mechanism.
When (when)iWhen the number of the codes is =1,c 1j represent the firstjThe 1 st coupling coefficient of the digital capsule layer wheniWhen the number of the codes is =2,c 2j represent the firstjThe 2 nd coupling coefficient of the digital capsule layer wheni=KIn the time-course of which the first and second contact surfaces,c Kj represent the firstjDigital capsule layer numberKAnd coupling coefficients.
In practical applications, exemplary embodiments of the present disclosure may first initialize the firstjPrediction of class traffic statev j And (d)jDigital capsule layer numberiAffine transformation resultsIs>(i.e. routing parameters) such that +.>Andthe value of (2) is 0, and then iteration is carried out through a dynamic routing algorithm, and the iteration times can be selected according to actual conditions.
When iterating, the firstjDigital capsule layer numberiCoupling coefficient ofc ij The softmax function shown in equation two may be used for the acquisition.
Two kinds of
When (when)iWhen the number of the codes is =1,b 1j represent the firstjAffine transformation result 1 of digital capsule layer Is used to determine the prior probability of (c) for a given channel,c 1j represent the firstjThe 1 st coupling coefficient of the digital capsule layer wheniWhen the number of the codes is =2,b 2j represent the firstjAffine transformation result 2 of the digital capsule layer->Is used to determine the prior probability of (c) for a given channel,c 2j represent the firstjThe 2 nd coupling coefficient of the digital capsule layer wheni=KIn the time-course of which the first and second contact surfaces,b Kj represent the firstjDigital capsule layer numberKAffine transformation result->Is used to determine the prior probability of (c) for a given channel,c Kj represent the firstjDigital capsule layer numberKAnd coupling coefficients. Based on this, the exemplary embodiment of the present disclosure inputs affine transformation results of the features of the respective capsules (++>、/>、……、/>) Through the corresponding coupling parametersc 1j 、c 2j 、……、c Kj ) The process of performing the weighted summation can be expressed by the formula shown in equation three:
three kinds of
Next, a nonlinear activation function is usedsquashFunction Specification No.jOutput vector of digital capsule layerThe length of (2) is 0-1, namely an expression shown in the formula IV.
Four kinds of
Finally, by solving for the firstjDigital capsule layer numberiAffine transformation resultsAnd (d)jOutput vector of digital capsule layer +.>To balance the consistency among vectors to realize the firstjDigital capsule layer numberiAffine transformation result->Is>The process of the update of (c) may be as shown in equation five.
Five kinds of
Exemplary embodiments of the present disclosure are based on five updates jDigital capsule layer numberiAffine transformation resultsIs>Thereafter, the first can be recalculated byjDigital capsule layer numberiCoupling coefficient ofc ij Thereby achieving the update of the firstjDigital capsule layer numberiCoupling coefficient ofc ij Is a target of (a).
In an alternative manner, the domain countermeasure network of the exemplary embodiment of the present disclosure may include a gradient inversion layer and a domain classifier, the gradient inversion layer may be configured to adaptively align the second source domain traffic high-order sample feature and the target domain traffic high-order sample feature to obtain an inter-domain adaptive alignment feature, and the domain classifier is configured to obtain a prediction result of the domain classification based on the inter-domain adaptive alignment feature.
In the second supervised training process, forward propagation mainly carries out identity transformation on the input second source domain flow high-order sample characteristics and the target domain flow high-order sample characteristics, and in the back propagation, the gradient inversion layer can invert the domain classification loss gradient before the domain classification loss gradient propagates to a capsule extraction network such as a second characteristic extractor, so that the domain classification loss gradient is similar to the antagonism loss similar to the antagonism network generation.
To facilitate understanding of the training method of the flow detection model of the exemplary embodiment of the present disclosure, fig. 6 shows an architectural diagram of the flow detection model of the exemplary embodiment of the present disclosure. As shown in fig. 6, a flow detection model 600 of an exemplary embodiment of the present disclosure may include: first feature extractorG s Second feature extractorG t Capsule feature extractorG cap Traffic classification networkCSum domain countermeasure networkDFirst feature extractorG s And a second feature extractorG t All the structures of the convolutional neural networks can be the same.
The disclosed exemplary embodiments include two supervised exercises, a first supervised exercise and a second supervised exercise, respectively, the first supervised exercise's penalty function including a category classification penalty function and the second supervised exercise's penalty function including a domain classification penalty function.
As shown in fig. 6, an exemplary embodiment of the present disclosure is used in a first supervised trainingThe data set of (1) includes source domain traffic sample datax s With traffic status tags, source domain traffic sample datax s Inputting a first feature extractorG s Obtaining source domain traffic sample datax s Is then used to generate source domain traffic sample data x s Is input into a capsule feature extractor to obtain a first source domain flow high order sample feature, which is characterized by a first source domain flow high order vector featuresMay include a plurality of attribute first capsule vectors.
Finally, as shown in FIG. 6, the higher order vector features of the first source domain trafficsInput traffic classification networkCTraffic classification networkCHigh order vector features that can be applied to first source domain trafficsNonlinear linearization is carried out to obtain high-order vector characteristics of source domain flowsIs a non-linearisation of (a).
For example, for the firstiFirst capsule vector of individual attributess j The squaring function specification may be used as shown in equation fouriFirst output vectors j The length of the source domain flow is 0-1, and the first source domain flow is obtainedjFirst output vectors j Is not linear with the result of (a)v j I.e. the first of source domain trafficjAnd predicting states.
