CN111291792B - Traffic data type integrated classification method and device based on dual evolution - Google Patents

Abstract

The invention discloses a flow data type integrated classification method, a device, computer equipment and a storage medium based on double evolution, which are characterized in that a first population size value feature subset is obtained after a plurality of different models are respectively iterated for a first maximum iteration number and trained into a classifier, then the generated classifier is selected, and a second type of initialization population obtained by initializing according to a preset second population size value is subjected to evolution corresponding algebra according to a preset second optimization target condition according to a second maximum iteration algebra, so that an output second type of initialization population is obtained; and selecting a base classifier according to each individual in the second class initialization population in the current classifier group to obtain a target classifier group corresponding to each individual so as to form an optimal target classifier group. According to the embodiment of the invention, the optimal classifier combination combining multiple models can be finally obtained, and the flow types can be more accurately classified through the result fusion of the classifiers, so that the problem that some attacks cannot be identified is solved.

Description

Traffic data type integrated classification method and device based on dual evolution

Technical field

The invention relates to the technical field of wireless network intrusion detection, and in particular to an integrated classification method, device, computer equipment and storage medium of traffic data types based on dual evolution.

Background technique

With the popularity of the Internet and the rapid development of technology, more and more network intrusions have occurred. As a widely used prevention technology, intrusion detection systems (IDS) have become increasingly important, which is also a hot research topic in recent years.

IDS is a classifier used to analyze network traffic data types and can accurately identify various attacks on the network. When an IDS is deployed on a server, data from the external network first reaches the IDS through the firewall. The IDS evaluates the type of data and returns it to the firewall. Ordinary data can reach the server through the firewall, while attack data will be filtered by the firewall. The essence of IDS is an unbalanced classification problem. The number of samples in each category of training samples in the current network traffic data set is unbalanced. The number of samples in some categories varies greatly. In order to maximize the detection rate, the trained model usually Minorities are ignored.

Classifiers usually deployed in IDS are single-type classifiers (such as self-organizing feature mapping network, the English abbreviation of self-organizing feature mapping network is SOM), and the recognition rate of less common attack types is not high.

Contents of the invention

Embodiments of the present invention provide an integrated classification method, device, computer equipment and storage medium for traffic data types based on dual evolution, aiming to solve the problem that the classifiers deployed in the intrusion detection system in the prior art are all single-type classifiers. A rare problem of low attack type recognition rate.

In the first aspect, embodiments of the present invention provide an integrated classification method of traffic data types based on dual evolution, which includes:

Perform population initialization according to the preset first population size value to obtain multiple sub-category initialization populations; wherein, the total number of individuals included in each sub-category initialization population in the multiple sub-category initialization populations is equal to the first population size value Equally, each individual included in each sub-category initialization population in multiple sub-category initialization populations corresponds to a binary sequence, and each individual included in each sub-category initialization population in multiple sub-category initialization populations corresponds to a binary sequence included in The number of features is equal to the number of features of the wireless network traffic data;

According to the preset first maximum iteration generation, iteratively and repeatedly perform feature selection and input for each individual in the initialization population of each subcategory of the multiple subcategories of the training data subset in the prestored wireless network traffic data set. Go to the classifier model to be trained corresponding to each sub-category initialization population, obtain the base classifier group corresponding to each sub-category initialization population, and use multiple sub-category initialization populations for each sub-category initialization population according to the corresponding base classifier group Evolve with the preset first optimization target conditions to obtain the current population of the subcategory corresponding to the initialization population of each subcategory, until the base classifier group corresponding to the initialization population of each subcategory is obtained, and the initialization population of each subcategory corresponds to The current classifier group composed of base classifier groups;

Perform population initialization according to the preset second population size value to obtain a second type of initialization population; wherein the second type of initialization population includes multiple individuals, and the total number of multiple individuals is equal to the second population size value. Equal, each individual corresponds to a binary sequence, and the number of features included in the binary sequence corresponding to each individual is equal to the first population size value multiplied by the total number of subclass categories corresponding to the multiple subclass initialization populations;

According to the preset second maximum iteration generation, iteratively repeat the steps of evolving each individual in the second type initialization population according to the current classifier group and the preset second optimization target conditions until the second type initialization of the iteration output is obtained. population; population

According to the output of each individual in the second type of initialization population, the base classifier is selected in the current classifier group to obtain the target classifier group corresponding to each individual in the second type of initialization population to form the optimal target classifier group. , store the optimal target classifier group.

In a second aspect, embodiments of the present invention provide an integrated classification device for traffic data types based on dual evolution, which includes a unit for executing the integrated classification method for traffic data types based on dual evolution described in the first aspect.

In a third aspect, embodiments of the present invention provide a computer device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor. The processor executes the computer program. The program implements the integrated classification method of traffic data types based on dual evolution described in the first aspect above.

In a fourth aspect, embodiments of the present invention further provide a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when executed by a processor, the computer program causes the processor to execute the above-mentioned first step. The dual evolution-based integrated classification method of traffic data types described in one aspect.

Embodiments of the present invention provide an integrated classification method, device, computer equipment and storage medium for traffic data types based on dual evolution. An integrated classifier group including at least two types of base classifiers is deployed in the server to form an optimal target classification. Classifier group can be used to classify traffic data types more accurately, avoiding the use of a single type of classifier, thereby improving the recognition rate of less common attack types.

Description of the drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings needed to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are some embodiments of the present invention, which are of great significance to this field. Ordinary technicians can also obtain other drawings based on these drawings without exerting creative work.

Figure 1 is a schematic diagram of the application scenario of the integrated classification method of traffic data types based on dual evolution provided by the embodiment of the present invention;

Figure 2 is a schematic flow chart of the integrated classification method of traffic data types based on dual evolution provided by an embodiment of the present invention;

Figure 3 is a schematic block diagram of a traffic data type integrated classification device based on dual evolution provided by an embodiment of the present invention;

Figure 4 is a schematic block diagram of a computer device provided by an embodiment of the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of the present invention.

It should be understood that, when used in this specification and the appended claims, the terms "comprises" and "comprises" indicate the presence of described features, integers, steps, operations, elements and/or components but do not exclude the presence of one or The presence or addition of multiple other features, integers, steps, operations, elements, components and/or collections thereof.

It should also be understood that the terminology used in the description of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used in this specification and the appended claims, the singular forms "a", "an" and "the" are intended to include the plural forms unless the context clearly dictates otherwise.

It will be further understood that the term "and/or" as used in the specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items. .

Please refer to Figures 1 and 2. Figure 1 is a schematic diagram of an application scenario of the integrated classification method of traffic data types based on dual evolution provided by an embodiment of the present invention; Figure 2 is an integrated classification of traffic data types based on dual evolution provided by an embodiment of the present invention. A schematic flow chart of the method. The integrated classification method of traffic data types based on dual evolution is applied to the server. The method is executed through the application software installed in the server.

As shown in Figure 2, the method includes steps S110 to S150.

S110. Perform population initialization according to the preset first population size value to obtain multiple sub-category initialization populations; wherein the total number of individuals included in each sub-category initialization population in the multiple sub-category initialization populations is equal to the total number of individuals included in the first population. The size values are equal. Each individual included in each sub-category initialization population in multiple sub-category initialization populations corresponds to a binary sequence. Each individual included in each sub-category initialization population in multiple sub-category initialization populations corresponds to a binary sequence. The number of features included is equal to the number of features of the wireless network traffic data.

In order to understand the technical solution of the present application more clearly, the involved terminals are introduced below. This application describes the technical solution from the perspective of the server.

The first is the client. The client can be understood as the user terminal. The user terminal can be an IoT electronic device with communication functions such as a smartphone, tablet, laptop, desktop computer, personal digital assistant, and wearable device. The user terminal generates Wireless network traffic data (for example, the user terminal is connected to the switch through wireless connection methods such as Bluetooth or Wi-Fi) is uploaded to the server after passing through the switch.

The second is the switch, which is used to provide an exclusive electrical signal path for any two network nodes connected to the switch. For example, after user terminal 1 and user terminal 2 enter the switch, user terminal 1 exclusively enjoys one electrical signal path, and user terminal 2 exclusively enjoys another electrical signal path.

The third is the server. The firewall is deployed in the server, and the IDS (intrusion detection system) is deployed in the firewall. The IDS in the firewall can judge the type of data attack on the wireless network traffic data uploaded by the user terminal. If the user terminal uploads If the wireless network traffic data is attack type data, the firewall will intercept the wireless network traffic data. If the wireless network traffic data uploaded by the user terminal is non-attack type data, the firewall will allow the network traffic data.

In this embodiment, in order to obtain a target classifier group for accurately classifying data attack types on wireless network traffic data in the server, the server first performs population initialization according to the preset first population size value to obtain multiple sub-category initialization populations. . The reason why multiple sub-category initialization populations are initialized is to select the characteristics of the training data subset in the wireless network traffic data set corresponding to each sub-category initialization population to input to the corresponding classifier model to be trained, and obtain the characteristics of each sub-category. Initialize the base classifier group corresponding to the population to obtain a heterogeneous base classifier group that integrates multiple classifiers. The data attack type result obtained by the heterogeneous base classifier group by classifying the wireless network traffic data to be detected is normal. One of operations, flooding attacks, injection attacks, and impersonation attacks. In other words, multiple types of classifiers in the heterogeneous base classifier group can be used to classify wireless network traffic data more accurately, avoiding the problem of using a single type of classifier and low recognition rate of rare attack types.

For example, a piece of wireless network traffic data has 95 attribute data (it can be understood that this piece of wireless network traffic data has 95 fields, and each field has a corresponding field value, that is, the number of characteristics of the wireless network traffic data is 95) , at this time, the total number of individuals included in each sub-category initialization population in the multiple sub-category initialization populations is equal to the first population size value, and each individual included in each sub-category initialization population in the multiple sub-category initialization populations The body corresponds to a binary sequence. The number of features included in the binary sequence corresponding to each individual included in the multiple sub-category initialization populations is equal to the number of features of the wireless network traffic data, that is, the number of features included in the binary sequence corresponding to each individual There are also 95. The binary values of these 95 features are 0 or 1. 0 represents deleting the feature at the corresponding position, and 1 represents selecting the feature at the corresponding position.

After the initialization of multiple sub-category initialization populations is completed, feature selection and simplification of each wireless network traffic data in the subsequent wireless network traffic data set can be performed based on each individual of each sub-category initialization population in the multiple sub-category initialization populations. .

S120. According to the preset first maximum iteration generation, iteratively and repeatedly perform feature selection on the training data subset in the pre-stored wireless network traffic data set based on each individual in each sub-category initialization population of multiple sub-categories. And input to the classifier model to be trained corresponding to each sub-category initialization population, obtain a base classifier group corresponding to each sub-category initialization population, and classify each sub-category initialization population in multiple sub-category initialization populations according to the corresponding base classification The steps of the current population of the sub-category corresponding to the initialization population of each sub-category are obtained by evolving the device group and the preset first optimization target conditions until the base classifier group corresponding to the initialization population of each sub-category is obtained, which is initialized by each sub-category. The current classifier group composed of the base classifier group corresponding to the population.

