VPN traffic identification method and system based on multi-model fusion

Abstract

The invention provides a VPN traffic identification method and system based on multi-model fusion, and the method comprises the steps: splicing a Pcap file traffic feature vector with a geographic feature vector, carrying out the traffic class prediction through employing a random forest model and an LSTM network model, and splicing prediction results as the input of a meta-model, and obtaining a final prediction result. According to the invention, efficient network flow monitoring, feature extraction and decision support are realized. Cooperative work among the modules provides powerful technical support for network security monitoring, and can effectively deal with complex network security threats. According to the method, the Vmess and Shadowsockets effects are researched and judged through multi-model fusion, and the effect is improved by 5% compared with the effect of a single algorithm; by obtaining the first 100 frames of the Pcap packet and abandoning the subsequent flow, the research and judgment accuracy is not reduced, and the research and judgment time is shortened to 40% of the original time.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic digital data processing, and in particular to a VPN traffic identification method and system based on multi-model fusion. Background Art

[0002] Cross-border communication uses technologies such as encrypted tunnels (VPN technology) and secret communications (protocol camouflage) to establish request transmission and data communications with overseas servers to achieve access to cross-border resources. Users connect to overseas servers through broadband lines of operators such as China Telecom, China Unicom, and China Mobile, using direct connections and transit (through domestically deployed servers for traffic aggregation and transit) to achieve the purpose of accessing the overseas Internet. Through the analysis of cross-border communication processes and data, various network basic resources in the communication process are obtained, and a cross-border communication resource intelligence database is established based on cross-border communication resources, services, data and other information. Based on the information in the intelligence database, a monitoring strategy is formed to monitor cross-border communication behavior.

[0003] Virtual Private Network (VPN) technology provides users with secure and reliable data transmission services by establishing a private network on a public network. VPN is widely used in scenarios such as remote office and internal communications of multinational enterprises. While improving the security of network transmission, it also brings challenges to network management and security supervision.

[0004] Currently, VPN traffic identification is mainly based on the following methods:

[0005] Port identification: Detection is performed by identifying the fixed ports used by VPNs, such as OpenVPN, which uses port 1194 by default. However, this method is easily circumvented, such as by using custom ports. Protocol feature identification: Analyze VPN protocol-specific features such as the handshake process and message format. However, with the development of VPN protocols and the application of obfuscation technology, it is difficult to accurately identify VPNs based solely on protocol features.

[0006] Traffic statistics: Analyze the statistical characteristics of VPN traffic, such as packet length distribution, flow duration, etc. However, this method is easily affected by the network environment and has poor robustness.

[0007] Machine learning method: Use machine learning algorithms to classify VPN traffic. However, traditional machine learning methods have limitations in feature selection and model generalization capabilities.

[0008] The prior art has the following deficiencies:

[0009] A single feature cannot fully describe the characteristics of VPN traffic, resulting in low recognition accuracy. Although deep learning has made great achievements in many fields, it is often not very effective in processing data in CSV format. There is a lack of real-time VPN traffic detection solutions for large-scale network environments, and it is difficult to deal with new VPN protocols and obfuscation technologies.

[0010] Therefore, there is an urgent need for a VPN traffic identification method that can integrate multi-dimensional features and has strong generalization ability to improve detection accuracy and practicality. Summary of the invention

[0011] The present invention aims to solve the accuracy and practicality of VPN traffic identification, and provides a VPN traffic identification method and system based on multi-model fusion, splicing the Pcap file traffic feature vector with the geographic feature vector, using the random forest model and the LSTM network model to predict the traffic category respectively, and then splicing the prediction results into the meta-model to obtain the final prediction result. The present invention realizes efficient network traffic monitoring, feature extraction and decision support. The collaborative work between the various modules provides a strong technical support for network security monitoring, and can effectively respond to complex network security threats; the present invention improves the effect of Vmess and Shadowsocks by 5% through multi-model fusion than that of a single algorithm; by obtaining the first 100 frames of the Pcap package and discarding the subsequent traffic, the accuracy of the judgment is not reduced, and the judgment time is shortened to 40% of the original.