On the basis, the magnitude of the nonlinear results of the plurality of first capsule vectors can be compared, the corresponding source domain flow state when the nonlinear result is maximum is determined as the predicted state of the source domain flow, and the process can be expressed as follows，P c Predictive classification result representing source domain traffic status, < >>Representing higher order features of the first source domain traffic.
It can be seen that the high order vector features due to the first source domain flow obtained by the capsule feature extractorsIn vector form, the traffic classification network is mainly implemented by a squaring functionObtaining high-order vector features of the first source domain trafficsAnd takes the model length as a prediction classification result of the source domain flow state, thereby achieving the purpose of classifying the state types of the source domain flow sample data. Then, the source domain traffic state corresponding to the result with the maximum modular length can be taken as the prediction state of the source domain traffic.
Exemplary embodiments of the present disclosure may classify a loss function by a class represented by formula two after a first supervised training completes a prediction of a prediction classification resultL c Calculating the actual classification loss of the flow state of a single class of the flow sample data of a certain source domain, summing the actual classification losses of the flow states of all classes to obtain the actual classification loss of the flow sample data of the source domain, and if a plurality of the flow sample data of the source domain exist, summing the actual classification losses of the flow sample data of the source domain to obtain the actual classification loss of the first supervision training.
Six-piece valve
Wherein,represent the firstcIndividual traffic status categories,/- >The first to represent traffic classification network outputcProbability values for individual traffic state categories; />Representing a class indication function, assumingkRepresent the firstkA traffic status category, when the traffic status label of the source domain traffic sample data is the firstkClass of traffic states, andc=kwhen (I)>Otherwise->The method comprises the steps of carrying out a first treatment on the surface of the As can be seen, the present disclosure showsExemplary embodiments can determine the class indication function therein by the traffic state label of the source domain traffic sample data and the predicted class result of the source domain traffic state>Is a value of (a).
Representing a penalty false positive, which can be considered as the upper boundary of the probability value, can take a fixed value of 0.9, when +.>>At 0.9, the loss function is set to 0; />Represents punishment false negative, can be regarded as the lower boundary of probability value, and takes a fixed value of 0.1 when<When 0.1, the loss function is set to 0; />The scale factor is expressed and is used for adjusting the proportion of the two items, and the value is usually 0.5.
As shown in fig. 6, a source domain feature extractor is providedCapsule extractor->And traffic classification network->The model parameters of (2) are expressed as +.>Model parameter optimization may be performed by minimizing class classification loss functions. Assuming that the capsule feature extractor includes a number of digital capsule layers of 1, and the number of samples of the input source domain flow sample data is 1, The first feature extractor may be optimized by minimizing the class classification loss function shown in equations seven through eight>Model parameters of>Capsule character extractor->Model parameters of>And traffic classification network->Model parameters of>。
Seven kinds of
Eight kinds of
Nine kinds of
Wherein,representing the first feature extractor->Model parameters of>Optimized value of->Representing a capsule feature extractor->Model parameters of>Optimized value of->Representing traffic classification network +.>Model parameters of>Is used for the optimization of the values of (a).
The exemplary embodiments of the present disclosure may perform a classification test on the target domain traffic data after the first supervised training is completed, and may utilize the model parameters of the first feature extractor and the optimization parameters of the nonlinear layer through the first supervised training, while the model parameters of the second feature extractor may be initialized through the model parameters of the first feature extractor.
As shown in fig. 6, the objective of the exemplary embodiment of the present disclosure in the second supervised training is to obfuscate the source domain traffic sample data and the target domain traffic sample data, and the first feature extractor obtained by the first supervised training may be utilizedG s For the second feature extractorG t Initializing and then inputting source domain traffic sample data into a first feature extractor G s Obtaining source domain traffic sample datax s Is the second basic feature of (2)G s (x s ). It should be appreciated that here source domain traffic sample datax s The source domain flow sample data can be re-acquired or the original source domain flow sample datax s . At the same time, inputting the target domain traffic sample data into a second feature extractorG t Obtaining basic characteristics of the target domain flowG t (x t ). Source domain traffic sample data is then usedx s Is the second basic feature of (2)G s (x s ) And target domain trafficIs characterized by (1)G t (x t ) Input capsule feature extractorSecond source domain flow higher order sample feature +.>And target domain traffic high order sample feature +.>。
Characterizing the second source domain traffic high order samplesAnd target domain traffic high order sample featuresInput domain countermeasure network, domain countermeasure networkDGradient inversion layer in (a)GRLHigh order sample feature for second source domain traffic can be +.>And target domain traffic high order sample feature +.>Performing identity transformation and then domain antagonizing the networkDThe second source domain traffic high order sample feature can be compromised by a fully connected approach>And target domain traffic high order sample feature +.>And performing domain classification, thereby obtaining a prediction result of the domain classification.
Exemplary, the second source domain traffic high order sample featureThe substance may include a predictive vector, target, of source domain flow output by each digital capsule layer in the capsule feature extractor Domain traffic high order sample featureThe substance may include a predictive vector of target domain traffic output by each digital capsule layer.
