Service and application classification method and system for encrypted traffic

Abstract

The invention discloses a service and application classification method and system for encrypted traffic. The method comprises the following steps: 1) segmenting continuous traffic to be processed into a plurality of session traffic according to session granularity; 2) segmenting the processed session traffic according to the granularity of the data packets, segmenting each session traffic into aplurality of traffic groups, wherein the number of the data packets in each traffic group does not exceed a set maximum value; 3) unifying the size of each traffic group, converting each traffic groupinto a traffic matrix, and packaging the traffic matrix and the label thereof into an IDX traffic file; 4) training a CapsNet model by using the IDX traffic file to obtain an identification model with an automatic feature selection capability; and 5) dividing an encrypted traffic to be identified, converting the encrypted traffic to be identified into a traffic matrix, and inputting the traffic matrix into the identification model to obtain a service type and an application type to which the traffic to be identified belongs. According to the method and system, the encrypted traffic can be effectively classified.

Description

technical field [0001] The present invention proposes a service and application classification method for encrypted traffic. It proposes a new type of traffic secondary segmentation mechanism. At the same time, it combines the capsule neural network (CapsNet) to realize the effective classification of encrypted traffic. The present invention covers the original traffic. Conversion, CapsNet-based model training, and classification of encrypted traffic belong to the cross-technical field of network security and computer science. Background technique [0002] In recent years, with the continuous development of Internet technology and information science and technology, network traffic has shown explosive growth. According to the Visual Network Index Forecast Report released by Cisco, IP traffic data transmitted on public and private networks, including hosted IP traffic, consumer-generated mobile data traffic, and Internet traffic, generated an average of 122 EB per month globa...

AI Technical Summary

Problems solved by technology

In addition, in the identification task of encrypted traffic, these encoded files are not equivalent to image files, and they are no longer suitable for CNN's pooling operation

Images