[0012] The present invention provides a VPN traffic identification method based on multi-model fusion, comprising the following steps:

[0013] S1, data acquisition module collects network traffic data in real time to generate Pcap file;

[0014] S2, the multi-dimensional feature extraction module segments and parses the Pcap file, classifies it into TCP and UDP according to the protocol type, and then extracts the five-tuple features and calculates the additional features to obtain the traffic feature vector;

[0015] The multi-model fusion module extracts the geographic location information of the Pcap file to obtain the geographic feature vector, concatenates the traffic feature vector with the geographic feature vector to obtain the cross-border feature concatenation vector, and outputs it to the trained random forest model and LSTM network model;

[0016] S3, the random forest model predicts the VPN traffic category based on the cross-border feature concatenation vector to obtain the random forest classification prediction result f _rf (x) is output to the meta-model. The LSTM network model predicts VPN traffic categories through time series prediction to obtain the LSTM prediction result f _lstm(x) is output to the meta-model, which forms a new feature set X based on the random forest classification prediction results and the LSTM prediction results. meta , and then the new feature set X meta Input into the meta-model to perform VPN traffic category prediction and perform logistic regression analysis to obtain the meta-model prediction probability P(y=1|x):

[0017] P(y=1|x)=σ(ω0+ω1·f _rf (x)+ω2·f _lstm (x));

[0018] Where σ is the sigmoid function, σ(z)=1 / (1+e ^(-z) ), ω0, ω1, ω2 are the weights of logistic regression, and x is the input cross-border feature concatenation vector;

[0019] According to the threshold and meta-model prediction probability, the data protocol category of the network traffic is determined and a detection report is generated. A VPN traffic identification method based on multi-model fusion is completed.

[0020] The VPN traffic identification method based on multi-model fusion described in the present invention is, as a preferred embodiment, in step S2, the five-tuple feature includes source IP, source port, destination IP, destination port and protocol type;

[0021] Additional features include: uplink packet size mean, uplink packet size standard deviation, uplink interval time mean, uplink interval time standard deviation, uplink packet size, downlink packet size, packet number ratio, packet size ratio, downlink packet size mean, downlink packet size standard deviation, entropy, response, response ratio, transmission, transmission ratio, and timestamp;

[0022] The upstream packet size is the size of the first 10 upstream packets in the Pcap file, the downstream packet size is the size of the first 10 downstream packets in the Pcap file, and the entropy value is the first 4 entropy values ​​in the Pcap file;

[0023] The geographic location information includes the country / region of the source IP address and the country / region of the destination IP address.

[0024] The VPN traffic identification method based on multi-model fusion described in the present invention is, as a preferred embodiment, in step S3,

[0025] X meta =[f _rf (x),f _lstm (x)];

[0026] The data protocol category of the network traffic is Vmess protocol or Shadowsocks protocol.

[0027] The VPN traffic identification method based on multi-model fusion described in the present invention, as a preferred embodiment, the training method of the random forest model, the LSTM network model and the meta-model comprises the following steps:

[0028] The machine learning analysis system extracts the stored log data from the machine learning log management system through the data collection module, splits the Pcap package into single flows through the multi-dimensional feature extraction module, extracts features and calculates additional features to obtain the traffic feature vector, extracts the geographic location information through the multi-model fusion module and fuses it with the traffic feature vector to form a cross-border feature splicing vector, which is then divided into training set, validation set and test set;

[0029] The training set is used to train the random forest model and LSTM network model for VPN traffic category prediction. The random forest model and LSTM network model are then used to predict the validation set and the prediction results are used to train the meta-model. The model hyperparameters are then adjusted according to the confusion matrix and ROC curve, and the accuracy of the model is evaluated using cross-validation. Based on the evaluation results, the hyperparameters or structure are adjusted to fine-tune the model until the accuracy of VPN traffic category prediction reaches the target value. Finally, the test set is used to predict the random forest model and LSTM network model, and the prediction results are spliced ​​and input into the meta-model to predict the final prediction results.

