A cross-layer semantic fusion traffic identification method, system, device, and medium

Abstract

This invention discloses a cross-layer semantic fusion traffic identification method, system, device, and medium, relating to the field of network security. The method includes collecting raw data from the network observation side and the semantic side and converting it into encrypted traffic vectors and log vectors carrying consistent timestamps; mapping the log vectors and encrypted traffic vectors to a unified space; calculating the semantic similarity between the log vectors and encrypted traffic vectors; constructing a time proximity weight based on the consistent timestamps; coordinating the time proximity weights and semantic similarity to generate a cross-layer association matrix; constructing a cross-layer heterogeneous inference graph using the unified vector representation and the cross-layer association matrix; mapping the target directed path extracted from the cross-layer heterogeneous inference graph to a target state vector; matching the target state vector with a reference vector; and determining the encrypted traffic identification result based on the matching result to improve the reliability of encrypted network communication.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a cross-layer semantic fusion traffic identification method, system, device, and medium. Background Technology

[0002] With the widespread deployment of cloud computing, the Internet of Things, and distributed systems, the encryption rate of network communications continues to rise, and encryption protocols such as TLS and QUIC have become the main transmission methods. Encryption mechanisms effectively protect data privacy and transmission security, but they also mask the semantic information of network traffic, posing challenges to the identification and analysis of encrypted traffic.

[0003] In real-world network operations, the behavioral characteristics of encrypted communication often span different system layers. However, existing identification models have structural limitations, enabling only single-layer feature analysis in actual network operations and failing to fully describe the causal chain, resulting in a lack of global consistency in the identification system.

[0004] Therefore, how to effectively identify encrypted traffic and improve the reliability of encrypted network communication has become a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] This invention provides a traffic identification method, system, device, and medium based on cross-layer semantic fusion, which solves the problem of how to perform cross-layer semantic association based on the traffic side and the semantic side, thereby improving identification efficiency and accuracy.

[0006] To address the aforementioned technical problems, embodiments of the present invention provide a cross-layer semantic fusion traffic identification method, comprising: Raw data is collected from the network observation and semantic sides and transformed into encrypted traffic vectors and log vectors carrying consistent timestamps; The log vector and the encrypted traffic vector are mapped to a unified space to obtain a unified vector representation, and the semantic similarity between the log vector and the encrypted traffic vector is calculated in the unified space. Based on the consistent timestamp, a time proximity weight is constructed, and the time proximity weight and the semantic similarity are combined to generate a cross-layer association matrix; Using the unified vector representation and the cross-layer association matrix, a cross-layer heterogeneous inference graph is constructed; The target directed path extracted from the cross-layer heterogeneous inference graph is mapped to a target state vector, and the target state vector is matched with a reference vector to determine the encrypted traffic identification result based on the matching result.

[0007] Furthermore, the process of generating the log vector includes: The raw log data collected from the semantic side will be encoded to obtain the initial log vector; Construct a sample set labeled with log template categories and keywords, and train a probability distribution model containing a linear mapping structure using the sample set; The trained probability distribution model is integrated onto the initial log vector to extract key information, thus obtaining the log vector.

[0008] Furthermore, the step of constructing the time proximity weight based on the consistent timestamp includes: The time difference between the first consistent timestamp corresponding to the encrypted traffic vector and the second consistent timestamp corresponding to the log vector is quantitatively calculated. By introducing a decay parameter in conjunction with the time difference, the time proximity weight between each node corresponding to the log vector and the node corresponding to the encrypted traffic vector is determined.

[0009] Furthermore, the step of coordinating the temporal proximity weights and the semantic similarity to generate a cross-layer association matrix includes: The semantic similarity is mapped to a non-negative correlation coefficient, and the initial association strength of each node pair corresponding to the log vector and the encrypted traffic vector is determined by multiplying the non-negative correlation coefficient with the time proximity weight. When the normalization result of the initial association strength satisfies the first preset condition, a directed edge is generated between the corresponding node pairs; The cross-layer association matrix is ​​generated based on the directed edges.