Considering that the domain classification task is a classification task when model parameter optimization is performed by the second supervised training, the domain classification loss function used by the exemplary embodiment of the present disclosure when performing the second supervised trainingL d May be a cross entropy loss function, which may be expressed as formula ten:
ten kinds of
Wherein,expressed by the firstiThe source domain traffic sample data is taken as input, the domain is against the first predictive vector of the network output,/->Expressed by the firstiSource domain traffic sample data, domain against a second predictive vector output by the network; />Expressed by the firstiThe target domain traffic sample data is used as input, the domain is against the first predictive vector of the network output,/->Expressed by the firstiThe target domain traffic sample data is input and the domain counter-acts the second predictive vector of the network output. Assuming that the first output value represents source domain traffic and the second represents target domain traffic, the domain classification label includes domain labels [1,0 ] of source domain traffic sample data]And domain label [0,1 ] of target domain traffic sample data]，n s A total number of samples representing source domain traffic sample data, n t Representing the total number of samples of the target flow sample data.
In view of the fact that the second feature extractor aims at maximizing the domain classification loss and the domain countermeasure network aims at minimizing the domain classification loss, and the model parameter optimization directions of the domain countermeasure network and the domain countermeasure network are opposite, the exemplary embodiments of the disclosure introduce a gradient inversion layer in the domain countermeasure network during the second supervised training, and the gradient inversion layer automatically inverts the domain classification loss gradient of the domain countermeasure layer during the back propagation process, so that the domain classification loss gradient is automatically inverted before being propagated to the model parameter of the second domain feature extractor, and an effect similar to that of generating the countermeasure network is achieved.
Illustratively, the related expression of the gradient inversion layer of the exemplary embodiment of the present disclosure may be shown in formula eleven, and the gradient inversion function of the gradient inversion layer may be implemented by formula twelve during the back propagation process, which is specifically as follows:
eleven
Twelve
IIs a matrix of units which is a matrix of units,λ p representing the gradient inversion parameter, which exhibits dynamic variation, can be represented by the formula thirteen, as follows:
thirteen kinds of
pThe relative value of the iteration process, that is, the ratio of the current iteration number to the total iteration number, is represented by gamma, which represents a constant, and can be 10.
The exemplary embodiments of the present disclosure may also update model parameters of the domain countermeasure network and model parameters of the capsule extraction network obtained by the first supervised training in an alternating iterative manner through alternating iterations at the time of the second supervised training.
In practical application, the exemplary embodiment of the present disclosure first fixes the capsule feature extractorModel parameters and traffic classification network of->And then updating the model parameters of the domain countermeasure network in a manner of minimizing the domain classification loss function through a formula shown in a formula fourteen when the prediction result of the domain classification is obtained.
Fourteen-in-one
Wherein,model parameters representing domain countermeasure network +.>Optimized value of->Model parameters representing the second feature extractor +.>Optimized value of->An optimized value representing model parameters of the capsule feature extractor.
Model parameters of a antagonizing network in a completion domainAfter one update of the optimized values of (a), the model parameters of the countermeasure network and the model parameters of the capsule feature extractor can be fixed, and then the next training is started by taking the source domain flow sample data and the target domain flow sample data as data sets. After the prediction result of the domain classification is obtained, model parameter optimization of the second feature extractor can be performed through the maximized domain classification loss function as shown in the formula fifteen.
Fifteen pieces of equipment
After the second supervised training is completed, the exemplary embodiments of the present disclosure may perform a target domain traffic data class classification test with the target domain traffic data as input. Considering that the second supervised training can confuse the source domain traffic sample data with the target domain traffic sample data, therefore, the network is classified by trafficThe source domain traffic state and the target domain traffic state can be predicted more accurately.
The exemplary embodiments of the present disclosure may also provide a flow detection method, which may apply the flow detection model trained by the training method of the exemplary embodiments of the present disclosure. Fig. 7 shows a flow diagram of a flow detection method according to an exemplary embodiment of the present disclosure. As shown in fig. 7, the flow detection method of the exemplary embodiment of the present disclosure may include:
step 701: inputting the target domain flow information into a capsule extraction network to obtain the high-order characteristic of the target domain flow. The target domain network referred to by the target domain traffic information herein may refer to a target domain network referred to by a training phase, and may refer to various possible networks, such as: various networks such as a campus network, a home network, and a corporate network, but not limited thereto.
Step 702: and inputting the high-order characteristics of the target domain flow into a flow classification network to obtain a classification result of the target domain flow state. The classification result of the target domain traffic state may include one or more classification results, each of which may represent its classification likelihood by way of probability.
Step 703: and determining the traffic state of the target domain based on the classification result of the traffic state of the target domain. When each classification result represents the classification possibility in a probability mode, the traffic state of the target domain corresponding to the classification result with the classification possibility larger than the preset threshold value can be obtained, the classification possibility of each classification result can be compared, and the traffic state of the target domain corresponding to the classification result with the highest classification possibility can be selected.
In one alternative, when the capsule extraction network of the exemplary embodiments of the present disclosure includes at least a first feature extractor and a capsule feature extractor, the first feature extractor of the exemplary embodiments of the present disclosure is configured to obtain a basic feature of the target domain traffic based on the target domain traffic information, and the capsule feature extractor is configured to obtain a higher-order feature of the target domain traffic based on the basic feature of the target domain traffic. The higher order features of the target domain flow here include the coupling results of the capsule features of the plurality of target domains by the coupling parameters.
For example, when the capsule extraction feature may initialize the basic feature of the target domain flow through the main capsule layer, obtain a plurality of capsule input features of the target domain flow, each digital capsule layer performs affine transformation on the plurality of capsule input features of the target domain flow, obtain a plurality of affine transformation results, then weight the plurality of affine transformation results through coupling coefficients, thereby obtaining an output vector of the target domain flow output by the digital capsule layer, and then normalize the output vector modulus of the target domain flow output by each digital capsule layer through the flow classification network, obtain classification probabilities of the plurality of target domain flows, and select a class with the highest classification probability as the flow state of the target domain.