[0030] The VPN traffic identification method based on multi-model fusion described in the present invention is, as a preferred method, data transmission is performed through the SFTP protocol during the identification and training process; sensitive data is encrypted, or a differential privacy method is used to process the core data to replace the user's personal identity information and use a unique ID instead.

[0031] The present invention provides a VPN traffic identification system based on multi-model fusion, including a machine learning log management system, a machine learning analysis system and a data collection and analysis system for data interaction through an SFTP protocol;

[0032] The machine learning log management system performs log storage, data management and data backup. The machine learning analysis system trains and evaluates the machine learning model based on the log data stored in the machine learning log management system and outputs the analysis results. The data collection and analysis system loads the trained machine learning model to parse the real-time collected network traffic data, integrates the country / region code for feature analysis, generates a test report and sends the test report to the machine learning analysis system.

[0033] The machine learning model includes a random forest model, an LSTM network model, and a meta-model connected to the output ends of the random forest model and the LSTM network model. The input ends of the random forest model and the LSTM network model are connected to the cross-border feature model.

[0034] The cross-border feature model includes a feature embedding layer, which extracts the traffic feature vector and geographic feature vector of the Pcap data packet and concatenates the geographic feature vector with the traffic feature vector to obtain a cross-border feature concatenation vector, and then outputs the cross-border feature concatenation vector to the random forest model and the LSTM network model respectively;

[0035] The random forest model processes cross-border feature concatenation vectors, captures nonlinear relationships, classifies traffic, and outputs random forest classification prediction results;

[0036] The LSTM network model captures the temporal pattern of traffic, analyzes the time dependency in the sequence data to classify traffic, and outputs the LSTM prediction results;

[0037] The meta-model is a logistic regression model, which concatenates the random forest classification prediction results with the LSTM prediction results to form a new feature set, and then makes probability predictions based on the new feature set and determines the data protocol category based on the threshold.

[0038] The VPN traffic identification system based on multi-model fusion described in the present invention is, as a preferred method, a machine learning log management system that receives log data from different sources through an API interface and stores it in a database, formats the received log data, provides a query interface, supports rapid retrieval and analysis of log data, regularly cleans up expired logs, and regularly backs up log data, and the log data includes network traffic logs and system event logs.

[0039] The VPN traffic identification system based on multi-model fusion described in the present invention is, as a preferred embodiment, the machine learning analysis system and the data acquisition analysis system both include a data acquisition module, a multi-dimensional feature extraction module, a multi-model fusion module, a decision engine and an adaptive optimization module.

[0040] The VPN traffic identification system based on multi-model fusion described in the present invention is, as a preferred embodiment, a multi-dimensional feature extraction module segments and analyzes the first 100 frames of the Pcap file.

[0041] In the VPN traffic identification system based on multi-model fusion described in the present invention, as a preferred embodiment, the meta-model predicts the threat level according to the new feature set.

[0042] The present invention solves the following problems: (1) How to accurately identify and distinguish VPN traffic from ordinary encrypted traffic; (2) How to reduce false positive and false negative rates, especially when facing cross-border characteristics of new VPN technologies; (3) How to effectively capture and utilize the unique characteristics of cross-border traffic; (4) How to quickly extract features for analysis and judgment when facing large Pacp traffic packets.

[0043] The present invention has the following advantages:

[0044] (1) Through the detailed implementation of machine learning log management system, machine learning judgment system and data collection and judgment system, this system realizes efficient network traffic monitoring, feature extraction and decision support. The collaborative work between various modules provides strong technical support for network security monitoring and can effectively deal with complex network security threats.

