Training method and detection method of encrypted traffic detection model and electronic device

Abstract

The application relates to the technical field of network security, and discloses a training method and a detection method of an encrypted traffic detection model and an electronic device. The training method of the encrypted traffic detection model comprises the following steps: training a first plaintext traffic model by using plaintext traffic feature data; training a backup plaintext traffic model by using at least part of encrypted traffic feature data to obtain a first encrypted traffic model; cooperatively training the first plaintext traffic model and the first encrypted traffic model by using the encrypted traffic feature data to obtain a second encrypted traffic model; training an adversarial generative network by using the encrypted traffic feature data; distilling training a teacher model and a student model by using the encrypted traffic feature data, and taking the trained student model as the encrypted traffic detection model. The encrypted traffic detection model trained by the application is lightweight and easy to deploy, and can realize high-precision detection of encrypted traffic.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a training method and a detection method of an encrypted traffic detection model and an electronic device. BACKGROUND

[0002] With the wide application of deep learning technology in encrypted malicious traffic detection tasks, many traffic detection problems are solved. However, with the emergence of more and more complex traffic environments and the increasing frequency of malicious software behavior changes, malicious traffic detection models and systems need to respond in a very short time to complete the learning and high-precision detection of new scene traffic data. At the same time, due to the increasing demand for high-precision detection of malicious traffic, the deep learning model applied to malicious traffic detection is becoming more and more complex, and the model structure and model parameters are becoming more and more large, which causes the problem that the related malicious traffic detection model scheme cannot be deployed on devices with less computing resources. At the same time, due to the large model structure, the inference calculation cannot be quickly calculated during detection, which cannot detect and calculate in time and affects the detection and response efficiency. SUMMARY

[0003] Therefore, the embodiments of the present application provide a training method and a detection method of an encrypted traffic detection model and an electronic device. The encrypted traffic detection model trained by the technical solution of the present application is lightweight and easy to deploy, and the encrypted traffic detection model can be used to realize high-precision detection of encrypted traffic.

[0004] The encrypted traffic data can be detected in a lightweight and high-precision manner.

[0005] In a first aspect, the present application provides a training method of an encrypted traffic detection model, which comprises the following steps.

[0006] obtaining a plaintext traffic dataset and an encrypted traffic dataset;

[0007] preprocessing the plaintext traffic dataset and the encrypted traffic dataset to obtain plaintext traffic feature data and encrypted traffic feature data;

[0008] training a first model set by using the plaintext traffic feature data to obtain a first plaintext traffic model;

[0009] backing up the first plaintext traffic model to obtain a backup plaintext traffic model;

[0010] training the backup plaintext traffic model by using at least part of the encrypted traffic feature data to obtain a first encrypted traffic model;

[0011] co-training the first plaintext traffic model and the first encrypted traffic model by using the encrypted traffic feature data to obtain a second encrypted traffic model;

[0012] training the generative adversarial network by using the encrypted traffic feature data, wherein both generators of the generative adversarial network adopt the second encrypted traffic model, and the discriminator of the generative adversarial network adopts the set second model;

[0013] using one of the trained generative adversarial network as a teacher model and using a set third model as a student model, distilling training the teacher model and the student model by using the encrypted traffic feature data, and using the trained student model as the encrypted traffic detection model.

[0014] In a possible implementation of the first aspect, the preprocessing of the plaintext traffic data set and the encrypted traffic data set to obtain the plaintext traffic feature data and the encrypted traffic feature data includes:

[0015] dividing the plaintext traffic data set and the encrypted traffic data set into data respectively to obtain a plurality of plaintext traffic data packets and a plurality of encrypted traffic data packets;

[0016] cleaning the plurality of plaintext traffic data packets and the plurality of encrypted traffic data packets to obtain a plurality of cleaned plaintext traffic data packets and a plurality of cleaned encrypted traffic data packets;

[0017] converting a set field of each cleaned plaintext traffic data packet and each cleaned encrypted traffic data packet into a two-dimensional grayscale image to obtain a plaintext traffic grayscale image and an encrypted traffic grayscale image;

[0018] converting every three two-dimensional grayscale images containing the same IP in the plaintext traffic grayscale image and the encrypted traffic grayscale image into RGB images in time sequence and fusing the RGB images into an RGB image;

[0019] using the plurality of RGB images corresponding to the plaintext traffic grayscale image as the plaintext traffic feature data and using the plurality of RGB images corresponding to the encrypted traffic grayscale image as the encrypted traffic feature data.

