Encrypted traffic classification method based on feature fusion and packet dilated convolutional network

Abstract

The invention discloses an encrypted traffic classification method based on feature fusion and a packet dilated convolutional network, which identifies network traffic with high precision and ensures privacy and computational efficiency at the same time, and comprises the following steps: data preprocessing: only retaining 26 bytes to protect privacy through segmentation, filtering and truncation; feature extraction: adopting a double-sliding window mechanism and a designed hash function, generating concrete and abstract features in cooperation with an embedded layer, and realizing joint feature representation; in the model design, firstly, lightweight convolutional network design is carried out, a receptive field is expanded through a lightweight grouping dilated convolutional structure, and channel mixing and point-by-point convolution are added to increase interchannel communication; and in a classification output stage, a cosine annealing mechanism is used to dynamically adjust a learning rate so as to improve a training effect and a convergence speed. The method is superior to an existing lightweight method in the aspects of accuracy, stability, processing speed and resource occupation, is suitable for efficient traffic classification application of resource-constrained equipment, and has practical and promotional values.

Description

Technical Field

[0001] The present invention relates to a privacy protection traffic classification method based on hybrid feature fusion and lightweight design, and belongs to the technical field of network security and data privacy protection. Background Art

[0002] Encrypted Traffic Classification (ETC) is of great significance in the fields of network management and data privacy protection. In recent years, the proportion of Internet encrypted traffic has increased rapidly, and the widespread use of SSL / TLS protocols has made encrypted traffic classification a key research area in network security. At present, the enhancement of user privacy awareness has promoted the widespread use of technologies such as encryption protocols, virtual private networks (VPNs), and anonymous networks (Tor). Although these technologies improve data privacy, they also make it difficult for traditional traffic classification methods (such as port-based classification and deep packet inspection) to effectively deal with them.

[0003] Existing traffic classification methods are mainly divided into models based on machine learning (ML) and deep learning (DL). Machine learning (ML) relies on the statistical characteristics of traffic, requires tedious feature engineering, and relies on the experience of domain experts; while DL methods reduce the burden of feature engineering through automatic feature learning, but their complex structure and computing resource requirements limit their application on resource-constrained devices. Although lightweight deep learning (DL) in recent years has achieved certain results in reducing computational complexity, its classification accuracy and privacy protection performance are still difficult to meet actual needs.

[0004] To address these challenges, researchers have proposed some lightweight encrypted traffic classification methods. These methods have achieved certain results in reducing the model size and input data volume, but their classification accuracy still fails to meet actual needs. For example, FastTraffic proposed a lightweight encrypted traffic classification method based on deep learning (DL) (Xu Y, Cao J, Song K, et al. FastTraffic: A lightweight method for encrypted traffic fast classification [J]. Computer Networks, 2023, 235: 109965.), aiming to achieve fast and accurate traffic classification. This method designs a traffic preprocessing process with data packets as the granularity, reduces the amount of data input by setting a suitable segmentation length (50 bytes), and effectively reduces the computational burden through a textual byte tokenization method. In terms of classification models, FastTraffic uses N-gram feature embedding to capture the structure and sequence information in the data packet, and achieves efficient classification through a three-layer multi-layer perceptron (MLP). However, this method has certain requirements on the amount of data, and needs to build a vocabulary and store it locally, which increases the storage and reading pressure of the device. The ECM method only uses 12 bytes of the IP layer header for analysis (Hu Y, Zeng Z, Song J, et al. Online network traffic classification based on external attention and convolution by IP packet header [J]. Computer Networks, 2024, 252: 110656.), which is an online network traffic classification method that only uses IP packet header information. It extracts byte features through external attention and convolution hybrid model (ECM). The network parameters are low and the effect is more significant, but the training rounds are too large, the stability is poor, and there is additional pressure on the device and the update pressure is high. Summary of the invention

[0005] The purpose of the present invention is to address the defects and shortcomings of the above-mentioned prior art and propose an encrypted traffic classification method based on feature fusion and grouped dilated convolutional networks. The method is applied to efficient encrypted traffic classification and innovatively optimizes the problems of privacy protection, high-precision classification requirements and high computing resource consumption.

