Network traffic classification method and device, equipment, storage medium and product

Abstract

The invention discloses a network traffic classification method and device, equipment, a storage medium and a product, relates to the technical field of artificial intelligence, and discloses a network traffic classification method comprising the following steps: obtaining a network traffic data packet collected by a network shunt; the network flow data packet is pre-processed, real network flow data samples are obtained, and the real network flow data samples comprise marked flow data samples and unmarked flow data samples; generating analog traffic data samples through a generator, and inputting the analog traffic data samples, the marked traffic data samples and the unmarked traffic data samples into a discriminator to obtain the probability that each traffic data sample belongs to each traffic type; and inputting the probability that each traffic data sample belongs to each traffic type into a classifier to obtain the traffic type corresponding to each traffic data sample, thereby improving the network traffic classification efficiency.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to network traffic classification methods, devices, equipment, storage media and products. Background Art

[0002] Currently, operators need to effectively manage their network traffic data to optimize service quality, improve user experience and satisfaction, and strengthen security monitoring and risk prevention. The basis for managing network traffic data is the classification of network traffic data.

[0003] In related technologies, machine learning or deep learning algorithm models are used to classify network traffic data, where the algorithm models used include logistic regression, decision tree, and random forest models.

[0004] However, the above algorithm needs to be trained separately using corresponding labeled data for different traffic types. Therefore, it is necessary to obtain a large number of labeled network traffic data sets of different traffic types. The process of obtaining labeled network traffic data sets is cumbersome and time-consuming, resulting in reduced efficiency in network traffic data classification. Summary of the invention

[0005] The main purpose of this application is to provide a network traffic classification method, device, equipment, storage medium and product, aiming to improve the efficiency of network traffic classification.

[0006] To achieve the above objectives, the present application proposes a network traffic classification method, the method comprising:

[0007] Obtain network traffic data packets collected by the network splitter;

[0008] Preprocessing the network traffic data packets to obtain real network traffic data samples, wherein the real network traffic data samples include marked traffic data samples and unmarked traffic data samples;

[0009] Generate simulated traffic data samples by means of a generator, input the simulated traffic data samples, the labeled traffic data samples and the unlabeled traffic data samples into a discriminator, and obtain the probability that each of the traffic data samples belongs to each traffic type;

[0010] The probability that each of the traffic data samples belongs to each traffic type is input into a classifier to obtain the traffic type corresponding to each of the traffic data samples.

[0011] In one embodiment, the generator includes a first fully connected layer, a deconvolution layer and a first convolution layer, and generating a simulated traffic data sample by the generator includes:

[0012] Inputting random noise into the first fully connected layer, and converting the random noise into a three-dimensional tensor through dimensionality transformation;

[0013] Performing a deconvolution operation on the three-dimensional tensor through the deconvolution layer, and using a LeakyReLU activation function to activate the deconvolution operation result;

[0014] The activation processing result is convolved by the first convolution layer, and the convolution operation result is activated by using the Tanh activation function to obtain the simulated traffic data sample.

[0015] In one embodiment, the discriminator includes a plurality of second convolutional layers and a plurality of second fully connected layers, and the simulated traffic data sample, the labeled traffic data sample, and the unlabeled traffic data sample are input into the discriminator to obtain the probability that each of the traffic data samples belongs to each traffic type, including:

[0016] Converting the labeled flow data sample and the unlabeled flow data sample into a three-dimensional tensor through dimensionality transformation;

[0017] The three-dimensional tensor is sequentially passed through each of the second convolutional layers to perform a convolution operation, and a LeakyReLU activation function is used to perform activation processing on each convolution operation;

[0018] The activation processing results are processed in sequence by each of the second fully connected layers, and activation processing is performed by a Lambda activation function;

[0019] The activation processing result of the Lambda activation function is normalized using a softmax activation function to obtain the probability that each of the traffic data samples belongs to each traffic type.

[0020] In one embodiment, before the step of generating a simulated traffic data sample by a generator, inputting the simulated traffic data sample, the labeled traffic data sample and the unlabeled traffic data sample into a discriminator, and obtaining the probability that each of the traffic data samples belongs to each traffic type, the step further includes:

[0021] Iteratively updating the network parameters of the discriminator and the generator respectively;

[0022] During the iterative update process, when it is detected that the loss value of the loss function corresponding to the discriminator is within a preset fluctuation range, the iterative update of the network parameters of the discriminator and the generator is stopped, and the iteratively updated generator and discriminator are output.

[0023] In one embodiment, the step of iteratively updating the network parameters of the discriminator and the generator respectively comprises:

[0024] Back-propagating the network parameters of the discriminator using the loss function, calculating the gradient of the network parameters of the discriminator, and updating the network parameters of the discriminator using the Adam gradient descent method, wherein the network parameters of the discriminator include: weight parameters and bias parameters of each convolutional layer of the discriminator, and weight parameters and bias parameters of each neuron of each fully connected layer of the discriminator;

[0025] And, fixing the network parameters of the discriminator, performing feature matching on real network traffic data samples and simulated traffic data samples, and using the feature matching results to adjust the network parameters of the generator, wherein the network parameters of the generator include: weight parameters and bias parameters of the convolutional layer of the generator, and weight parameters and bias parameters of each neuron of the fully connected layer of the generator.

[0026] In one embodiment, the step of preprocessing the network traffic data packet to obtain a real network traffic data sample includes:

[0027] Performing in-depth analysis on the network traffic data packets to obtain data packet analysis results;

[0028] Filtering the data packet analysis result to obtain a filtered data packet analysis result;

[0029] Obtaining data within a set time period from the filtered data packet analysis results;

[0030] Performing data type conversion on the data within the set time period, and performing deletion processing or zero value filling processing on the data after the data type conversion to obtain processed data;

[0031] The processed data is normalized, and the normalized data is label-encoded based on the traffic type to obtain the real network traffic data sample, wherein the labeled traffic data sample and the unlabeled traffic data sample have different corresponding labels.

