API参数异常检测Transformer架构设计文档

// Transformer配置
typedef struct transformer_config {
    int d_model;           // 模型维度 (512)
    int n_heads;           // 注意力头数 (8)
    int n_layers;          // 层数 (6)
    int d_ff;             // 前馈网络维度 (2048)
    int max_seq_len;       // 最大序列长度 (1024)
    float dropout;         // Dropout率 (0.1)
    int vocab_size;        // 词汇表大小 (50000)
    int num_classes;       // 分类数量 (2: 正常/异常)
} transformer_config_t;

// 位置编码
typedef struct position_encoding {
    float *pe;             // 位置编码矩阵
    int max_len;           // 最大长度
    int d_model;           // 模型维度
} position_encoding_t;

// 多头注意力
typedef struct multi_head_attention {
    float *W_q;            // Query权重矩阵
    float *W_k;            // Key权重矩阵
    float *W_v;            // Value权重矩阵
    float *W_o;            // 输出权重矩阵
    float *b_q;            // Query偏置
    float *b_k;            // Key偏置
    float *b_v;            // Value偏置
    float *b_o;            // 输出偏置
    int d_model;           // 模型维度
    int n_heads;           // 注意力头数
    int d_k;              // 每个头的维度
} multi_head_attention_t;

// 前馈网络
typedef struct feed_forward {
    float *W1;             // 第一层权重
    float *W2;             // 第二层权重
    float *b1;             // 第一层偏置
    float *b2;             // 第二层偏置
    int d_model;           // 模型维度
    int d_ff;             // 前馈网络维度
} feed_forward_t;

// Transformer层
typedef struct transformer_layer {
    multi_head_attention_t *attention;  // 多头注意力
    feed_forward_t *ff;                // 前馈网络
    layer_norm_t *ln1;                 // 第一个层归一化
    layer_norm_t *ln2;                 // 第二个层归一化
    float dropout;                     // Dropout率
} transformer_layer_t;

// 完整的Transformer模型
typedef struct transformer_model {
    transformer_config_t config;        // 配置
    position_encoding_t *pe;           // 位置编码
    transformer_layer_t *layers;       // Transformer层
    layer_norm_t *final_ln;           // 最终层归一化
    float *classifier;                 // 分类器权重
    float *classifier_bias;            // 分类器偏置
    float *embedding;                  // 嵌入层权重
    float *embedding_bias;             // 嵌入层偏置
} transformer_model_t;

// HTTP参数特征
typedef struct http_param_feature {
    char *name;                        // 参数名
    char *value;                       // 参数值
    int name_len;                      // 参数名长度
    int value_len;                     // 参数值长度
    float *name_embedding;             // 参数名嵌入
    float *value_embedding;            // 参数值嵌入
    float *combined_embedding;         // 组合嵌入
} http_param_feature_t;

// HTTP请求特征
typedef struct http_request_feature {
    char *uri;                         // URI
    char *method;                      // HTTP方法
    char *content_type;                // 内容类型
    int content_length;                // 内容长度
    http_param_feature_t *params;      // 参数列表
    int param_count;                   // 参数数量
    float *request_embedding;          // 请求嵌入
    float *context_embedding;          // 上下文嵌入
} http_request_feature_t;

typedef struct statistical_features {
    // 参数长度统计
    double param_length_mean;          // 参数长度均值
    double param_length_std;           // 参数长度标准差
    double param_length_min;           // 参数长度最小值
    double param_length_max;           // 参数长度最大值
    
    // 字符分布统计
    double digit_ratio;                // 数字比例
    double alpha_ratio;                // 字母比例
    double special_char_ratio;         // 特殊字符比例
    double upper_case_ratio;           // 大写字母比例
    
    // 信息熵
    double entropy;                    // 信息熵
    double conditional_entropy;        // 条件熵
    
    // 压缩特征
    double compression_ratio;          // 压缩比
    double gzip_ratio;                // Gzip压缩比
    