In this embodiment, in order to accurately obtain the data attack type results for each wireless network traffic data to be detected in the wireless network traffic data set to be detected sent by the client, it is necessary to simultaneously analyze the data in the server according to the first maximum iteration algebra. Multiple sub-category initialization populations are respectively evolved to satisfy the first optimization objective conditions, thereby obtaining the base classifier group corresponding to each sub-category initialization population, and the current classifier group is composed of the base classifier group corresponding to each sub-category initialization population. . This current classifier group is an integrated classifier group including at least 2 types of base classifiers, which avoids using a single type of classifier, thereby improving the recognition rate of less common attack types.

Wherein, when each sub-category initialization population in the multiple sub-category initialization populations evolves according to the corresponding base classifier group and the preset first optimization target condition, the first optimization target condition can be specifically referred to as follows by the first multi-objective The strategy obtains a first target value set corresponding to the first classification result set corresponding to each individual in the first sub-category mixed population, and a second classification result corresponding to each individual in the second sub-category mixed population. The second target value set corresponding to the set, and the third target value set corresponding to the third classification result set corresponding to each individual in the third sub-category mixed population.

In one embodiment, the total number of subcategories corresponding to the multiple subcategory initialization populations in step S120 is 3, and the three subcategory initialization populations respectively correspond to the first subcategory initialization population, the second subcategory initialization population, and the third subcategory initialization population. Class initialization population; wherein, the total number of individuals in the first sub-class initialization population is equal to the size of the first population, and each individual in the first sub-class initialization population corresponds to a binary sequence, so The number of features included in the binary sequence corresponding to each individual in the first subcategory initialization population is equal to the number of features of the wireless network traffic data; the total number of multiple individuals in the second subcategory initialization population is equal to the number of features in the second subcategory initialization population. A group size value is equal, each individual in the second sub-category initialization population corresponds to a binary sequence, and the number of features included in the binary sequence corresponding to each individual in the second sub-category initialization population is equal to the number of wireless network traffic data The number of features is equal; the total number of multiple individuals in the third subcategory initialization population is equal to the size value of the first population, and each individual in the third subcategory initialization population corresponds to a binary sequence. The number of features included in the binary sequence corresponding to each individual in the three-subcategory initialization population is equal to the number of features of the wireless network traffic data.

In this embodiment, the above three subclasses are used to initialize the population because the specific implementation of using three types of base classifiers to form the current classifier group can achieve better classification results. At this time, in order to obtain the base classifier group corresponding to each sub-category initialization population through the population evolution process, it is necessary to simultaneously initialize the first sub-category initialization population, the second sub-category initialization population, and the third sub-category initialization population according to the first population size value. Three subclasses initialize the population.

In an embodiment, step S120 includes:

Obtain the first current iteration generation and determine whether the first current iteration generation reaches the first maximum iteration generation;

If the first current iteration generation does not reach the first maximum iteration generation, obtain a training data subset in the pre-stored wireless network traffic data set;

Each individual in the first subclass initialization population performs feature selection on the training data subset and inputs it into the K nearest neighbor model to be trained for training, correspondingly obtaining a K nearest neighbor model classifier group; wherein, the The total number of base classifiers in the K nearest neighbor model classifier group is equal to the first population size value;

Each individual in the second subclass initialization population performs feature selection on the training data subset and inputs it into the support vector machine model to be trained for training, correspondingly obtaining a support vector machine model classifier group; wherein, the The total number of base classifiers in the support vector machine model classifier group is equal to the first population size value;

Each individual in the third subcategory initialization population performs feature selection on the training data subset and inputs it into the self-organizing feature mapping network to be trained for training, correspondingly obtaining a self-organizing feature mapping network classifier group; wherein, The total number of base classifiers in the self-organizing feature map network classifier group is equal to the first population size value;

The current classifier group is composed of the K nearest neighbor model classifier group, the support vector machine model classifier group and the self-organizing feature map network classifier group; wherein, the total number of corresponding base classifiers in the current classifier group is 3 times the first population size value;

Perform simulated binary crossover and polynomial mutation on the first sub-category initialization population to obtain a first sub-category sub-population with the same total number of individuals as the first sub-category initialization population;

Perform simulated binary crossover and polynomial mutation on the second sub-category initialization population to obtain a second sub-category sub-population with the same total number of individuals as the second sub-category initialization population;

Perform simulated binary crossover and polynomial mutation on the third subcategory initialization population to obtain a third subcategory subpopulation with the same total number of individuals as the third subcategory initialization population;

Merge the first sub-category initialization population and the first sub-category sub-population to obtain a first sub-category mixed population;

Merge the second sub-category initialization population and the second sub-category sub-population to obtain a second sub-category mixed population;

Merge the third subcategory initialization population and the third subcategory subpopulation to obtain a third subcategory mixed population;

Obtain the verification data subset from the pre-stored wireless network traffic data set;

By each individual in the first sub-category mixed population performing feature selection on the verification data subset and inputting it into each base classifier in the K-nearest neighbor model classifier group, the result is the same as the first sub-category. The first classification result set corresponding to each individual in the mixed population;

By each individual in the second sub-category mixed population performing feature selection on the verification data subset and inputting it into each base classifier in the support vector machine model classifier group, the result is the same as the second sub-category. The second classification result set corresponding to each individual in the mixed population;

Each individual in the third sub-category mixed population performs feature selection on the verification data subset and inputs it into each base classifier in the self-organizing feature map network classifier group to obtain the same as the third sub-category. The third classification result set corresponding to each individual in the mixed population;

Call the pre-stored first multi-objective strategy to combine the first classification result set corresponding to each individual in the first sub-category mixed population and the second classification result set corresponding to each individual in the second sub-category mixed population. , the third classification result set corresponding to each individual in the third sub-category mixed population is used as the input of the first multi-objective strategy to obtain the first classification result corresponding to each individual in the first sub-category mixed population. The first target value set corresponding to the set, the second target value set corresponding to the second classification result set corresponding to each individual in the second subcategory mixed population, and the second target value set corresponding to the third subcategory mixed population. The third target value set corresponding to the third classification result set corresponding to each individual;

Set the individuals in the first sub-category mixed population according to the corresponding first target value, set the individuals in the second sub-category mixed population according to the corresponding second target value, and set the The individuals in the third sub-category mixed population are respectively non-dominated sorted according to the corresponding third target value set, and the first sub-category non-dominated solution set and the first sub-category multi-population solution set corresponding to the first target value set are obtained. layer solution set, a second sub-category non-dominated solution set corresponding to the second target value set and a second sub-category multi-level solution set, and a third sub-category non-dominated solution set corresponding to the third target value set Sets and multi-level solution sets of the third sub-category; wherein, the first sub-category non-dominated solution set is denoted as Q ₁₁ , and the first sub-category multi-layer solution set includes multiple solution set subsets and are denoted as Q respectively ₁₂ to Q _1X , where the union of Q ₁₁ to Q _1X is the first subcategory mixed population, the intersection of any two sets in Q ₁₁ to Q _1X is the empty set, Q ₁₁ ≥ _{Q 12} ≥ _{Q 13} ≥… ...≥Q _1X ; the second subcategory of non-dominated solution sets is denoted as Q ₂₁ , and the second subcategory of multi-layer solution sets includes multiple solution set subsets and are denoted as Q ₂₂ to Q _2Y respectively, where Q ₂₁ The union of Q _2Y to Q 2Y is the mixed population of the second subcategory. The intersection of any two sets from Q ₂₁ to Q _2Y is the empty set. Q ₂₁ ≥ _{Q 22} ≥ _{Q 23} ≥...≥ Q _2Y ; the above-mentioned third The third subcategory of non-dominated solution sets is denoted as Q ₃₁ . The third subcategory of multi-level solution sets includes multiple solution set subsets and are denoted as Q ₃₂ to Q _3Z respectively, where the union of Q ₃₁ to Q _3Z is For the third subcategory of mixed populations, the intersection of any two sets from Q ₃₁ to Q _3Z is the empty set, Q ₃₁ ≥ _{Q 32} ≥ _{Q 33} ≥……≥Q _3Z ;

Multiple solution set subsets in the first sub-category non-dominated solution set and the first sub-category multi-layer solution set are merged sequentially to obtain multiple sets until the total number of individuals is equal to the first population size value, so as to Form a first sub-category current population, and use the first sub-category current population as the first sub-category initialization population;

Multiple solution set subsets in the second sub-category non-dominated solution set and the second sub-category multi-layer solution set are merged sequentially to obtain multiple sets until the total number of individuals is equal to the first population size value, so as to Form a current population of the second subcategory, and use the current population of the second subcategory as the initialization population of the second subcategory;

Multiple solution set subsets in the third sub-category non-dominated solution set and the third sub-category multi-layer solution set are merged sequentially to obtain multiple sets until the total number of individuals is equal to the first population size value, so that Form a third subcategory current population, and use the third subcategory current population as the third subcategory initialization population;

Add one to the first current iteration generation to serve as the first current iteration generation, and return to the step of determining whether the first current iteration generation reaches the first maximum iteration generation;

If the first current iteration generation reaches the first maximum iteration generation, obtain the K nearest neighbor model classifier group corresponding to the first subclass initialization population, the support vector machine model classifier group corresponding to the second subclass initialization population, and the self-organizing feature map network classifier group corresponding to the third subcategory initialization population. The current classifier group is composed of the K nearest neighbor model classifier group, the support vector machine model classifier group and the self-organizing feature map network classifier group.

In this embodiment, a wireless network traffic data set is pre-stored in the server (for example, the AWID data set is a commonly used wireless network traffic data set). The wireless network traffic data set includes a training data subset (used for classification). model training) and validation data subset (used to verify the classification effect of the trained classifier). At this time, in order to speed up the training of the K nearest neighbor model (the K nearest neighbor model is the KNN model), the support vector machine model to be trained (the support vector machine model is the SVM model), and the self-organizing feature mapping network to be trained (the self-organizing feature mapping network is SOM model), each individual in the first sub-category initialization population can perform feature selection on the training data subset and input it to the K nearest neighbor model to be trained for training, and through the second sub-category Each individual in the class initialization population performs feature selection on the training data subset and inputs it into the support vector machine model to be trained for training, and each individual in the third sub-class initialization population performs feature selection on the training data subset. Features are selected and input into the self-organizing feature mapping network to be trained for training. Wherein, the function of each individual in the first sub-category initialization population, each individual in the second sub-category initialization population, and each individual in the third sub-category initialization population is to modify the training data. Feature selection is performed on each training data in the subset (for example, each training data also has 95 attribute data) to remove redundant features (that is, redundant attribute data) in each training data, thereby reducing the number of each training data. data dimensions to improve the training speed of the classifier.

For example, the individuals in the initialization population of the first subcategory are recorded as A ₁ -A _m respectively, and the value set of m is {1, 2,...,X1}, and X1 is equal to the size of the first population; The wireless network traffic data in the wireless network traffic data set are respectively recorded as B ₁ -B _N . The value set of N is {1, 2,...,X2}, and X2 is the same as the wireless network traffic data in the wireless network traffic data set. The total number of data items is equal.

