Network encryption traffic classification method and system based on three-layer model SFTF-L

Abstract

The invention discloses a network encryption traffic classification method and system based on a three-layer model SFTF-L. The method comprises the following steps: collecting a network encryption traffic data set with a marked type; the method comprises the following steps of: segmenting an encrypted traffic file through traffic segmentation, converging same sessions into a data stream, then carrying out traffic cleaning to remove useless information in the data stream, and selecting first three data packets of each data stream to carry out feature learning; for each data stream, converting the byte stream information of the data packet into a grayscale image, calculating the arrival time interval among the three data packets, and inserting a time sequence feature map among the images corresponding to the data packets according to the arrival time interval; and designing the structure of a three-layer model SFTF-L, carrying out model training by using an image corresponding to the training data set, learning spatial features and time sequence features of the encrypted traffic, and constructing a network encrypted traffic classification model. According to the method, the learning ability of important spatial features is improved, and the classification accuracy of encrypted traffic with obvious time sequence features is improved.

Description

technical field [0001] The invention relates to the field of network security, in particular to a network encryption traffic classification method and system based on a three-layer model SFTF-L (Spatial Features and Temporal Features Learning). Background technique [0002] Network traffic classification is an important technical means to collect and analyze network traffic to accurately obtain the type of network traffic information. It can help network managers to effectively carry out network planning, network optimization, network monitoring, and traffic trend analysis. [0003] With the development and maturity of network technology, the applications and services carried on the network have grown from the initial web pages, emails and instant messaging to various communities, online games, P2P file sharing, etc. . At the same time, the public's network security awareness is also steadily increasing, and the awareness of data protection is also becoming stronger. Accor...

AI Technical Summary

Problems solved by technology

[0005] Although the current traffic classification methods have made a lot of research progress, most of these achievements are for the classification of non-encrypted traffic, and the current encrypted traffic classification research is facing new challenges

Images