[0032] In addition, to achieve the above purpose, the present application also proposes a network traffic classification device, the network traffic classification device comprising:

[0033] An acquisition module, used to acquire network traffic data packets collected by a network splitter;

[0034] A preprocessing module, used for preprocessing the network traffic data packets to obtain real network traffic data samples, wherein the real network traffic data samples include marked traffic data samples and unmarked traffic data samples;

[0035] A generation and identification module, used to generate simulated traffic data samples through a generator, input the simulated traffic data samples, the marked traffic data samples and the unmarked traffic data samples into a discriminator, and obtain the probability that each of the traffic data samples belongs to each traffic type;

[0036] The classification module is used to input the probability that each of the traffic data samples belongs to each traffic type into a classifier to obtain the traffic type corresponding to each of the traffic data samples.

[0037] In addition, to achieve the above-mentioned purpose, the present application also proposes a network traffic classification device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the network traffic classification method described above.

[0038] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the network traffic classification method described above are implemented.

[0039] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the network traffic classification method described above are implemented.

[0040] The present application generates simulated traffic data samples through a generator, inputs the simulated traffic data samples, the labeled traffic data samples and the unlabeled traffic data samples into a discriminator, and obtains the probability that each of the traffic data samples belongs to each traffic type; the probability that each of the traffic data samples belongs to each traffic type is input into a classifier, and the traffic type corresponding to each of the traffic data samples is obtained. By using a semi-supervised traffic classification model to generate network traffic data samples, only a small number of labeled traffic data samples and a large number of unlabeled traffic data samples are used to achieve good traffic classification performance, overcome the shortcomings of labeled traffic data samples, and there is no need to train different traffic types separately. By adding a classifier, automatic classification of network traffic can be achieved, which improves the efficiency of traffic classification. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0042] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0043] Figure 1 A flowchart of the first embodiment of the network traffic classification method of the present application is provided;

[0044] Figure 2 A flowchart of the second embodiment of the network traffic classification method of the present application is provided;

[0045] Figure 3 This is a schematic diagram of the network structure of the generator for this application;

[0046] Figure 4 Another flowchart provided for the second embodiment of the network traffic classification method of the present application;

[0047] Figure 5 This is a schematic diagram of the network structure of the identifier of this application;

[0048] Figure 6 A flowchart of the third embodiment of the network traffic classification method of the present application is provided;

[0049] Figure 7 A flowchart of the fourth embodiment of the network traffic classification method of the present application is provided;

[0050] Figure 8 This is a schematic diagram of the module structure of the network traffic classification device according to an embodiment of the present application;

[0051] Fig. 9 This is a schematic diagram of the structure of the network traffic classification device according to an embodiment of the present application.

[0052] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0053] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0054] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0055] In the related art, machine learning or deep learning algorithm models are used to classify network traffic data, wherein the algorithm models used include logistic regression, decision tree, and random forest models. However, the above algorithms need to be trained separately with corresponding labeled data for different traffic types. Therefore, a large number of labeled network traffic data sets of different traffic types need to be obtained. The process of obtaining labeled network traffic data sets is cumbersome and time-consuming, resulting in reduced efficiency in network traffic data classification.

[0056] In response to the above problems, the present application proposes a network traffic classification method, and the main technical solutions include: obtaining network traffic data packets collected by a network splitter; preprocessing the network traffic data packets to obtain real network traffic data samples, wherein the real network traffic data samples include marked traffic data samples and unmarked traffic data samples; generating simulated traffic data samples through a generator, inputting the simulated traffic data samples, the marked traffic data samples and the unmarked traffic data samples into a discriminator, and obtaining the probability that each of the traffic data samples belongs to each traffic type; inputting the probability that each of the traffic data samples belongs to each traffic type into a classifier, and obtaining the traffic type corresponding to each of the traffic data samples.

[0057] The present application generates simulated traffic data samples through a generator, inputs the simulated traffic data samples, the labeled traffic data samples and the unlabeled traffic data samples into a discriminator, and obtains the probability that each of the traffic data samples belongs to each traffic type; the probability that each of the traffic data samples belongs to each traffic type is input into a classifier, and the traffic type corresponding to each of the traffic data samples is obtained. By using a semi-supervised traffic classification model to generate network traffic data samples, only a small number of labeled traffic data samples and a large number of unlabeled traffic data samples are used to achieve good traffic classification performance, overcome the shortcomings of labeled traffic data samples, and there is no need to train different traffic types separately. By adding a classifier, automatic classification of network traffic can be achieved, which improves the efficiency of traffic classification.

[0058] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, a network traffic classification device, etc. The following takes the network traffic classification device as an example to illustrate this embodiment and the following embodiments.

[0059] It should be noted that network traffic classification can achieve the following purposes:

[0060] To improve the quality of network services, classification can dynamically allocate network resources according to the characteristics and needs of different types of traffic to avoid network congestion, thereby improving the overall quality of network services. In addition, Internet service providers can provide targeted optimization and services based on the identified network application types to meet the needs of different users and improve user experience.

[0061] To ensure network security, network traffic classification technology can identify abnormal and unknown traffic in the network, handle it in a timely manner, prevent network attacks and virus propagation, and ensure a safe network environment. In addition, as the core technology of intrusion detection systems, network traffic classification plays a vital role in maintaining network security.