At this time, take the individual A ₁ in the first sub-category initialization population as an example. After performing feature selection on the wireless network traffic data B ₁ -B _N respectively, for example, there are 95 field values in the wireless network traffic data B ₁ , and A ₁ is also a binary sequence with 95 values. In A ₁ , only the first to fifth bits have a value of 1 and the other bits have a value of 0. At this time, the wireless network traffic data B ₁ -B _N After feature selection based on A ₁ , the simplified intrusion detection data A ₁ B ₁ -A ₁ B _N corresponding to the wireless network traffic data B ₁ -B _N are obtained. At this time, the simplified wireless network traffic data A ₁ B ₁ In -A ₁ B _N , only the first to fifth bits retain their original values and the values of other bits are simplified to 0. In the same way, the feature selection and simplification process of individual wireless network traffic data in the wireless network traffic data set can refer to the above process.

In this iterative process of obtaining the final current classifier group, when the K nearest neighbor model classifier group, the support vector machine model classifier group and the self-organizing feature map network classifier group are obtained, the K nearest neighbor model classifier group is obtained. The neighbor model classifier group, the support vector machine model classifier group and the self-organizing feature map network classifier group constitute the current classifier group. For example, the K nearest neighbor model classifier group has X1 K nearest neighbor model classifiers, the support vector machine model classifier group has X1 support vector machine model classifiers, the classifier group and the self-organizing feature map The network classifier group has X1 classifier groups and self-organizing feature map network classifiers, so that there are 3X1 base classifiers in the current classifier group (that is, the total number of base classifiers corresponding to the current classifier group is 3X1).

In order to carry out the population evolution of the first sub-category initialization population, the second sub-category initialization population and the third sub-category initialization population, at this time, binary crossover and polynomial transformation can be simulated for the first sub-category initialization population. Perform simulated binary crossover and polynomial mutation on the second subcategory initialization population, simulate binary crossover and polynomial mutation on the third subcategory initialization population, and obtain the same total number of individuals as the first subcategory initialization population respectively. The first sub-category sub-population, the second sub-category sub-population with the same total number of individuals as the second sub-category initialization population, and the third sub-category with the same total number of individuals as the third sub-category initialization population. subpopulation.

For example, in the process of simulating binary crossover and polynomial mutation on the first sub-category initialization population to obtain the first sub-category sub-population with the same total number of individuals as the first sub-category initialization population, it is during the process that the first sub-category initialization population has the same total number of individuals. A subclass initializes two individuals randomly selected from the population to perform binary crossover in sequence until X1 new individuals after crossover processing are generated. Polynomial mutation is performed on the X1 new individuals after crossover processing, and the new individuals after polynomial mutation form the first subclass. Class subpopulation. For the process of simulating binary crossover and polynomial mutation for the second subcategory initialization population and the third subcategory initialization population, please refer to the process of simulating binary crossover and polynomial mutation for the first subcategory initialization population. Binary crossover and polynomial mutation are routine processes and will not be described again here.

Afterwards, the merging process of the initialization population and the sub-population is carried out to obtain the first sub-category mixed population, the second sub-category mixed population and the third sub-category mixed population respectively. In order to select individuals with better performance in the first sub-category mixed population, the second sub-category mixed population, and the third sub-category mixed population to evolve into the next generation population, the verification data in the pre-stored wireless network traffic data set is obtained at this time. Subset, each individual in the first sub-category mixed population performs feature selection on the verification data subset and inputs it into each base classifier in the K nearest neighbor model classifier group to obtain the same as the first sub-category. The first classification result set corresponding to each individual in a sub-category mixed population; performing feature selection on the verification data subset through each individual in the second sub-category mixed population and inputting it into the support vector machine model respectively Each base classifier in the classifier group obtains a second classification result set corresponding to each individual in the second sub-category mixed population; the verification data sub-set is processed by each individual in the third sub-category mixed population. Feature selection is performed on the set and input to each base classifier in the self-organizing feature map network classifier group, to obtain a third classification result set corresponding to each individual in the third sub-category mixed population. Wherein, each verification data in the verification data subset also has 95 attribute data, each individual in the first sub-category mixed population, each individual in the second sub-category mixed population, the third sub-category Each individual in the quasi-mixed population also has 95 binary values (the specific value of the binary value is 0 or 1).

In the verification data subset included in the wireless network traffic data set pre-stored in the server, the same as the training data subset is that the verification data included in the verification data subset has 4 types of wireless network traffic data subsets, namely normal operation wireless Network traffic data subset, flood attack wireless network traffic data subset, injection attack wireless network traffic data subset and impersonation attack wireless network traffic data subset, each verification data (each piece of verification data) in the above four verification data subsets Corresponding to a piece of wireless network traffic data), the true type of the classification result is a positive example.

Each verification data in the verification data subset is characterized based on each individual in the first sub-category mixed population, each individual in the second sub-category mixed population, and each individual in the third sub-category mixed population. Select and simplify to obtain the first subcategory simplified verification data set corresponding to each individual in the first subcategory mixed population (wherein, each simplified verification data in the first subcategory simplified verification data set corresponds to a simplified wireless network traffic data), the second subcategory simplified verification data set corresponding to each individual in the second subcategory mixed population, and the third subcategory corresponding to each individual in the third subcategory mixed population. Class simplified verification data set; wherein, the classification result of each simplified verification data set in the first sub-class simplified verification data set, the second sub-class simplified verification data set, and the third sub-class simplified verification data set is true Type is positive example.

Call the pre-stored first multi-objective strategy to obtain the first target value set corresponding to the first classification result set corresponding to each individual in the first sub-category mixed population, and the second sub-category mixed population. The second target value set corresponding to the second classification result set corresponding to each individual in the third subcategory mixed population, and the third target value set corresponding to the third classification result set corresponding to each individual in the third subcategory mixed population. In the process, since each classification result in the first classification result set, the second classification result set, and the third classification result set is the prediction result of the simplified verification data input to the classifier, and each simplified verification data also corresponds to a real result. , so it can be used as the optimization target of the first multi-objective strategy. According to the population evolution strategy until the population converges or reaches the stopping condition, the final first sub-category initialization population, the final second sub-category initialization population, and the final The third subcategory initializes the population, and the above three subcategories initialize the population to form the optimal feature subset.

In one embodiment, the formula corresponding to the first multi-objective strategy is J _m (k) = TP _mk / (TP _mk + FN _mk + FP _mk ); where the corresponding value set of k is {1, 2, 3 ,4}, the value set of m is {1,2,...,L} and L is equal to the first population size value, J _m (k) is the k-th type simplified wireless network of the m-th individual The target value corresponding to the flow data, and J _m (1), J _m (2), J _m (3), J _m (4) form the target value set corresponding to the m-th individual, TP _mk is the m-th individual's The first total value in the simplified wireless network traffic data of k type that the true type of the classification result is a positive example and the predicted type of the classification result is a positive example, FN _mk is the classification result of the mth individual in the kth type of simplified wireless network traffic data The second total value whose true type is a positive example and the prediction type of the classification result is a negative example. FP _mk is the simplified wireless network traffic data of the kth type of the m-th individual. The true type of the classification result is a negative example and the prediction type of the classification result is The third total value of the positive example;

The first classification result set corresponding to each individual in the first sub-category mixed population, the second classification result set corresponding to each individual in the second sub-category mixed population, the third sub-category mixed population The third classification result set corresponding to each individual in the population is respectively used as the input of the first multi-objective strategy to obtain the first target value corresponding to the first classification result set corresponding to each individual in the first sub-category mixed population. set, a second target value set corresponding to the second classification result set corresponding to each individual in the second sub-category mixed population, and a third classification corresponding to each individual in the third sub-category mixed population The third target value set corresponding to the result set includes:

Obtain the first target value set corresponding to the first classification result set corresponding to each individual in the first sub-category mixed population according to J _m (k) = TP _mk / (TP _mk + FN mk ₊ FP _mk ) , a second target value set corresponding to the second classification result set corresponding to each individual in the second sub-category mixed population, and a third classification result corresponding to each individual in the third sub-category mixed population. The third set of target values corresponding to the set.

Since there are four types of attack data (i.e. normal operation, flooding attack, injection attack, impersonation attack) in both the training data subset and the verification data subset in the wireless network traffic data set, each individual has four target values. According to the above The formula corresponding to the first multi-target strategy calculates J _M (k) corresponding to the attack type as the target value, that is, each individual is a binary sequence and has four target values. Specifically, J _M (1), J _M (2), J _M (3), and J _M (4) form the target value set corresponding to the M-th individual. By obtaining the target value set corresponding to each individual, it can be used as a reference for subsequent selection of individuals with better performance.

After obtaining the corresponding first target value set of the individuals in the first sub-category mixed population, the corresponding second target value set of the individuals in the second sub-category mixed population, and the After the individuals in the third sub-category mixed population are gathered according to the corresponding third target value, the above-mentioned three types of mixed populations can be non-dominated sorted at this time to obtain the first corresponding to the first target value set. The non-dominated solution set of the sub-category and the multi-level solution set of the first sub-category, the non-dominated solution set of the second sub-category and the multi-level solution set of the second sub-category corresponding to the second target value set, and the non-dominated solution set of the second sub-category corresponding to the third target value set The third subcategory non-dominated solution set and the third subcategory multi-layer solution set corresponding to the target value set.

Among them, when performing a non-dominated sorting of individuals in a population that includes multiple individuals, the non-dominated solution corresponding to this population can be obtained by obtaining a non-dominated solution (also called a Pareto solution). Solution set. Among them, the definition of Pareto solution is to assume that for any two solutions S1 and S2, S1 is better than or the same as S2 for all targets, and there is at least one target, and the corresponding target value of S1 on this target is better than S2. The corresponding target value on the target is said to dominate S2. If the solution of S1 is not dominated by other solutions, then S1 is called a non-dominated solution (undominated solution), also called a Pareto solution (i.e. Pareto solution). For example, the first subtype of non-dominated solution set is denoted as Q ₁₁ , and the first subtype of multi-layer solution set includes multiple solution set subsets and are denoted as Q ₁₂ to Q _1X respectively, where Q ₁₁ to Q _1X The union of is the mixed population of the first subcategory, the intersection of any two sets from Q ₁₁ to Q _1X is the empty set, Q ₁₁ ≥ _{Q 12} ≥ _{Q 13} ≥……≥Q _1X ; the second subcategory The non-dominated solution set is denoted as Q ₂₁ , and the second subcategory multi-layer solution set includes multiple solution set subsets and are denoted as Q ₂₂ to Q _2Y respectively, where the union of Q ₂₁ to Q _2Y is the second Subcategory mixed population, the intersection of any two sets from Q ₂₁ to Q _2Y is the empty set, Q ₂₁ ≥ _{Q 22} ≥ _{Q 23} ≥... ≥ Q _2Y ; the third subcategory non-dominated solution set is recorded as Q ₃₁ , the third subcategory multi-layer solution set includes multiple solution set subsets and are respectively recorded as Q ₃₂ to Q _3Z , where the union of Q ₃₁ to Q _3Z is the third subcategory mixed population, Q ₃₁ to Q 3Z The intersection of any two sets in Q _3Z is the empty set, Q ₃₁ ≥ Q ₃₂ ≥ Q ₃₃ ≥...≥ Q _3Z ; among them, "≥" represents the dominance relationship, and Q _i ≥ Q _j represents the existence of solution dominance in Q _i Q _j , the relationship is transitive, Q ₁ ≥ Q ₂ means that for J _m (1) to J _m (4), each solution in Q ₂ is dominated by at least one solution in Q ₁ , This relationship is transitive, that is, each solution in Q ₃ is dominated by at least one solution in Q ₁ or Q ₂ , and so on for the others.