[0020] In a possible implementation of the first aspect, the collaborative training of the first plaintext traffic model and the first encrypted traffic model by using the encrypted traffic feature data to obtain the second encrypted traffic model includes:

[0021] inputting the encrypted traffic feature data into the first plaintext traffic model and the first encrypted traffic model respectively, so that the first plaintext traffic model and the first encrypted traffic model complete model inference based on the encrypted traffic feature data respectively;

[0022] performing merging calculation on the binary classification tensors obtained by the first plaintext traffic model and the first encrypted traffic model respectively to obtain a target tensor;

[0023] The target tensor is target knowledge obtained by learning the first plaintext traffic model based on the encrypted traffic feature data, and the first encrypted traffic model is collaboratively trained based on the target knowledge to obtain a second encrypted traffic model.

[0024] In a possible implementation of the first aspect, the distillation training of the teacher model and the student model based on the encrypted traffic feature data comprises:

[0025] The encrypted traffic feature data is input into the teacher model for model training.

[0026] The output vector of the teacher model in the model training process is used as the learning parameter of the student model.

[0027] The encrypted traffic feature data and the learning parameter of the student model are input into the student model for distillation training.

[0028] In a possible implementation of the first aspect, the first model is a ViTAE model, the second model is a ResNet model, and the third model is a ViT model.

[0029] In a possible implementation of the first aspect, the plaintext traffic feature data comprises features and label data of the plaintext traffic, and the encrypted traffic feature data comprises features and label data of the encrypted traffic.

[0030] In a second aspect, the present application provides an encrypted traffic detection method, comprising:

[0031] obtaining network traffic data to be detected,

[0032] inputting the network traffic data to be detected into the encrypted traffic detection model in the first aspect or any possible implementation of the first aspect to perform encrypted traffic detection, and obtaining a detection result.

[0033] In a third aspect, the present application provides a computer-readable storage medium, and the computer-readable storage medium stores instructions, which, when executed on an electronic device, cause the electronic device to perform the training method of the encrypted traffic detection model in the first aspect or any possible implementation of the first aspect, or perform the encrypted traffic detection method in the second aspect.

[0034] In a fourth aspect, the present application provides a computer program product, and the computer program product comprises instructions for implementing the training method of the encrypted traffic detection model in the first aspect or any possible implementation of the first aspect, or implementing the encrypted traffic detection method in the second aspect when executed by one or more processors.

[0035] In a fifth aspect, the present application provides an electronic device, comprising:

[0036] a memory for storing instructions, and

[0037] one or more processors, when the instructions are executed by the one or more processors, the processors perform the training method of the encrypted traffic detection model in the first aspect and any one of the possible implementations of the first aspect, or perform the encrypted traffic detection method in the second aspect.

[0038] Compared with the prior art, the present application has the beneficial effects that:

[0039] The present application trains the backup plaintext traffic model using at least part of the encrypted traffic feature data to obtain a first encrypted traffic model, and cooperatively trains the first plaintext traffic model and the first encrypted traffic model using the encrypted traffic feature data to obtain a second encrypted traffic model, thereby achieving efficient training and learning of the model in encrypted traffic. The second encrypted traffic model is used as two generators of the generative adversarial network, a set second model is used as a discriminator of the generative adversarial network, and the generative adversarial network is trained using the encrypted traffic feature data, so as to improve the discrimination and accuracy of the generative adversarial network for plaintext traffic and encrypted traffic. Then, one of the generators in the trained generative adversarial network is used as a teacher model, a set third model is used as a student model, the teacher model and the student model are distilled and trained using the encrypted traffic feature data, and the trained student model is used as an encrypted traffic detection model. Since the student model is a lightweight model, the encrypted traffic detection model obtained by the technical solution of the present application is convenient to deploy in an edge terminal environment, thereby assisting in realizing lightweight and high-precision detection of encrypted traffic. BRIEF DESCRIPTION OF DRAWINGS

[0040] Figure 1 According to some embodiments of the present application, a flowchart of a training method of an encrypted traffic detection model is shown;

[0041] Figure 2 According to some embodiments of the present application, a brief flowchart of a training method of an encrypted traffic detection model with signal flow is shown;

[0042] Figure 3 According to some embodiments of the present application, a specific flowchart of S12 in Figure 1 is shown;

[0043] Figure 4 According to some embodiments of the present application, a brief flowchart of preprocessing of a plaintext traffic data set and an encrypted traffic data set is shown;