[0062] In order to optimize network management, by classifying and analyzing network traffic, operators can timely understand the development of network applications, rationally plan the network architecture, and prepare for network expansion and upgrade. In addition, network traffic classification is an important basis for formulating and implementing network billing policies, which helps to achieve a fair and reasonable billing mechanism.

[0063] In order to enhance the value of network research, network traffic classification can reflect the use of network resources by users and provide valuable data support for network researchers. It can also guide network traffic congestion control and routing selection mechanisms through analysis of traffic classification results, and improve the stability and fairness of network operation.

[0064] In addition, network traffic classification can also monitor and supervise network resources to prevent infringements. Dynamic bandwidth allocation can be performed based on the classification results to maximize network bandwidth utilization while ensuring service quality.

[0065] Therefore, network traffic classification is an important way to improve network service quality, ensure network security, optimize network management, enhance the value of network research, and realize other practical applications. With the continuous development of network technology, the importance and necessity of network traffic classification will become increasingly prominent.

[0066] Based on this, the present application embodiment provides a network traffic classification method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the network traffic classification method of the present application.

[0067] In this embodiment, the network traffic classification method includes steps S10 to S40:

[0068] Step S10, obtaining network traffic data packets collected by the network splitter;

[0069] Data collection is achieved through network taps. Network taps are deployed at key nodes of the network, such as the egress of switches or routers. When network traffic packets flow through these nodes, the network taps capture and copy these network traffic packets in real time. The copied network traffic packets are then sent to the connected network traffic classification device, so that the network traffic classification device can obtain the network traffic packets collected by the network tap.

[0070] Step S20, preprocessing the network traffic data packets to obtain real network traffic data samples, wherein the real network traffic data samples include marked traffic data samples and unmarked traffic data samples;

[0071] Preprocessing includes but is not limited to: filtering redundant fields, truncating data, converting string data with fewer values ​​into numeric data using one-hot encoding, normalizing, label encoding application types, etc.

[0072] Preprocessing network traffic data packets can uniformly clean and preprocess a small amount of labeled data and a large amount of unlabeled data, and then input the preprocessed data into the subsequent model, effectively realizing the preprocessing of multiple traffic samples, improving the efficiency of traffic classification, and improving the accuracy of subsequent traffic classification.

[0073] Step S30, generating simulated traffic data samples through a generator, inputting the simulated traffic data samples, the labeled traffic data samples and the unlabeled traffic data samples into a discriminator, and obtaining the probability that each of the traffic data samples belongs to each traffic type;

[0074] Step S40: input the probability that each of the traffic data samples belongs to each traffic type into a classifier to obtain the traffic type corresponding to each of the traffic data samples.

[0075] Considering that the related technology uses machine learning or deep learning algorithm models to classify network traffic data, it is necessary to use corresponding labeled data for different traffic types for separate training. Therefore, it is necessary to obtain a large number of labeled network traffic data sets of different traffic types. The process of obtaining labeled network traffic data sets is relatively cumbersome and time-consuming, resulting in reduced efficiency in network traffic data classification. Therefore, the present application adopts a semi-supervised traffic classification model, and inputs labeled traffic data samples and unlabeled traffic data samples into the semi-supervised traffic classification model. The generator and discriminator of the semi-supervised traffic classification model are alternately trained and iteratively updated multiple times to obtain the probability that each traffic data sample belongs to each traffic type. Finally, the probability that each traffic data sample belongs to each traffic type is input into the classifier, and the traffic type corresponding to each traffic data sample is output.

[0076] The semi-supervised traffic classification model consists of two parts: the generator and the discriminator. The main task of the generator is to generate samples similar to simulated traffic data to expand the labeled samples and improve the generalization ability of the model. The main task of the discriminator is to determine whether the input data is a real network traffic data sample or a simulated traffic data sample generated by the generator. During the training of the generator, the discrimination result of the discriminator will be passed to the generator as a feedback signal, with the goal of maximizing the probability that the discriminator misjudges the simulated data as a real sample, and adjusting the network parameters of the generator. During the training of the discriminator, both the simulated traffic data samples and the real network traffic data samples are passed to the discriminator, and the network parameters of the discriminator network are adjusted with the goal of minimizing the loss function. During the adversarial training process, the generator and the discriminator are trained alternately, and the network parameters of the unlabeled traffic data samples and the simulated traffic data samples are updated.

[0077] After the semi-supervised traffic classification model is trained, when making predictions, the input of the semi-supervised traffic classification model is a preprocessed data sample, that is, the real network traffic data sample mentioned above, and the output is an N+1-dimensional vector. The first column indicates whether the sample is a real sample or a simulated sample, and the remaining N columns indicate the probability that the sample belongs to each traffic type.

[0078] This embodiment provides a network traffic classification method, which generates network traffic data samples by using a semi-supervised traffic classification model, and only uses a small number of labeled traffic data samples and a large number of unlabeled traffic data samples to achieve good traffic classification performance, overcome the shortcomings of labeled traffic data samples, and does not require separate training for different traffic types. By adding a classifier, automatic classification of network traffic can be achieved, thereby improving the efficiency of traffic classification.

[0079] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can refer to the above introduction, and will not be repeated later. Figure 2 The generator includes a first fully connected layer, a deconvolution layer and a first convolution layer. In step S30, generating simulated traffic data samples by the generator includes steps S31 to S33:

[0080] Step S31, inputting random noise into the first fully connected layer, and converting the random noise into a three-dimensional tensor through dimensionality transformation;

[0081] Fully connected layers, also called densely connected layers or linear layers, are usually used to process one-dimensional data (such as vectors) and transform the dimensions of these data through learned weights and biases. The random noise here can be a one-dimensional vector, and a fully connected layer can be used to transform this random noise vector. The fully connected layer will learn how to map the random noise vector to a new vector space. After obtaining the vector output by the fully connected layer, a three-dimensional tensor is obtained by reshaping or rearranging this vector.