When the first sub-category non-dominated solution set and the first sub-category multi-layer solution set corresponding to the first target value set, the second sub-category non-dominated solution set corresponding to the second target value set and After the second subcategory multi-level solution set, the third subcategory non-dominated solution set corresponding to the third target value set, and the third subcategory multi-level solution set, it is necessary to set the first subcategory non-dominated solution set at this time. X1 individuals are selected from the dominated solution set and the first sub-category multi-layer solution set to form the current population of the first sub-category, and selected from the second sub-category non-dominated solution set and the second sub-category multi-layer solution set X1 individuals are selected to form the current population of the second subcategory. X1 individuals are selected from the non-dominated solution set of the third subcategory and the multi-layer solution set of the third subcategory to form the current population of the third subcategory. This is complete This round of iteration process is used to obtain the current classifier group.

For example, the first sub-category of non-dominated solution sets is denoted as Q ₁₁ , and the first sub-category of multi-layer solution sets includes multiple solution set subsets and are denoted as Q ₁₂ to Q _1X respectively. In the first sub-category of multi-layer solution sets, Multiple solution set subsets in the class non-dominated solution set Q ₁₁ and the first sub-class multi-layer solution set Q ₁₂ to Q _1X are sequentially merged to obtain multiple individuals until the total number of individuals is equal to the first population size value In the process of X1, for example, the total number of individuals corresponding to Q ₁₁ is 3, the total number of individuals corresponding to Q ₁₂ is 4, the total number of individuals corresponding to Q ₁₃ is 5, the total number of individuals corresponding to Q ₁₄ is 6, and 3+4+5+ 6=X1, then all individuals in Q ₁₁ -Q ₁₄ form the current population of the first subcategory.

S130. Perform population initialization according to the preset second population size value to obtain a second type of initialization population; wherein the second type of initialization population includes multiple individuals, and the total number of multiple individuals is equal to the second type of population. The size values are equal, each individual corresponds to a binary sequence, and the number of features included in the binary sequence corresponding to each individual is equal to the first population size value multiplied by the total number of subclass categories corresponding to the multiple subclass initialization populations.

In this embodiment, in order to select a target classifier with better classification performance from the current classifier group to form a target classifier group, a second type of initialization population may also be initialized first. The second type of initialization population includes The total number of multiple individuals is equal to the second population size value, each individual corresponds to a binary sequence, and the number of features included in the binary sequence corresponding to each individual is equal to the first population size value multiplied by the The total number of subclass categories corresponding to multiple subclass initialization populations. For example, the total number of subclass categories corresponding to the multiple subclass initialization populations is 3, and the first population size value is X1, then the number of features included in the binary sequence corresponding to each individual in the second class initialization population is equal to 3X1, the binary value of these 3X1 features is 0 or 1, 0 represents deleting the base classifier at the corresponding position, and 1 represents selecting the base classifier at the corresponding position.

S140. According to the preset second maximum iteration generation, iteratively repeat the steps of evolving each individual in the second type initialization population according to the current classifier group and the preset second optimization target condition until the second iteration output is obtained. Class initialization population.

In this embodiment, when optimizing the classifier selection for the current classifier group including multiple base classifiers, it is also to remove redundant base classifiers and improve the classification accuracy of the minority class. For example, the current classifier group includes 3X1 base classifiers, of which the i-th (i=1, 2,..., 3X1) base classifier is _Ci , and the current classifier group including 3X1 base classifiers is AC. . Based on whether each base classifier is selected as an individual, a population is initialized, and the detection rate of each category (including normal operation, flooding attack, injection attack, and fake attack) and the proportion of the selected base classifier to the total generated base classifiers are calculated. Ratio is used as the evolutionary goal. Through a series of evolutionary algorithm strategies until the number of iterations is exhausted or the target value converges, the optimal classifier group selected is SC.

Among them, the steps of evolving each individual in the second type initialization population according to the current classifier group and the preset second optimization target condition are iteratively repeated. The second optimization target condition can be specifically referred to as follows by the second multi-objective strategy. The process of obtaining a set of individual target values corresponding to each individual in the second type of mixed population.

In one embodiment, according to the preset second maximum iteration generation, iteratively repeats the steps of evolving each individual in the second type initialization population according to the current classifier group and the preset second optimization target condition until The second type of initialization population that obtains the iterative output includes:

Obtain the second current iteration generation and determine whether the second current iteration generation reaches the second maximum iteration generation;

If the second current iteration generation does not reach the second maximum iteration generation, obtain the current classifier group;

Simulate binary crossover and polynomial mutation on the second type initialization population to obtain a second type subpopulation with the same total number of individuals as the second type initialization population;

Merge the second type initialization population with the second type sub-population to obtain a second type mixed population;

Perform base classifier selection on the current classifier group by each individual in the second type of mixed population to obtain the selected classifier group corresponding to each individual in the second type of mixed population;

Obtain the verification data subset from the pre-stored wireless network traffic data set;

Input the verification data subset into the selected classifier group corresponding to each individual in the second type of mixed population, and obtain an individual classification result set corresponding to each individual in the second type of mixed population;

Call the pre-stored second multi-objective strategy, use the individual classification result set corresponding to each individual in the second type of mixed population as the input of the second multi-objective strategy, and obtain the corresponding set of individual classification results for each individual in the second type of mixed population. The set of individual target values corresponding to the body phase;

The individuals in the second type of mixed population are non-dominated sorted according to the individual target value set, and a non-dominated solution set and a multi-layer solution set corresponding to the individual target value set are obtained, where the non-dominated solution set is recorded as Q ₄₁ , the multi-layer solution set includes multiple solution set subsets and are recorded as Q ₄₂ to Q _4W respectively, where the union of Q ₄₁ to Q _4W is the second type of mixed population, among Q ₄₁ to Q _4W The intersection of any two sets is the empty set, Q ₄₁ ≥ Q ₄₂ ≥ Q ₄₃ ≥……≥Q _4W ;

Multiple solution set subsets in the non-dominated solution set and the multi-layer solution set are sequentially merged to obtain multiple sets until the total number of individuals is equal to the second population size value to form a second type of current population. The second type of current population serves as the second type of initialization population;

Add one to the second current iteration generation to serve as the second current iteration generation, and return to the step of determining whether the second current iteration generation reaches the second maximum iteration generation;

If the second current iteration generation reaches the second maximum iteration generation, obtain a second type of initialization population.

In this embodiment, the formula corresponding to the first multi-objective strategy corresponding to the second type of initialization population during the iterative evolution process includes two formulas, among which:

The first formula is J _n (k) = TP _nk /(TP _nk +FN _nk +FP _nk ); among them, the value set corresponding to k is {1,2,3,4}, and the value set corresponding to n is {1,2,...,L2} and L2 is equal to the second population size value, J _n (k) is the target value corresponding to the k-th type of simplified wireless network traffic data of the n-th individual, and J _n (1), J _n (2), J _n (3), J _n (4) constitute the individual classification result set corresponding to the m-th individual, TP _nk is the simplified wireless network traffic data of the k-th type of the n-th individual The fourth total value in which the true type of the classification result is a positive example and the predicted type of the classification result is a positive example. FN _nk is the simplified wireless network traffic data of the kth type of the nth individual. The true type of the classification result is a positive example and the predicted classification result is a positive example. The fifth total value whose type is a negative example, FP _nk is the sixth total value whose true type of classification result is a negative example and the predicted type of the classification result is a positive example in the simplified wireless network traffic data of the nth individual and kth type;

The second formula is min S _n = |SC _n |/|AC|; where S _n represents the number of base classifiers selected in the current classifier group corresponding to the nth individual of the second type of initialization population. The proportion of the total number of base classifiers in the current classifier group, |SC _n |, represents the number of base classifiers selected in the current classifier group corresponding to the nth individual of the second type of initialization population, |AC| Indicates the total number of base classifiers in the current classifier group (that is, the total number of base classifiers included in the current classifier group, for example, the value is 3X1).

For example, the non-dominated solution set is denoted as Q ₄₁ , the multi-layer solution set includes multiple solution set subsets and are denoted as Q ₄₂ to Q _4W respectively, and multiple sets from Q ₄₁ to Q _4W are sequentially merged to obtain In the process of multiple individuals until the total number of individuals is equal to the second population size value, for example, the total number of individuals corresponding to Q ₄₁ is 4, the total number of individuals corresponding to Q ₄₂ is 5, and the total number of individuals corresponding to Q ₁₃ is 5, The total number of individuals corresponding to Q ₁₄ is 7, and 4+5+5+7=the second population size value, then all individuals in Q ₄₁ -Q ₄₄ form the second type of current population. Among them, for example, Q ₄₁ ≥ Q ₄₂ means that for J _n (1) to J _n (4) and S _n , each solution in Q ₂ is dominated by at least one solution in Q _1. This relationship has transitive property, that is, each solution in Q ₃ is dominated by at least one solution in Q ₁ or Q ₂ , and so on for the others. More specifically, Q ₄₁ corresponds to individual 1-individual 4, Q ₄₂ corresponds to individual 5-individual 9, Q ₄₁ ≥ Q ₄₂ can mean J ₁ (1) ≥ J ₆ (1), J ₁ (2) ≥ J ₆ (2), J ₁ (3) ≥ _{J 6} (3), J ₁ (4) ≥ _{J 6} (4), S ₁ ≤ S ₆ , from J ₁ (1), J ₁ (2), J ₁ (3), J ₁ (4), and S ₁ form the individual target value set corresponding to individual 1 in Q ₄₁ , _which is composed of J ₆ (1), J 6 (2), J ₆ (3), J ₆ (4), S ₆ constitutes the set of individual target values corresponding to individual 6 in Q ₄₂ .

S150. Select a base classifier in the current classifier group according to the output of each individual in the second type of initialization population, and obtain the target classifier group corresponding to each individual in the second type of initialization population to form the optimal target classification. The optimal target classifier group is stored.