[0044] Figure 5 According to some embodiments of the present application, a specific flowchart of step S16 in Figure 1 is shown;

[0045] Figure 6 According to some embodiments of the present application, a brief flowchart of co-training a first plaintext traffic model and a first encrypted traffic model using encrypted traffic feature data is shown;

[0046] Figure 7 According to some embodiments of the present application, a specific flowchart of step S18 in Figure 1 is shown;

[0047] Figure 8 According to some embodiments of the present application, a flowchart of an encrypted traffic detection method is shown;

[0048] Figure 9 According to some embodiments of the present application, a structural diagram of an electronic device is shown. DETAILED DESCRIPTION

[0049] The illustrative embodiments of the present application include, but are not limited to, a training method of an encrypted traffic detection model, a detection method, and an electronic device.

[0050] The training method of the encrypted traffic detection model provided by the present application trains a backup plaintext traffic model using at least part of the encrypted traffic feature data to obtain a first encrypted traffic model; co-trains a first plaintext traffic model and the first encrypted traffic model using the encrypted traffic feature data to obtain a second encrypted traffic model, thereby achieving efficient training and learning of the model in encrypted traffic. The second encrypted traffic model is used as two generators of a generative adversarial network, a set second model is used as a discriminator of the generative adversarial network, and the generative adversarial network is trained using the encrypted traffic feature data, thereby improving the discrimination and accuracy of the generative adversarial network for plaintext traffic and encrypted traffic. Then, one of the generators in the trained generative adversarial network is used as a teacher model, a set third model is used as a student model, the teacher model and the student model are distilled and trained using the encrypted traffic feature data, and the trained student model is used as an encrypted traffic detection model. Since the student model is a lightweight model, the encrypted traffic detection model obtained by the technical solution of the present application is convenient to deploy in an edge terminal environment, thereby assisting in achieving high-precision detection of encrypted traffic.

[0051] In order to facilitate understanding of the technical solutions of the present application, some professional terms will be explained first as follows.

[0052] (1) Deep Learning: Deep Learning (DL) is a branch of machine learning that mimics the structure and function of the human brain's neural network by constructing multi-layered neural networks for learning and inference. The core idea of deep learning is to learn the representation and feature extraction of data through multiple nonlinear transformations, thereby realizing the learning of complex patterns and abstract concepts.

[0053] The neural network in deep learning is composed of many nodes called neurons, which are arranged in a hierarchical structure. Each node receives input from the previous layer of nodes and performs a nonlinear transformation on the input through an activation function, then passes the result to the next layer of nodes. Through the combination and connection of multiple layers of nodes, the neural network can learn the high-level representation and abstract features of data.

[0054] The training process of deep learning usually uses a large amount of labeled data and the backpropagation algorithm. The backpropagation algorithm calculates the difference between the network output and the expected output, and propagates the error back to each node in the network, thereby adjusting the weights and biases in the network to minimize the error. This process improves the performance and accuracy of the network through repeated iterations. Deep learning has achieved remarkable results in many fields, such as computer vision, natural language processing, speech recognition, etc. It has made many breakthroughs in image classification, object detection, machine translation, speech generation, etc., and is widely used in various practical applications.

[0055] (2) Transfer Learning: Transfer Learning (TL) is an important concept in the field of machine learning, which refers to transferring the knowledge learned from one task to another related task to speed up and improve learning performance. In traditional machine learning, a large amount of labeled data needs to be collected for each task, and the model needs to be trained independently for each task. However, in reality, there is a certain correlation and shared features between many tasks. The goal of transfer learning is to use the knowledge learned to help the learning of new tasks, thereby reducing the demand for labeled data and improving the generalization ability of the model.

[0056] In transfer learning, there are two key concepts: source domain and target domain. The source domain is the task or dataset that has been learned, while the target domain is the new task or dataset to be solved. The core idea of transfer learning is to transfer the knowledge of the source domain to the target domain to speed up the learning process of the target domain.

[0057] (3) GAN: Generative Adversarial Networks (GAN) is a deep learning model composed of a generator and a discriminator, which realizes data generation through adversarial training. The generator is responsible for generating realistic samples from random noise, trying to deceive the discriminator; the discriminator distinguishes between real data and generated samples, and outputs a probability to judge the authenticity. Both continue to optimize in the game: the generator improves the generation quality, and the discriminator enhances the identification ability, and finally reaches Nash equilibrium (the generated samples and real data distribution are difficult to distinguish). The core advantage is that it does not need to explicitly model the data distribution, and it is good at generating high-dimensional data such as images and audio.