[0082] Step S32, performing a deconvolution operation on the three-dimensional tensor through the deconvolution layer, and using a LeakyReLU activation function to activate the deconvolution operation result;

[0083] Step S33: performing a convolution operation on the activation processing result through the first convolution layer, and using a Tanh activation function to perform activation processing on the convolution operation result to obtain the simulated traffic data sample.

[0084] For example, refer to Figure 3 , Figure 3 Schematic diagram of the network structure of the generator.

[0085] The first fully connected layer contains a large number of neurons, each of which is connected to all elements of the input layer. Each neuron has 100 weight parameters, corresponding to the 100 elements of the input vector. Each neuron also has a bias parameter that is used to adjust the output of the neuron. The deconvolution layer contains multiple convolution kernels, each of which has a set of weight parameters and a bias parameter. The first convolution layer also contains multiple convolution kernels, each of which has a set of weight parameters and a bias parameter.

[0086] In the actual processing process, a 100-dimensional random noise z with a Gaussian distribution is used as the input layer and input into the first fully connected layer, and is converted into a three-dimensional tensor through dimensionality transformation. The three-dimensional tensor after dimensionality transformation is input into a convolution kernel w with a size of 4*4 and a stride of 2 for deconvolution operation, activated by the LeakyReLU activation function, and then input into a first convolution layer z with a kernel size of 7*7 and a stride of 2 for convolution operation, and then activated by the Tanh activation function to generate a 20*74*1 traffic data sample tensor, that is, to obtain a simulated traffic data sample.

[0087] Specifically, the above LeakyReLU activation function formula is as follows:

[0088]

[0089] It should be noted that x in the LeakyReLU activation function represents the data to be activated, α represents the slope, and the value of α can be set to 0.2. The LeakyReLU activation function can retain a very small slope α on the negative semi-axis. Due to the increase in slope, the output of the LeakyReLU activation function will be larger when the input is negative, so that during the back propagation process, the gradient value will also be larger, which helps to better propagate gradient information in the deep structure of the network and reduce the possibility of gradient disappearance, thereby improving the stability and convergence speed of training. Due to the increase in slope, the model can adapt to data changes more quickly during training, thereby accelerating the convergence of the model and reducing training time. Due to the increase in slope, the output of the LeakyReLU activation function in the negative value area changes faster, which makes the model more sensitive to small changes in input data, thereby improving accuracy.

[0090] It should be noted that the Tanh (Hyperbolic Tangent) activation function is a commonly used activation function, especially when processing data in the hidden layer. The Tanh activation function maps input values ​​to output values ​​between -1 and 1, which allows the data to be effectively normalized when propagating through the neural network.

[0091] In addition, refer to Figure 4 The discriminator includes a plurality of second convolutional layers and a plurality of second fully connected layers. In step S30, the simulated traffic data sample, the labeled traffic data sample and the unlabeled traffic data sample are input into the discriminator, and the probability that each of the traffic data samples belongs to each traffic type is obtained, including steps S34 to S37:

[0092] Step S34, converting the labeled flow data sample and the unlabeled flow data sample into a three-dimensional tensor through dimensionality transformation;

[0093] Step S35, performing convolution operation on the three-dimensional tensor in turn through each of the second convolution layers, and using a LeakyReLU activation function to perform activation processing on each convolution operation;

[0094] Step S36, processing the activation processing results in sequence through each of the second fully connected layers, and performing activation processing through the Lambda activation function;

[0095] Step S37, normalizing the activation processing result of the Lambda activation function using a softmax activation function to obtain the probability that each of the traffic data samples belongs to each traffic type.

[0096] For example, refer to Figure 5 , Figure 5 Schematic diagram of the network structure of the discriminator.

[0097] The discriminator consists of 3 second convolutional layers and 2 second fully connected layers. There are 3 second convolutional layers. The first convolutional layer contains 128 convolution kernels. Each convolution kernel has a set of weight parameters and bias parameters. The convolution kernel size is 3*3, the step size is 2, and there is a LeakyRELU activation function. The second convolutional layer contains 64 convolution kernels. Each convolution kernel has a set of weight parameters and bias parameters. The convolution kernel size is 3*3, the step size is 2, and there is a LeakyRELU activation function. The third convolutional layer contains 32 convolution kernels. Each convolution kernel has a set of weight parameters and bias parameters. The convolution kernel size is 3*3, the step size is 2, and there is a LeakyRELU activation. There are 2 fully connected layers. The first fully connected layer has 960 neurons. Each neuron has a weight parameter and a bias parameter. The Lambda function is used as the activation function. The second fully connected layer has N+1 neurons. Each neuron has a weight parameter and a bias parameter. Lambda is used as the activation function.

[0098] In the actual processing process, after the pre-processed labeled traffic data samples and unlabeled traffic data samples are input into the discriminator, the labeled traffic data samples with a length of 1480 and the unlabeled traffic data samples are converted into a three-dimensional tensor 20*74*1, and then sent to the 3-layer second convolutional layer with a size of 3*3, and convolution processing is performed through the convolution kernel w of each convolutional layer, and then the LeakyReLU activation function is used for activation after each convolution. Among them, the formula of the LeakyReLU activation function refers to the above embodiment and is not repeated here. Finally, after passing through the flattening layer, the second fully connected layer is input. The network is constructed as a stacked network with shared weights, using the Lambda function as the activation function, and finally the softmax activation function is used for normalization operation to obtain the probability that each of the traffic data samples belongs to each traffic type.