    // 参数数量特征
    int param_count;                  // 参数数量
    double param_count_ratio;         // 参数数量比例
} statistical_features_t;

typedef struct semantic_features {
    // Word2Vec特征
    float *word2vec_embedding;        // Word2Vec嵌入
    int embedding_dim;                // 嵌入维度
    
    // 语义相似性
    float semantic_similarity;        // 语义相似性
    float cosine_similarity;          // 余弦相似性
    
    // 词汇特征
    int vocabulary_size;              // 词汇表大小
    float oov_ratio;                 // 未知词比例
    float rare_word_ratio;           // 罕见词比例
} semantic_features_t;

typedef struct structural_features {
    // URL结构特征
    int url_depth;                   // URL深度
    int path_segments;               // 路径段数
    int query_params;                // 查询参数数
    
    // 参数结构特征
    int nested_level;                // 嵌套层级
    int array_elements;              // 数组元素数
    int object_properties;           // 对象属性数
    
    // 编码特征
    int encoding_type;               // 编码类型
    float encoding_efficiency;       // 编码效率
    int escape_sequences;            // 转义序列数
} structural_features_t;

// 特征融合函数
float* fuse_features(statistical_features_t *stat_feat,
                    semantic_features_t *sem_feat,
                    structural_features_t *struct_feat,
                    int *output_dim) {
    // 1. 统计特征归一化
    float *norm_stat = normalize_statistical_features(stat_feat);
    
    // 2. 语义特征处理
    float *sem_feat_processed = process_semantic_features(sem_feat);
    
    // 3. 结构特征编码
    float *struct_feat_encoded = encode_structural_features(struct_feat);
    
    // 4. 特征拼接
    float *fused_features = concatenate_features(norm_stat, 
                                                sem_feat_processed, 
                                                struct_feat_encoded);
    
    *output_dim = get_fused_dimension();
    return fused_features;
}

// 正弦位置编码
void generate_position_encoding(position_encoding_t *pe) {
    for (int pos = 0; pos < pe->max_len; pos++) {
        for (int i = 0; i < pe->d_model; i += 2) {
            float angle = pos / pow(10000, (2 * i) / (float)pe->d_model);
            pe->pe[pos * pe->d_model + i] = sin(angle);
            if (i + 1 < pe->d_model) {
                pe->pe[pos * pe->d_model + i + 1] = cos(angle);
            }
        }
    }
}

// 相对位置编码
void generate_relative_position_encoding(float *rel_pe, int max_len, int d_model) {
    for (int i = 0; i < max_len; i++) {
        for (int j = 0; j < max_len; j++) {
            int rel_pos = i - j + max_len - 1;
            for (int k = 0; k < d_model; k++) {
                float angle = rel_pos / pow(10000, (2 * k) / (float)d_model);
                rel_pe[(i * max_len + j) * d_model + k] = sin(angle);
            }
        }
    }
}

// 缩放点积注意力
void scaled_dot_product_attention(float *Q, float *K, float *V, 
                                 float *output, int seq_len, int d_k) {
    // 计算注意力分数
    float *scores = malloc(seq_len * seq_len * sizeof(float));
    matrix_multiply(Q, K, scores, seq_len, d_k, seq_len);
    
    // 缩放
    for (int i = 0; i < seq_len * seq_len; i++) {
        scores[i] /= sqrt(d_k);
    }
    
    // Softmax
    softmax(scores, seq_len, seq_len);
    
    // 与V相乘
    matrix_multiply(scores, V, output, seq_len, seq_len, d_k);
    
    free(scores);
}

// 多头注意力
void multi_head_attention_forward(multi_head_attention_t *mha,
                                 float *input, float *output,
                                 int seq_len, int d_model) {
    int d_k = d_model / mha->n_heads;
    
