Method of feature extraction of abnormal communication signal in network based on nonlinear technology

2.1.1 Wavelet packet decomposition

Although the traditional method of feature extraction for abnormal signal in network can be conducted in both time domain and frequency domain and because the abnormal communication signal in network is a nonlinear signal, the traditional time-domain analysis and frequency–domain analysis are global transformation changes, the abnormal signal cannot be analyzed in both time domain and frequency domain at the same time. Wavelet decomposition can transform the abnormal signal locally in time and frequency domain and effectively extract the abnormal information [12]. It can refine and analyze the abnormal signal in multiscale, so it is suitable for nonlinear feature extraction. Wavelet packet analysis can provide a more refined analysis method for signals. Wavelet packet analysis divides the time–frequency plane into more detailed parts, and its resolution for the high-frequency part of the signal is higher than that of the dyadic wavelet. Moreover, it introduces the concept of optimal basis selection based on the wavelet analysis theory. That is, after dividing the frequency band into multiple levels, the optimal basis function is adaptively selected based on the characteristics of the analyzed signal to match it with the signal, to improve the signal analysis ability. Therefore, wavelet packets have the extensive application value, so this study will choose wavelet packet transform as the algorithm for this study. The expression of the basic wavelet is given as follows:

where a is the scale of wavelet signal and b is the offset of wavelet.

The basic wavelet transforms the scale and displacement to make the inner product with the original signal, and the result is the wavelet coefficient. This process is called continuous wavelet transform. However, to facilitate the analysis of abnormal signals [13], discrete wavelet transform is adopted in this article, and its expression is expressed as follows [14]:

After the discrete wavelet decomposition of the original abnormal signal, the characteristic solutions of the abnormal signal can be obtained in high frequency and low frequency. To illustrate the effectiveness of higher order cumulants in nonlinear abnormal signal processing, the concept of characteristic function is first introduced. It lets the probability density function of random variable x be f ( x ) , and the first characteristic function equation of random variable is given as follows:

The second characteristic function equation of x is:

For random vector x , its higher-order cumulant can be defined as follows:

where r = v 1 , v 2 , … , v k ; the k -order cumulant of zero mean stationary random vector x = ( x 1 , x 2 … x k ) is given as follows:

Given the random process x , the first- to fourth-order cumulants are calculated by the following method:

where R x is the autocorrelation of random process x .

It demonstrates that the mean and the mean square difference of the first-order cumulants and the second-order cumulants are the embodiment of the basic information in the signal; the third-order and the fourth-order cumulants of Gaussian random variable x are always zero. Therefore, when the signal conforms to the Gaussian process, the colored noise can be completely eliminated theoretically, reflecting the nonlinear features of autocorrelation in the abnormal signal. Therefore, this article adopts the second-order cumulants, the third-order cumulants, and the fourth-order cumulants as the method of feature extraction.

2.1.2 LTSA mainstream shape recognition algorithm

LTSA is a very effective nonlinear dimension reduction method. It is mainly used to describe the local geometry of the manifold by the low-dimensional tangent space in the neighborhood of sample points, and then to globally arrange the low-dimensional tangent space to obtain the low-dimensional global coordinates of sample points. Aiming at the correlation features between nonlinear and nonstationary abnormal signals generated in the process of network communication [15], in accordance with the correlation features between abnormal signal features, the LTSA in the nonlinear manifold learning method can eliminate a large amount of redundant information, reduce the signal noise, and improve the sensitivity of abnormal signal features. It can effectively obtain the internal low-dimensional manifold structure, which is embedded in high-dimensional space and mine the internal essential features of abnormal communication signal in networks. Therefore, on the basis of wavelet decomposition, this article uses LTSA mainstream shape recognition algorithm to further complete the signal denoising.

The signal set X = { x i ∈ R D ; i = 1 , … , N } is composed of the signal after wavelet decomposition. The main shape recognition using LTSA algorithm mainly includes the following steps:

1. Construct neighborhood: For each sample point x i , determine its k nearest neighbors X i , and X i = [ x i 1 , x i 2 , … , x i k ] . The number of samples contained in the sample set is N .

2. Extract local information: Select a set of orthogonal bases Q i in the neighborhood of data sample point x i , project X i onto Q i , and mine the main information of signals in the neighborhood [16]. In the solution process, Q i is mainly composed of the eigenvectors consistent with the d maximum eigenvalues of ( X i H k ) ( X i H k ) T , where d is the dimension of the low dimensional manifold subspace, the local low dimensional coordinates of X i are Ω i = Q i T X i H k , and H k = I − e e T / k is the centralization matrix.