[0006] The technical solution adopted by the present invention to solve the technical problem is: an encrypted traffic classification method based on feature fusion and grouping hole convolutional network, the method specifically includes the following steps:

[0007] Step 1: Data preprocessing;

[0008] The raw traffic data for training needs to be preprocessed, including traffic segmentation, packet filtering, data standardization, and interception of the required 26-byte raw traffic byte data.

[0009] Step 2: Joint feature extraction;

[0010] Abstract and concrete features are extracted from the preprocessed data, and then the joint feature representation of the traffic (covering byte-level and packet-level features) is obtained by splicing.

[0011] Step 3: Neural network classification output;

[0012] The joint features are sent to the designed neural network for training. According to the spatial and temporal relationship of the joint features, a lightweight neural network with variable learning rate is designed.

[0013] A further improvement of the present invention is that, in step 1, the specific steps of data preprocessing are as follows.

[0014] Step 1-1: Read traffic data, split it by packet size, filter invalid packets, and unify the input length.

[0015] Step 1-2: Mask the source and destination addresses to 0.0.0.0 to protect privacy and avoid bias due to high-frequency addresses.

[0016] Step 1-3: Extract the first 36 bytes of the packet header, and then select the first 10 bytes and the last 16 bytes of the 36 bytes to form the input.

[0017] A further improvement of the present invention is that, in step 2, the specific steps of joint feature extraction are as follows.

[0018] Step 2-1: The concrete features come from the individual representation of each byte. Each byte is converted into a decimal value by operating with a sliding window of 1, which retains the fine-level information of the data. This method can retain the independent information of each byte, directly reflect the fine structure in the data packet, and enable the model to learn fine-grained features, thereby better describing the independent features of the traffic packet.

[0019] Step 2-2: Abstract features are obtained by sliding the window to 2, and the association representation between bytes is generated by the newly designed hash function and projection technology. By calculating the relationship between adjacent bytes, this part of the features describes the contextual association and spatial structure between bytes, and extracts the time and space patterns in the traffic data.

[0020] Step 2-3: Project the association between the current byte and the previous and next bytes into a high-dimensional space to create more complex and meaningful features. This mapping method allows low-level information and high-level semantics to interact with each other, helping the model form a richer feature representation.

[0021] Step 2-4: Combine the embedded concrete features and abstract features to generate a comprehensive feature map, so that the model can capture both low-level detail information and high-level context associations. Among them, the concrete features retain the detail level of the data, while the abstract features represent the higher-level byte sequence relationship. This fusion enhances the expressiveness of the model.

[0022] A further improvement of the present invention is that, in step 3, the neural network classification output step is as follows.

[0023] Step 3-1: The processed joint features are first input into two parallel grouped atrous convolutions. The convolution kernels of the two grouped atrous convolutions are different, and features in different ranges are extracted to complement each other. At the same time, the input channels are divided into multiple groups, and independent convolution is performed in each group. In this way, the computational complexity is reduced and the feature expression ability is improved. Finally, the two new features are combined.

[0024] Step 3-2: After the grouped atrous convolution operation, channel shuffling is introduced to adjust the channel dimension of the feature map, such as dividing the channels into multiple groups and then swapping the channels in each group. After shuffling, channels from different groups are recombined together, so that the information on the same channel comes from different groups, enhancing the information sharing and complementarity between channels.

[0025] Step 3-3: Use point-by-point convolution to mix and reduce the dimensions of the channels. Point-by-point convolution uses a 1×1 convolution kernel to perform pixel-by-pixel calculations on each channel. It can mix the results of each group of convolutions so that the information of each output channel comes from multiple input channels. Such channel mixing can not only strengthen the information exchange between channels and reduce the number of output channels, but also effectively reduce the number of parameters. Combined with batch normalization and LeakyReLU activation function, point-by-point convolution enhances the nonlinear expression ability of the model while maintaining high efficiency.

[0026] Step 3-4: On the features output by the convolutional layer, use the fully connected layer to map them to various traffic categories to generate the final classification results. The probability distribution of each category is calculated through the softmax function. The cross entropy loss function is used to optimize the model and minimize the prediction error. During the training process, the cosine annealing learning rate scheduling strategy is introduced to gradually reduce the learning rate according to the cosine curve during training, so that the entire network can quickly reach the optimal effect.

[0027] Beneficial effects:

[0028] 1. The present invention only uses the required 26 bytes of original data. Compared with the 50-byte and 784-byte methods commonly used in current research, it not only reduces the length of the input data, but also protects user privacy, while reducing the interference of meaningless data on classification.