[0010] Furthermore, the construction of a cross-layer heterogeneous inference graph using the unified vector representation and the cross-layer association matrix includes: A node feature set is established using the unified vector representation; Based on the cross-layer association matrix, corresponding edge relationships are generated, and time decay weights are assigned to each edge relationship to construct an edge set. The cross-layer heterogeneous inference graph is generated using the node feature set and the edge set.

[0011] Furthermore, mapping the target directed path extracted from the cross-layer heterogeneous inference graph into a target state vector includes: Extract the target directed path of a preset length from the cross-layer heterogeneous inference graph, and mark each directed path with a substructure to obtain a weighted multiset; The weighted multiset is mapped to the target state vector.

[0012] Furthermore, the step of matching the target state vector with the reference vector to determine the encrypted traffic identification result based on the matching result includes: Calculate the similarity between the target state vector and each of the reference vectors in the pre-established vector library; When the calculation result meets the second preset condition, the encrypted traffic identification result is determined.

[0013] Another embodiment of the present invention provides a cross-layer semantic fusion traffic identification system, comprising: The data vectorization module is used to collect raw data from the network observation side and the semantic side and transform it into encrypted traffic vectors and log vectors carrying consistent timestamps; The vector unification module is used to map the log vector and the encrypted traffic vector to a unified space to obtain a unified vector representation, and to calculate the semantic similarity between the log vector and the encrypted traffic vector in the unified space; The cross-layer association module is used to construct a time proximity weight based on the consistent timestamp, and coordinate the time proximity weight and the semantic similarity to generate a cross-layer association matrix; The inference graph construction module is used to construct a cross-layer heterogeneous inference graph using the unified vector representation and the cross-layer association matrix; The traffic identification module is used to map the target directed path extracted from the cross-layer heterogeneous inference graph into a target state vector, and match the target state vector with a reference vector to determine the encrypted traffic identification result based on the matching result.

[0014] Another embodiment of the present invention provides a computer device including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the cross-layer semantic fusion traffic identification method as described above.

[0015] Another embodiment of the present invention provides a computer-readable storage medium storing a computer program, wherein when the device containing the computer-readable storage medium executes the computer program, it implements the cross-layer semantic fusion traffic identification method as described above.

[0016] Compared with the prior art, the beneficial effects of the embodiments of the present invention are at least one of the following: This embodiment transforms encrypted traffic and log data into vectors carrying consistent timestamps, achieving time alignment of cross-layer data and improving the accuracy of subsequent cross-layer correlation analysis. By mapping heterogeneous data to a unified vector space and calculating semantic similarity, the computability of cross-layer semantic correlation is enhanced. By combining temporal proximity weights and semantic similarity to construct a cross-layer correlation matrix, the reliability of inter-node correlations is improved, thereby enhancing the comprehensiveness and accuracy of identification. By constructing a cross-layer heterogeneous inference graph with time decay weights, the adaptability of the identification system to real-time traffic changes is ensured. By encoding directed paths in the inference graph into target state vectors and matching them with reference vectors, the accuracy and efficiency of encrypted traffic identification in large-scale concurrency and complex network scenarios are guaranteed. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the traffic identification method through cross-layer semantic fusion in one embodiment of the present invention; Figure 2 This is a schematic diagram of the cross-layer semantic fusion traffic identification system structure in one embodiment of the present invention; Figure 3 This is a structural block diagram of a preferred embodiment of a computer device provided by the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0019] In the description of this application, the terms "first," "second," "third," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined with "first," "second," "third," etc., may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0020] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to fixed connections, detachable connections, or integral connections; they can refer to mechanical connections or electrical connections; they can refer to direct connections or indirect connections through an intermediate medium; and they can refer to the internal communication between two components. The terms "vertical," "horizontal," "left," "right," "upper," "lower," and similar expressions used herein are for illustrative purposes only and do not indicate or imply that the device or component referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as limiting the invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0021] In the description of this application, it should be noted that, unless otherwise defined, all technical and scientific terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art. The terminology used in this specification is for the purpose of describing specific embodiments only and is not intended to limit the invention. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0022] One embodiment of the present invention provides a traffic identification method based on cross-layer semantic fusion. For details, please refer to [link to relevant documentation]. Figure 1 , Figure 1 The diagram shown illustrates a flow chart of a cross-layer semantic fusion traffic identification method according to one embodiment of the present invention, including the following steps: S1. Collect raw data from the network observation side and semantic side and transform it into encrypted traffic vectors and log vectors carrying consistent timestamps.