[0045] (2) The present invention improves the judgment effect of Vmess and Shadowsocks by 5% compared with a single algorithm through multi-model fusion; by obtaining the first 100 frames of the Pcap packet and discarding the subsequent traffic, the judgment accuracy is not reduced, and the judgment time is shortened to 40% of the original. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a flow chart of a VPN traffic identification method based on multi-model fusion;

[0047] Figure 2 This is a structural diagram of a VPN traffic identification system based on multi-model fusion. DETAILED DESCRIPTION

[0048] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0049] Example 1

[0050] like Figures 1-2 As shown in the figure, a VPN traffic identification method and system based on multi-model fusion is composed of three main modules: machine learning log management system, machine learning judgment system and data collection and judgment system. Each module exchanges data through the secure SFTP protocol to ensure the security and integrity of data transmission.

[0051] (1) The functions of the machine learning log management system are:

[0052] Log storage: responsible for receiving and storing log data from different sources, including network traffic logs, system event logs, etc.

[0053] Data management: Regularly clean up expired logs to ensure efficient operation of the database.

[0054] Data backup: Back up log data regularly to prevent data loss.

[0055] Implementation steps include:

[0056] Data reception: Receive log data through the API interface and store it in the database.

[0057] Data formatting: Format the received log data to ensure data consistency and readability.

[0058] Data query: Provides a query interface to support rapid retrieval and analysis of log data.

[0059] (2) The functions of the machine learning analysis system are:

[0060] Feature extraction: extract features of Pcap packets

[0061] Model training: Use stored log data to train machine learning models.

[0062] Model evaluation: Evaluate the trained model to ensure its accuracy and reliability.

[0063] Result output: Output the model's analysis and judgment results for subsequent decision-making.

[0064] Implementation steps include:

[0065] Feature extraction: Extract the required log data from the log management system and perform preprocessing, including Pcap packet segmentation and feature extraction. Calculate additional features, including but not limited to:

[0066] Entropy calculation

[0067] Packet uplink size and its standard deviation

[0068] Packet downlink size and its average value

[0069] Communication frequency, duration, etc.

[0070] Extract geographic location information, such as the country of the source and destination IP addresses

[0071] Model selection: choosing between random forest and LSTM models

[0072] Model training: Using the preprocessed data for model training can generate prediction values ​​of multiple base models (such as random forest and LSTM). These prediction values ​​are concatenated according to the following formula (1) as new features (meta-features). As shown in formula 1, these new features are input into the meta-model (logistic regression is selected in this patent) for training, and hyperparameters are adjusted according to the confusion matrix, ROC curve, etc. to optimize model performance.

[0073] Feature stitching:

[0074] X meta =[f _rf (x),f _lstm (x)] (1)

[0075] X meta By combining the prediction results from the random forest and LSTM models (f _rf (x) and f _lstm (x)) to form a new feature set;

[0076] Where: X meta is the meta-feature matrix or meta-data set, f _rf (x) represents the prediction result generated by the random forest model on the input feature x, f _lstm (x) represents the prediction result generated by the LSTM model on the input feature x;

[0077] Mathematical expression for metamodel prediction:

[0078] For input x, the predicted probability of the meta-model is shown in formula (2):

[0079] P(y=1|x)=σ(ω0+ω1·f _rf (x)+ω2·f _lstm (x)) (2)

[0080] in:

[0081] σ is the sigmoid function: σ(z)=1 / (1+e ^(-z) ), w0, w1, w2 are the weights of logistic regression, f _rf (x) is the prediction of the random forest model for x, and f _lstm (x) is the LSTM model’s prediction for x;

[0082] Model evaluation: Use methods such as cross-validation to evaluate the accuracy of the model to ensure its effectiveness in practical applications.

[0083] Final Decision:

[0084] According to the output probability, select a threshold (for example, 0.5) to determine which category the sample belongs to. The category can be Vmess protocol or Shadowsocks protocol.

[0085] For binary classification, if P(y=1|x)>=0.5, the sample is predicted to belong to category 1; otherwise, it is predicted to belong to category 0;

[0086] (3) The functions of the data collection and analysis system are:

[0087] Data collection: collect network traffic data in real time and generate pcap packages.

[0088] Data analysis: Analyze the collected pcap packages, extract features and make judgments.