[0029] 2. The present invention adopts a joint feature embedding layer, which can extract a combination of concrete features and abstract features, and capture the spatial and temporal features at the byte level. This embedding method captures the correlation between bytes through a sliding window and a hash function. This splicing method can more comprehensively retain the key information in the traffic packet.

[0030] 3. The lightweight design of the convolution layer of the present invention embodies high efficiency and flexibility in many aspects. First, the model introduces grouped hole convolution, which divides the input feature channels into several groups, and each group performs convolution calculations independently. Compared with traditional convolution, this grouping operation greatly reduces the amount of calculation, and expands the receptive field by inserting holes between convolution kernels, so that a wider range of feature information can be captured without adding additional parameters. However, one disadvantage of grouped convolution is that the information exchange between groups is limited, resulting in limited feature fusion capabilities. In order to solve this problem, a channel shuffle operation is added, and the features of different groups are mixed by rearranging the order of channels, so that cross-group information can be further integrated in the next layer. The features of each channel are fused and the number of channels is reduced by point-by-point convolution, further reducing the amount of parameters. After that, a 1×1 convolution kernel is used by point-by-point convolution to effectively compress and reduce the dimension of information from different channels. This step not only reduces the computational requirements, but also ensures the accuracy of the model, making the lightweight design more efficient.

[0031] 4. Normalization and LeakyReLU activation function of the present invention. Batch normalization accelerates the convergence process of the model and makes the training more stable. The LeakyReLU activation function avoids the problem of neuron "death" by introducing a small negative slope when the input is negative, further improving the nonlinear expression ability of the model. Using the cosine annealing learning rate mechanism to gradually reduce the learning rate can help the model converge to a better solution in the later stage of training and reduce the number of training rounds.

[0032] 5. Compared with the existing all-round optimal model, the present invention has only It takes up less memory and has better performance. It performs better under the same training rounds, making it very suitable for deployment and application on resource-constrained devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 This is a flow chart of the model structure of the present invention, showing the overall structure and processing flow chart.

[0034] Figure 2 This is a data preprocessing flow chart of the present invention, showing the flow data segmentation, filtering and truncation processing steps.

[0035] Figure 3 This is a data shape diagram obtained after the data preprocessing of the present invention is completed.

[0036] Figure 4 This is a schematic diagram of the joint feature extraction of the present invention, showing the generation and fusion process of concrete and abstract features.

[0037] Figure 5 This is the structure diagram of the lightweight convolutional network of the present invention, including module diagrams such as grouped hole convolution, channel shuffle, and point-by-point convolution.

[0038] Figure 6 This is the classification output flow chart of the present invention, showing the fully connected layer and softmax function diagram.

[0039] Figure 7 This is a diagram showing the change process of the learning rate controlled by the cosine annealing mechanism of the present invention. DETAILED DESCRIPTION

[0040] The invention will be further described in detail below in conjunction with the accompanying drawings.

[0041] Embodiment 1

[0042] The present invention is a privacy-preserving traffic classification method based on hybrid feature fusion and lightweight design, and its specific implementation process is as follows:

[0043] Step 1, data preprocessing;

[0044] Step 101, such as Figure 2 As shown in the figure, the traffic is segmented according to the granularity of IP packets to improve classification efficiency and reduce the burden on the device. In the packet filtering stage, DNS and ICMP packets that are not related to the classification task are removed, and the header and tail information of the Ethernet frame are removed, leaving only the IP layer data. Since TCP and UDP protocols are used respectively. Because the UDP header is short, 12 bytes of 0x00 are filled after the UDP header to the same length as the TCP header, and TCP control packets without payload are removed to ensure data uniformity. To protect user privacy, the source address and destination address are uniformly masked to 0.0.0.0.

[0045] Step 102, according to the data packet structure, it is finally decided to intercept 36 bytes first, and then intercept the first 10 bytes of the 36 bytes, and the last 16 bytes to avoid invalid information. The processed data is as follows Figure 3 shown.