[0099] It should be noted that the above softmax activation function is expressed as:

[0100]

[0101] In the above formula, e xi is the exponent of the i-th element in the input vector (the activation result after each sample is activated by the Lambda activation function), and the denominator is the sum of the exponents of all elements in the input vector. In this way, the output value of each element is between 0 and 1, and the sum of all elements is equal to 1.

[0102] It should be noted that the output result of the above Lambda activation function is a Boolean value.

[0103] In this embodiment, the generator consists of a fully connected layer, a deconvolution layer, and a convolution layer. The fully connected layer contains a large number of neurons, each neuron is connected to all elements of the input layer, and each neuron has a set of weight parameters and a bias parameter. Both the deconvolution layer and the convolution layer contain multiple convolution kernels, and each convolution kernel has a set of weight parameters and a bias parameter. The discriminator consists of 3 convolution layers and 2 fully connected layers. There are 3 convolution layers, and the number of convolution kernels in each convolution layer is different (128, 64, and 32, respectively), and the other parameters are the same. Each convolution kernel has a set of weight parameters and bias parameters, the convolution kernel size is 3*3, the step size is 2, and it is activated by LeakyRELU. There are 2 fully connected layers, and the number of neurons in each fully connected layer is different, and the other parameters are the same. Each neuron has a weight parameter and a bias parameter, and Lambda is used as the activation function. Through the above-mentioned generator and discriminator network structure, the probability of each of the traffic data samples belonging to each traffic type is accurately judged.

[0104] Based on the above embodiments of the present application, in the third embodiment of the present application, the same or similar contents as those in the above embodiments can be referred to the above introduction, and will not be described in detail later. Figure 6 , before step S30, further comprising steps S110 to S120:

[0105] Step S110, iteratively updating the network parameters of the discriminator and the generator respectively;

[0106] Step S120, during the iterative update process, when it is detected that the loss value of the loss function corresponding to the discriminator is within a preset fluctuation range, the iterative update of the network parameters of the discriminator and the generator is stopped, and the iteratively updated generator and discriminator are output.

[0107] The LeakyRELU activation function has a parameter slope α. Normally, the value of α is set to 0.01, and this application sets it to 0.2. As the slope increases, the output of the LeakyReLU activation function will be larger when the input is negative, so that during the back propagation process, the gradient value will also be larger, which helps to better propagate gradient information in the deep structure of the network and reduce the possibility of gradient vanishing, thereby improving the stability and convergence speed of training. Therefore, if the loss value output by the loss function no longer decreases significantly, but fluctuates within a small range (i.e., the preset fluctuation range), and the gradient value is stable and no longer changes significantly, this usually means that the model has converged, and the iterative update of the network parameters of the discriminator and generator can be stopped.

[0108] In another feasible implementation, the change in the loss function is continuously observed, and when the decrease in the loss function in multiple iterations is less than a preset threshold, the calculation is stopped.

[0109] In this embodiment, the accuracy of the trained generator and discriminator in classifying traffic data is improved by iteratively updating the network parameters of the discriminator and the generator, respectively, and setting corresponding iterative update stop conditions.

[0110] Further, in one embodiment, step S110 includes steps S111 and S112:

[0111] Step S111, using the loss function to back-propagate the network parameters of the discriminator, and calculating the gradient of the network parameters of the discriminator, and using the Adam gradient descent method to update the network parameters of the discriminator, wherein the network parameters of the discriminator include: weight parameters and bias parameters of each convolutional layer of the discriminator, and weight parameters and bias parameters of each neuron of each fully connected layer of the discriminator.

[0112] For the discriminator, a binary cross entropy loss function is usually used to measure the difference between the real network traffic data sample and the simulated traffic data sample. The real network traffic data sample and the simulated traffic data sample generated by the generator can be input into the discriminator to obtain the prediction result. The losses corresponding to the real network traffic data sample and the simulated traffic data sample generated by the generator are calculated respectively, and they are added together as the loss value of the discriminator. The parameters of the discriminator are back-propagated using the loss function to calculate the gradient of each parameter. The Adam optimizer is used to update the network parameters of the discriminator according to the calculated gradient.

[0113] It is a common practice to use the Adam gradient descent method to adjust the network parameters of the discriminator. The goal of the discriminator is to distinguish whether the input data comes from the real data distribution or the fake data generated by the generator. In order to optimize the discriminator, the parameters of the discriminator need to be back-propagated using the loss function and updated through the Adam optimizer.

[0114] Step S112, fix the network parameters of the discriminator, perform feature matching on the real network traffic data samples and the simulated traffic data samples, and use the feature matching results to adjust the network parameters of the generator, wherein the network parameters of the generator include: weight parameters and bias parameters of the convolutional layer of the generator, and weight parameters and bias parameters of each neuron of the fully connected layer of the generator.

[0115] Once the discriminator reaches a certain level of performance, such as stable accuracy or loss on the validation set, you can fix its parameters and stop updating them.

[0116] Next, the discriminator is used to extract the features of real network traffic data samples and simulated traffic data samples and match them. The specific methods include:

[0117] Feature statistics matching: Calculate the feature statistics (such as mean, variance, covariance, etc.) of real network traffic data samples and simulated traffic data samples on certain layers of the discriminator, and try to minimize the difference between these statistics.

[0118] Observe the activation mapping of the discriminator to real network traffic data samples and simulated traffic data samples, and try to adjust the generator to produce more similar activation patterns.