[0023] In one specific implementation described in this embodiment, the experimental environment was chosen as an Ubuntu 20.04 LTS (64-bit) operating system, Python 3.10, with main dependencies including PyTorch 2.2, Transformers 4.40, scikit-learn 1.5, and NetworkX 3.2, used for model training, semantic parsing, and graph structure construction. The hardware configuration consisted of a 32-core CPU, 128GB of RAM, and an NVIDIA A100 GPU (40GB of VRAM). Under this configuration, the overall process verification of data acquisition, semantic information extraction and synchronous encoding, inference graph construction, and encrypted traffic identification based on the inference graph was completed.

[0024] This step involves data acquisition and preprocessing. Specifically, raw data is collected from the network observation side and the system semantic side, and then time-standardized, formatted, and cleaned to lay the foundation for cross-layer fusion.

[0025] For example, the raw encrypted traffic data collected from the network observation side includes: TLS handshake characteristics, QUIC handshake characteristics, certificate digests, JA3 fingerprints, and flow-level statistics, etc. Then, based on this encrypted traffic data, time-consistent encoding is performed, thus providing time-consistent encoding for each i-th encrypted session. The encoding process is represented as follows: in, Indicates a splicing operation; This is the encrypted traffic vector; For the UTC timestamp of the encrypted session; For the output of the time encoder, by the pair Sine / cosine position encoding and the logarithmic time interval between adjacent events obtained by piecing together; , These represent the embedded results of the TLS and QUIC protocol handshake states, respectively. This is a vectorized representation of the JA3 fingerprint; The certificate chain embedding vector contains the serialized result of the subject, issuer, SAN, validity period, and public key information. The flow-level statistical characteristic vector is obtained by normalizing and linearly transforming the packet length distribution, direction sequence, and round-trip time delay.

[0026] Preferably, the time encoding dimension is set to 32, the TLS / QUIC embedding dimension is 128, the JA3 fingerprint embedding dimension is 64, the certificate chain embedding dimension is 256, and the stream-level statistics embedding dimension is 64. The final concatenated encrypted traffic vector is obtained. It is represented by a 672-dimensional fixed-length representation. This representation ensures that the same encrypted session is comparable and computable in both the temporal and protocol semantic dimensions.

[0027] Log vectors, on the other hand, are generated by encoding the raw log data collected from the semantic side into an initial log vector that is isomorphic and aligned with the traffic side. For example, the collected raw log text is first segmented into words, specifically the i-th log text... Word segmentation yields a word sequence. In this example, the log data averages 50–120 words in length, and is uniformly truncated to a maximum of 256 tokens.

[0028] Add semantic tag vectors to the beginning of the word sequence And concatenate the semantic domain encoding vector , get input , is represented as: in, This represents the word sequence obtained after word segmentation. The first in The word embedding vector corresponding to each word is obtained by mapping from the pre-trained word embedding matrix or the word embedding layer of the encoder. Its dimension is consistent with the hidden size of the encoder and is used to represent the semantic information of the nth word in the log text.

[0029] In this example, the semantic tag vector dimension is set to 64, and the first tag embedding dimension is the same as the encoder hidden size, both being 768.