In one or more technical schemes provided in the embodiments of the present disclosure, in a first supervised training process, a capsule extraction network ensures that a high-order sample feature of a first source domain flow output by the capsule extraction network fully reflects a bottom layer feature and a high layer feature of source domain flow sample data, so that a trained flow classification network can accurately detect a source domain flow state. In the second supervised training process, the capsule extraction network obtained through the first supervised training can enable the second source domain flow high-order sample characteristics extracted by the capsule extraction network obtained through the first supervised training to fully reflect the bottom-layer characteristics and the high-layer characteristics of the source domain flow sample data, and the target domain flow high-order sample characteristics can fully reflect the bottom-layer characteristics and the high-layer characteristics of the target domain flow sample data. On the basis, in the method of the exemplary embodiment of the disclosure, during the second supervised training, the domain countermeasure network is used for adaptively aligning the second source domain traffic high-order sample feature and the target domain traffic high-order sample feature, so as to obtain an inter-domain adaptive alignment feature, and a prediction result of domain classification is determined based on the inter-domain adaptive alignment feature, and the domain countermeasure network can map the first source domain traffic high-order sample feature and the target domain traffic high-order sample feature to the same feature space as much as possible through a back propagation process in the training process, and the distance between the first source domain traffic high-order sample feature and the target domain traffic high-order sample feature in the feature space is gradually close.
It can be seen that the exemplary embodiments of the present disclosure can ensure that the capsule extraction network extracts as high-level features as possible from the target domain flow information and the source domain flow information through training the flow detection model. When the trained flow detection model is applied to target domain flow detection, the high-order feature of the target domain flow extracted by the capsule extraction network can be suitable for a flow classification network trained on the basis of source domain flow sample data, so that the flow classification network can accurately identify the target domain flow state.
The foregoing description of the embodiments of the present disclosure has been presented primarily in terms of methods. It is to be understood that the apparatus for implementing the methods of the exemplary embodiments of the present disclosure may include corresponding hardware structures and/or software modules that perform the various functions. Those of skill in the art will readily appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as hardware or combinations of hardware and computer software. Whether a function is implemented as hardware or computer software driven hardware depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present disclosure.
The embodiments of the present disclosure may divide functional units of an apparatus implementing the methods of the exemplary embodiments of the present disclosure according to the above-described method examples, for example, each functional module may be divided corresponding to each function, or two or more functions may be integrated into one processing module. The integrated modules may be implemented in hardware or in software functional modules. It should be noted that, in the embodiment of the present disclosure, the division of the modules is merely a logic function division, and other division manners may be implemented in actual practice.
In the case of dividing each functional module by corresponding each function, exemplary embodiments of the present disclosure provide a training apparatus, which may be an electronic device or a chip applied to the electronic device. Fig. 8 shows a functional block diagram of a training device according to an exemplary embodiment of the present disclosure. As shown in fig. 8, the training device 800 is configured to train a flow detection model, where the flow detection model includes: capsule extraction network, traffic classification network, and domain countermeasure network, the training device 800 comprises:
a first training module 801, configured to perform a first supervised training on the capsule extraction network and the flow classification network based on source domain flow sample data, where the capsule extraction network is configured to determine a first source domain flow high order sample feature based on the source domain flow sample data, and the flow classification network is configured to obtain a prediction classification result of a source domain flow state based on the source domain flow high order sample feature;
A second training module 802, configured to perform a second supervised training on the capsule extraction network and the domain countermeasure network obtained by the first supervised training based on the source domain traffic sample data and the target domain traffic sample data, where the capsule extraction network obtained by the first supervised training is configured to determine a second source domain traffic high order sample feature and a target domain traffic high order sample feature based on the source domain traffic sample data and the target domain traffic sample data, and the domain countermeasure network is configured to adaptively align the second source domain traffic high order sample feature and the target domain traffic high order sample feature to obtain an inter-domain adaptive alignment feature, and determine a prediction result of a domain classification based on the inter-domain adaptive alignment feature.
In one possible implementation, the updating of the model parameters of the capsule extraction network and the model parameters of the flow classification network during the first supervised training process includes an updating of a minimized class classification loss function.
In a possible implementation manner, the updating manner of the model parameters of the domain countermeasure network and the model parameters of the capsule extraction network obtained by the first supervised training in the second supervised training includes: updating model parameters of the domain countermeasure network and model parameters of the capsule extraction network obtained by the first supervised training in an alternating iterative manner.
In one possible implementation manner, the updating manner of the model parameters of the domain countermeasure network is an updating manner of the minimized domain classification loss function, and the updating manner of the model parameters of the capsule extraction network obtained by the first supervision training is an updating manner of the maximized domain classification loss function.
In one possible implementation, the domain countermeasure network includes:
the gradient inversion layer is used for adaptively aligning the second source domain flow high-order sample characteristic and the target domain flow high-order sample characteristic to obtain an inter-domain adaptive alignment characteristic;
and the domain classifier is used for obtaining a prediction result of the domain classification based on the inter-domain self-adaptive alignment feature.