[0089] Result feedback: The analysis results are fed back to the machine learning analysis system to form a closed loop.

[0090] The implementation steps are:

[0091] Real-time collection: Use network monitoring tools to collect network traffic in real time and generate Pcap files.

[0092] Data parsing: Parse the Pcap file and extract five-tuple features (source IP, source port, destination IP, destination port, protocol type).

[0093] Feature analysis: Calculate additional features, such as packet size, traffic frequency, etc., to form a feature set.

[0094] Data analysis:

[0095] (1) Design a feature embedding layer to encode the country / region into a vector, concatenate the geographic vector with the traffic feature, and input it into the random forest model to obtain preliminary prediction results. At the same time, this feature data is input into the LSTM model for time series prediction to obtain another set of prediction results.

[0096] (2) The prediction results of the random forest and LSTM models are integrated and input into the meta-model to obtain the final prediction results. This step can improve the accuracy and robustness of the prediction.

[0097] (3) Output the fusion results and generate a corresponding report, which includes analysis and visualization of the prediction results.

[0098] Result output: The analysis results are sent to the machine learning analysis system for further analysis by the model.

[0099] The process of VPN traffic identification method based on multi-model fusion is as follows Figure 2 As shown, the specific steps include:

[0100] Step 1: Load the trained machine learning models, including random forest, LSTM network, and cross-border feature model.

[0101] Step 2: Input the extracted features into each model for prediction.

[0102] Step 3:

[0103] 1. Send the test set to the base model (random forest, LSTM) to get the prediction results of each random forest and LSTM

[0104] 2. Prediction

[0105] Use the result obtained in step 1 to input into the meta-model, and this prediction result is the final prediction result.

[0106] Step 4: Generate a preliminary detection report based on the fusion results, including possible threat levels and related features.

[0107] In this embodiment, data interaction and security are carried out through the following methods:

[0108] SFTP interface: Modules use the SFTP protocol to transmit data to each other, ensuring data security during transmission.

[0109] Data encryption: During the transmission process, sensitive data is encrypted to prevent data leakage.

[0110] Privacy protection mechanism: Differential privacy technology is used throughout the implementation process to ensure that the processing of user data complies with privacy protection standards. The core data is processed to replace the user's personal identity information, such as name, address, etc., with a unique ID instead, and will no longer contain specific user identities and sensitive information.

[0111] Through the detailed implementation of the above modules, this system realizes efficient network traffic monitoring, feature extraction and decision support. The collaborative work between the modules provides a strong technical support for network security monitoring and can effectively deal with complex network security threats.

[0112] In this system, the machine learning analysis system and data acquisition analysis system both include five main parts: data acquisition module, multi-dimensional feature extraction module, multi-model fusion module, decision engine and adaptive optimization module, aiming to perform network traffic analysis and detection efficiently and accurately.

[0113] 1. Data acquisition module

[0114] This module obtains Pcap data packets from the remote server through the SFTP protocol to ensure efficient and secure data transmission. At the same time, it supports the integration and management of large-scale data.

[0115] 2. Multidimensional feature extraction module

[0116] After obtaining the Pcap data, the system segments and parses the data packets, classifies them into TCP and UDP by protocol type, and then extracts the five-tuple features of each data flow (source IP, source port, destination IP, destination port, protocol type). This module calculates up to 30 features, including but not limited to:

[0117] Entropy

[0118] Packet uplink size and its standard deviation

[0119] Packet downlink size and its average value

[0120] The extraction of this series of features helps to deeply analyze the behavioral patterns of network traffic.

[0121] 3. Multi-model fusion detection

[0122] 3.1 The system integrates multiple machine learning models to enhance the comprehensiveness and accuracy of detection, mainly including:

[0123] 3.3.1 Random Forest: It is good at processing high-dimensional features and capturing nonlinear relationships, and is suitable for the classification of complex data sets.

[0124] 3.3.2LSTM (Long Short-Term Memory) network: can capture the timing characteristics of traffic, and is particularly suitable for analyzing time dependencies in sequence data.