[0119] Gradient Penalty or Feature Loss: When training the generator, in addition to the adversarial loss between the generator and the discriminator, an additional loss term can be added, which is based on the difference between the simulated traffic data samples and the real network traffic data samples of the discriminator for the generated data (for example, using L1 or L2 loss).

[0120] Using one or more of the above methods, the parameters of the generator can be adjusted based on the discriminator's evaluation of simulated traffic data samples. The specific steps include:

[0121] (1) Freeze the parameters of the discriminator.

[0122] (2) Use simulated traffic data samples and real network traffic data samples as input to run the discriminator, but only use its output to adjust the generator.

[0123] (3) Compute a loss function that combines the adversarial loss between the generator and the discriminator and any additional feature matching loss.

[0124] (4) Use the Adam optimizer to minimize this loss function and update the parameters of the generator.

[0125] In this embodiment, the generator and the discriminator are trained and iteratively updated in the above manner to improve the accuracy of the trained generator and the discriminator in classifying traffic data.

[0126] Based on the above embodiments of the present application, in the fourth embodiment of the present application, the same or similar contents as those in the above embodiments can be referred to the above introduction, and will not be described in detail later. Figure 7 , step S20 includes steps S21 to S25:

[0127] Step S21, performing deep analysis on the network traffic data packet to obtain a data packet analysis result;

[0128] After receiving the network traffic data packet provided by the network splitter, the network traffic classification device performs in-depth analysis on the network traffic data packet and extracts the data content of the application layer, namely, the data packet analysis result. The network traffic classification device uses specific identification technology to match the application data in the network traffic data packet to determine the application or service to which the network traffic data packet belongs.

[0129] Among them, the data packet analysis results are shown in Table 1:

[0130] Table 1

[0131]

[0132] Step S22, filtering the data packet analysis result to obtain a filtered data packet analysis result;

[0133] The packet parsing results from the previous step are used as input to filter out redundant fields such as session ID, host name, and user agent, detect duplicate fields, and remove duplicate fields to streamline the data set and improve the efficiency and accuracy of analysis. Among them, the drop_duplicates() activation function of Python can be used to delete redundant and duplicate fields in the packet parsing results.

[0134] Step S23, obtaining data within a set time period from the filtered data packet analysis result;

[0135] After filtering the data packet analysis results, the filtered data packet analysis results are truncated to obtain data within a set time period in the filtered data packet analysis results. Specifically, according to the timestamp, the time range is set and only the data within a specific time period is retained.

[0136] In addition, for data within a set period, for numerical data such as packet size, number of bytes transmitted, etc., these data can be visualized to observe data distribution, and the interquartile range method can be used to detect extreme points and delete extreme points. Among them, data visualization can be performed with the help of Python's matplotlib library.

[0137] Step S24, performing data type conversion on the data within the set time period, and performing deletion processing or zero value filling processing on the data after the data type conversion to obtain processed data;

[0138] After obtaining the data within the set time period, the data type conversion is performed on the data within the set time period. Specifically, for string data with fewer values, such as data packet direction, one-hot encoding is used to convert it into numeric data. For example, if the data packet direction has two values ​​"input" and "output", each string is converted into a binary vector, [1,0] represents input, and [0,1] represents output. For string data with fewer values, such as application name, label encoding is used to convert it into numeric data. Each string is mapped to an integer, such as the video of application A is mapped to 1 and the video of application B is mapped to 2.

[0139] In addition, the data packet timestamp can be split into year, month, day, hour, minute and second with the help of Python's third-party library datetime for subsequent analysis.

[0140] After data type conversion, the rows and columns in the converted data can be deleted or filled with zero values ​​according to the proportion of missing values ​​to obtain processed data. For example, if the missing value proportion reaches 80%, it will be deleted directly, otherwise it will be filled with zero values.

[0141] Step S25, normalizing the processed data, and label encoding the normalized data based on the traffic type to obtain the real network traffic data sample, wherein the labeled traffic data sample and the unlabeled traffic data sample have different corresponding labels.

[0142] The processed data can be normalized by the minimum and maximum normalization method to obtain the normalized data. The characteristic value of the processed data is scaled to a specified range (usually 0 to 1) by the minimum and maximum normalization method. It can be converted by the following formula:

[0143]

[0144] Wherein, x is the eigenvalue of the processed data, min(x) and max(x) are the minimum and maximum eigenvalues ​​of the processed data, respectively, and x′ is the eigenvalue of the normalized data.

[0145] After normalizing the processed data, in order to facilitate subsequent modeling, the application type is label-encoded to obtain real network traffic data samples, wherein the real network traffic data samples include labeled traffic data samples and unlabeled traffic data samples, and the labeled traffic data samples and the unlabeled traffic data samples have different corresponding labels. For example, video traffic is 1, and music traffic is 2. The encoded application type is used as the label to be predicted. The data with an empty application type is unlabeled data, and the data with a non-empty application type is labeled data. The application type is the traffic type, including: video traffic, music traffic, web browsing traffic, file transfer traffic, instant messaging traffic, game traffic, VoIP traffic, and email traffic.

[0146] After the preprocessing of the above preprocessing steps, the obtained real network traffic data samples are shown in Table 2:

[0147] Table 2

[0148]

[0149]

[0150]

[0151] In this embodiment, by adopting the above scheme, a small amount of labeled data and a large amount of unlabeled data are uniformly cleaned and preprocessed, and the preprocessed data is then input into the subsequent model, thereby effectively realizing the preprocessing of multiple traffic samples and improving the efficiency of traffic classification.