[0046] Step 2, joint network feature extraction step, such as Figure 4 As shown:

[0047] Step 201: The traffic packet obtained in step 1 can be represented as p i ={(t1,t2,t3,...t l ),y pi},y pi is the real tag of the packet, and is each byte in the packet and is defined as follows: 0x00≤t i ≤0xff, select sliding windows with lengths of 1 and 2 respectively. , slide on the processed original sequence:

[0048] The sliding window of 1 is mainly to express the hexadecimal bytes as decimal numbers, that is, to convert t i becomes k i , k i It is a decimal number to facilitate processing and extracting the specific characteristics of each byte.

[0049] The main purpose of the sliding window of 2 is to obtain the correlation between the bytes connected before and after through hash functions and projection technology, and project them into a range, so as to obtain the abstract features of the bytes in each sliding window.

[0050] Hash function design:

[0051] c i = hash(k i ,k i+1 )=αk i -βk i+1 (1)

[0052] Among them, c i It is a function that indicates the relationship between two bytes. α and β are large random prime numbers that reduce the possibility of hash collision. Through this mapping, adjacent byte pairs are projected into a specific range to generate a unique value to reflect the relative size relationship and semantic association between bytes.

[0053] Step 202, select to use the embedding layer to obtain the connection and features. First, transform it into H by one-hot encoding. P =(h p,1 ,h p,2 ....h p,L ), L is the length of the processed data, h p,i It is the one-hot encoding of each byte to achieve orthogonality of each vector. Since the sparse representation of the one-hot encoding cannot express the correlation between bytes, the model introduces a trainable Embedding layer to represent the bytes:

[0054] E=H P ×WP (2)

[0055] Among them, W P are the trainable weights of the embedding layer,

[0056] The embedding layer uses word embedding technology (Word2Vec) to convert discrete input data into vectors that can capture the semantic relationship between the input data. In this way, the embedding layer not only reduces the dimension of the input data, but also improves the expressiveness of the features, allowing subsequent neural network layers to learn and infer more effectively.

[0057] combination:

[0058] Combine concrete features with abstract features.

[0059] E U =[E A ,E C ] (3)

[0060] E U represents the joint feature, E A represents the abstract feature, E C It represents the concrete features, so the current byte, the association between the previous and next bytes and the corresponding features are obtained. The concrete features provide detailed information, while the abstract features provide a higher level of semantic understanding. The new feature graph that combines the two enables the model to capture both low-level and high-level features at the same time, enhancing the expressive power of the features. Mapping the association between the current byte and its previous and next bytes into high-dimensional features can create more complex and meaningful feature combinations. Joint features can construct more complex and semantically rich feature combinations, allowing the model to capture deeper relationships in the data. These rich features are expressed in the subsequent neural network layers of the model, significantly improving the learning effect and inference ability, and helping to achieve higher-precision encrypted traffic classification.

[0061] Step 3, neural network classification output step, such as Figure 5 As shown:

[0062] In step 301, parallel dilated convolution is first used to replace the traditional depthwise convolution to increase the receptive field without significantly increasing the number of parameters.

[0063]

[0064] Among them, Y[i] is the i-th value of the output feature map.

[0065] W[i] is the kth weight of the convolution kernel.

[0066] K is the size of the convolution kernel.

[0067] r is the dilation rate, which indicates the number of holes inserted in the convolution kernel. For r = 1, it indicates standard convolution; for r>1, it indicates dilated convolution.

[0068] X[i+r·k] represents the position in the input feature map corresponding to the convolution kernel. Due to the influence of the hole rate, there is a gap between the positions. This convolution method effectively captures long-distance dependencies by inserting holes between the convolution kernels while keeping the output length the same as the input.

[0069] In addition, grouped convolution is used on the basis of dilated convolution to form grouped dilated convolution. The logical expression is as follows:

[0070]

[0071] Y g [i]=Y g1 [i]+Y g2 [i] (7)

[0072] Among them, Y g [i] is the i-th value of the output feature map of the g-th group.

[0073] W g,c,k It is the kth weight of the convolution kernel corresponding to the cth input channel of the gth group.

[0074] C g is the number of input channels per group.

[0075] K g is the size of the convolution kernel in each group.

[0076] r is the void ratio.

[0077] E g,c,i+rgk Represents the position in the input feature map corresponding to the convolution kernel in the cth input channel in the gth group.