[0125] 3.2 Enhanced cross-border features

[0126] 3.2.1 Introduce geographic location awareness mechanism, extract cross-border traffic characteristics, focus on key features such as international gateways and cross-border links to improve detection accuracy.

[0127] 3.3 Integrated model results fusion

[0128] Use Stacking method (stacked generalization) to integrate the output of random forest and LSTM

[0129] 4. Privacy protection mechanism

[0130] Design a differential privacy mechanism to ensure efficient detection while minimizing the risk of personal information leakage and protecting user privacy.

[0131] 5. Cross-platform compatibility

[0132] With a modular architecture, the system design has good adaptability and can be deployed on different network devices and operating systems, ensuring a wide range of application scenarios.

[0133] 6. Reporting of research and judgment results

[0134] Finally, the system can report the detection and analysis results to the designated location in a timely manner to support subsequent decision-making and response mechanisms.

[0135] This technical solution achieves efficient network traffic monitoring and analysis through the synergy of various modules, providing a solid technical foundation for addressing complex network security challenges.

[0136] This embodiment uses multi-model fusion to judge Vmess and Shadowsocks, which is 5% better than the effect of a single algorithm; by obtaining the first 100 frames of the Pcap package and discarding the subsequent traffic, the judgment accuracy is not reduced, and the judgment time is shortened to 40% of the original.

[0137] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A VPN traffic identification method based on multi-model fusion, characterized by: The following steps are involved: S1, data acquisition module collects network traffic data in real time to generate Pcap file; S2, a multi-dimensional feature extraction module segments and parses the Pcap file, classifies it into TCP and UDP according to the protocol type, and then extracts the five-tuple features and calculates the additional features to obtain the traffic feature vector; The multi-model fusion module extracts the geographic location information of the Pcap file to obtain a geographic feature vector, and splices the traffic feature vector with the geographic feature vector to obtain a cross-border feature splicing vector, which is output to the trained random forest model and LSTM network model; S3, the random forest model predicts the VPN traffic category according to the cross-border feature concatenation vector to obtain a random forest classification prediction result f _rf (x) is output to the meta-model, and the LSTM network model predicts the VPN traffic category through time series prediction to obtain the LSTM prediction result f _lstm (x) is output to the meta-model, and the meta-model forms a new feature set X based on the random forest classification prediction result and the LSTM prediction result. meta , and then the new feature set X meta Input into the meta-model to predict VPN traffic category and obtain the meta-model prediction probability P(y=1|x): P(y=1|x)=σ(ω0+ω1·f _rf (x)+ω2·f _lstm (x)); Where σ is the sigmoid function, σ(z)=1 / (1+e ^(-z) ), ω0, ω1, ω2 are the weights of logistic regression, and x is the input cross-border feature concatenation vector; The data protocol category of the network traffic is determined based on the threshold and the predicted probability of the meta-model and a detection report is generated, thereby completing a VPN traffic identification method based on multi-model fusion.

2. The VPN traffic identification method based on multi-model fusion according to claim 1 is characterized in that: In step S2, the five-tuple features include source IP, source port, destination IP, destination port and protocol type; The additional features include: uplink packet size mean, uplink packet size standard deviation, uplink interval time mean, uplink interval time standard deviation, uplink packet size, downlink packet size, packet number ratio, packet size ratio, downlink packet size mean, downlink packet size standard deviation, entropy value, response, response ratio, transmission, transmission ratio and timestamp; The uplink packet size is the size of the first 10 uplink packets in the Pcap file, the downlink packet size is the size of the first 10 downlink packets in the Pcap file, and the entropy value is the first 4 entropy values ​​in the Pcap file; The geographical location information includes the country / region of the source IP and the country / region of the destination IP.

3. The VPN traffic identification method based on multi-model fusion according to claim 1 is characterized in that: In step S3, X meta =[f _rf (x),f _lstm (x)]; The data protocol category of the network traffic is Vmess protocol or Shadowsocks protocol.

