Anonymous network traffic identification method and device based on traffic reconstruction and inheritance learning

Abstract

The invention discloses an anonymous network traffic identification method and device based on traffic reconstruction and inheritance learning, and the method comprises the steps: collecting original network traffic, carrying out the preliminary screening of the traffic, and removing non-Tor traffic; reconstructing the flow after preliminary screening, and converting the flow into a gray feature map; utilizing a convolutional neural network and a recurrent neural network model to process the feature map after flow reconstruction, extracting an interaction information feature vector, a packet space feature vector and a flow time sequence feature vector, and fusing the three feature vectors; inputting the fusion features into a multi-classifier for application classification, wherein the multi-classifier updates classifier parameters through an inheritance learning mechanism when detecting a new traffic category; and determining the attribution application of the traffic based on a majority principle. According to the method, the feature design process is simplified, the comprehensiveness of features is enriched, the requirement for online updating of model parameters is met, the model keeps memory for past training, and only small-scale training needs to be carried out when a new category is added every time.

Description

technical field [0001] The invention relates to network traffic identification and network application classification, in particular to an anonymous network traffic identification method and device based on traffic reconstruction and inheritance learning. Background technique [0002] With the continuous development of the Internet, the types of network traffic are becoming more and more complex, and different types of applications are constantly emerging. Applications generate a large amount of network traffic, and different types of traffic exhibit different characteristics. The goal of traffic classification is to identify traffic types according to the distinguishing characteristics of traffic. Network traffic classification is essential for network operators. The reasons include the following two aspects. On the one hand, from the perspective of user service quality, traffic classification is the first step to ensure service quality, and it is the premise to provide di...

AI Technical Summary

Problems solved by technology

However, the traffic classification method based on machine learning requires expert experience to extract and screen traffic features, which consumes time and energy, and the features are not comprehensive enough. The representativeness of the features is very high, and the classification accuracy is not high enough.

The model based on deep learning is currently a research hotspot, and the end-to-end model is favored by researchers. However, in actual deployment, the model needs to be retrained when encountering new traffic recognition scenarios, which takes a lot of time. This is currently the case in anonymous network traffic. Difficulties Encountered in App Classification

Images