In this embodiment, after the evolution process of the second type initialization population is completed in the server, a base classifier is selected in the current classifier group based on each individual in the final second type initialization population, and we get The second type initializes the target classifier group corresponding to each individual in the population to form an optimal target classifier group, and stores the optimal target classifier group. For example, individual 1 in the second type of initialization population corresponds to the base classifier in the current classifier group, and the 1st sorting position, the 3rd sorting position, the 8th sorting position, and the 3X1 base classifiers included in the current classifier group are selected. After the base classifier in the 9th sorting position, the target classifier group corresponding to individual 1 in the second type of initialization population is composed of the 1st sorting position, the 3rd sorting position, and the 8th sorting position among the 3X1 base classifiers included in the current classifier group. The base classifier consists of the sorting bit and the 9th sorting bit. Referring to this process, the target classifier groups corresponding to other individuals in the second type of initialization population can be obtained, so that the optimal target classifier group is composed of these multiple target classifier groups.

At this time, the optimal target classifier group is deployed in the IDS of the server's firewall to classify the attack types of the wireless network traffic data to be detected. Since the target classifier group is an integrated classifier group including at least two types of base classifiers, the use of a single type of classifier is avoided, thereby improving the recognition rate of less common attack types.

In an embodiment, after step S150, it further includes:

Determine whether the wireless network traffic data set to be detected sent by the client is received;

If the wireless network traffic data set to be detected is received, the optimal target classifier group is used to classify the data attack type of each wireless network traffic data to be detected in the wireless network traffic data set to be detected, and obtain the data attack type corresponding to each wireless network traffic data set to be detected. The data attack type result corresponding to the wireless network traffic data; wherein the data attack type result is normal operation, flooding attack, injection attack, or impersonation attack.

In this embodiment, an optimal target classifier group is deployed in the IDS in the server's firewall. If a certain piece of wireless network traffic data is detected and reaches the server's firewall, the optimal target classifier can be used to The group classifies the wireless network traffic data with an integrated model to obtain a more accurate classification effect, especially to improve the recognition rate of less common attack types.

In one embodiment, the optimal target classifier group is used to classify the data attack type of each wireless network traffic data to be detected in the wireless network traffic data set to be detected, and obtain the data attack type corresponding to each wireless network traffic to be detected. The steps for the results of the data attack type corresponding to the data include:

Classify the data attack type of each wireless network traffic data to be detected in the wireless network traffic data set to be detected by using the optimal target classifier group to obtain the optimal target classifier for each wireless network traffic data to be detected. The target classification results corresponding to each target classifier group in the group;

Determine whether there is a flooding attack in the target classification results corresponding to each target classifier group in the optimal target classifier group for each wireless network traffic data to be detected;

If the wireless network traffic data to be detected contains flooding attacks in the target classification results corresponding to each target classifier group in the optimal target classifier group, and the total proportion of flooding attacks in the target classification results exceeds the predetermined Assuming the minority class proportion, obtain the wireless network traffic data to be detected corresponding to the target classification results with flooding attacks to form a minority class wireless network traffic data set, and obtain the wireless network traffic to be detected corresponding to the target classification results without flooding attacks. Data to form most types of wireless network traffic data sets;

Set the classification result of the wireless network traffic data to be detected for which the total proportion corresponding to flood attacks in the target classification results in the minority class wireless network traffic data set exceeds the preset minority class proportion as flooding attacks;

Obtain the classification result with the maximum total number of classification results among the target classification results corresponding to each target classifier in the target classifier group for each wireless network traffic data to be detected in the majority category wireless network traffic data set, as the majority category Data attack type results corresponding to each wireless network traffic data to be detected in the wireless network traffic data set;

If the wireless network traffic data to be detected contains flooding attacks in the target classification results corresponding to each target classifier group in the optimal target classifier group, and the total proportion of flooding attacks in the target classification results does not exceed The preset proportion of minority classes is used to obtain the classification result in which the total number of classification results is the maximum value among the target classification results corresponding to each target classifier group in the optimal target classifier group for each wireless network traffic data to be detected, so as to As the result of the data attack type corresponding to each wireless network traffic data to be detected.

In this embodiment, if the wireless network traffic data to be detected does not have a flooding attack in the target classification results corresponding to each target classifier group in the optimal target classifier group, obtain the wireless network traffic data to be detected. Among the target classification results corresponding to each target classifier group in the optimal target classifier group, the classification result with the maximum total number of classification results is used as the data attack type result corresponding to each wireless network traffic data to be detected. .

In order to more clearly understand the process of classifying the data attack type results of the wireless network traffic data to be detected through the optimal target classifier group, a specific embodiment will be described below. Assume that the second type of initialization population output by the iterative completion of step S140 includes individual 1 and individual 2. The corresponding target classifier group in individual 1 is composed of the 1st sorting position and the 3rd sorting position among the 3X1 base classifiers included in the current classifier group. , the 8th sorted position, and the 9th sorted base classifier. The corresponding target classifier group in individual 2 consists of the 2nd sorted position, the 3rd sorted position, and the 7th ranked classifier among the 3X1 base classifiers included in the current classifier group. The base classifier consists of the sorting bit and the 9th sorting bit. At this time, wireless network traffic data 1 is input into the selected target classifier group corresponding to individual 1, and the obtained target classification results are normal operation, normal operation, injection attack, and normal operation; wireless network traffic data 1 is input into the selected target classifier group corresponding to individual 2. In the target classifier group, the obtained target classification results are normal operation, fake attack, normal operation, and normal operation. At this time, among the 4 classification results of wireless network traffic data 1 by the target classifier group corresponding to individual 1, the total number of classification results for normal operation is 3, then wireless network traffic data 1 is in the target classifier group corresponding to individual 1 The data attack type result is normal operation; similarly, the data attack type result of wireless network traffic data 1 in the target classifier group corresponding to individual 2 is normal operation, because the wireless network traffic data 1 is in the target classification corresponding to individual 1 If the corresponding classification results of the target classifier group corresponding to the device group and individual 2 are normal operations, it can be determined that the data attack type result corresponding to the wireless network traffic data 1 is normal operation.

For example, when selecting the corresponding classification results of the target classifier group corresponding to individual 1, it is also judged whether the total number of weighted classification results corresponding to flooding attacks in the classification results is the total number of classification results for normal operations and the classification results for fake attacks. The maximum value among the total number, the total number of injection attack classification results, and the total number of weighted classification results corresponding to flooding attacks. When calculating the total number of weighted classification results corresponding to flooding attacks in the classification results, the total number of classification results corresponding to flooding attacks in the classification results may be multiplied by a preset weighting coefficient. For example, the weighting coefficient is set to 3. If the total number of weighted classification results corresponding to flooding attacks in the classification results is the maximum value among the above four values, then the classification result of each target classifier group corresponding to individual 1 for wireless network traffic data 1 is a flooding attack; if The total number of weighted classification results corresponding to flooding attacks in the classification results is not the maximum value among the above four values, then the classification result corresponding to the maximum value among the above four values will be used as the target classifier group corresponding to individual 1 for the wireless network Classification results of traffic data 1.

This method implements the deployment of an integrated classifier group including at least two types of base classifiers in the server to form an optimal target classifier group, thereby enabling more accurate classification of traffic data types and avoiding the use of a single type of classifier. , thereby improving the recognition rate of less common attack types.

Embodiments of the present invention also provide an integrated classification device for traffic data types based on dual evolution. The integrated classification device for traffic data types based on dual evolution is used to execute any embodiment of the aforementioned integrated classification method for traffic data types based on dual evolution. Specifically, please refer to Figure 3, which is a schematic block diagram of a traffic data type integrated classification device based on dual evolution provided by an embodiment of the present invention. The dual evolution-based traffic data type integrated classification device 100 may be configured in a server.

As shown in Figure 3, the traffic data type integrated classification device 100 based on dual evolution includes a first population initialization unit 110, a first iterative evolution unit 120, a second population initialization unit 130, a second iterative evolution unit 140, an optimal target classification The device group acquisition unit 150.

Among them, the first population initialization unit 110 is used to perform population initialization according to the preset first population size value to obtain multiple sub-category initialization populations; wherein, the number of individuals included in each sub-category initialization population in the multiple sub-category initialization populations is The total number is equal to the size of the first population. Each individual included in each sub-category initialization population in the multiple sub-category initialization populations corresponds to a binary sequence. All individuals included in each sub-category initialization population in the multiple sub-category initialization populations The number of features included in the binary sequence corresponding to each individual is equal to the number of features of the wireless network traffic data.

The first iterative evolution unit 120 is configured to iteratively and repeatedly perform training on the pre-stored wireless network traffic data set based on each individual in each sub-category initialization population of multiple sub-categories according to the preset first maximum iteration generation number. The data subset is subjected to feature selection and input to the classifier model to be trained corresponding to the initialization population of each subcategory, and a base classifier group corresponding to the initialization population of each subcategory is obtained, and each subcategory in the initialization population is initialized with multiple subcategories. The initialization population evolves according to the corresponding base classifier group and the preset first optimization target condition, and the steps of obtaining the current population of the subcategory corresponding to the initialization population of each subcategory are obtained until the base classifier group corresponding to the initialization population of each subcategory is obtained. , the current classifier group composed of the base classifier group corresponding to the initialization population of each subclass.

The second population initialization unit 130 is configured to perform population initialization according to the preset second population size value to obtain a second type of initialization population; wherein the second type of initialization population includes multiple individuals, and the total number of individuals is The number is equal to the second population size value, each individual corresponds to a binary sequence, and the number of features included in the binary sequence corresponding to each individual is equal to the first population size value multiplied by the number corresponding to the multiple subclass initialization populations. The total number of subcategories.

The second iterative evolution unit 140 is configured to iteratively and repeatedly execute the steps of evolving each individual in the second type initialization population according to the current classifier group and the preset second optimization target condition according to the preset second maximum iteration generation, Until the second type of initialization population of the iterative output is obtained.

The optimal target classifier group acquisition unit 150 is used to select a base classifier in the current classifier group according to each individual in the output second type initialization population, and obtain the target corresponding to each individual in the second type initialization population. Classifier group to form an optimal target classifier group, and store the optimal target classifier group.

In one embodiment, the dual evolution-based traffic data type integrated classification device 100 further includes:

The traffic data detection unit is used to determine whether the wireless network traffic data set to be detected sent by the client is received;

A data attack type result classification unit, used to perform a data attack on each wireless network traffic data to be detected in the wireless network traffic data set to be detected through the optimal target classifier group if a wireless network traffic data set to be detected is received. Type classification is performed to obtain a data attack type result corresponding to each wireless network traffic data to be detected; wherein the data attack type result is normal operation, flooding attack, injection attack, or impersonation attack.

When the total number of subclass types corresponding to the multiple subclass initialization populations is 3, refer to the above method embodiments for detailed description, and will not be described again this time.