3. The local tangent space global arrangement can be converted into a minimization problem’s approximate solution process, and its equation is given as follows [17]:

   (8) arg min T ∑ i = 1 N E i = arg min i = 1 ∑ i = 1 N ∥ T i H k − L i Ω i ∥ ,

   where the global low dimensional coordinate of X i is T i = [ t i 1 , … , t i k ] . In accordance with the equation, when L i = T i H k Ω i + , the mapping error is the minimum, and Ω i + is the Moore Penrose generalized inverse of Ω i .

4. Mainstream shape reconstruction: After obtaining the low-dimensional coordinates T = [ t 1 , … , t N ] of all signals, the mainstream shape is reconstructed in its high-dimensional space by Eq. (9):

where X i and T i are, respectively, the mean values of x ¯ i and t ¯ i ; the generalized inverse of L i is L i . Finally, the mainstream shape Y ∈ R m × N in high-dimensional space is obtained; the embedding dimension is expressed in m .

2.1.3 Overall process

Based on the above two parts, the overall flow of nonlinear signal processing based on wavelet packet transform and LTSA is obtained. The steps are as follows:

1. The wavelet packet is used to decompose the one-dimensional time series x ( t ) , t = 1 , 2 , ⋯ , T , and the corresponding wavelet packet decomposition coefficient p j , k n is obtained, where n ∈ [ 1 , N ] is the number of wavelet packet decomposition layers, j ∈ [ 0 , 2 n − 1 ] is the wavelet packet node number, and k ∈ [ 1 , K ] , K is the data length in the wavelet packet node.

2. For each wavelet packet decomposition node, the pseudo-nearest neighbor and mutual information methods are used to select the phase space reconstruction time delay τ and the best embedding dimension m , and the phase space matrix of wavelet packet decomposition coefficient P j = [ p 1 , ⋯ p K ] is obtained, in which the point in phase space p K = ( p j , t N , p j , 1 + τ N , ⋯ p j , 1 + ( m − 1 ) τ N ) .

3. The adaptive maximum likelihood estimation method is adopted to estimate the eighth dimension d of the mainstream shape, and LTSA is adopted to reduce the nonlinear dimension of p j to obtain the low dimensional matrix P j ¯ = [ p ¯ 1 , ⋯ p ¯ 1 ] ∈ R d .

4. The wavelet packet decomposition coefficient after noise reduction is inversely obtained by Eq. (2):

where { I k ( ζ , v ) } represents the subscript set of all elements of the k th element in the decomposition coefficient of wavelet packet that meet the condition ζ + ( v − 1 ) τ = k in the phase space data matrix, v ∈ [ 1 , m ] , ζ ∈ [ 0 , K − ( m − 1 ) τ ] , and C k is the number of elements in { I k ( ζ , v ) } . The wavelet packet decomposition coefficient is reconstructed to obtain the denoised signal. The signal nonlinear processing flow based on wavelet packet transform and LTSA is shown in Figure 1.

Figure 1

Signal nonlinear processing flow based on wavelet packet transform and LTSA.

Figure 1 shows that in the process of nonlinear signal processing based on wavelet packet transform and LTSA, it is necessary to first process the one-dimensional noise signal time series and then use the wavelet packet decomposition coefficients to reconstruct the phase space of the wavelet packet decomposition coefficients. Before the reconstruction, it is necessary to determine the time delay and embedding size, and after the reconstruction is completed, the mainstream shape of LTSA is identified. Then it carries out one-dimensional wavelet packet decomposition coefficient reconstruction and wavelet packet decomposition and reconstruction. After these operations are completed, the process can be ended.

2.2.1 Feature extraction

Principal component analysis (PCA) is an optimal orthogonal transformation based on the statistical features of the target and has the ability to extract the maximum descriptive features in the mode. However, PCA is a linear algorithm, which only considers the second-order statistical features in the data. When there are massive nonlinear relationships in the features of network communication signals, it cannot meet the requirements [18]. Therefore, kernel principal component analysis (KPCA), which is formed by the organic integration of PCA and kernel learning method is not only suitable for dealing with nonlinear problems but also can provide more information. KPCA realizes the selection of important characteristic variables while classifying in accordance with the size of energy entropy. Based on the analysis of network communication signals without assuming the distribution of signals [19], the nonlinear processing and dimensionality reduction of signals are realized by mapping the input space to the high-dimensional feature space.

The basic idea of KPCA is to map the abnormal communication signal in the network denoised in Section 2.1 to a high-dimensional feature space [20] through a nonlinear mapping and then to carry out linear principal component analysis on the feature space. Assuming that the input abnormal communication signals x k in network are mapped to ϕ ( x k ) , and they have been centralized, that is, the condition of Eq. (11) is satisfied, there is [21]:

where x k ( k = 1 , … , N ) is N abnormal communication signal samples of input training network and ϕ ( x k ) is the transformed training abnormal communication signal in network sample.