[0078] The entire output Y is obtained by combining the outputs of all groups:

[0079] Y joint =[Y1,Y2,....,Y G ] (8)

[0080] Step 302, divide the input channels into multiple groups, so that the channels in each group are independently convolved, thereby reducing the computational complexity. Next, the channel shuffling operation is introduced to disrupt the order of channels in each group to promote information interaction and rich expression of features. Channel shuffling is not just a simple rearrangement process, it provides a more flexible feature learning method for the model, allowing channels between different groups to collaborate more effectively during the computation process.

[0081] Then, the number of output channels is reduced by point-by-point convolution, and the channel information is mixed to further reduce the number of parameters.

[0082]

[0083] Where c is the number of channels, Y joint is the previous input, W c is the weight of the 1×1 convolution kernel

[0084] Point-by-point convolution is responsible for the integration of channel information, strengthening the communication between channels and solving the problem of insufficient communication in previous grouped hole convolution. This separation method enables the network to capture richer feature representations while maintaining high efficiency.

[0085] Step 303, then, the module uses batch normalization BN to standardize the output of point-by-point convolution to accelerate the training process and reduce internal covariate shift. The activation function selects the LeakyReLU activation function:

[0086]

[0087] in,

[0088] x is the input value.

[0089] α is a small constant (e.g. 0.01) that represents the slope of negative inputs (usually chosen between 0.01 and 0.1).

[0090] Y act =f LeakyRelu (BN(Y feature )) (11)

[0091] Introduce nonlinearity and improve the learning ability of the model, avoiding the "dead neuron" problem (that is, when the input is less than 0, the gradient is 0, causing the neuron to no longer update).

[0092] Next, the maximum pooling layer:

[0093]

[0094] Among them, X i·s+m,j·s+n is the input,

[0095] pool_window is the window size, usually a k×k area,

[0096] s is the stride.

[0097] So the input is:

[0098] Y maxpool =f maxpooing (Yact ) (13)

[0099] Downsampling is achieved by selecting the maximum value of each pooling window, reducing the feature dimension while retaining important information.

[0100] Finally, the Dropout layer randomly discards neurons with a certain probability to reduce the risk of overfitting and improve the generalization ability of the model on unseen data. After passing:

[0101] Y=Dropout(Y maxpool ) (14)

[0102] Step 304, through the linear output layer, such as Figure 6 As shown in the figure, after the data passes through the convolution layer, we need to map the low-dimensional features obtained by convolution to specific traffic categories to generate the final output of the model. Assuming there are T traffic categories in total, first use the fully connected layer to match the output dimensions and obtain a T×1 vector from Y. The calculation formula is:

[0103] Y OUT =[y1,y2,...y t ...y N ]=W liner ×Y (15)

[0104] Among them, W liner is the weight matrix of the linear layer. Next, the probability distribution of the current input sample belonging to category T is calculated through the softmax function. The formula is as follows:

[0105]

[0106] Therefore, the probability distribution of the current input sample belonging to each category can be obtained After obtaining the final predicted category, we compare it with the true category probability of the current sample For comparison,

[0107] The loss function selects the cross-entropy loss function (Cross-Entropy Loss):

[0108]

[0109] This is a loss function commonly used in classification tasks to measure the gap between the probability distribution predicted by the model and the true distribution. The cross entropy loss function can help optimize the classification model and make its predictions more accurate.

[0110] And the cosine annealing mechanism is used to control the learning rate:

[0111]

[0112] Among them, η t is the learning rate of the current step t, η min The minimum learning rate, the learning rate will gradually decay to this value, η max The initial learning rate (or the highest learning rate at the beginning of the cycle), T annealing cycle, that is, the total number of steps required to complete one annealing, and t current training steps, change as follows Figure 7 shown.

[0113] Finally, based on the current overall loss, the model will perform backpropagation and use the gradient descent method to update and optimize the parameters until the loss is minimized or reaches the set threshold.

[0114] Embodiment 2

[0115] The present invention provides an encrypted traffic classification method based on feature fusion and grouping hole convolutional network, the method comprising the following steps:

[0116] 1) Data preprocessing;

[0117] When preprocessing the input traffic data packets, segmentation, filtering, and truncation operations are first performed to ensure that the data conforms to a unified format specification. The first 36 bytes are extracted from each data packet, and then further reduced to the first 10 bytes and the last 16 bytes. During this process, the principle of not affecting user privacy must be strictly followed, while ensuring the validity of the extracted data to meet the needs of high-precision classification.