[0152] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the network traffic classification method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0153] Based on the same inventive concept, the present application also provides a network traffic classification device, please refer to Figure 8 , the network traffic classification device comprises:

[0154] An acquisition module 10 is used to acquire network traffic data packets collected by a network splitter;

[0155] A preprocessing module 20, used for preprocessing the network traffic data packets to obtain real network traffic data samples, wherein the real network traffic data samples include marked traffic data samples and unmarked traffic data samples;

[0156] A generation and identification module 30, configured to generate a simulated traffic data sample through a generator, input the simulated traffic data sample, the marked traffic data sample and the unmarked traffic data sample into a discriminator, and obtain the probability that each of the traffic data samples belongs to each traffic type;

[0157] The classification module 40 is used to input the probability that each of the traffic data samples belongs to each traffic type into a classifier to obtain the traffic type corresponding to each of the traffic data samples.

[0158] Optionally, the generating and identifying module 30 is further used for:

[0159] Inputting random noise into the first fully connected layer, and converting the random noise into a three-dimensional tensor through dimensionality transformation;

[0160] Performing a deconvolution operation on the three-dimensional tensor through the deconvolution layer, and using a LeakyReLU activation function to activate the deconvolution operation result;

[0161] The activation processing result is convolved by the first convolution layer, and the convolution operation result is activated by using the Tanh activation function to obtain the simulated traffic data sample.

[0162] Optionally, the generating and identifying module 30 is further used for:

[0163] Converting the labeled flow data sample and the unlabeled flow data sample into a three-dimensional tensor through dimensionality transformation;

[0164] The three-dimensional tensor is sequentially passed through each of the second convolutional layers to perform a convolution operation, and a LeakyReLU activation function is used to perform activation processing on each convolution operation;

[0165] The activation processing results are processed in sequence by each of the second fully connected layers, and activation processing is performed by a Lambda activation function;

[0166] The activation processing result of the Lambda activation function is normalized using a softmax activation function to obtain the probability that each of the traffic data samples belongs to each traffic type.

[0167] Optionally, the network traffic classification device further includes a training module, and the training module is used to:

[0168] Iteratively updating the network parameters of the discriminator and the generator respectively;

[0169] During the iterative update process, when it is detected that the loss value of the loss function corresponding to the discriminator is within a preset fluctuation range, the iterative update of the network parameters of the discriminator and the generator is stopped, and the iteratively updated generator and discriminator are output.

[0170] Optionally, the training module is further used to:

[0171] Back-propagating the network parameters of the discriminator using the loss function, calculating the gradient of the network parameters of the discriminator, and updating the network parameters of the discriminator using the Adam gradient descent method, wherein the network parameters of the discriminator include: weight parameters and bias parameters of each convolutional layer of the discriminator, and weight parameters and bias parameters of each neuron of each fully connected layer of the discriminator;

[0172] And, fixing the network parameters of the discriminator, performing feature matching on real network traffic data samples and simulated traffic data samples, and using the feature matching results to adjust the network parameters of the generator, wherein the network parameters of the generator include: weight parameters and bias parameters of the convolutional layer of the generator, and weight parameters and bias parameters of each neuron of the fully connected layer of the generator.

[0173] Optionally, the preprocessing module 20 is used to:

[0174] Performing in-depth analysis on the network traffic data packets to obtain data packet analysis results;

[0175] Filtering the data packet analysis result to obtain a filtered data packet analysis result;

[0176] Obtaining data within a set time period from the filtered data packet analysis results;

[0177] Performing data type conversion on the data within the set time period, and performing deletion processing or zero value filling processing on the data after the data type conversion to obtain processed data;

[0178] The processed data is normalized, and the normalized data is label-encoded based on the traffic type to obtain the real network traffic data sample, wherein the labeled traffic data sample and the unlabeled traffic data sample have different corresponding labels.

[0179] The network traffic classification device provided by the present application adopts the network traffic classification method in the above embodiment, which can improve the efficiency of network traffic classification. Compared with the prior art, the beneficial effects of the network traffic classification device provided by the present application are the same as the beneficial effects of the network traffic classification method provided by the above embodiment, and other technical features in the network traffic classification device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0180] Based on the same inventive concept, the present application provides a network traffic classification device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the network traffic classification method in the above-mentioned embodiment one.

[0181] Reference below Fig. 9 , which shows a schematic diagram of the structure of a network traffic classification device suitable for implementing the embodiment of the present application. The network traffic classification device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig. 9 The network traffic classification device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0182] like Fig. 9As shown, the network traffic classification device may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the network traffic classification device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the network traffic classification device to communicate with other devices wirelessly or wired to exchange data. Although the figure shows a network traffic classification device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0183] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0184] The network traffic classification device provided by the present application adopts the network traffic classification method in the above embodiment to improve the efficiency of network traffic classification. Compared with the prior art, the beneficial effects of the network traffic classification device provided by the present application are the same as the beneficial effects of the network traffic classification method provided by the above embodiment, and the other technical features in the network traffic classification device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0185] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0186] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0187] Based on the same inventive concept, the present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the network traffic classification method in the above-mentioned embodiment.

[0188] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0189] The computer-readable storage medium may be included in the network traffic classification device; or may exist independently without being assembled into the network traffic classification device.

[0190] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the network traffic classification device, the network traffic classification device: obtains network traffic data packets collected by the network splitter; preprocesses the network traffic data packets to obtain real network traffic data samples, wherein the real network traffic data samples include marked traffic data samples and unmarked traffic data samples; generates simulated traffic data samples through a generator, inputs the simulated traffic data samples, the marked traffic data samples and the unmarked traffic data samples into a discriminator, and obtains the probability that each of the traffic data samples belongs to each traffic type; inputs the probability that each of the traffic data samples belongs to each traffic type into a classifier, and obtains the traffic type corresponding to each of the traffic data samples.