In one possible implementation, the capsule extraction network comprises:
a first feature extractor for determining a plurality of first basic features of source domain traffic based on the source domain traffic sample data during a first supervised training process, and a plurality of second basic features of source domain traffic based on the source domain traffic sample data during the second supervised training process;
a second feature extractor for determining a plurality of basic features of a target domain flow based on the target domain flow sample data during the second supervised training process;
And the capsule feature extractor is used for determining the first source domain flow high-order sample feature based on a plurality of first basic features of the source domain flow in the first supervised training process, determining the second source domain flow high-order sample feature based on a plurality of second basic features of the source domain flow in the second supervised training process, and determining the target domain flow high-order sample feature based on a plurality of basic features of the target domain flow.
In a possible implementation manner, the traffic classification network is configured to perform nonlinear processing on the high-order sample feature of the first source domain traffic in the first supervised training to obtain a prediction classification result of the source domain traffic state.
In one possible implementation, the first source domain traffic high order sample feature comprises a plurality of attribute first capsule sample features of the source domain traffic, the second source domain traffic high order sample feature comprises a plurality of attribute second capsule sample features of the source domain traffic, and the target domain traffic high order sample feature comprises a plurality of attribute capsule sample features of the target domain.
In the case of dividing each functional module with corresponding each function, exemplary embodiments of the present disclosure provide a flow rate detection apparatus, which may be an electronic device or a chip applied to the electronic device. Fig. 9 shows a functional block diagram of a flow rate detection device according to an exemplary embodiment of the present disclosure. As shown in fig. 9, the flow detection device 900 applies a flow detection model trained by the method according to the exemplary embodiment of the present disclosure, including:
The extraction module 901 is used for inputting the information of the target domain flow into the capsule extraction network to obtain the high-order characteristic of the target domain flow;
the classification module 902 is configured to input the higher-order feature of the target domain traffic into a traffic classification network, and obtain a classification result of the target domain traffic state;
a determining module 903, configured to determine a traffic state of the target domain based on a classification result of the traffic state of the target domain.
In one possible implementation, the high-order feature of the target domain flow includes coupling results of a plurality of capsule features of the target domain formed by coupling parameters, and the capsule extraction network includes at least a first feature extractor and a capsule feature extractor;
the first feature extractor is used for obtaining basic features of the target domain flow based on the target domain flow information;
the capsule feature extractor is configured to obtain a higher-order feature of the target domain flow based on the basic feature of the target domain flow.
Fig. 10 shows a schematic block diagram of a chip according to an exemplary embodiment of the present disclosure. As shown in fig. 10, the chip 1000 includes one or more (including two) processors 1001 and a communication interface 1002. The communication interface 1002 may support a server to perform the data transceiving steps in the image processing method described above, and the processor 1001 may support the server to perform the data processing steps in the image processing method described above.
Optionally, as shown in fig. 10, the chip 1000 further includes a memory 1003, and the memory 1003 may include a read-only memory and a random access memory, and provides operation instructions and data to the processor. A portion of the memory may also include non-volatile random access memory (non-volatile random access memory, NVRAM).
In some embodiments, as shown in fig. 10, the processor 1001 performs the corresponding operation by invoking an operation instruction stored in memory (which may be stored in an operating system). The processor 1001 controls the processing operations of any one of the terminal devices, and may also be referred to as a central processing unit (central processing unit, CPU). Memory 1003 may include read only memory and random access memory and provides instructions and data to processor 1001. A portion of the memory 1003 may also include NVRAM. Such as a memory, a communication interface, and a memory coupled together by a bus system that may include a power bus, a control bus, a status signal bus, etc., in addition to a data bus. The various buses are labeled in fig. 10 as bus system 1004 for clarity of illustration.
The method disclosed by the embodiment of the disclosure can be applied to a processor or implemented by the processor. The processor may be an integrated circuit chip having signal processing capabilities. In implementation, the steps of the above method may be performed by integrated logic circuits of hardware in a processor or by instructions in the form of software. The processor may be a general purpose processor, a digital signal processor (digital signal processing, DSP), an ASIC, an off-the-shelf programmable gate array (field-programmable gate array, FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware components. The various methods, steps and logic blocks of the disclosure in the embodiments of the disclosure may be implemented or performed. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like. The steps of a method disclosed in connection with the embodiments of the present disclosure may be embodied directly in hardware, in a decoded processor, or in a combination of hardware and software modules in a decoded processor. The software modules may be located in a random access memory, flash memory, read only memory, programmable read only memory, or electrically erasable programmable memory, registers, etc. as well known in the art. The storage medium is located in a memory, and the processor reads the information in the memory and, in combination with its hardware, performs the steps of the above method.
The exemplary embodiments of the present disclosure also provide an electronic device including: at least one processor; and a memory communicatively coupled to the at least one processor. The memory stores a computer program executable by the at least one processor for causing the electronic device to perform a method according to embodiments of the present disclosure when executed by the at least one processor.
The present disclosure also provides a non-transitory computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor of a computer, is for causing the computer to perform a method according to an embodiment of the present disclosure.
The present disclosure also provides a computer program product comprising a computer program, wherein the computer program, when executed by a processor of a computer, is for causing the computer to perform a method according to embodiments of the disclosure.
Referring to fig. 11, a block diagram of an electronic device 1100 that may be a server or a client of the present disclosure, which is an example of a hardware device that may be applied to aspects of the present disclosure, will now be described. Electronic devices are intended to represent various forms of digital electronic computer devices, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular telephones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be exemplary only, and are not meant to limit implementations of the disclosure described and/or claimed herein.