[0058] (4) Distillation learning: Knowledge Distillation (KD) is a process of purifying and refining the knowledge obtained. In this distillation process, the model structure of the model with complex and superior prediction accuracy is called the teacher network, and the simplified and low complexity model is called the learning model. By introducing the soft target related to the teacher network as part of the overall loss function, the student network is induced to train, and the knowledge obtained by the teacher network is migrated to the student network, completing the migration of the model with large parameters to the model with small parameters, and in the case of acceptable accuracy drop, the student model completes the inference detection.

[0059] In order to make the purpose, technical scheme and advantages of the present application clearer, the present application will be further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0060] First, combined with Figure 1 and Figure 2 , a training method of an encrypted traffic detection model provided by the present application is described in detail.

[0061] Figure 1 According to some embodiments of the present application, a flowchart of a training method of an encrypted traffic detection model is shown. Figure 2 According to some embodiments of the present application, a brief flowchart of a training method of an encrypted traffic detection model with signal flow is shown.

[0062] Referring to Figure 1 , the training method of the encrypted traffic detection model provided by the present application includes the following steps:

[0063] S11: Obtain plaintext traffic dataset and encrypted traffic dataset.

[0064] Plaintext traffic datasets and encrypted traffic datasets can be selected as needed.

[0065] In some embodiments, the plaintext traffic dataset is selected from the CIRA-CIC-DoHBrw-2020 dataset (a network intrusion detection dataset developed by the Canadian Cyber ​​Security Institute).

[0066] In some embodiments, the encrypted traffic dataset is selected from the IoT-23 dataset (an Internet of Things network traffic dataset developed by a Spanish company).

[0067] S12: Preprocess the plaintext traffic dataset and the encrypted traffic dataset to obtain plaintext traffic feature data and encrypted traffic feature data.

[0068] For example, in some embodiments, denoising and feature enhancement processing are performed on plaintext traffic datasets and encrypted traffic datasets to convert complex traffic datasets into easily processed visual representations. For example, complex traffic datasets are converted into grayscale images, and then the grayscale images are fused to obtain RGB images. At the same time, the key information of the datasets is preserved. Since the amount of data in RGB images is small, the model training time can be reduced when using the preprocessed plaintext traffic feature data and encrypted traffic feature data for model training.

[0069] In some embodiments, the plaintext traffic feature data includes plaintext traffic features and tag data, and the encrypted traffic feature data includes encrypted traffic features and tag data. Therefore, after training a model using either the plaintext or encrypted traffic feature data, the resulting model can not only identify plaintext or encrypted traffic features, but also identify the tags of the plaintext or encrypted traffic.

[0070] The specific process for preprocessing plaintext and encrypted traffic datasets will be detailed below. Figure 3 A detailed introduction will not be provided here.

[0071] S13: Train the first model using plaintext traffic feature data to obtain a first plaintext traffic model. In some embodiments, the first model is a ViTAE model.

[0072] Because the ViTAE model incorporates inductive bias, multi-scale modeling, and an efficient attention mechanism, it outperforms traditional convolutional neural network models in scenarios such as network intrusion detection and anomaly prediction, making it particularly suitable for handling complex, high-dimensional network traffic data. Therefore, using the ViTAE model as the first model and training it with plaintext traffic feature data can result in a first plaintext traffic model with high detection performance in network traffic detection.

[0073] S14: Backup the first plaintext traffic model to obtain the backup plaintext traffic model.

[0074] For example, Figure 4 The example shown is a ViTAE model backup trained based on plaintext traffic. Figure 4 The ViTAE model, which is shown as a "plaintext flow model".

[0075] S15: Train the backup plaintext traffic model using at least a portion of the encrypted traffic feature data to obtain the first encrypted traffic model. In other words, a portion or all of the encrypted traffic feature data can be selected to train the backup plaintext traffic model to obtain the first encrypted traffic model. In this process, transfer learning of the encrypted traffic feature data with label classification is realized, so that the first encrypted traffic model obtained by transfer learning can achieve efficient identification of encrypted traffic.

[0076] For example, using partial data from encrypted traffic feature data to... Figure 4 The result is obtained by fine-tuning ViTAE training based on plaintext traffic training. Figure 4 The example shown is ViTAE fine-tuning based on encrypted traffic.