In one embodiment, the first iterative evolution unit 120 includes:

A first processing unit, configured to obtain the first current iteration generation and determine whether the first current iteration generation reaches the first maximum iteration generation;

A second processing unit configured to obtain a training data subset in the pre-stored wireless network traffic data set if the first current iteration generation does not reach the first maximum iteration generation;

The third processing unit is used to perform feature selection on the training data subset through each individual in the first subcategory initialization population and input it into the K nearest neighbor model to be trained for training, and correspondingly obtain the K nearest neighbor model classification. group; wherein, the total number of base classifiers in the K nearest neighbor model classifier group is equal to the first population size value;

The fourth processing unit is used to perform feature selection on the training data subset through each individual in the second subcategory initialization population and input it into the support vector machine model to be trained for training, and correspondingly obtain the support vector machine model classification. group; wherein, the total number of base classifiers in the support vector machine model classifier group is equal to the first population size value;

The fifth processing unit is used to perform feature selection on the training data subset through each individual in the third subcategory initialization population and input it into the self-organizing feature map network to be trained for training, and obtain the self-organizing feature map accordingly. Network classifier group; wherein the total number of base classifiers in the self-organizing feature map network classifier group is equal to the first population size value;

The sixth processing unit is used to form a current classifier group with the K nearest neighbor model classifier group, the support vector machine model classifier group and the self-organizing feature map network classifier group; wherein the corresponding The total number of base classifiers is 3 times the first population size value;

A seventh processing unit, configured to perform simulated binary crossover and polynomial mutation on the first sub-category initialization population to obtain a first sub-category sub-population with the same total number of individuals as the first sub-category initialization population;

The eighth processing unit is used to simulate binary crossover and polynomial mutation on the second sub-category initialization population to obtain a second sub-category sub-population with the same total number of individuals as the second sub-category initialization population;

The ninth processing unit is used to simulate binary crossover and polynomial mutation on the third sub-category initialization population to obtain a third sub-category sub-population with the same total number of individuals as the third sub-category initialization population;

A tenth processing unit, configured to merge the first sub-category initialization population and the first sub-category sub-population to obtain a first sub-category mixed population;

An eleventh processing unit, configured to merge the second sub-category initialization population and the second sub-category sub-population to obtain a second sub-category mixed population;

A twelfth processing unit, configured to merge the third sub-category initialization population and the third sub-category sub-population to obtain a third sub-category mixed population;

A thirteenth processing unit, used to obtain the verification data subset in the pre-stored wireless network traffic data set;

A fourteenth processing unit, configured to perform feature selection on the verification data subset through each individual in the first sub-category mixed population and input it to each base classifier in the K nearest neighbor model classifier group, Obtain a first classification result set corresponding to each individual in the first sub-category mixed population;

A fifteenth processing unit, configured to perform feature selection on the verification data subset through each individual in the second sub-category mixed population and input it to each base classifier in the support vector machine model classifier group, Obtain a second classification result set corresponding to each individual in the second sub-category mixed population;

The sixteenth processing unit is used to perform feature selection on the verification data subset through each individual in the third sub-category mixed population and input it to each base classifier in the self-organizing feature map network classifier group. , obtain the third classification result set corresponding to each individual in the third subcategory mixed population;

The seventeenth processing unit is used to call the pre-stored first multi-objective strategy to combine the first classification result set corresponding to each individual in the first sub-category mixed population and each individual in the second sub-category mixed population. The second classification result set corresponding to the individual and the third classification result set corresponding to each individual in the third sub-category mixed population are respectively used as inputs of the first multi-objective strategy to obtain the information corresponding to each individual in the first sub-category mixed population. a first target value set corresponding to the first classification result set corresponding to an individual, a second target value set corresponding to the second classification result set corresponding to each individual in the second subcategory mixed population, and The third target value set corresponding to the third classification result set corresponding to each individual in the third subcategory mixed population;

The eighteenth processing unit is used to assign individuals in the first sub-category mixed population according to the corresponding first target value set, and assign individuals in the second sub-category mixed population according to the corresponding second target value set. Target value set, and non-dominated sorting of the individuals in the third sub-category mixed population according to the corresponding third target value set, to obtain the first sub-category non-dominated sequence corresponding to the first target value set. The solution set and the first sub-category multi-level solution set, the second sub-category non-dominated solution set and the second sub-category multi-level solution set corresponding to the second target value set, and the second sub-category multi-level solution set corresponding to the third target value set The third sub-category of non-dominated solution sets and the third sub-category of multi-level solution sets; wherein, the first sub-category of non-dominated solution sets is denoted as Q ₁₁ , and the first sub-category of multi-level solution sets includes multiple solutions Set subsets are recorded as Q ₁₂ to Q _1X respectively, where the union of Q ₁₁ to Q _1X is the first subtype mixed population, and the intersection of any two sets in Q ₁₁ to Q _1X is the empty set, Q ₁₁ ≥Q ₁₂ ≥Q ₁₃ ≥…≥Q _1X ; the second subcategory non-dominated solution set is recorded as Q ₂₁ , and the second subcategory multi-layer solution set includes multiple solution set subsets and are respectively marked as Q ₂₂ to Q _2Y , where the union of Q ₂₁ to Q _2Y is the second subcategory mixed population, the intersection of any two sets in Q ₂₁ to Q _2Y is the empty set, Q ₂₁ ≥ _{Q 22} ≥ _{Q 23} ≥… ...≥Q _2Y ; the third subcategory of non-dominated solution sets is denoted as Q ₃₁ , and the third subcategory of multi-layer solution sets includes multiple solution set subsets and are denoted as Q ₃₂ to Q _3Z respectively, where Q ₃₁ The union to Q _3Z is the third sub-category mixed population, the intersection of any two sets from Q ₃₁ to Q _3Z is the empty set, Q ₃₁ ≥ _{Q 32} ≥ _{Q 33} ≥……≥Q _3Z ;

The nineteenth processing unit is used to sequentially merge multiple solution set subsets in the first sub-category non-dominated solution set and the first sub-category multi-layer solution set to obtain multiple sets until the total number of individuals equals the required number. The first population size value is used to form the current population of the first subcategory, and the current population of the first subcategory is used as the initialization population of the first subcategory;

The twentieth processing unit is used to sequentially merge multiple solution set subsets in the second sub-category non-dominated solution set and the second sub-category multi-layer solution set to obtain multiple sets until the total number of individuals equals the required number. The first population size value is used to form the current population of the second subcategory, and the current population of the second subcategory is used as the initialization population of the second subcategory;

The twenty-first processing unit is used to sequentially merge multiple solution set subsets in the third sub-category non-dominated solution set and the third sub-category multi-layer solution set to obtain multiple sets until the total number of individuals is equal to The first population size value is used to form the current population of the third subcategory, and the current population of the third subcategory is used as the initialization population of the third subcategory;

The twenty-second processing unit is configured to add one to the first current iteration generation as the first current iteration generation, and return to the step of determining whether the first current iteration generation reaches the first maximum iteration generation;

The twenty-third processing unit is used to obtain the K nearest neighbor model classifier group corresponding to the initialization population of the first subclass and the initialization population of the second subclass if the first current iteration generation reaches the first maximum iteration generation. The support vector machine model classifier group and the self-organizing feature map network classifier group corresponding to the third subclass initialization population are classified by the K nearest neighbor model classifier group, the support vector machine model classifier group and the self-organizing feature map network The classifier group forms the current classifier group.

In an embodiment, the second iterative evolution unit 140 includes:

The twenty-fourth processing unit is used to obtain the second current iteration generation and determine whether the second current iteration generation reaches the second maximum iteration generation;

A twenty-fifth processing unit, configured to obtain the current classifier group if the second current iteration generation does not reach the second maximum iteration generation;

The twenty-sixth processing unit is used to simulate binary crossover and polynomial mutation on the second type initialization population to obtain a second type subpopulation with the same total number of individuals as the second type initialization population;

The twenty-seventh processing unit is used to merge the second type of initialization population with the second type of subpopulation to obtain a second type of mixed population;

The twenty-eighth processing unit is used to select a base classifier for the current classifier group through each individual in the second type of mixed population, and obtain the corresponding already-classified classifier for each individual in the second type of mixed population. Select classifier group;

The twenty-ninth processing unit is used to obtain the verification data subset in the pre-stored wireless network traffic data set;

The thirtieth processing unit is used to input the verification data subset to the selected classifier group corresponding to each individual in the second type of mixed population, and obtain the corresponding classification of each individual in the second type of mixed population. The corresponding individual classification result set;

The thirty-first processing unit is used to call the pre-stored second multi-objective strategy, and use the individual classification result set corresponding to each individual in the second type of mixed population as the input of the second multi-objective strategy to obtain the corresponding The set of individual target values corresponding to each individual in the second type of mixed population;

The thirty-second processing unit is used to non-dominated sort the individuals in the second type of mixed population according to the individual target value set, and obtain the non-dominated solution set and the multi-layer solution set corresponding to the individual target value set, where , the non-dominated solution set is denoted as Q ₄₁ , the multi-level solution set includes multiple solution set subsets and are denoted as Q ₄₂ to Q _4W respectively, where the union of Q ₄₁ to Q _4W is the second category Mixed population, the intersection of any two sets from Q ₄₁ to Q _4W is the empty set, Q ₄₁ ≥ _{Q 42} ≥ _{Q 43} ≥... ≥ Q _4W ;

The thirty-third processing unit is used to sequentially merge multiple solution set subsets in the non-dominated solution set and the multi-layer solution set to obtain multiple sets until the total number of individuals is equal to the second population size value, To form a second type of current population, the second type of current population is used as the second type of initialization population;

A thirty-fourth processing unit, configured to add one to the second current iteration generation as the second current iteration generation, and return to the step of determining whether the second current iteration generation reaches the second maximum iteration generation;

The thirty-fifth processing unit is configured to obtain the second type of initialization population if the second current iteration generation reaches the second maximum iteration generation.

In one embodiment, the data attack type result classification unit includes:

The thirty-sixth processing unit is configured to use the optimal target classifier group to classify the data attack type of each wireless network traffic data to be detected in the wireless network traffic data set to be detected, and obtain each wireless network traffic to be detected. The target classification results corresponding to each target classifier group of the data in the optimal target classifier group;

The thirty-seventh processing unit is used to determine whether there is a flooding attack in the target classification results corresponding to each target classifier group in the optimal target classifier group for each wireless network traffic data to be detected;

The thirty-eighth processing unit is used to perform a flooding attack if the wireless network traffic data to be detected is flooded in the target classification results corresponding to each target classifier group in the optimal target classifier group, and the target classification results are flooded. If the total proportion corresponding to flood attacks exceeds the preset proportion of the minority class, obtain the wireless network traffic data to be detected corresponding to the target classification results with flooding attacks to form a minority class wireless network traffic data set, and obtain the targets without flooding attacks. The wireless network traffic data to be detected corresponding to the classification results form a majority wireless network traffic data set;

The thirty-ninth processing unit is used to set the classification result of the wireless network traffic data to be detected corresponding to the flood attack in the target classification result of the minority class wireless network traffic data set to flood if the total proportion corresponding to the flood attack exceeds the preset minority class proportion. general attack;

The fortieth processing unit is used to obtain the maximum number of classification results among the target classification results corresponding to each target classifier in the target classifier group for each wireless network traffic data to be detected in the wireless network traffic data set of most types. The classification result is used as the result of the data attack type corresponding to each wireless network traffic data to be detected in the majority wireless network traffic data set;

The forty-first processing unit is used to perform a flooding attack if the wireless network traffic data to be detected is flooded in the target classification results corresponding to each target classifier group in the optimal target classifier group, and the target classification results are flooded. The total proportion corresponding to general attacks does not exceed the preset proportion of minority categories, and the total number of classification results of each wireless network traffic data to be detected in the target classification results corresponding to each target classifier group in the optimal target classifier group is obtained. The classification result with the largest number is used as the data attack type result corresponding to each wireless network traffic data to be detected.