As shown in fig. 11, the electronic device 1100 includes a computing unit 1101 that can perform various appropriate actions and processes according to a computer program stored in a Read Only Memory (ROM) 1102 or a computer program loaded from a storage unit 1108 into a Random Access Memory (RAM) 1103. In the RAM 1103, various programs and data required for the operation of the device 1100 can also be stored. The computing unit 1101, ROM 1102, and RAM 1103 are connected to each other by a bus 1104. An input/output (I/O) interface 1105 is also connected to bus 1104.
As shown in fig. 11, various components in the electronic device 1100 are connected to the I/O interface 1105, including: an input unit 1106, an output unit 1107, a storage unit 1108, and a communication unit 1109. The input unit 1106 may be any type of device capable of inputting information to the electronic device 1100, and the input unit 1106 may receive input numeric or character information and generate key signal inputs related to user settings and/or function controls of the electronic device. The output unit 1107 may be any type of device capable of presenting information and may include, but is not limited to, a display, speakers, video/audio output terminals, vibrators, and/or printers. Storage unit 1108 may include, but is not limited to, magnetic disks, optical disks. The communication unit 1109 allows the electronic device 1100 to exchange information/data with other devices through computer networks such as the internet and/or various telecommunications networks, and may include, but is not limited to, modems, network cards, infrared communication devices, wireless communication transceivers and/or chipsets, such as bluetooth (TM) devices, wiFi devices, wiMax devices, cellular communication devices, and/or the like.
As shown in fig. 11, the computing unit 1101 may be a variety of general purpose and/or special purpose processing components having processing and computing capabilities. Some examples of computing unit 1101 include, but are not limited to, a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), various specialized Artificial Intelligence (AI) computing chips, various computing units running machine learning model algorithms, a Digital Signal Processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 1101 performs the respective methods and processes described above. For example, in some embodiments, the methods of the exemplary embodiments of the present disclosure may be implemented as a computer software program tangibly embodied on a machine-readable medium, such as storage unit 1108. In some embodiments, some or all of the computer programs may be loaded and/or installed onto electronic device 1100 via ROM 1102 and/or communication unit 1109. In some embodiments, the computing unit 1101 may be configured to perform the methods of the exemplary embodiments of the present disclosure by any other suitable means (e.g., by means of firmware).
Program code for carrying out methods of the present disclosure may be written in any combination of one or more programming languages. These program code may be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus such that the program code, when executed by the processor or controller, causes the functions/operations specified in the flowchart and/or block diagram to be implemented. The program code may execute entirely on the machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.
In the context of this disclosure, a machine-readable medium may be a tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. The machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
As used in this disclosure, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, apparatus, and/or device (e.g., magnetic discs, optical disks, memory, programmable Logic Devices (PLDs)) used to provide machine instructions and/or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The term "machine-readable signal" refers to any signal used to provide machine instructions and/or data to a programmable processor.
To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to a user; and a keyboard and pointing device (e.g., a mouse or trackball) by which a user can provide input to the computer. Other kinds of devices may also be used to provide for interaction with a user; for example, feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form, including acoustic input, speech input, or tactile input.
The systems and techniques described here can be implemented in a computing system that includes a background component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such background, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local Area Networks (LANs), wide Area Networks (WANs), and the internet.
The computer system may include a client and a server. The client and server are typically remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other.
In the above embodiments, it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented in software, may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instructions are loaded and executed on a computer, the processes or functions described by the embodiments of the present disclosure are performed in whole or in part. The computer may be a general purpose computer, a special purpose computer, a computer network, a terminal, a user equipment, or other programmable apparatus. The computer program or instructions may be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer program or instructions may be transmitted from one website site, computer, server, or data center to another website site, computer, server, or data center by wired or wireless means. The computer readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that integrates one or more available media. The usable medium may be a magnetic medium, e.g., floppy disk, hard disk, tape; optical media, such as digital video discs (digital video disc, DVD); but also semiconductor media such as solid state disks (solid state drive, SSD).
Although the present disclosure has been described in connection with specific features and embodiments thereof, it will be apparent that various modifications and combinations thereof can be made without departing from the spirit and scope of the disclosure. Accordingly, the specification and drawings are merely exemplary illustrations of the present disclosure as defined in the appended claims and are considered to cover any and all modifications, variations, combinations, or equivalents within the scope of the disclosure. It will be apparent to those skilled in the art that various modifications and variations can be made to the present disclosure without departing from the spirit or scope of the disclosure. Thus, the present disclosure is intended to include such modifications and alterations insofar as they come within the scope of the appended claims or the equivalents thereof.
Claims (11)
1. A method of training, for training a flow detection model, the flow detection model comprising: a capsule extraction network, a traffic classification network, and a domain countermeasure network, the method comprising:
performing first supervised training on the capsule extraction network and the flow classification network based on source domain flow sample data, wherein the capsule extraction network is used for determining a first source domain flow high-order sample feature based on the source domain flow sample data, and the flow classification network is used for acquiring a prediction classification result of a source domain flow state based on the source domain flow high-order sample feature;
Performing second supervised training on the capsule extraction network and the domain countermeasure network obtained by the first supervised training based on the source domain traffic sample data and the target domain traffic sample data, wherein the capsule extraction network obtained by the first supervised training is used for determining a second source domain traffic high-order sample feature and a target domain traffic high-order sample feature based on the source domain traffic sample data and the target domain traffic sample data, and the domain countermeasure network is used for adaptively aligning the second source domain traffic high-order sample feature and the target domain traffic high-order sample feature to obtain inter-domain adaptive alignment features and determining a prediction result of domain classification based on the inter-domain adaptive alignment features;
the updating mode of the model parameters of the domain countermeasure network and the model parameters of the capsule extraction network obtained by the first supervised training in the second supervised training comprises the following steps: updating model parameters of the domain countermeasure network and model parameters of the capsule extraction network obtained by the first supervision training in an alternate iteration mode;
the updating mode of the model parameters of the domain countermeasure network is the updating mode of the minimized domain classification loss function, and the updating mode of the model parameters of the capsule extraction network obtained by the first supervision training is the updating mode of the maximized domain classification loss function.