[0077] S16: Co-train the first plaintext traffic model and the first encrypted traffic model using encrypted traffic feature data to obtain the second encrypted traffic model. This allows the second encrypted traffic model to have a stronger ability to identify encrypted traffic.

[0078] The specific process of co-training the first plaintext traffic model and the first encrypted traffic model using encrypted traffic feature data to obtain the second encrypted traffic model will be described below. Figure 5 A detailed introduction will not be provided here.

[0079] S17: The Generative Adversarial Network (GAN) is trained using encrypted traffic feature data. Both generators in the GAN employ a second encrypted traffic model, while the discriminator uses a predefined second model. This adversarial training process is... Figure 2 The encrypted traffic feature classification enhancement stage is shown.

[0080] In some embodiments, the second model described above is a ResNet model.

[0081] In some embodiments, the two generators described above are respectively input into encrypted traffic feature data, and the output of the generators is input into the ResNet discriminant network. The ResNet discriminant network calculates the similarity labels of the encrypted traffic feature data input by the two generators and compares them with the real similarity labels. The discriminant network and the generator network are corrected and learned through backpropagation, so that the generator has a higher accuracy in detecting and identifying benign and malicious traffic in encrypted traffic.

[0082] S18: Use one of the generators in the trained Generative Adversarial Network as the teacher model and the set third model as the student model. Use encrypted traffic feature data to distill the teacher model and student model for training, and use the trained student model as the encrypted traffic detection model.

[0083] In some embodiments, the third model defined above is the ViT model.

[0084] The specific process of using encrypted traffic feature data to distill and train the teacher and student models, and then using the trained student model as the encrypted traffic detection model, will be detailed below. Figure 7 A detailed introduction will not be provided here.

[0085] The teacher and student models are trained by distillation using encrypted traffic feature data, and the trained student model is used as the encrypted traffic detection model. Since the student model is a lightweight model, the encrypted traffic detection model obtained by the technical solution of this application can be easily deployed in the edge terminal environment, thereby helping to achieve lightweight and high-precision detection of encrypted traffic.

[0086] It is understood that the execution order of steps S11 to S18 above is only an illustration. In other embodiments, other execution orders may be used, and some steps may be split or combined. This is not limited here.

[0087] The following will combine Figure 3 and Figure 4 ,right Figure 1 S12 in the document provides a detailed introduction to the preprocessing process for plaintext traffic datasets and encrypted traffic datasets.

[0088] Figure 3 According to some embodiments of this application, it is shown that Figure 1 S12 in the diagram: A flowchart for preprocessing plaintext traffic datasets and encrypted traffic datasets. Figure 4 According to some embodiments of this application, a simplified flowchart of preprocessing plaintext traffic datasets and encrypted traffic datasets is shown.

[0089] refer to Figure 3Step S12 above: Preprocessing the plaintext traffic dataset and the encrypted traffic dataset to obtain plaintext traffic feature data and encrypted traffic feature data includes the following steps:

[0090] S121: Divide the plaintext traffic dataset and the encrypted traffic dataset into multiple plaintext traffic data packets and multiple encrypted traffic data packets.

[0091] For example, by dividing the plaintext traffic dataset and the encrypted traffic dataset into communication packets, multiple plaintext traffic communication packets and multiple encrypted traffic communication packets can be obtained.

[0092] It should be understood that each communication packet typically consists of two parts: a header and data. The header usually contains information such as the source address, destination address, and protocol type. For example, in TCP / IP (Transmission Control Protocol / Internet Protocol) data packets transmitted at the network layer, the header contains information such as the source / destination IP addresses and protocol type.

[0093] S122: Clean multiple plaintext traffic data packets and multiple encrypted traffic data packets to obtain multiple cleaned plaintext traffic data packets and multiple cleaned encrypted traffic data packets.

[0094] By cleaning multiple plaintext traffic data packets and multiple encrypted traffic data packets, communication packets containing empty source IP addresses and empty destination IP addresses can be filtered out.

[0095] S123: Convert the set fields of each cleaned plaintext traffic data packet and each cleaned encrypted traffic data packet into two-dimensional grayscale images to obtain plaintext traffic grayscale images and encrypted traffic grayscale images.

[0096] In some embodiments, plaintext traffic grayscale and encrypted traffic grayscale are also included. Figure 1 This is called a grayscale image of traffic characteristics.