    // 线性变换
    float *Q = malloc(seq_len * d_model * sizeof(float));
    float *K = malloc(seq_len * d_model * sizeof(float));
    float *V = malloc(seq_len * d_model * sizeof(float));
    
    linear_transform(input, mha->W_q, mha->b_q, Q, seq_len, d_model);
    linear_transform(input, mha->W_k, mha->b_k, K, seq_len, d_model);
    linear_transform(input, mha->W_v, mha->b_v, V, seq_len, d_model);
    
    // 重塑为多头
    float *Q_heads = reshape_for_heads(Q, seq_len, d_model, mha->n_heads);
    float *K_heads = reshape_for_heads(K, seq_len, d_model, mha->n_heads);
    float *V_heads = reshape_for_heads(V, seq_len, d_model, mha->n_heads);
    
    // 并行计算注意力
    float *attention_outputs = malloc(mha->n_heads * seq_len * d_k * sizeof(float));
    for (int h = 0; h < mha->n_heads; h++) {
        float *Q_head = Q_heads + h * seq_len * d_k;
        float *K_head = K_heads + h * seq_len * d_k;
        float *V_head = V_heads + h * seq_len * d_k;
        float *output_head = attention_outputs + h * seq_len * d_k;
        
        scaled_dot_product_attention(Q_head, K_head, V_head, 
                                   output_head, seq_len, d_k);
    }
    
    // 合并多头输出
    float *concatenated = concatenate_heads(attention_outputs, 
                                           seq_len, d_model, mha->n_heads);
    
    // 最终线性变换
    linear_transform(concatenated, mha->W_o, mha->b_o, output, seq_len, d_model);
    
    // 清理内存
    free(Q); free(K); free(V);
    free(Q_heads); free(K_heads); free(V_heads);
    free(attention_outputs); free(concatenated);
}

// 前馈网络前向传播
void feed_forward_forward(feed_forward_t *ff, float *input, 
                         float *output, int seq_len) {
    // 第一层线性变换
    float *hidden = malloc(seq_len * ff->d_ff * sizeof(float));
    linear_transform(input, ff->W1, ff->b1, hidden, seq_len, ff->d_ff);
    
    // ReLU激活
    relu_activation(hidden, seq_len * ff->d_ff);
    
    // 第二层线性变换
    linear_transform(hidden, ff->W2, ff->b2, output, seq_len, ff->d_model);
    
    free(hidden);
}

// 层归一化
void layer_norm_forward(layer_norm_t *ln, float *input, 
                       float *output, int seq_len, int d_model) {
    for (int i = 0; i < seq_len; i++) {
        float *seq = input + i * d_model;
        float *out_seq = output + i * d_model;
        
        // 计算均值
        float mean = 0;
        for (int j = 0; j < d_model; j++) {
            mean += seq[j];
        }
        mean /= d_model;
        
        // 计算方差
        float var = 0;
        for (int j = 0; j < d_model; j++) {
            var += (seq[j] - mean) * (seq[j] - mean);
        }
        var /= d_model;
        
        // 归一化
        for (int j = 0; j < d_model; j++) {
            out_seq[j] = (seq[j] - mean) / sqrt(var + ln->epsilon);
            out_seq[j] = out_seq[j] * ln->weight[j] + ln->bias[j];
        }
    }
}

// 交叉熵损失
float cross_entropy_loss(float *predictions, int *labels, 
                        int batch_size, int num_classes) {
    float loss = 0;
    for (int i = 0; i < batch_size; i++) {
        float max_val = predictions[i * num_classes];
        for (int j = 1; j < num_classes; j++) {
            if (predictions[i * num_classes + j] > max_val) {
                max_val = predictions[i * num_classes + j];
            }
        }
        
        float sum_exp = 0;
        for (int j = 0; j < num_classes; j++) {
            sum_exp += exp(predictions[i * num_classes + j] - max_val);
        }
        
        float log_prob = predictions[i * num_classes + labels[i]] - max_val - log(sum_exp);
        loss -= log_prob;
    }
    return loss / batch_size;
}