[0118] 2) Feature extraction;

[0119] The feature extraction stage is based on a dual sliding window mechanism, which aims to obtain multi-level features of traffic bytes. One sliding window is responsible for capturing the concrete features between bytes, reflecting the basic structure and behavior pattern of the data packet; the other sliding window combines hash functions and projection technology to extract abstract features and reveal deeper data relationships. After being mapped by the embedding layer, these extracted features are spliced ​​to form a joint feature representation of the data.

[0120] 3) Neural network training output;

[0121] During the neural network training process, a lightweight separable grouped atrous convolutional network is used to perform in-depth feature extraction and classification training on the joint features. This network structure not only optimizes the efficiency of computing resources, but also ensures the powerful representation ability of the model. During the training process, the cosine annealing mechanism is used to dynamically adjust the learning rate so that it can gradually adapt according to the progress of network training, thereby accelerating the convergence of the model and achieving the optimal classification performance.

[0122] The above-mentioned data preprocessing step 1) of the present invention includes: reading the network traffic data packet, and performing fine segmentation according to the granularity of the packet to ensure the effectiveness and accuracy of subsequent processing. Next, by implementing data packet filtering, redundant and unnecessary information is removed, thereby improving data quality. In addition, the address mask processing technology is used to process the source and target IP addresses to enhance user privacy protection and prevent sensitive information leakage. During the processing of the data packet, the TCP and UDP protocol headers are standardized in a unified format to facilitate subsequent analysis and feature extraction. In order to further reduce interference with user privacy and ensure the lightweight of data, truncation and padding operations are implemented. Specifically, the first 36 bytes are extracted from the data packet as the basic features, and the first 10 bytes and the last 16 bytes are selected to construct a valid feature set.

[0123] The feature extraction step 2) of the present invention includes: the design of the feature extraction step is to deeply mine the information structure in the traffic data. Specifically, the 26-byte traffic data is first processed with a double sliding window, in which one sliding window is used to extract the concrete features between bytes to capture the local pattern and feature distribution of the traffic data; and the other sliding window applies hashing and projection technology to obtain the abstract features between bytes, thereby revealing higher-level semantic information. On this basis, the relationship between the original features and the embedded features is explored through the embedding layer to ensure that both types of features are effectively retained. This step not only enhances the richness and diversity of feature representation, but also provides more comprehensive and accurate features for subsequent classification tasks. The joint two-dimensional feature map formed by splicing the two can not only contain rich semantic information, but also retain detailed information of the original data. This method can enhance the diversity of feature expression and improve the model's ability to recognize and classify complex patterns, while taking into account lightweight design and computational efficiency.

[0124] The above-mentioned neural network training output step 3 of the present invention includes: adopting a convolutional network architecture with a lightweight design, extracting features of different sizes through two parallel grouped hole convolution layers, making full use of the advantages of grouped hole convolution to expand the receptive field, and then using channel shuffling. In order to enhance the information exchange between channels, the channels of the input feature map are first divided into several groups, and then reordered (i.e. "shuffled") in each group to reduce the potential impact of grouping. Subsequently, point-by-point convolution is used to integrate the information of all channels to ensure the comprehensiveness of feature representation and reduce the number of channel outputs, thereby reducing the overall number of parameters and improving computational efficiency. Leaky ReLU activation function and batch normalization are used in the model to improve the accuracy and stability of classification. In addition, a cosine annealing mechanism is introduced to optimize the learning rate adjustment to adapt it to the training process, effectively reduce the training time, and save time costs.

[0125] In summary, the method of the present invention has simple steps and reasonable design, can accurately implement traffic classification in a large amount of data, and occupies less resources.

[0126] The above contents are only preferred embodiments of the present invention and do not limit the present invention in any way. Any simple modifications, changes and equivalent structural changes made to the above embodiments based on the technical essence of the present invention still fall within the protection scope of the technical solution of the present invention.

Claims

1. An encrypted traffic classification method based on feature fusion and grouping hole convolutional network, characterized in that: The method comprises the following steps: Step 1: Data preprocessing; The raw traffic data for training needs to be preprocessed, including traffic segmentation, packet filtering, data standardization, and interception of the required 26-byte raw traffic byte data; Step 2: Joint feature extraction; The pre-processed data is extracted by abstract and concrete features respectively, and then the joint feature representation of the traffic is obtained by splicing, which covers the features at the byte level and the packet level. Step 3: Neural network classification output; The joint features are sent to the designed neural network for training. According to the spatial and temporal relationship of the joint features, a lightweight neural network with variable learning rate is designed.