[0097] The aforementioned settings fields can be selected as needed. For example, in some embodiments, the first 1024 bytes of each cleaned plaintext traffic data packet and each cleaned encrypted traffic data packet can be selected as the aforementioned settings fields. This converts the first 1024 fields of each cleaned plaintext traffic data packet and each cleaned encrypted traffic data packet into a 32*32 two-dimensional grayscale image.

[0098] In some embodiments, if a portion of the cleaned plaintext traffic data packets or the cleaned encrypted traffic data packets is less than 1024 bytes, this portion of the data packets can be padded with 0s to reach 1024 bytes. The padded data packets are then converted into 32*32 two-dimensional grayscale images. Because two-dimensional grayscale images have a low data volume, using data in this format for subsequent model training can improve the model training speed.

[0099] S124: Convert every three two-dimensional grayscale images containing the same IP in both the plaintext traffic grayscale image and the encrypted traffic grayscale image to the red, green, and blue channels in chronological order and then merge them into an RGB image.

[0100] In some embodiments, the RGB graph described above is also referred to as a flow characteristic RGB graph.

[0101] Because RGB images add temporal information to two-dimensional grayscale images, they transform the time dimension into a spatial dimension. This allows models to simultaneously capture both spatial (e.g., packet size distribution) and temporal (e.g., packet traffic trends) characteristics of traffic data. Compared to processing each grayscale image independently, RGB images reduce the number of iterative calculations the model performs on the time series, improving training efficiency.

[0102] S125: Multiple RGB images corresponding to the plaintext traffic grayscale image are used as plaintext traffic feature data, and multiple RGB images corresponding to the encrypted traffic grayscale image are used as encrypted traffic feature data. This reduces the need for multiple iterations of time series calculations during subsequent model training using either plaintext or encrypted traffic feature data in RGB image format, thus improving training efficiency.

[0103] The following will combine Figure 5 and Figure 6 ,right Figure 1 Step S16: The process of using encrypted traffic feature data to co-train the first plaintext traffic model and the first encrypted traffic model to obtain the second encrypted traffic model is described in detail.

[0104] Figure 5 According to some embodiments of this application, it is shown that Figure 1 Step S16: The flowchart of the process of using encrypted traffic feature data to co-train the first plaintext traffic model and the first encrypted traffic model to obtain the second encrypted traffic model. Figure 6 According to some embodiments of this application, a simplified flowchart is shown for co-training a first plaintext traffic model and a first encrypted traffic model using encrypted traffic feature data.

[0105] refer to Figure 5 The above steps Figure 1Step S16: Using encrypted traffic feature data, the first plaintext traffic model and the first encrypted traffic model are co-trained to obtain the second encrypted traffic model, including the following steps:

[0106] S161: Input the encrypted traffic feature data into the first plaintext traffic model and the first encrypted traffic model respectively, so that the first plaintext traffic model and the first encrypted traffic model can complete model inference based on the encrypted traffic feature data respectively.

[0107] Among them, the first plaintext traffic model and the first encrypted traffic model constitute a collaborative training framework.

[0108] S162: Combine the binary classification tensors obtained from the first plaintext traffic model and the first encrypted traffic model to obtain the target tensor.

[0109] S163: The target tensor is used as the target knowledge learned by the first plaintext traffic model based on encrypted traffic feature data. The first encrypted traffic model is then co-trained based on the target knowledge to obtain the second encrypted traffic model.

[0110] Through the above collaborative training, the first encrypted traffic model is further fine-tuned in terms of encrypted traffic knowledge, and the sample learning between encrypted traffic is strengthened, so that the trained second encrypted traffic model has higher recognition accuracy for encrypted traffic in real application scenarios.

[0111] The following is combined with Figure 7 ,right Figure 1 The process of distilling the teacher and student models using encrypted traffic feature data in step S18 is described in detail. (Reference) Figure 7 The distillation training of the teacher and student models using encrypted traffic feature data includes the following steps:

[0112] S181: Input the encrypted traffic feature data into the teacher model for model training.

[0113] S182: Use the output vector of the teacher model during the model training process as the learning parameters of the student model.

[0114] S183: Input the encrypted traffic feature data and the learning parameters of the student model into the student model for distillation training.

[0115] Figure 7 The illustrated embodiments correspond to Figure 2The model is shown in the knowledge distillation stage. In this stage, knowledge distillation is performed on one of the generators in the previously trained adversarial generative network to obtain the encrypted traffic detection model. In this stage, a teacher-student knowledge distillation architecture is adopted, and the encrypted traffic feature data is again used as input to both the teacher model and the student model. The network parameters of the teacher model are the network parameters of one of the generators in the previously trained adversarial generative network; the network function of the student model can be randomly generated.