The device implements the deployment of an integrated classifier group including at least two types of base classifiers in the server to form an optimal target classifier group, thereby enabling more accurate classification of traffic data types and avoiding the use of a single type of classifier. , thereby improving the recognition rate of less common attack types.

The above-mentioned integrated classification device of traffic data types based on dual evolution can be implemented in the form of a computer program, and the computer program can be run on the computer device as shown in Figure 4.

Please refer to Figure 4. Figure 4 is a schematic block diagram of a computer device provided by an embodiment of the present invention. The computer device 500 is a server, and the server can be an independent server or a server cluster composed of multiple servers.

Referring to Figure 4, the computer device 500 includes a processor 502, a memory and a network interface 505 connected through a system bus 501, where the memory may include a non-volatile storage medium 503 and an internal memory 504.

The non-volatile storage medium 503 can store an operating system 5031 and a computer program 5032. When executed, the computer program 5032 can cause the processor 502 to execute a traffic data type integration classification method based on dual evolution.

The processor 502 is used to provide computing and control capabilities to support the operation of the entire computer device 500 .

The internal memory 504 provides an environment for the execution of the computer program 5032 in the non-volatile storage medium 503. When the computer program 5032 is executed by the processor 502, it can cause the processor 502 to execute the traffic data type integration classification method based on dual evolution.

The network interface 505 is used for network communication, such as providing transmission of data information, etc. Those skilled in the art can understand that the structure shown in Figure 4 is only a block diagram of a partial structure related to the solution of the present invention, and does not constitute a limitation on the computer equipment 500 to which the solution of the present invention is applied. Specific computer equipment 500 may include more or fewer components than shown, some combinations of components, or a different arrangement of components.

The processor 502 is used to run the computer program 5032 stored in the memory to implement the integrated classification method of traffic data types based on dual evolution disclosed in the embodiment of the present invention.

Those skilled in the art can understand that the embodiment of the computer device shown in Figure 4 does not constitute a limitation on the specific configuration of the computer device. In other embodiments, the computer device may include more or fewer components than shown in the figure. Or combining certain parts, or different parts arrangements. For example, in some embodiments, the computer device may only include a memory and a processor. In such an embodiment, the structure and function of the memory and processor are consistent with the embodiment shown in FIG. 4 and will not be described again.

It should be understood that in the embodiment of the present invention, the processor 502 may be a central processing unit (Central Processing Unit, CPU), and the processor 502 may also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), dedicated integrated processors, etc. Circuit (Application Specific Integrated Circuit, ASIC), off-the-shelf programmable gate array (Field-Programmable GateArray, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general processor may be a microprocessor or the processor may be any conventional processor.

In another embodiment of the invention a computer readable storage medium is provided. The computer-readable storage medium may be a non-volatile computer-readable storage medium. The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the integrated classification method of traffic data types based on dual evolution disclosed in the embodiment of the present invention is implemented.

The computer-readable storage medium is a physical, non-transient storage medium, such as a U disk, a mobile hard disk, a read-only memory (Read-Only Memory, ROM), a magnetic disk or an optical disk, which can store program codes. physical storage media.

Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the above-described equipment, devices and units can be referred to the corresponding processes in the foregoing method embodiments, and will not be described again here.

The above are only specific embodiments of the present application, but the protection scope of the present application is not limited thereto. Any person familiar with the technical field can easily think of various equivalent methods within the technical scope disclosed in the present application. Modification or replacement, these modifications or replacements shall be covered by the protection scope of this application. Therefore, the protection scope of this application should be subject to the protection scope of the claims.

Claims (10)

1. The flow data type integrated classification method based on double evolution is applied to a server and is characterized by comprising the following steps of:

carrying out population initialization according to a preset first population size value to obtain a plurality of sub-class initialization populations; the total number of individuals included in each sub-class initializing population in the plurality of sub-class initializing populations is equal to the first population size value, each individual included in each sub-class initializing population in the plurality of sub-class initializing populations corresponds to a binary sequence, and the number of features included in the binary sequence corresponding to each individual included in each sub-class initializing population in the plurality of sub-class initializing populations is equal to the number of features of the wireless network flow data;

According to a preset first maximum iteration algebra, iteratively repeatedly executing the steps of selecting features of training data subsets in a pre-stored wireless network flow data set according to each individual in each sub-class initializing population in a plurality of sub-class initializing populations, inputting the feature to a classifier model to be trained corresponding to each sub-class initializing population to obtain a base classifier group corresponding to each sub-class initializing population, and evolving each sub-class initializing population in the plurality of sub-class initializing populations according to the corresponding base classifier group and a preset first optimization target condition to obtain a sub-class current population corresponding to each sub-class initializing population until a base classifier group corresponding to each sub-class initializing population is obtained, wherein the current classifier group consists of the base classifier groups corresponding to each sub-class initializing population;

carrying out population initialization according to a preset second population size value to obtain a second type of initialization population; the second-type initializing population comprises a plurality of individuals, the total number of the individuals is equal to the second population size value, each individual corresponds to a binary sequence, and the feature number contained in the binary sequence corresponding to each individual is equal to the first population size value multiplied by the subclass type total value corresponding to the subclass initializing population;

According to a preset second maximum iteration algebra, iteratively executing the step of evolving by each individual in the second class of initialized population according to the current classifier group and a preset second optimization target condition until the second class of initialized population output by iteration is obtained;

and selecting a base classifier according to each individual in the output second class initialization population in the current classifier group to obtain a target classifier group corresponding to each individual in the second class initialization population so as to form an optimal target classifier group, and storing the optimal target classifier group.

2. The method for integrated classification of traffic data types based on dual evolution according to claim 1, wherein each of the second class of initialized population according to the output performs a base classifier selection in a current classifier group to obtain a target classifier group corresponding to each of the second class of initialized population, so as to form an optimal target classifier group, and after storing the optimal target classifier group, further comprises:

judging whether a wireless network flow data set to be detected sent by a client is received or not;

if a wireless network traffic data set to be detected is received, classifying the data attack type of each wireless network traffic data set to be detected in the wireless network traffic data set to be detected through the optimal target classifier group, and obtaining a data attack type result corresponding to each wireless network traffic data set to be detected; the data attack type result is normal operation, flooding attack, injection attack or counterfeit attack.

3. The integrated classification method of traffic data types based on double evolution according to claim 1, wherein the total value of subclasses corresponding to the plurality of subclass initialization populations is 3, and the 3 subclass initialization populations respectively correspond to a first subclass initialization population, a second subclass initialization population and a third subclass initialization population; the total number of the plurality of individuals in the first sub-class initialization population is equal to the first population size value, each individual in the first sub-class initialization population corresponds to a binary sequence, and the number of features included in the binary sequence corresponding to each individual in the first sub-class initialization population is equal to the number of features of wireless network flow data; the total number of the individuals in the second sub-class initialization population is equal to the first population size value, each individual in the second sub-class initialization population corresponds to a binary sequence, and the number of features included in the binary sequence corresponding to each individual in the second sub-class initialization population is equal to the number of features of the wireless network flow data; the total number of the plurality of individuals in the third sub-class initialization population is equal to the first population size value, each individual in the third sub-class initialization population corresponds to a binary sequence, and the number of features included in the binary sequence corresponding to each individual in the third sub-class initialization population is equal to the number of features of the wireless network flow data.

4. The method of integrated classification of traffic data types based on dual evolution according to claim 3, wherein the step of iteratively repeating the steps of performing feature selection on the training data subset in the pre-stored wireless network traffic data set according to each individual in each of the plurality of sub-class initialization populations and inputting the feature selection to the classifier model to be trained corresponding to each sub-class initialization population to obtain a base classifier group corresponding to each sub-class initialization population, and performing evolution on each sub-class initialization population in the plurality of sub-class initialization populations according to the corresponding base classifier group and a preset first optimization target condition to obtain a sub-class current population corresponding to each sub-class initialization population until a base classifier group corresponding to each sub-class initialization population is obtained, the current classifier group consisting of the base classifier groups corresponding to each sub-class initialization population comprises:

acquiring a first current iteration algebra, and judging whether the first current iteration algebra reaches the first maximum iteration algebra;

if the first current iteration algebra does not reach the first maximum iteration algebra, acquiring a training data subset in a pre-stored wireless network flow data set;

Each individual in the first subclass initializing population is used for carrying out feature selection on the training data subset, and the feature selection is respectively input into a K nearest neighbor model to be trained for training, so that a K nearest neighbor model classifier group is correspondingly obtained; wherein the total number of base classifiers in the K-nearest model classifier group is equal to the first population size value;

each individual in the second subclass initializing population is used for carrying out feature selection on the training data subset, and the feature selection is respectively input into a support vector machine model to be trained for training, so that a support vector machine model classifier group is correspondingly obtained; the total number of base classifiers in the support vector machine model classifier group is equal to the first population size value;

each individual in the third subclass initializing population is used for carrying out feature selection on the training data subset, and the feature selection is respectively input into a self-organizing feature mapping network to be trained for training, so that a self-organizing feature mapping network classifier group is correspondingly obtained; the total number of the base classifiers in the self-organizing feature mapping network classifier group is equal to the first population size value;

forming a current classifier group by the K nearest neighbor model classifier group, the support vector machine model classifier group and the self-organizing feature mapping network classifier group; wherein the total number of corresponding base classifiers in the current classifier group is 3 times the first population size value;

Simulating binary cross and polynomial variation on the first sub-class initialization population to obtain a first sub-class sub-population with the same total number of individuals as the first sub-class initialization population;

simulating binary cross and polynomial variation on the second sub-class initialization population to obtain a second sub-class sub-population with the same total number of individuals as the second sub-class initialization population;

simulating binary cross and polynomial variation on the third sub-class initialization population to obtain a third sub-class sub-population which has the same total number of individuals as the third sub-class initialization population;

combining the first sub-class initialization population with the first sub-class sub-population to obtain a first sub-class mixed population;

combining the second sub-class initializing population with the second sub-class sub-population to obtain a second sub-class mixed population;

combining the third sub-class initializing population with the third sub-class sub-population to obtain a third sub-class mixed population;

acquiring a verification data subset in a pre-stored wireless network flow data set;

performing feature selection on the verification data subset through each individual in the first sub-class mixed population, and respectively inputting the feature selection to each base classifier in the K nearest neighbor model classifier group to obtain a first classification result set corresponding to each individual in the first sub-class mixed population;