// 焦点损失（处理类别不平衡）
float focal_loss(float *predictions, int *labels, 
                int batch_size, int num_classes, float alpha, float gamma) {
    float loss = 0;
    for (int i = 0; i < batch_size; i++) {
        float p_t = predictions[i * num_classes + labels[i]];
        float alpha_t = (labels[i] == 1) ? alpha : (1 - alpha);
        loss -= alpha_t * pow(1 - p_t, gamma) * log(p_t);
    }
    return loss / batch_size;
}

// Adam优化器
typedef struct adam_optimizer {
    float learning_rate;
    float beta1;
    float beta2;
    float epsilon;
    float *m;              // 一阶矩估计
    float *v;              // 二阶矩估计
    int t;                 // 时间步
} adam_optimizer_t;

void adam_update(adam_optimizer_t *adam, float *params, float *gradients, 
                int param_size) {
    adam->t++;
    
    for (int i = 0; i < param_size; i++) {
        // 更新一阶矩估计
        adam->m[i] = adam->beta1 * adam->m[i] + (1 - adam->beta1) * gradients[i];
        
        // 更新二阶矩估计
        adam->v[i] = adam->beta2 * adam->v[i] + 
                     (1 - adam->beta2) * gradients[i] * gradients[i];
        
        // 偏差修正
        float m_hat = adam->m[i] / (1 - pow(adam->beta1, adam->t));
        float v_hat = adam->v[i] / (1 - pow(adam->beta2, adam->t));
        
        // 参数更新
        params[i] -= adam->learning_rate * m_hat / (sqrt(v_hat) + adam->epsilon);
    }
}

// 在线学习管理器
typedef struct online_learning_manager {
    float *buffer;         // 样本缓冲区
    int *labels;           // 标签缓冲区
    int buffer_size;       // 缓冲区大小
    int current_pos;       // 当前位置
    int buffer_count;      // 缓冲区中的样本数
    float learning_rate;   // 学习率
    int update_frequency;  // 更新频率
    int update_counter;    // 更新计数器
} online_learning_manager_t;

// 添加新样本
void add_sample(online_learning_manager_t *olm, float *features, int label) {
    // 添加到缓冲区
    memcpy(olm->buffer + olm->current_pos * FEATURE_DIM, 
           features, FEATURE_DIM * sizeof(float));
    olm->labels[olm->current_pos] = label;
    
    olm->current_pos = (olm->current_pos + 1) % olm->buffer_size;
    if (olm->buffer_count < olm->buffer_size) {
        olm->buffer_count++;
    }
    
    olm->update_counter++;
    
    // 达到更新频率时进行在线更新
    if (olm->update_counter >= olm->update_frequency) {
        online_update_model(olm);
        olm->update_counter = 0;
    }
}

// 在线模型更新
void online_update_model(online_learning_manager_t *olm) {
    // 使用缓冲区中的样本进行小批量更新
    int batch_size = min(olm->buffer_count, 32);
    
    for (int i = 0; i < batch_size; i++) {
        int idx = (olm->current_pos - batch_size + i + olm->buffer_size) % olm->buffer_size;
        float *features = olm->buffer + idx * FEATURE_DIM;
        int label = olm->labels[idx];
        
        // 前向传播
        float *prediction = forward_pass(features);
        
        // 计算梯度
        float *gradients = compute_gradients(prediction, label);
        
        // 更新模型参数
        update_model_parameters(gradients, olm->learning_rate);
        
        free(prediction);
        free(gradients);
    }
}

// 量化配置
typedef struct quantization_config {
    int bits;              // 量化位数 (8/16)
    float scale;           // 缩放因子
    int zero_point;        // 零点
    float min_val;         // 最小值
    float max_val;         // 最大值
} quantization_config_t;

// 量化权重
void quantize_weights(float *float_weights, int8_t *quantized_weights,
                     int size, quantization_config_t *config) {
    // 计算量化参数
    float range = config->max_val - config->min_val;
    config->scale = range / (pow(2, config->bits) - 1);
    config->zero_point = -round(config->min_val / config->scale);
    