[0030] Will Input encoder Obtain hidden state output , is represented as: in, For encoder parameters, This is the aggregated semantic vector corresponding to the first tag of the sequence.

[0031] Preferably, the encoder It adopts the BERT-base structure, with a hidden size of 768 and a vocabulary size of 30K.

[0032] Then log vector Represented as: in, For content-level average, For time encoding consistent with the encrypted traffic vector, This is the UTC timestamp of the log. In this example, the dimension of the time location vector is set to 32, and the final concatenated log vector is an 864-dimensional representation.

[0033] It is worth noting that, in order to enable the log semantic representation to adapt to different business domains, this embodiment uses the initial log vector, i.e., the aggregated semantic vector, from the output of the aforementioned log bias code. A task layer structure is established above to identify log template categories and key field ranges. Specifically, a sample set labeled with log template categories and keywords is constructed. In this embodiment, we use... Let the sample set be denoted as , where For log template categories, A set of annotations for key fields.

[0034] Train a linear mapping structure using a sample set. The probability distribution model is integrated into the initial log vector to extract key information. The extracted key information includes user ID, process name, service identifier, and two operation types, which are uniformly mapped to embedding vectors to obtain the final log vector representation. Specifically, it identifies the probability distribution of template categories and key fields by driving a probability distribution model, as expressed by the following formula: in, It is a learnable classification weight matrix. It is a bias term. It is the log semantic vector output by the encoder, that is, the aggregate semantic vector corresponding to the first marker of the sequence in the log vector construction phase. The Softmax function will linearly combine... Transform it into a category probability distribution.

[0035] The Softmax function calculates the j-th log sample by converting the log odds of each class into a normalized probability value. Belongs to various categories probability This allows for the accurate extraction of necessary subject (such as user, process) and service entity information from logs, adapting to different business domains. For example, for the video website business domain, it identifies the log template category "Login Successful".

[0036] S2. Map the log vector and encrypted traffic vector to a unified space to obtain a unified vector representation, and calculate the semantic similarity between the log vector and the encrypted traffic vector in the unified space.

[0037] To ensure dimensional consistency and metric comparability in subsequent cross-layer correlation calculations, a unified feature representation space is established between the traffic side and the log side, represented as: In the formula, , These are linear projection matrices, used to perform structural mapping on data from different sources within a unified inference space. Through linear transformation, they maintain the directionality and proportional relationship between features, enabling cross-source information to have computable similarity on a numerical scale. , These are the unified vector representations of the traffic side and the log side in the unified space, respectively.

[0038] Furthermore, semantic similarity between log vectors and encrypted traffic vectors is calculated in a unified space. , means as follows: This embodiment performs similarity calculations to compute the temporal proximity and semantic relevance between cross-layer observations in a unified space, providing a foundation for establishing inference edges in the future.

[0039] S3. Construct time proximity weights based on consistent timestamps, coordinate time proximity weights and semantic similarity to generate a cross-layer association matrix.

[0040] In this embodiment, at each node pair of traffic and logs Based on this, the time difference between the first consistent timestamp corresponding to the encrypted traffic vector and the second consistent timestamp corresponding to the log vector is quantitatively calculated. Then, a decay parameter is introduced to coordinate the time difference, and the time proximity weight between each node corresponding to the log vector and the node corresponding to the encrypted traffic vector is determined. Specifically, it is expressed as follows: In the formula, This indicates the temporal proximity between traffic events and log events. The closer the proximity is to 1, the higher the temporal proximity, ensuring that only events that are reasonably close in time are considered to be associated; λ>0; In this embodiment, the spatial dimension is set to 256, and the coefficient λ=0.05.

