A feature extraction method for encrypted traffic based on feature fusion

Abstract

The invention relates to an encrypted traffic feature extraction method based on feature fusion, and belongs to the technical field of machine learning, network service security and traffic identification. The method comprises the following steps: step 1, extracting characteristic values of different dimensions of an encrypted data packet in an encrypted stream; step 2, calculating and normalizinga feature contribution degree, performing feature selection based on the feature contribution degree, selecting an optimal feature number n participating in fusion, and selecting the first n featuresas optimal feature quantities participating in fusion; and step 3, classifying features of different dimensions based on the optimal fusion feature number n, carrying out dimension raising and fusionon the optimal features selected in the step 2 by using a kernel function, and outputting a final feature set participating in classification. According to the method, the encrypted network traffic fingerprint can be better depicted; the relation between different characteristics can be represented; the number of features participating in fusion can be rapidly determined, and the feature fusion efficiency is improved; higher accuracy is realized.

Description

technical field [0001] The present invention relates to a method for extracting encrypted traffic features based on feature fusion, in particular to dimensionally increasing and merging traffic features of different dimensions, aiming to provide high-dimensional and reliable features for identifying encrypted traffic, belonging to machine learning, network service security and Flow identification technology field. Background technique [0002] Traffic is the carrier of network information transmission. In order to protect user privacy, existing network transmission protocols use encryption to transmit data. By analyzing and identifying encrypted network traffic, it can provide a theoretical basis for network service providers to better formulate routing strategies, improve the efficiency of data distribution at key transmission nodes, and further improve the user experience of network users. The existing encrypted traffic identification methods rely on single-dimensional n...

AI Technical Summary

Problems solved by technology

As the number and types of traffic to be classified increase, the performance of this classification method in terms of classification accuracy is greatly reduced

[0007] To sum up, in the existing field of encrypted traffic classification, encrypted traffic classification methods rely on single-dimensional features to construct encrypted application fingerprints. As the number of applications increases with single-dimensional features, encrypted application fingerprints constructed by single-dimensional features are difficult to provide sufficient The distinguishing information of the encrypted application will lead to a decrease in the classification accuracy of the encrypted application

Images