4. The VPN traffic identification method based on multi-model fusion according to claim 1 is characterized in that: The training method of the random forest model, the LSTM network model and the meta-model comprises the following steps: The machine learning analysis system extracts the stored log data from the machine learning log management system through the data acquisition module, divides the Pcap package into single flows through the multidimensional feature extraction module, performs feature extraction and calculates additional features to obtain the traffic feature vector, extracts the geographic location information through the multi-model fusion module, and fuses it with the traffic feature vector to form the cross-border feature splicing vector, and divides it into a training set, a validation set and a test set; The random forest model and the LSTM network model are trained for VPN traffic category prediction using the training set, and then the random forest model and the LSTM network model are used to predict the validation set and the prediction results are used to train the meta-model, and then the model hyperparameters are adjusted according to the confusion matrix and the ROC curve, and the accuracy of the model is evaluated by cross-validation; hyperparameter adjustment or structural adjustment is performed according to the evaluation results to fine-tune the model until the accuracy of VPN traffic category prediction reaches the target value; finally, the random forest model and the LSTM network model are used to predict the test set, and then the prediction results are spliced ​​and input into the meta-model to predict to obtain the final prediction results.

5. The VPN traffic identification method based on multi-model fusion according to claim 1 is characterized in that: During the recognition and training process, data is transmitted through the SFTP protocol; sensitive data is encrypted, or differential privacy methods are used to process the core data to replace the user's personal identity information and use a unique ID instead.

6. A VPN traffic identification system based on multi-model fusion according to any one of claims 1 to 5, characterized in that: Including machine learning log management system, machine learning analysis system and data collection and analysis system that exchange data through SFTP protocol; The machine learning log management system performs log storage, data management and data backup. The machine learning analysis and judgment system trains and evaluates the machine learning model according to the log data stored in the machine learning log management system and outputs the analysis and judgment results. The data collection and judgment system loads the trained machine learning model to parse the real-time collected network traffic data, integrates the country / region code for feature analysis, generates a test report and sends the test report to the machine learning analysis and judgment system. The machine learning model includes the random forest model, the LSTM network model, and the meta-model connected to the output ends of the random forest model and the LSTM network model, and the input ends of the random forest model and the LSTM network model are connected to the cross-border feature model; The cross-border feature model includes a feature embedding layer, which extracts the traffic feature vector and the geographic feature vector of the Pcap data packet and concatenates the geographic feature vector with the traffic feature vector to obtain the cross-border feature concatenation vector, and then outputs the cross-border feature concatenation vector to the random forest model and the LSTM network model respectively; The random forest model processes the cross-border feature concatenation vector, captures nonlinear relationships, performs traffic classification, and outputs a random forest classification prediction result; The LSTM network model captures the temporal pattern of traffic, analyzes the time dependency in the sequence data to classify traffic and outputs LSTM prediction results; The meta-model is a logistic regression model, which concatenates the random forest classification prediction result and the LSTM prediction result to form a new feature set, and then performs probability prediction based on the new feature set and determines the data protocol category based on a threshold.

7. The VPN traffic identification system based on multi-model fusion according to claim 6 is characterized in that: The machine learning log management system receives log data from different sources through an API interface and stores it in a database, formats the received log data, provides a query interface, supports rapid retrieval and analysis of log data, regularly cleans up expired logs, and regularly backs up log data. The log data includes network traffic logs and system event logs.

8. The VPN traffic identification system based on multi-model fusion according to claim 6 is characterized in that: The machine learning analysis system and the data acquisition and analysis system both include the data acquisition module, the multi-dimensional feature extraction module, the multi-model fusion module, the decision engine and the adaptive optimization module.

9. The VPN traffic identification system based on multi-model fusion according to claim 8 is characterized in that: The multi-dimensional feature extraction module segments and analyzes the first 100 frames of the Pcap file.

10. The VPN traffic identification system based on multi-model fusion according to claim 6 is characterized in that: The meta-model predicts a threat level based on the new feature set.

Images