[0041] The previously obtained semantic similarity is mapped to a non-negative correlation coefficient, expressed as: Time weight non-negative correlation coefficient These respectively reflect the proximity of events along the timeline and in the semantic space. The two are used together to construct the reasoning edge weights, specifically: The initial correlation strength of the node pairs corresponding to each log vector and encrypted traffic vector is determined by multiplying the non-negative correlation coefficient by the time proximity weight. , means as follows: For each traffic node, according to its corresponding set of candidate log nodes Normalize: in, Indicates at the traffic node Candidate log node set Internal, log nodes and The relative proportion of correlation strength, when the normalized result of the initial correlation strength When the first preset condition is met, a directed edge is generated between the corresponding node pairs. For example, let... A threshold is established for association to determine whether it is at a traffic node. With log nodes Cross-layer directed edges are generated between them. If the node pair is considered to have a sufficiently high relative correlation strength within the candidate set, a directed edge is generated; otherwise, no edge is established to suppress noise correlation and control the sparsity of the graph structure.

[0042] In this embodiment, the design The purpose is to select suitable edges, that is, the normalized correlation strength between node pairs. An edge is considered highly reliable only if it meets a threshold requirement. (For example, setting a threshold...) =0.5, if If the value is greater than 0.5, then at node and Directed edges are established between nodes. This normalized association strength also carries a temporal proximity weight, which can select directed edges between node pairs that are temporally close and have high association strength. Then, a cross-layer association matrix is ​​generated based on these directed edges, thus laying an accurate data foundation for the establishment of candidate heterogeneous inference graphs.

[0043] S4. Construct a cross-layer heterogeneous inference graph using a unified vector representation and a cross-layer association matrix.

[0044] First, a set of node features is established using a unified vector representation. An example of the specific process is shown below: In a sliding window at time T Let the set of nodes be... Specifically: in, Encrypting session nodes; The main nodes (users, processes, and services); For certificate nodes; This is a fingerprint node.

[0045] Each node Corresponding to a vector feature Then the set This is called node feature mapping. Based on this, for each encrypted session... Its node feature representation That is: Logs associated with this encrypted session Construct the subject based on the semantic meaning of the roles it contains. With service entity nodes , means as follows: in, , It is a type-derived operator used to distinguish the semantic projection between the behavior initiator and the service provider.

[0046] For certificates and fingerprint nodes, features are directly encoded to generate features: in, , All are linear transformation operators; For the k-th certificate node Node feature vectors in a cross-layer heterogeneous inference graph; For the q-th JA3 fingerprint node Node feature vectors in a cross-layer heterogeneous inference graph.

[0047] At this point, all nodes All obtain a unique vector representation Node feature set A feature space is defined on the cross-layer heterogeneous inference graph.

[0048] Next, based on the cross-layer association matrix, corresponding edge relationships are generated, and each edge relationship is assigned a time decay weight to construct the edge set. The following example illustrates the edge set generation process in detail: In the window Within, for any session node The corresponding edge relation generation process is as follows: 1. If the certificate was verified during the handshake. Generate edges ( bind_cert); 2. If carrying a JA3 fingerprint Generate edges ( , has_ja3); 3. If the log indicates that the session was initiated by the main body within a reasonable timeframe. Initiating or with service entities Interact to generate edges respectively ,initated_by), ( (served_by).

[0049] bind_cert, has_ja3, initiated_by, and served_by are relation types. The set of these relation types is denoted as . .

[0050] For each edge ,in and These are the start and end nodes in the cross-layer heterogeneous inference graph, respectively. For node pairs The relationship type is defined as follows: Let the time anchors of the endpoint nodes be respectively... and Define the timestamp of this edge. Time interval , This serves as the time anchor for the endpoint nodes. Based on this, each edge is assigned a time decay weight. , means as follows: in, For relation types The relevant attenuation coefficient; Reflecting the temporal consistency of events: events that are closer in time have a higher association weight.