Performing feature selection on the verification data subset through each individual in the second sub-class mixed population, and respectively inputting the feature selection to each base classifier in the support vector machine model classifier group to obtain a second classification result set corresponding to each individual in the second sub-class mixed population;

performing feature selection on the verification data subset through each individual in the third sub-class mixed population, and respectively inputting the feature selection to each base classifier in the self-organizing feature mapping network classifier group to obtain a third classification result set corresponding to each individual in the third sub-class mixed population;

invoking a pre-stored first multi-objective strategy, and taking a first classification result set corresponding to each individual in the first mixed population of subclasses, a second classification result set corresponding to each individual in the second mixed population of subclasses and a third classification result set corresponding to each individual in the third mixed population of subclasses as input of the first multi-objective strategy respectively to acquire a first target value set corresponding to the first classification result set corresponding to each individual in the first mixed population of subclasses, a second target value set corresponding to the second classification result set corresponding to each individual in the second mixed population of subclasses and a third target value set corresponding to the third classification result set corresponding to each individual in the third mixed population of subclasses;

Combining the individuals in the first mixed population of subclasses according to the corresponding first set of target values, combining the individuals in the second mixed population of subclasses according to the corresponding second set of target values, and combining the sameThe individuals in the third sub-class mixed population respectively perform non-dominant sorting according to the corresponding third target value set to obtain a first sub-class non-dominant solution set and a first sub-class multi-layer solution set corresponding to the first target value set, a second sub-class non-dominant solution set and a second sub-class multi-layer solution set corresponding to the second target value set, and a third sub-class non-dominant solution set and a third sub-class multi-layer solution set corresponding to the third target value set; wherein the first subclass non-dominant solution set is denoted as Q ₁₁ The first sub-class multi-layer solution set comprises a plurality of solution subsets and is respectively denoted as Q ₁₂ To Q _1X Wherein Q is ₁₁ To Q _1X Is the union of the first subclass mixed population, Q ₁₁ To Q _1X The intersection of any two sets is an empty set, Q ₁₁ ≥Q ₁₂ ≥Q ₁₃ ≥……≥Q _1X The method comprises the steps of carrying out a first treatment on the surface of the The second subclass of non-dominant solution set is denoted as Q ₂₁ The second sub-class multi-layer solution set includes a plurality of solution subsets and is denoted as Q respectively ₂₂ To Q _2Y Wherein Q is ₂₁ To Q _2Y Is the union of the second subclass mixed population, Q ₂₁ To Q _2Y The intersection of any two sets is an empty set, Q ₂₁ ≥Q ₂₂ ≥Q ₂₃ ≥……≥Q _2Y The method comprises the steps of carrying out a first treatment on the surface of the The third subclass of non-dominant solution set is denoted as Q ₃₁ The third sub-class multi-layer solution set comprises a plurality of solution subsets and is respectively denoted as Q ₃₂ To Q _3Z Wherein Q is ₃₁ To Q _3Z Is the third subclass mixed population, Q ₃₁ To Q _3Z The intersection of any two sets is an empty set, Q ₃₁ ≥Q ₃₂ ≥Q ₃₃ ≥……≥Q _3Z ；

Sequentially combining a plurality of solution set subsets in the first sub-class non-dominant solution set and the first sub-class multi-layer solution set to obtain a plurality of sets until the total number of individuals is equal to the first population size value so as to form a first sub-class current population, and taking the first sub-class current population as the first sub-class initialization population;

sequentially combining a plurality of solution set subsets in the second sub-class non-dominant solution set and the second sub-class multi-layer solution set to obtain a plurality of sets until the total number of individuals is equal to the first population size value so as to form a second sub-class current population, and taking the second sub-class current population as the second sub-class initialization population;

sequentially combining a plurality of solution set subsets in the third sub-class non-dominant solution set and the third sub-class multi-layer solution set to obtain a plurality of sets until the total number of individuals is equal to the first population size value so as to form a third sub-class current population, and taking the third sub-class current population as the third sub-class initialization population;

Adding one to the first current iteration algebra to serve as a first current iteration algebra, and returning to execute the step of judging whether the first current iteration algebra reaches the first maximum iteration algebra;

and if the first current iteration algebra reaches the first maximum iteration algebra, acquiring a K nearest neighbor model classifier group corresponding to the first subclass initializing population, a support vector machine model classifier group corresponding to the second subclass initializing population and a self-organizing feature mapping network classifier group corresponding to the third subclass initializing population, and forming the current classifier group by the K nearest neighbor model classifier group, the support vector machine model classifier group and the self-organizing feature mapping network classifier group.

5. The method for integrated classification of traffic data types based on dual evolution according to claim 4, wherein the formula corresponding to the first multi-objective strategy is J _m (k)＝TP _mk /(TP _mk +FN _mk +FP _mk ) The method comprises the steps of carrying out a first treatment on the surface of the Wherein the value set corresponding to k is {1,2,3,4}, the value set of m is {1,2, … …, L }, L is equal to the first population size value, J _m (k) A target value corresponding to the k type of simplified wireless network traffic data of the mth individual, and J _m (1)、J _m (2)、J _m (3)、J _m (4) Forming a target value set corresponding to the mth individual, TP _mk For a first total value, FN, of the mth individual kth type of simplified wireless network traffic data for which the classification result true type is positive and the classification result predicted type is positive _mk A second total value, FP, for positive examples of classification result true types and negative examples of classification result prediction types in the mth individual kth type of simplified wireless network traffic data _mk A third total value for the m-th individual k-th type of simplified wireless network traffic data, the true type of the classification result being a negative example and the predicted type of the classification result being a positive example;

the step of respectively taking a first classification result set corresponding to each individual in the first mixed population of subclasses, a second classification result set corresponding to each individual in the second mixed population of subclasses, and a third classification result set corresponding to each individual in the third mixed population of subclasses as input of a first multi-objective strategy to obtain a first target value set corresponding to the first classification result set corresponding to each individual in the first mixed population of subclasses, a second target value set corresponding to the second classification result set corresponding to each individual in the second mixed population of subclasses, and a third target value set corresponding to the third classification result set corresponding to each individual in the third mixed population of subclasses, includes:

According to J _m (k)＝TP _mk /(TP _mk +FN _mk +FP _mk ) A first set of target values corresponding to a first set of classification results for each individual in the first mixed population of subclasses, a second set of target values corresponding to a second set of classification results for each individual in the second mixed population of subclasses, and a third set of target values corresponding to a third set of classification results for each individual in the third mixed population of subclasses are obtained.

6. The method of claim 5, wherein the step of iteratively repeating the step of evolving by each individual in the second class of initialized population according to the current classifier set and the preset second optimization objective condition according to the preset second maximum iteration algebra until the second class of initialized population iteratively outputted is obtained comprises:

obtaining a second current iteration algebra, and judging whether the second current iteration algebra reaches the second maximum iteration algebra;

if the second current iteration algebra does not reach the second maximum iteration algebra, acquiring the current classifier group;

simulating binary cross and polynomial variation on the second class initialization population to obtain a second class sub population with the same total number of individuals as the second class initialization population;

Combining the second type initializing population with the second type sub population to obtain a second type mixed population;

performing base classifier selection on the current classifier group through each individual in the second class mixed population to obtain a selected classifier group corresponding to each individual in the second class mixed population;

acquiring a verification data subset in a pre-stored wireless network flow data set;

inputting the verification data subset into a selected classifier group corresponding to each individual in the second class mixed population to obtain an individual classification result set corresponding to each individual in the second class mixed population;

invoking a pre-stored second multi-target strategy, and taking an individual classification result set corresponding to each individual in the second class mixed population as the input of the second multi-target strategy to obtain an individual target value set corresponding to each individual in the second class mixed population;

the individuals in the second class mixed population are subjected to non-dominant ranking according to the individual target value set to obtain a non-dominant solution set and a multi-layer solution set corresponding to the individual target value set, wherein the non-dominant solution set is marked as Q ₄₁ The multi-layer solution set includes a plurality of solution subsets and is denoted as Q respectively ₄₂ To Q _4W Wherein Q is ₄₁ To Q _4W Is the union of the second class of mixed populations, Q ₄₁ To Q _4W The intersection of any two sets is an empty set, Q ₄₁ ≥Q ₄₂ ≥Q ₄₃ ≥……≥Q _4W ；

Sequentially combining a plurality of solution set subsets in the non-dominant solution set and the multi-layer solution set to obtain a plurality of sets until the total number of individuals is equal to the second population size value so as to form a second type current population, and taking the second type current population as the second type initialization population;

adding one to the second current iteration algebra to serve as a second current iteration algebra, and returning to execute the step of judging whether the second current iteration algebra reaches the second maximum iteration algebra;

and if the second current iteration algebra reaches the second maximum iteration algebra, obtaining a second class of initialization population.

7. The integrated classification method of traffic data types based on dual evolution according to claim 2, wherein the classifying, by the optimal target classifier set, the data attack type of each wireless network traffic data to be detected in the wireless network traffic data set to be detected, to obtain a data attack type result corresponding to each wireless network traffic data to be detected, includes:

Performing data attack type classification on each wireless network traffic data to be detected in the wireless network traffic data set to be detected through the optimal target classifier group to obtain a target classification result corresponding to each target classifier group of each wireless network traffic data to be detected in the optimal target classifier group;

judging whether flooding attack exists in target classification results corresponding to each target classifier group in the optimal target classifier groups according to the wireless network traffic data to be detected;

if flooding attack exists in the target classification results corresponding to the target classifier groups in the optimal target classifier groups, and the total proportion corresponding to the flooding attack in the target classification results exceeds a preset minority class proportion, acquiring the wireless network traffic data to be detected corresponding to the target classification results with the flooding attack to form a minority class wireless network traffic data set, and acquiring the wireless network traffic data to be detected corresponding to the target classification results without the flooding attack to form a majority class wireless network traffic data set;

setting a classification result of the to-be-detected wireless network traffic data corresponding to the flooding attack with the total proportion exceeding the preset minority class proportion in the target classification result in the minority class wireless network traffic data set as the flooding attack;

Obtaining the classification result with the maximum total classification result number in the target classification results corresponding to the target classifiers in the target classifier group respectively for each wireless network traffic data to be detected in the plurality of wireless network traffic data sets, and taking the classification result as a data attack type result corresponding to each wireless network traffic data to be detected in the plurality of wireless network traffic data sets;

if flooding attack exists in the target classification results corresponding to the target classifier groups in the optimal target classifier groups, and the total proportion of the flooding attack in the target classification results does not exceed the preset minority class proportion, obtaining the classification result that the total number of classification results in the target classification results corresponding to the target classifier groups in the optimal target classifier groups is the maximum, and taking the classification result as the data attack type result corresponding to each wireless network traffic data to be detected.

8. A dual evolution based traffic data type integrated classification device comprising means for performing the dual evolution based traffic data type integrated classification method of any one of claims 1 to 7.

9. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the dual evolution based integrated classification method of traffic data types as claimed in any one of claims 1 to 7 when the computer program is executed by the processor.

10. A computer readable storage medium, characterized in that the computer readable storage medium stores a computer program which, when executed by a processor, causes the processor to perform the dual evolution based integrated classification method of traffic data types according to any one of claims 1 to 7.