A graph-based interactive feature extraction method for encrypted Internet traffic

Abstract

The invention discloses a graph structure-based Internet encryption flow interaction feature extraction method, which belongs to the technical field of encryption network flow classification and is applied to fine-grained classification of network flow after TLS encryption. The invention extracts the encrypted traffic interaction feature based on graph structure from the original packet sequence, and the graph structure feature includes sequence information of data packets, packet direction information, packet length information, burst flow information and the like. Through quantitative calculation, compared with the packet length sequence, after using the graph structure feature, the intra-class distance is significantly smaller and the inter-class distance is larger. This method can obtain encrypted traffic features with richer dimensions and higher discrimination, and then combine with deep neural networks such as graph neural networks to carry out refined classification and identification of encrypted traffic. Through a large number of experimental data experiments, it is proved that the use of graph structure features combined with graph neural network has higher accuracy and lower false alarm rate than existing methods.

Description

technical field [0001] The invention relates to a method for extracting interactive features of Internet encrypted traffic, in particular to a method for extracting interactive features of Internet encrypted traffic based on a graph structure, which provides a feature with richer dimensions and higher discrimination for deep neural networks such as graph neural networks, and belongs to Encrypted network traffic classification technology field. Background technique [0002] Traffic classification can assist network operators in load balancing and routing planning, bringing better user experience to users. However, with the dramatic increase in the usage of encryption protocols such as SSL / TLS, traditional classification methods, such as deep packet inspection, fail due to the fact that the payload information is encrypted. In order to be able to classify encrypted network traffic, related research has begun to extract available information from encrypted network data packets...

AI Technical Summary

Problems solved by technology

In the work related to statistical features, there are literatures that calculate 54 statistical features for uplink, downlink, and bidirectional data packet lengths, such as the average length of uplink data packets. However, such feature calculation methods require a large number of packets and feature calculation time complexity. High, but also requires a complex feature selection process

In related work on sequence features, there are literatures that use packet length sequences as feature inputs for deep learning methods such as convolutional neural networks. However, most of the data packets in the network are transmitted with a fixed maximum length, making the packet length sequence The timing information of the discriminative reduction

[0004] To sum up, the features currently suitable for network encrypted traffic classification have problems such as high computational complexity or low discrimination.

Images