[0051] To facilitate matrix operations, based on relation type Construct a weighted adjacency matrix The details are as follows: Finally, using the node feature set and edge set, the required cross-layer heterogeneous inference graph is generated. In this embodiment, the cross-layer heterogeneous inference graph is defined as follows: In the formula, Let be the set of edges, by Label the edge types. It's worth noting that this step groups the aforementioned nodes and edges within the window. Incremental assembly is performed within the system, and updatable graph snapshots are generated using deterministic serialization rules. The specific rules are as follows: When the window slides to a new moment At that time, the timestamp was removed earlier than The nodes and edges are identified, and then, for multiple edges generated from the same pair of endpoints and relation types, they are summed or the maximum value is taken according to time weights for merging, ensuring the sparsity and consistency of the graph structure. An index mapping is generated based on the node type priority and lexicographical order, as shown below: Based on this, the adjacency matrix and the node feature matrix determined by the features of each node are compared. Perform serialization output. This serialization result serves as the input interface for subsequent steps, ensuring that different runtimes or devices obtain a consistent cross-layer heterogeneous inference graph representation of the same window data, thereby supporting real-time identification and result reproducibility of cross-layer streaming inference.

[0052] S5. Map the target directed path extracted from the cross-layer heterogeneous inference graph to a target state vector, and match the target state vector with the reference vector to determine the encrypted traffic identification result based on the matching result.

[0053] This step is the identification process based on the cross-layer heterogeneous inference graph. First, it is necessary to extract the target directed path of a preset length from the cross-layer heterogeneous inference graph. For example, the cross-layer heterogeneous inference graph... any starting node in The length is selected based on the time consistency constraint. Targeted path , Indicates the relation type corresponding to a directed edge: Furthermore, based on the time decay weight previously assigned to each edge, the time weight of each target directed path is determined. : in, This refers to the edge order index in path π. For the first in the path A directed edge, which consists of pairs of adjacent nodes. and the corresponding relation types constitute; This represents the time decay weight corresponding to the directed edge.

[0054] To distinguish different event chains in terms of timing and structure, each directed path is encoded as a substructure tag, as shown below: Where type(·) represents the node type. , This is the time interval quantization function.

[0055] Obtain weighted multiset : Furthermore, the weighted multiset is mapped to the target state vector using a fixed-length sparse projection. Let the projection dimension be B, and select... Group Independent Hash Parameters and large prime numbers ,in Indicates the first Each independent hash projection These are the parameters used for the index hash function. These are the parameters used in the symbolic hash function.

[0056] Then, for any substructure, mark tok string hashing Calculate the integer fingerprint, then calculate the first... Group Index With sign bit Specifically, it is expressed as follows: When a new timing sequence is added to the window - Substructure hour( That is, the timing sequence - The substructure corresponds to the directed path of the target. Time weight ), for all sparse projection stages, the th Indexes of group-independent hash projections Perform a constant-step update to obtain the target state vector. Specifically, it is expressed as follows: The similarity between the target state vector and each reference vector in the pre-established vector library is calculated. When the calculation result meets a second preset condition, the encrypted traffic identification result is determined. In some embodiments of the present invention, a prototype library P is pre-established: in, For the first Encrypted traffic, This serves as its reference vector. The target state vector for the current window is obtained by averaging the historical window states during online recognition. The cosine similarity with each reference vector is calculated using the following formula: With formula Perform a match, if If so, it is determined to be a category. This is used as the identification result, where A threshold is set (which can be obtained based on statistical analysis of historical data, such as the similarity distribution between known samples and corresponding category reference vectors). Otherwise, it is considered unknown or pending processing.

[0057] In summary, this embodiment determines encrypted traffic vectors and log vectors from two levels: the network observation side and the semantic side, and maps them to a unified space, laying the foundation for subsequent cross-layer information fusion. By calculating the semantic similarity between the two, and collaboratively constructing a time proximity weight based on their consistent timestamps, a cross-layer association matrix is ​​established. Using the unified vector representation and the cross-layer association matrix, a cross-layer heterogeneous inference graph with cross-layer association expression and dynamic weight adjustment is constructed. Finally, by matching and identifying traffic from the cross-layer heterogeneous inference graph, the accuracy and stability of encrypted traffic identification are maintained while keeping high-concurrency processing performance high.