    // 量化
    for (int i = 0; i < size; i++) {
        int quantized = round(float_weights[i] / config->scale) + config->zero_point;
        quantized = max(0, min(pow(2, config->bits) - 1, quantized));
        quantized_weights[i] = (int8_t)quantized;
    }
}

// 反量化
void dequantize_weights(int8_t *quantized_weights, float *float_weights,
                       int size, quantization_config_t *config) {
    for (int i = 0; i < size; i++) {
        float_weights[i] = (quantized_weights[i] - config->zero_point) * config->scale;
    }
}

// 注意力缓存
typedef struct attention_cache {
    float *key_cache;      // Key缓存
    float *value_cache;    // Value缓存
    int cache_size;        // 缓存大小
    int current_pos;       // 当前位置
} attention_cache_t;

// 缓存注意力计算
void cached_attention(multi_head_attention_t *mha, float *input,
                     attention_cache_t *cache, float *output,
                     int seq_len, int d_model) {
    // 计算当前输入的Key和Value
    float *current_key = malloc(seq_len * d_model * sizeof(float));
    float *current_value = malloc(seq_len * d_model * sizeof(float));
    
    linear_transform(input, mha->W_k, mha->b_k, current_key, seq_len, d_model);
    linear_transform(input, mha->W_v, mha->b_v, current_value, seq_len, d_model);
    
    // 更新缓存
    memcpy(cache->key_cache + cache->current_pos * seq_len * d_model,
           current_key, seq_len * d_model * sizeof(float));
    memcpy(cache->value_cache + cache->current_pos * seq_len * d_model,
           current_value, seq_len * d_model * sizeof(float));
    
    cache->current_pos = (cache->current_pos + 1) % cache->cache_size;
    
    // 使用缓存进行注意力计算
    // ... 注意力计算逻辑
    
    free(current_key);
    free(current_value);
}

// 集成接口
typedef struct transformer_waf_integration {
    transformer_model_t *model;        // Transformer模型
    http_request_feature_t *features;  // 特征提取器
    float threshold;                   // 检测阈值
    int action;                        // 执行动作
} transformer_waf_integration_t;

// 检测函数
int transformer_detect_anomaly(http_waf_msg *req) {
    // 1. 特征提取
    http_request_feature_t *features = extract_http_features(req);
    
    // 2. 特征预处理
    float *processed_features = preprocess_features(features);
    
    // 3. Transformer推理
    float *prediction = transformer_forward(model, processed_features);
    
    // 4. 异常评分
    float anomaly_score = compute_anomaly_score(prediction);
    
    // 5. 决策
    if (anomaly_score > threshold) {
        req->rule_id = TRANSFORMER_RULE_ID;
        req->severity = SEVERITY_CRITICAL;
        req->action = ACTION_DROP;
        return 1; // 异常
    }
    
    return 0; // 正常
}

// 性能指标
typedef struct performance_metrics {
    // 检测性能
    int total_requests;        // 总请求数
    int detected_anomalies;    // 检测到的异常数
    int false_positives;       // 误报数
    int false_negatives;       // 漏报数
    
    // 时间性能
    double avg_inference_time; // 平均推理时间
    double max_inference_time; // 最大推理时间
    double min_inference_time; // 最小推理时间
    
    // 资源使用
    double memory_usage;       // 内存使用
    double cpu_usage;          // CPU使用率
} performance_metrics_t;

// 性能监控
void update_performance_metrics(performance_metrics_t *metrics,
                              int is_anomaly, int is_correct,
                              double inference_time) {
    metrics->total_requests++;
    
    if (is_anomaly) {
        metrics->detected_anomalies++;
        if (!is_correct) {
            metrics->false_positives++;
        }
    } else {
        if (!is_correct) {
            metrics->false_negatives++;
        }
    }
    