[0116] exist Figure 7 In the aforementioned model knowledge distillation stage, the number of parameters in the student model network is smaller than that in the teacher model network. By learning the same encrypted traffic feature data through both the teacher and student model networks, and combining the output vector of the teacher model network into the learning parameters of the student model network, the student model network's learning of encrypted traffic feature data is improved. With the cooperation of the teacher model network, the accuracy can be quickly improved and the fitting can be fast and accurate.

[0117] The encrypted traffic detection model trained by the training method of the above embodiments of this application is a lightweight model, which is more convenient to deploy in the edge terminal environment, thereby helping to achieve lightweight and high-precision detection of encrypted traffic.

[0118] In addition, this application also provides a method for detecting encrypted traffic, referencing Figure 8 The encrypted traffic detection method provided in this application includes the following steps:

[0119] S21: Obtain network traffic data to be detected.

[0120] For example, the network traffic data to be inspected is actual network traffic data on the internet. Or, the network traffic data to be inspected is network traffic data within an office environment.

[0121] S22: Input the network traffic data to be detected into the encrypted traffic detection model described above to perform encrypted traffic detection and obtain the detection results.

[0122] In some embodiments, the detection results described above include identification information of the encrypted traffic, which can be used to determine whether the encrypted traffic is malicious.

[0123] Since the encrypted traffic inspection model described above is obtained through the related collaborative training, encrypted traffic feature classification enhancement and model knowledge distillation in the technical solution of this application, the model is not only lightweight and easy to deploy, but also has higher accuracy when used to detect network traffic data, especially encrypted traffic data.

[0124] Embodiments of the present invention also provide an electronic device 600, such as...Figure 9 As shown, the electronic device 600 includes a memory 601 and a processor 602. The memory 601 is used to store computer programs executable by the processor 602; the processor 602 is used to execute the computer programs in the memory 601 to implement the training method or encryption traffic detection method of the encryption traffic detection model provided in any of the above embodiments.

[0125] Figure 9 The electronic device 600 shown also includes a communication interface 603. The processor 602, memory 601, and communication interface 603 are connected via a communication bus and communicate with each other.

[0126] Processor 602 may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits used to control the execution of programs in the above scheme.

[0127] Communication interface 603 is used to communicate with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), Wireless Local Area Networks (WLAN), etc.

[0128] The memory 601 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. The memory may exist independently and be connected to the processor via a bus. The memory may also be integrated with the processor.

[0129] Embodiments of the present invention also provide a computer-readable storage medium storing instructions that, when executed on an electronic device, cause the electronic device to perform the training method or the encrypted traffic detection method of the encrypted traffic detection model provided in any of the above embodiments.

[0130] Embodiments of the present invention also provide a computer program product, the computer program product including instructions, which, when executed by one or more processors, are used to implement a training method for an encrypted traffic detection model or an encrypted traffic detection method as provided in any of the above embodiments.

[0131] Various embodiments of the mechanisms disclosed in this invention can be implemented in hardware, software, firmware, or combinations of these implementations. Embodiments of this invention can be implemented as computer programs or program code executable on a programmable system, the programmable system including at least one processor, a storage system (including volatile and non-volatile memories and / or storage elements), at least one input device, and at least one output device.

[0132] It should be noted that the units / modules mentioned in the various device embodiments of the present invention are all logical units / modules. Physically, a logical unit / module can be a physical unit / module, a part of a physical unit / module, or a combination of multiple physical units / modules. The physical implementation of these logical units / modules themselves is not the most important factor; the combination of functions implemented by these logical units / modules is the key to solving the technical problem proposed by the present invention. Furthermore, to highlight the innovative aspects of the present invention, the above-described device embodiments of the present invention have not introduced units / modules that are not closely related to solving the technical problem proposed by the present invention. This does not mean that the above-described device embodiments do not contain other units / modules.

[0133] It should be noted that in the examples and description of this patent, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one" does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0134] Although the invention has been illustrated and described with reference to certain preferred embodiments thereof, those skilled in the art will understand that various changes in form and detail may be made therein without departing from the spirit and scope of the invention.