[0058] One embodiment of the present invention provides a cross-layer semantic fusion traffic identification system. For details, please refer to [link to relevant documentation]. Figure 2 , Figure 2 The diagram shown illustrates the structure of a cross-layer semantic fusion traffic identification system according to one embodiment of the present invention, including: The data vectorization module M1 is used to collect raw data from the network observation side and the semantic side and transform it into encrypted traffic vectors and log vectors carrying consistent timestamps; The vector unification module M2 is used to map the log vector and the encrypted traffic vector to a unified space to obtain a unified vector representation, and to calculate the semantic similarity between the log vector and the encrypted traffic vector in the unified space; The cross-layer association module M3 is used to construct a time proximity weight based on the consistent timestamp, and to generate a cross-layer association matrix by coordinating the time proximity weight and the semantic similarity. The inference graph construction module M4 is used to construct a cross-layer heterogeneous inference graph using the unified vector representation and the cross-layer association matrix; The traffic identification module M5 is used to map the target directed path extracted from the cross-layer heterogeneous inference graph into a target state vector, and match the target state vector with a reference vector to determine the encrypted traffic identification result based on the matching result.

[0059] like Figure 3 As shown, this embodiment of the invention also provides a computer device. Figure 3 This is a structural block diagram of a preferred embodiment of a computer device provided by the present invention. The computer device includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the method described above.

[0060] Preferably, the computer program can be divided into one or more modules / units (such as computer program 1, computer program 2, ...), and the one or more modules / units are stored in the memory and executed by the processor to complete the present invention. The one or more modules / units can be a series of computer program instruction segments capable of performing specific functions, and the instruction segments are used to describe the execution process of the computer program in the computer device.

[0061] The processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor, or the processor can be any conventional processor. The processor is the control center of the terminal device, connecting various parts of the terminal device through various interfaces and lines.

[0062] The memory mainly includes a program storage area and a data storage area. The program storage area can store the operating system, applications required for at least one function, etc., while the data storage area can store related data, etc. Furthermore, the memory can be a high-speed random access memory, or a non-volatile memory, such as a plug-in hard drive, a SmartMedia Card (SMC), a Secure Digital (SD) card, and a Flash Card, or other volatile solid-state storage devices.

[0063] It should be noted that the aforementioned terminal devices may include, but are not limited to, processors and memory, as will be understood by those skilled in the art. Figure 3 The structural block diagram is merely an example of a terminal device and does not constitute a limitation on the terminal device. It may include more or fewer components than shown, or combine certain components, or use different components. Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium may be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0064] Accordingly, embodiments of the present invention provide a computer-readable storage medium, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the steps in the method of the above embodiments, for example... Figure 1 Steps S1 to S5 as described above.

[0065] The technical features and effects of the cross-layer semantic fusion traffic identification system proposed in this embodiment of the invention are the same as those of the cross-layer semantic fusion traffic identification method proposed in this embodiment of the invention, and will not be repeated here.

[0066] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

Claims

1. A traffic identification method based on cross-layer semantic fusion, characterized in that, include: Raw data is collected from the network observation and semantic sides and transformed into encrypted traffic vectors and log vectors carrying consistent timestamps; The log vector and the encrypted traffic vector are mapped to a unified space to obtain a unified vector representation, and the semantic similarity between the log vector and the encrypted traffic vector is calculated in the unified space. Based on the consistent timestamp, a time proximity weight is constructed, and the time proximity weight and the semantic similarity are coordinated to generate a cross-layer association matrix; specifically, the semantic similarity is mapped to a non-negative correlation coefficient, and the initial association strength of each log vector and the encrypted traffic vector corresponding node pair is determined by the product of the non-negative correlation coefficient and the time proximity weight. When the normalization result of the initial association strength satisfies the first preset condition, a directed edge is generated between the corresponding node pairs; Generate the cross-layer association matrix based on the directed edges; Using the unified vector representation and the cross-layer association matrix, a cross-layer heterogeneous inference graph is constructed; The target directed path extracted from the cross-layer heterogeneous inference graph is mapped to a target state vector, and the target state vector is matched with a reference vector to determine the encrypted traffic identification result based on the matching result.