    // 更新时间统计
    metrics->avg_inference_time = 
        (metrics->avg_inference_time * (metrics->total_requests - 1) + inference_time) 
        / metrics->total_requests;
    
    if (inference_time > metrics->max_inference_time) {
        metrics->max_inference_time = inference_time;
    }
    
    if (inference_time < metrics->min_inference_time || metrics->min_inference_time == 0) {
        metrics->min_inference_time = inference_time;
    }
}

// 测试数据集结构
typedef struct test_dataset {
    http_request_feature_t *requests;  // 请求特征
    int *labels;                      // 真实标签
    int dataset_size;                 // 数据集大小
    float train_ratio;                // 训练集比例
    float val_ratio;                  // 验证集比例
    float test_ratio;                 // 测试集比例
} test_dataset_t;

// 数据集分割
void split_dataset(test_dataset_t *dataset, 
                  test_dataset_t *train_set,
                  test_dataset_t *val_set,
                  test_dataset_t *test_set) {
    int train_size = dataset->dataset_size * dataset->train_ratio;
    int val_size = dataset->dataset_size * dataset->val_ratio;
    int test_size = dataset->dataset_size * dataset->test_ratio;
    
    // 随机分割数据集
    // ... 实现细节
}

// 评估指标计算
typedef struct evaluation_metrics {
    float accuracy;           // 准确率
    float precision;          // 精确率
    float recall;             // 召回率
    float f1_score;           // F1分数
    float auc;               // AUC
    float mcc;               // Matthews相关系数
} evaluation_metrics_t;

// 计算评估指标
evaluation_metrics_t calculate_metrics(int *predictions, int *labels, int size) {
    evaluation_metrics_t metrics;
    
    int tp = 0, fp = 0, tn = 0, fn = 0;
    for (int i = 0; i < size; i++) {
        if (predictions[i] == 1 && labels[i] == 1) tp++;
        else if (predictions[i] == 1 && labels[i] == 0) fp++;
        else if (predictions[i] == 0 && labels[i] == 0) tn++;
        else if (predictions[i] == 0 && labels[i] == 1) fn++;
    }
    
    metrics.accuracy = (float)(tp + tn) / (tp + tn + fp + fn);
    metrics.precision = (float)tp / (tp + fp);
    metrics.recall = (float)tp / (tp + fn);
    metrics.f1_score = 2 * metrics.precision * metrics.recall / 
                      (metrics.precision + metrics.recall);
    metrics.mcc = (float)(tp * tn - fp * fn) / 
                  sqrt((tp + fp) * (tp + fn) * (tn + fp) * (tn + fn));
    
    return metrics;
}

# Makefile配置
CC = gcc
CFLAGS = -O3 -march=native -mtune=native -fopenmp
LDFLAGS = -lm -lpthread

# 源文件
TRANSFORMER_SOURCES = transformer.c \
                      attention.c \
                      feed_forward.c \
                      layer_norm.c \
                      position_encoding.c \
                      feature_extraction.c \
                      training.c \
                      inference.c

# 目标文件
TRANSFORMER_OBJECTS = $(TRANSFORMER_SOURCES:.c=.o)

# 编译规则
transformer_waf: $(TRANSFORMER_OBJECTS)
	$(CC) $(CFLAGS) -o $@ $^ $(LDFLAGS)

%.o: %.c
	$(CC) $(CFLAGS) -c $< -o $@

{
    "transformer_config": {
        "d_model": 512,
        "n_heads": 8,
        "n_layers": 6,
        "d_ff": 2048,
        "max_seq_len": 1024,
        "dropout": 0.1,
        "vocab_size": 50000,
        "num_classes": 2
    },
    "training_config": {
        "learning_rate": 0.0001,
        "batch_size": 32,
        "epochs": 100,
        "warmup_steps": 4000,
        "weight_decay": 0.01
    },
    "inference_config": {
        "threshold": 0.5,
        "quantization": true,
        "cache_attention": true,
        "max_batch_size": 64
    },
    "feature_config": {
        "use_statistical_features": true,
        "use_semantic_features": true,
        "use_structural_features": true,
        "word2vec_dim": 100,
        "max_param_length": 1024
    }
}