[0191] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0192] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0193] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0194] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned network traffic classification method, and can improve the efficiency of network traffic classification. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the network traffic classification method provided by the above-mentioned embodiment, and will not be repeated here.

[0195] Based on the same inventive concept, the present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned network traffic classification method when executed by a processor.

[0196] The computer program product provided by the present application can improve the efficiency of network traffic classification. Compared with the prior art, the beneficial effects of the computer program product provided by the present application are the same as the beneficial effects of the network traffic classification method provided by the above embodiment, which will not be repeated here.

[0197] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A network traffic classification method, It is characterized in that The method comprises: Obtain network traffic data packets collected by the network splitter; Preprocessing the network traffic data packets to obtain real network traffic data samples, wherein the real network traffic data samples include marked traffic data samples and unmarked traffic data samples; Generate simulated traffic data samples by means of a generator, input the simulated traffic data samples, the labeled traffic data samples and the unlabeled traffic data samples into a discriminator, and obtain the probability that each of the traffic data samples belongs to each traffic type; The probability that each of the traffic data samples belongs to each traffic type is input into a classifier to obtain the traffic type corresponding to each of the traffic data samples.

2. The method according to claim 1, It is characterized in that The generator includes a first fully connected layer, a deconvolution layer and a first convolution layer, and generating a simulated traffic data sample by the generator includes: Inputting random noise into the first fully connected layer, and converting the random noise into a three-dimensional tensor through dimensionality transformation; Performing a deconvolution operation on the three-dimensional tensor through the deconvolution layer, and using a LeakyReLU activation function to activate the deconvolution operation result; The activation processing result is convolved by the first convolution layer, and the convolution operation result is activated by using the Tanh activation function to obtain the simulated traffic data sample.

3. The method according to claim 2, It is characterized in that The discriminator includes a plurality of second convolutional layers and a plurality of second fully connected layers, and the simulated traffic data samples, the labeled traffic data samples, and the unlabeled traffic data samples are input into the discriminator to obtain the probability that each of the traffic data samples belongs to each traffic type, including: Converting the labeled flow data sample and the unlabeled flow data sample into a three-dimensional tensor through dimensionality transformation; The three-dimensional tensor is sequentially passed through each of the second convolutional layers to perform a convolution operation, and a LeakyReLU activation function is used to perform activation processing on each convolution operation; The activation processing results are processed in sequence by each of the second fully connected layers, and activation processing is performed by a Lambda activation function; The activation processing result of the Lambda activation function is normalized using a softmax activation function to obtain the probability that each of the traffic data samples belongs to each traffic type.

4. The method according to any one of claims 1 to 3, It is characterized in that Before the step of generating a simulated traffic data sample by a generator, inputting the simulated traffic data sample, the labeled traffic data sample and the unlabeled traffic data sample into a discriminator, and obtaining the probability that each of the traffic data samples belongs to each traffic type, the step further includes: Iteratively updating the network parameters of the discriminator and the generator respectively; During the iterative update process, when it is detected that the loss value of the loss function corresponding to the discriminator is within a preset fluctuation range, the iterative update of the network parameters of the discriminator and the generator is stopped, and the iteratively updated generator and discriminator are output.

5. The method according to claim 4, It is characterized in that The steps of iteratively updating the network parameters of the discriminator and the generator respectively include: Back-propagating the network parameters of the discriminator using the loss function, calculating the gradient of the network parameters of the discriminator, and updating the network parameters of the discriminator using the Adam gradient descent method, wherein the network parameters of the discriminator include: weight parameters and bias parameters of each convolutional layer of the discriminator, and weight parameters and bias parameters of each neuron of each fully connected layer of the discriminator; And, fixing the network parameters of the discriminator, performing feature matching on real network traffic data samples and simulated traffic data samples, and using the feature matching results to adjust the network parameters of the generator, wherein the network parameters of the generator include: weight parameters and bias parameters of the convolutional layer of the generator, and weight parameters and bias parameters of each neuron of the fully connected layer of the generator.

6. The method according to claim 1, It is characterized in that The step of preprocessing the network traffic data packet to obtain a real network traffic data sample comprises: Performing in-depth analysis on the network traffic data packets to obtain data packet analysis results; Filtering the data packet analysis result to obtain a filtered data packet analysis result; Obtaining data within a set time period from the filtered data packet analysis results; Performing data type conversion on the data within the set time period, and performing deletion processing or zero value filling processing on the data after the data type conversion to obtain processed data; The processed data is normalized, and the normalized data is label-encoded based on the traffic type to obtain the real network traffic data sample, wherein the labeled traffic data sample and the unlabeled traffic data sample have different corresponding labels.

7. A network traffic classification device, It is characterized in that The device comprises: An acquisition module, used to acquire network traffic data packets collected by a network splitter; A preprocessing module, used for preprocessing the network traffic data packets to obtain real network traffic data samples, wherein the real network traffic data samples include marked traffic data samples and unmarked traffic data samples; A generation and identification module, used to generate simulated traffic data samples through a generator, input the simulated traffic data samples, the marked traffic data samples and the unmarked traffic data samples into a discriminator, and obtain the probability that each of the traffic data samples belongs to each traffic type; The classification module is used to input the probability that each of the traffic data samples belongs to each traffic type into a classifier to obtain the traffic type corresponding to each of the traffic data samples.

8. A network traffic classification device, It is characterized in that The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the network traffic classification method according to any one of claims 1 to 6.

9. A storage medium, It is characterized in that The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the network traffic classification method according to any one of claims 1 to 6 are implemented.

10. A computer program product, It is characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the network traffic classification method according to any one of claims 1 to 6 are implemented.

Images