2. The cross-layer semantic fusion traffic identification method as described in claim 1, characterized in that, The process of generating the log vector includes: The raw log data collected from the semantic side will be encoded to obtain the initial log vector; Construct a sample set labeled with log template categories and keywords, and train a probability distribution model containing a linear mapping structure using the sample set; The trained probability distribution model is integrated onto the initial log vector to extract key information, thus obtaining the log vector.

3. The cross-layer semantic fusion traffic identification method as described in claim 1, characterized in that, The step of constructing the time proximity weight based on the consistent timestamp includes: The time difference between the first consistent timestamp corresponding to the encrypted traffic vector and the second consistent timestamp corresponding to the log vector is quantitatively calculated. By introducing a decay parameter in conjunction with the time difference, the time proximity weight between each node corresponding to the log vector and the node corresponding to the encrypted traffic vector is determined.

4. The cross-layer semantic fusion traffic identification method as described in claim 1, characterized in that, The construction of a cross-layer heterogeneous inference graph using the unified vector representation and the cross-layer association matrix includes: A node feature set is established using the unified vector representation; Based on the cross-layer association matrix, corresponding edge relationships are generated, and time decay weights are assigned to each edge relationship to construct an edge set. The cross-layer heterogeneous inference graph is generated using the node feature set and the edge set.

5. The cross-layer semantic fusion traffic identification method as described in claim 1, characterized in that, The step of mapping the target directed path extracted from the cross-layer heterogeneous inference graph into a target state vector includes: Extract the target directed path of a preset length from the cross-layer heterogeneous inference graph, and mark each directed path with a substructure to obtain a weighted multiset; The weighted multiset is mapped to the target state vector.

6. The cross-layer semantic fusion traffic identification method as described in claim 5, characterized in that, The step of matching the target state vector with the reference vector and determining the encrypted traffic identification result based on the matching result includes: Calculate the similarity between the target state vector and each of the reference vectors in the pre-established vector library; When the calculation result meets the second preset condition, the encrypted traffic identification result is determined.

7. A cross-layer semantic fusion traffic identification system, characterized in that, include: The data vectorization module is used to collect raw data from the network observation side and the semantic side and transform it into encrypted traffic vectors and log vectors carrying consistent timestamps; The vector unification module is used to map the log vector and the encrypted traffic vector to a unified space to obtain a unified vector representation, and to calculate the semantic similarity between the log vector and the encrypted traffic vector in the unified space; The cross-layer association module is used to construct a time proximity weight based on the consistent timestamp, and coordinate the time proximity weight and the semantic similarity to generate a cross-layer association matrix; specifically, the semantic similarity is mapped to a non-negative correlation coefficient, and the initial association strength of each log vector and the encrypted traffic vector corresponding node pair is determined by the product of the non-negative correlation coefficient and the time proximity weight. When the normalization result of the initial association strength satisfies the first preset condition, a directed edge is generated between the corresponding node pairs; Generate the cross-layer association matrix based on the directed edges; The inference graph construction module is used to construct a cross-layer heterogeneous inference graph using the unified vector representation and the cross-layer association matrix; The traffic identification module is used to map the target directed path extracted from the cross-layer heterogeneous inference graph into a target state vector, and match the target state vector with a reference vector to determine the encrypted traffic identification result based on the matching result.

8. A computer device, characterized in that, The method includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the cross-layer semantic fusion traffic identification method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein when the device containing the computer-readable storage medium executes the computer program, it implements the cross-layer semantic fusion traffic identification method as described in any one of claims 1 to 6.

Images