2. The method of claim 1, wherein the updating of the model parameters of the capsule extraction network and the model parameters of the flow classification network in the first supervised training comprises minimizing updating of class classification loss functions.
3. The method of claim 1, wherein the domain countermeasure network comprises:
the gradient inversion layer is used for adaptively aligning the second source domain flow high-order sample characteristic and the target domain flow high-order sample characteristic to obtain an inter-domain adaptive alignment characteristic;
and the domain classifier is used for obtaining a prediction result of the domain classification based on the inter-domain self-adaptive alignment feature.
4. The method of claim 1, wherein the capsule extraction network comprises:
a first feature extractor for determining a plurality of first basic features of source domain traffic based on the source domain traffic sample data during a first supervised training process, and a plurality of second basic features of source domain traffic based on the source domain traffic sample data during the second supervised training process;
a second feature extractor for determining a plurality of basic features of the target domain traffic based on the target domain traffic sample data during a second supervised training process;
And the capsule feature extractor is used for determining the first source domain flow high-order sample feature based on a plurality of first basic features of the source domain flow in the first supervised training process, determining the second source domain flow high-order sample feature based on a plurality of second basic features of the source domain flow in the second supervised training process, and determining the target domain flow high-order sample feature based on a plurality of basic features of the target domain flow.
5. The method according to any one of claims 1 to 4, wherein the traffic classification network is configured to perform nonlinear processing on the high-order sample feature of the first source domain traffic in the first supervised training to obtain a prediction classification result of the source domain traffic state.
6. A flow detection method, characterized in that a flow detection model trained by the training method according to any one of claims 1 to 5 is applied, the method comprising:
inputting the target domain flow information into a capsule extraction network to obtain the high-order characteristic of the target domain flow;
inputting the high-order characteristics of the target domain flow into a flow classification network to obtain a classification result of the target domain flow state;
And determining the traffic state of the target domain based on the classification result of the traffic state of the target domain.
7. The method of claim 6, wherein the higher order features of the target domain flow comprise coupling results of a plurality of capsule features of the target domain formed by coupling parameters, the capsule extraction network comprising at least a first feature extractor and a capsule feature extractor;
the first feature extractor is used for obtaining basic features of the target domain flow based on the target domain flow information;
the capsule feature extractor is configured to obtain a higher-order feature of the target domain flow based on the basic feature of the target domain flow.
8. A training device for training a flow detection model, the flow detection model comprising: a capsule extraction network, a traffic classification network, and a domain countermeasure network, the apparatus comprising:
the first training module is used for performing first supervision training on the capsule extraction network and the flow classification network based on source domain flow sample data, the capsule extraction network is used for determining first source domain flow high-order sample characteristics based on the source domain flow sample data, and the flow classification network is used for acquiring a prediction classification result of a source domain flow state based on the source domain flow high-order sample characteristics;
The second training module is used for performing second supervised training on the capsule extraction network and the domain countermeasure network obtained by the first supervised training based on the source domain flow sample data and the target domain flow sample data, the capsule extraction network obtained by the first supervised training is used for determining a second source domain flow high-order sample feature and a target domain flow high-order sample feature based on the source domain flow sample data and the target domain flow sample data, and the domain countermeasure network is used for performing self-adaptive alignment on the second source domain flow high-order sample feature and the target domain flow high-order sample feature to obtain inter-domain self-adaptive alignment features and determining a prediction result of domain classification based on the inter-domain self-adaptive alignment features;
the updating mode of the model parameters of the domain countermeasure network and the model parameters of the capsule extraction network obtained by the first supervised training in the second supervised training comprises the following steps: updating model parameters of the domain countermeasure network and model parameters of the capsule extraction network obtained by the first supervision training in an alternate iteration mode;
the updating mode of the model parameters of the domain countermeasure network is the updating mode of the minimized domain classification loss function, and the updating mode of the model parameters of the capsule extraction network obtained by the first supervision training is the updating mode of the maximized domain classification loss function.
9. A flow detection device, characterized in that a flow detection model trained by the method of any one of claims 1 to 5 is applied, the device comprising:
the extraction module is used for inputting the information of the target domain flow into the capsule extraction network to obtain the high-order characteristic of the target domain flow;
the classification module is used for inputting the high-order characteristics of the target domain flow into a flow classification network to obtain a classification result of the target domain flow state;
and the determining module is used for determining the traffic state of the target domain based on the classification result of the traffic state of the target domain.
10. An electronic device, comprising:
a processor; the method comprises the steps of,
a memory storing a program;
wherein the program comprises instructions which, when executed by the processor, cause the processor to perform the method according to any one of claims 1-7.