Covariance matrix C of abnormal communication signal sample of training network after mapping is given as follows:

The following characteristic equations are solved:

In accordance with the reproducing kernel theory, the eigenvector v must be located in the space composed of ϕ ( x 1 ) , . . . , ϕ ( x N ) , that is, it can be expressed by the linear combination of ϕ ( x 1 ) , . . . , ϕ ( x N ) :

where a 1 , . . . , a i is a constant.

Define a N × N matrix K :

Eq. (15) is also called the kernel matrix. By substituting Eqs. (12), (14), and (15) into Eq. (13), we obtain:

In this way, the problem of solving the eigenvector v of Eq. (13) is transformed into finding the eigenvector α of eigenequation (15). From Eq. (15), it can be seen that the nuclear matrix K is a symmetric, semi positive definite square matrix, and its eigenvalue will be nonnegative. By solving the characteristic Eq. (16), a set of nonzero eigenvalues λ j and the corresponding eigenvector α j ( j = 1 , . . . , N ) satisfying the normalization condition can be obtained. The condition expression satisfied is given as follows:

In accordance with Eq. (14), the projected principal component [22] of the network communication signal in the feature space can be obtained, which is represented by v j ( j = 1 , . . . , N ) .

Let x be a test sample, then its projection on v j is given as follows [23]:

In accordance with the aforementioned steps, the projection feature vector of the original network communication signal can be obtained. In the aforementioned process, the selection process of principal component V is the process of feature extraction of abnormal communication signals in network.

KPCA is an extension of PCA. Its coordinates are nonlinear, that is, the nonlinear function representing X can be expressed by the principal component matrix U , and its equation is given as follows:

where F ( ⋅ ) represents a nonlinear function, and its principal component inverse transformation is also nonlinear [24]. The calculation equation of inverse result X ⌢ is given as follows:

where G ( ⋅ ) is also a nonlinear function. After obtaining the results in accordance with the above equation, important principal variables are selected to represent the most important information contained in the sample data.

In the process of feature extraction, KPCA guarantees the principle of minimum mean square deviation between cost functions X and X ⌢ , and it is expressed as follows:

where X i is the i th component of X and X ⌢ i is the i th component of X ⌢ .

2.2.2 Determination of nonlinear function

To ensure the best feature extraction, the two nonlinear functions of F ( ⋅ ) and G ( ⋅ ) should be determined. This article is completed based on self-organizing neural network. Figure 2 shows the network structure.

Figure 2

Structure based on self-organizing neural network.

Self-organizing neural network is a five-layer forward network composed of two self-organizing neural networks, which consists of one input layer, one output layer, and three hidden layers. The input layer and output layer are n neurons, and the hidden layer in the middle is also called bottleneck layer. It is not only the output of the front self-organizing neural network but also the input of the back self-organizing neural network. The extracted main metadata can be used for the subsequent signal analysis [25].

The nonlinear transformation function f 1 is used for mapping the input vector X to the first hidden layer. The mapping result is h ( X ) , and the column vector length is l , then:

where the weight matrix of l × n is W ( X ) ; the offset parameter vector of l is b ( X ) , where i = 1 , 2 , . . . , l . The transformation function f 2 is adopted to map h ( X ) to the bottleneck layer to obtain the main element vector U with only one element μ , which is expressed as follows:

Generally, f 1 uses hyperbolic tangent function and f 2 selects the identity function. The mapping relationship between f 1 and f 2 constitutes F ( ⋅ ) , so as to realize the dimensionality reduction extraction process of nonlinear principal component U .

After extracting the nonlinear principal component U , the nonlinear transformation function f 3 is selected to map U to the third hidden layer. The mapping result is h ( U ) , and its equation is given as follows:

where i = 1 , 2 , . . . , l .

The nonlinear transformation function f 4 is adopted to map h ( U ) to the output layer to obtain the vector with n elements. The equations are given as follows:

When selecting the nonlinear transformation function, f 1 and f 3 select the same nonlinear function; f 2 and f 4 select the same nonlinear function [26], and the mapping relationship between f 3 and f 4 constitutes G ( ⋅ ) , so as to realize the mapping process from U to X .

The minimum value of the cost function of Eq. (19) is obtained by finding the optimal W ( X ) , ω ( X ) , b ¯ ( X ) , W ( U ) , and b ¯ ( U ) , so as to minimize the variance between the output X ⌢ and the original X achieved by the neural network. When f 2 and f 4 select identity functions, we obtain [27]:

Based on the aforementioned steps, the feature extraction of abnormal communication signal in network is completed.