Claims

1. A training method for an encrypted traffic detection model, characterized in that, The method includes: Obtain plaintext traffic datasets and encrypted traffic datasets; Preprocess the plaintext traffic dataset and the encrypted traffic dataset to obtain plaintext traffic feature data and encrypted traffic feature data; The first model is trained using the plaintext traffic feature data to obtain the first plaintext traffic model; The first plaintext traffic model is backed up to obtain the backup plaintext traffic model; The backup plaintext traffic model is trained using at least a portion of the encrypted traffic feature data to obtain a first encrypted traffic model; The first plaintext traffic model and the first encrypted traffic model are jointly trained using the encrypted traffic feature data to obtain the second encrypted traffic model. The encrypted traffic feature data is used to train the Generative Adversarial Network (GAN), wherein both generators of the GAN adopt the second encrypted traffic model, and the discriminator of the GAN adopts the set second model. One of the generators in the trained Generative Adversarial Network is used as the teacher model, and the third model is used as the student model. The teacher model and the student model are trained by distillation using the encrypted traffic feature data, and the trained student model is used as the encrypted traffic detection model.

2. The training method for the encrypted traffic detection model according to claim 1, characterized in that, The preprocessing of the plaintext traffic dataset and the encrypted traffic dataset to obtain plaintext traffic feature data and encrypted traffic feature data includes: The plaintext traffic dataset and the encrypted traffic dataset are divided into multiple plaintext traffic data packets and multiple encrypted traffic data packets. Clean the multiple plaintext traffic data packets and the multiple encrypted traffic data packets to obtain multiple cleaned plaintext traffic data packets and multiple cleaned encrypted traffic data packets; The set fields of each cleaned plaintext traffic data packet and each cleaned encrypted traffic data packet are converted into two-dimensional grayscale images to obtain plaintext traffic grayscale images and encrypted traffic grayscale images. The three two-dimensional grayscale images containing the same IP in the plaintext traffic grayscale image and the encrypted traffic grayscale image are converted to the red, green and blue channels in chronological order and then merged into an RGB image. Multiple RGB images corresponding to the plaintext traffic grayscale image are used as plaintext traffic feature data, and multiple RGB images corresponding to the encrypted traffic grayscale image are used as encrypted traffic feature data.

3. The training method for the encrypted traffic detection model according to claim 1, characterized in that, The step of using the encrypted traffic feature data to jointly train the first plaintext traffic model and the first encrypted traffic model to obtain the second encrypted traffic model includes: The encrypted traffic feature data is input into the first plaintext traffic model and the first encrypted traffic model respectively, so that the first plaintext traffic model and the first encrypted traffic model can complete model inference based on the encrypted traffic feature data respectively; The binary classification tensors obtained from the first plaintext traffic model and the first encrypted traffic model are merged and calculated to obtain the target tensor. The target tensor is used as the target knowledge learned by the first plaintext traffic model based on the encrypted traffic feature data. The first encrypted traffic model is then co-trained based on the target knowledge to obtain the second encrypted traffic model.

4. The training method for the encrypted traffic detection model according to claim 1, characterized in that, The process of using the encrypted traffic feature data to perform distillation training on the teacher model and the student model includes: The encrypted traffic feature data is input into the teacher model for model training. The output vector of the teacher model during the model training process is used as the learning parameter of the student model; The encrypted traffic feature data and the learning parameters of the student model are input into the student model for distillation training.

5. The training method for the encrypted traffic detection model according to claim 1, characterized in that, The first model is the ViTAE model; the second model is the ResNet model; and the third model is the ViT model.

6. The training method for the encrypted traffic detection model according to claim 1, characterized in that, The plaintext traffic feature data includes the features of the plaintext traffic and tag data; or The encrypted traffic feature data includes the features of the encrypted traffic and tag data.

7. A method for detecting encrypted traffic, characterized in that, include: Obtain the network traffic data to be detected. The network traffic data to be detected is input into the encrypted traffic detection model as described in any one of claims 1 to 6 to perform encrypted traffic detection and obtain the detection result.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores instructions that, when executed on an electronic device, cause the electronic device to perform the training method for the encrypted traffic detection model as described in any one of claims 1 to 6, or to perform the encrypted traffic detection method as described in claim 7.

9. A computer program product, characterized in that, The computer program product includes instructions that, when executed by one or more processors, implement the training method for the encrypted traffic detection model as described in any one of claims 1 to 6, or implement the encrypted traffic detection method as described in claim 7.

10. An electronic device, characterized in that, include: Memory, used to store instructions, and One or more processors, when the instructions are executed by the one or more processors, perform the training method of the encrypted traffic detection model as described in any one of claims 1 to 6, or perform the encrypted traffic detection method as described in claim 7.

Images