2. According to claim 1, the encrypted traffic classification method based on feature fusion and grouping hole convolutional network is characterized in that: In step 1, data preprocessing includes: Step 1-1: Read traffic data, split it by packet size, filter invalid packets, and unify the input length; Step 1-2: Mask the source and destination addresses to 0.0.0.0 to protect privacy and avoid bias due to high-frequency addresses; Step 1-3: Extract the first 36 bytes of the packet header, and then select the first 10 bytes and the last 16 bytes of the 36 bytes to form the input.

3. According to claim 1, the encrypted traffic classification method based on feature fusion and grouping hole convolutional network is characterized in that: In step 2, the joint feature extraction includes: Step 2-1: The concrete features come from the individual representation of each byte. By operating with a sliding window of 1, each byte is converted into a decimal value, which retains the fine-level information of the data and the independent information of each byte, directly reflecting the fine structure in the data packet, so that the model can learn fine-grained features and better describe the independent features of the traffic packet; Step 2-2: Abstract features are obtained by sliding a window of 2, and the association representation between bytes is generated using a newly designed hash function and projection technology. By calculating the relationship between adjacent bytes, this part of the features describes the contextual association and spatial structure between bytes, and extracts the temporal and spatial patterns in the traffic data; Step 2-3: Project the association between the current byte and the previous and next bytes into a high-dimensional space to create more complex and meaningful features. This mapping method enables low-level information and high-level semantics to interact with each other, helping the model form a richer feature representation; Step 2-4: Combine the embedded concrete features and abstract features to generate a comprehensive feature map, so that the model can capture low-level detail information and high-level contextual associations at the same time. The concrete features retain the detail level of the data, while the abstract features represent higher-level byte sequence relationships. This fusion enhances the expressiveness of the model.

4. According to claim 1, the encrypted traffic classification method based on feature fusion and grouping hole convolutional network is characterized in that: In step 3, the neural network classification output includes: Step 3-1: The processed joint features are first input into two parallel grouped atrous convolutions. The convolution kernels of the two grouped atrous convolutions are different, and features in different ranges are extracted to complement each other. At the same time, the input channels are divided into multiple groups, and independent convolution is performed in each group. In this way, the computational complexity is reduced and the feature expression ability is improved. Finally, the two new features are combined; Step 3-2: After the grouped atrous convolution operation, channel shuffling is introduced to adjust the channel dimension of the feature map. For example, the channels are divided into multiple groups, and then the channels of each group are arranged and exchanged. After shuffling, the channels of different groups are recombined together, which makes the information on the same channel come from different groups, enhancing the information sharing and complementarity between channels. Step 3-3: Then use point-by-point convolution to mix and reduce the dimension of the channels. Point-by-point convolution uses a 1×1 convolution kernel to perform pixel-by-pixel calculations on each channel and mix the results of each group of convolutions so that the information of each output channel comes from multiple input channels. Such channel mixing can not only strengthen the information exchange between channels and reduce the number of output channels, but also effectively reduce the number of parameters. Combined with batch normalization and LeakyReLU activation function, point-by-point convolution enhances the nonlinear expression ability of the model while maintaining high efficiency. Step 3-4: On the features output by the convolutional layer, a fully connected layer is used to map them to various traffic categories to generate the final classification results. The probability distribution of each category is calculated through the softmax function. The cross entropy loss function is used to optimize the model and minimize the prediction error. During the training process, the cosine annealing learning rate scheduling strategy is introduced to gradually reduce the learning rate according to the cosine curve during training, so that the entire network can quickly reach the optimal effect.

5. According to claim 1, the encrypted traffic classification method based on feature fusion and grouping hole convolutional network is characterized in that: The cross entropy loss function in steps 3-4 can help optimize the classification model to make its prediction more accurate, and use the cosine annealing mechanism to control the learning rate: Among them, η t is the learning rate of the current step t, η min The minimum learning rate, the learning rate will gradually decay to this value, η max The initial learning rate (or the highest learning rate at the beginning of the cycle), T annealing cycles, that is, the total number of steps required to complete one annealing, and t the current training step number.

Images