11. A non-transitory computer readable storage medium storing computer instructions for causing a computer to perform the method of any one of claims 1-7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311385659.9A CN117131424B (en) | 2023-10-25 | 2023-10-25 | Training method, flow detection method, device, equipment and medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311385659.9A CN117131424B (en) | 2023-10-25 | 2023-10-25 | Training method, flow detection method, device, equipment and medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN117131424A CN117131424A (en) | 2023-11-28 |
| CN117131424B true CN117131424B (en) | 2024-02-20 |
Family
ID=88861314
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202311385659.9A Active CN117131424B (en) | 2023-10-25 | 2023-10-25 | Training method, flow detection method, device, equipment and medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117131424B (en) |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112446423A (en) * | 2020-11-12 | 2021-03-05 | 昆明理工大学 | Fast hybrid high-order attention domain confrontation network method based on transfer learning |
| CN113669246A (en) * | 2021-08-23 | 2021-11-19 | 水利部交通运输部国家能源局南京水利科学研究院 | Intelligent diagnosis method for water pump fault under cross-working condition |
| CN114529766A (en) * | 2022-02-18 | 2022-05-24 | 厦门大学 | Heterogeneous source SAR target identification method based on domain adaptation |
| CN114781647A (en) * | 2022-04-11 | 2022-07-22 | 南京信息工程大学 | Unsupervised domain adaptation method for distinguishing simple samples from difficult samples |
| CN114970715A (en) * | 2022-05-26 | 2022-08-30 | 山东大学 | Variable working condition fault diagnosis method and system under small sample and unbalanced data constraint |
| CN115127814A (en) * | 2022-07-20 | 2022-09-30 | 燕山大学 | Unsupervised bearing fault diagnosis method based on self-adaptive residual error countermeasure network |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US11176477B2 (en) * | 2018-02-06 | 2021-11-16 | Hrl Laboratories, Llc | System and method for unsupervised domain adaptation via sliced-wasserstein distance |
| US20200130177A1 (en) * | 2018-10-29 | 2020-04-30 | Hrl Laboratories, Llc | Systems and methods for few-shot transfer learning |
-
2023
- 2023-10-25 CN CN202311385659.9A patent/CN117131424B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112446423A (en) * | 2020-11-12 | 2021-03-05 | 昆明理工大学 | Fast hybrid high-order attention domain confrontation network method based on transfer learning |
| CN113669246A (en) * | 2021-08-23 | 2021-11-19 | 水利部交通运输部国家能源局南京水利科学研究院 | Intelligent diagnosis method for water pump fault under cross-working condition |
| CN114529766A (en) * | 2022-02-18 | 2022-05-24 | 厦门大学 | Heterogeneous source SAR target identification method based on domain adaptation |
| CN114781647A (en) * | 2022-04-11 | 2022-07-22 | 南京信息工程大学 | Unsupervised domain adaptation method for distinguishing simple samples from difficult samples |
| CN114970715A (en) * | 2022-05-26 | 2022-08-30 | 山东大学 | Variable working condition fault diagnosis method and system under small sample and unbalanced data constraint |
| CN115127814A (en) * | 2022-07-20 | 2022-09-30 | 燕山大学 | Unsupervised bearing fault diagnosis method based on self-adaptive residual error countermeasure network |
Non-Patent Citations (1)
| Title |
|---|
| Sankaranarayanan,S.等.Generate to adapt：Aligning domains using generative adversarial networks.CVPR.2018,第1-11页. * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN117131424A (en) | 2023-11-28 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US20210174264A1 (en) | Training tree-based machine-learning modeling algorithms for predicting outputs and generating explanatory data | |
| US11537852B2 (en) | Evolving graph convolutional networks for dynamic graphs | |
| CN110929047B (en) | Knowledge graph reasoning method and device for focusing on neighbor entity | |
| CN113408743B (en) | Method and device for generating federal model, electronic equipment and storage medium | |
| US20200177634A1 (en) | Hybrid Network Infrastructure Management | |
| US11397891B2 (en) | Interpretability-aware adversarial attack and defense method for deep learnings | |
| CN114357105B (en) | Pre-training method and model fine-tuning method of geographic pre-training model | |
| CN112508199B (en) | Feature selection method and device for cross-feature federal learning and related equipment | |
| CN112214775A (en) | Injection type attack method and device for graph data, medium and electronic equipment | |
| CN112580733B (en) | Classification model training method, device, equipment and storage medium | |
| US11373760B2 (en) | False detection rate control with null-hypothesis | |
| US20230021338A1 (en) | Conditionally independent data generation for training machine learning systems | |
| CN109670141A (en) | Prediction technique, system, medium and electronic equipment | |
| US20240005646A1 (en) | Method for generating saliency map, and method and apparatus for detecting abnormal object | |
| CN114462532A (en) | Model training method, device, equipment and medium for predicting transaction risk | |
| CN111459898A (en) | Machine learning method, computer-readable recording medium, and machine learning apparatus | |
| CN113627536A (en) | Model training method, video classification method, device, equipment and storage medium | |
| US20210142213A1 (en) | Data Partitioning with Quality Evaluation | |
| CN117131424B (en) | Training method, flow detection method, device, equipment and medium | |
| US20210158179A1 (en) | Dynamic recommendation system for correlated metrics and key performance indicators | |
| WO2020252925A1 (en) | Method and apparatus for searching user feature group for optimized user feature, electronic device, and computer nonvolatile readable storage medium | |
| CN115346072A (en) | Training method and device of image classification model, electronic equipment and storage medium | |
| CN112749082B (en) | Test case generation method and system based on DE-TH algorithm | |
| CN116777814A (en) | Image processing method, apparatus, computer device, storage medium, and program product | |
| CN113961962A (en) | Model training method and system based on privacy protection and computer equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |