An encrypted traffic anomaly mining and sample generation method

Abstract

This invention relates to the interdisciplinary field of network security and artificial intelligence, and discloses a method for anomaly mining and sample generation in encrypted traffic. The method includes: data collection and preprocessing to construct a dataset of normal encrypted traffic under multiple scenarios and a dataset of a small number of real malicious samples; deep behavioral modeling of normal encrypted traffic under multiple scenarios based on a large model to construct a baseline security behavior knowledge base; fine-grained comparison of the features of the encrypted traffic to be detected with normal traffic based on an improved contrastive learning algorithm to mine hidden anomaly features; generating encrypted malicious samples based on a controllable generation architecture of the large model, combining hidden anomaly features and known attack patterns; optimizing the encrypted traffic anomaly detection model using the generated encrypted malicious samples, and feeding the optimized encrypted traffic anomaly detection model back to the anomaly feature mining stage to form a closed-loop iterative optimization system. Using this invention, the accuracy, generalization, and real-time performance of encrypted traffic anomaly detection can be improved.

Description

Technical Field

[0001] This invention relates to the field of interdisciplinary technology of network security and artificial intelligence, specifically to a method for detecting and generating samples of encrypted traffic anomalies. Background Technology

[0002] With the rapid development of network communication technology, data encryption technology has become a core means of ensuring network communication privacy and security. Statistics show that 90% of global network traffic is now encrypted. While protecting the privacy of legitimate user data, encryption technology also provides a covert platform for malicious attacks. Attackers use methods such as encrypted tunnels, private encrypted Trojans, and zero-day attacks to hide malicious traffic within legitimate encrypted traffic, circumventing traditional security detection methods and posing a serious threat to network security.

[0003] Currently, anomaly detection in encrypted traffic has become a research hotspot and technical challenge in the field of cybersecurity. Its core requirement is to accurately identify malicious behavior in encrypted traffic, especially new and unknown encrypted attacks, without decrypting the traffic content.

[0004] Currently, the technical solutions for detecting anomalies in encrypted traffic in the industry are mainly divided into three categories, and each type of solution has obvious defects, which are analyzed in detail below: 1. Traditional feature matching and statistical analysis methods.

[0005] The core idea of ​​this type of method is to manually extract the surface statistical features of encrypted traffic (such as packet size, number of sessions, connection duration, and protocol fields), and make anomaly judgments based on preset thresholds or rules. Some solutions combine simple statistical models (such as Poisson distribution and Gaussian distribution) to achieve anomaly identification.

[0006] The shortcomings of this type of method are quite prominent: First, it heavily relies on manual feature engineering, and the features extracted manually are often superficial and coarse-grained, unable to capture the hidden fine-grained abnormal features in encrypted traffic, and are completely ineffective against new and unknown attacks; Second, it has poor adaptability, as the normal traffic characteristics of different scenarios (such as encrypted traffic for short videos and encrypted traffic for office use) vary greatly, and preset rules and thresholds are difficult to adapt to multiple application scenarios, easily resulting in a large number of false positives and false negatives; Third, it cannot cope with the iterative upgrades of encryption protocols. New protocols such as TLS 1.3 simplify the handshake process and hide more protocol details, rendering traditional feature extraction methods ineffective; Fourth, it does not involve sample generation, cannot solve the problem of the scarcity of malicious samples, and the detection model cannot be continuously optimized.

[0007] 2. Traditional machine learning and common deep learning methods.

[0008] This type of method applies traditional machine learning algorithms (such as Support Vector Machines (SVM), Random Forests (RF), and Logistic Regression (LR)) and common deep learning models (such as Convolutional Neural Networks (CNN), Recurrent Neural Networks (RNN), and Long Short-Term Memory (LSTM)) to encrypted traffic anomaly detection. The core idea is to train the model with a large number of labeled samples, allowing the model to learn the feature differences between normal and malicious encrypted traffic, thus achieving anomaly identification. Some solutions introduce pre-trained Transformer models to convert traffic data packets into natural language-like words, extracting traffic representations for detection.

[0009] The core drawbacks of this type of method are: First, it is highly dependent on labeled samples. Due to the scarcity and difficulty in labeling encrypted malicious samples, the model training is insufficient, resulting in poor generalization ability and difficulty in dealing with new and unknown encrypted attacks. Second, the feature extraction capability is limited. Ordinary deep learning models have insufficient feature extraction depth and cannot uncover small and hidden fine-grained abnormal features in encrypted traffic. Especially in scenarios with high traffic feature similarity, the detection effect drops significantly. Third, it lacks the ability to generate samples and cannot actively supplement new attack samples. The detection model cannot achieve closed-loop optimization and always lags behind the development of attack techniques. Fourth, existing solutions mostly adopt a single learning mode and do not combine the advantages of contrastive learning. They lack the ability to distinguish fine-grained features and do not utilize the strong representation and generation capabilities of large models, making it difficult to break through the performance bottleneck of traditional models.

[0010] 3. Sample generation method based on Generative Adversarial Network (GAN).

[0011] To address the scarcity of malicious samples, this type of method utilizes Generative Adversarial Networks (GANs) to generate encrypted malicious samples. The core idea is to use a GAN generator to generate simulated encrypted malicious traffic samples to supplement training data and optimize the detection model. Furthermore, some solutions combine adversarial training to enhance model robustness.

[0012] Existing publicly available patents (such as CN110602078A, CN114399029A, and CN118643325A) all employ a single GAN architecture to generate encrypted traffic samples. The drawbacks of this approach are twofold: First, the controllability of the generated samples is poor. GAN-generated samples often suffer from vague features and significant differences from real malicious traffic; some samples even fail to conform to encryption protocol specifications and cannot be used for model training. Second, the diversity of generated samples is insufficient, making it difficult to cover various scenarios such as novel private encrypted Trojans, encrypted tunnels, and zero-day attacks, thus failing to meet the diverse sample requirements of detection models. Third, without the integration of contrastive learning techniques, it is impossible to accurately mine hidden anomaly features. The generated samples lack specificity and cannot effectively improve the detection model's ability to identify hidden anomalies. Fourth, there is a lack of desensitization and compliance mechanisms. The generated samples may contain sensitive information, posing a risk of privacy leakage. Furthermore, they do not form a closed loop with baseline modeling and anomaly mining, resulting in a disconnect between sample generation and model optimization, which fails to fully realize the value of the samples. Fifth, existing GAN solutions do not combine the strong semantic understanding and representation capabilities of large models. The authenticity and diversity of the generated samples are far from meeting actual needs and cannot cope with the dynamic mutation characteristics of new encryption attacks. Summary of the Invention

[0013] This invention provides a method for detecting and generating samples of encrypted traffic anomalies, which improves the accuracy, generalization and real-time performance of encrypted traffic anomaly detection, breaks through the limitations of traditional technologies, and provides efficient and reliable technical support for network security protection.

[0014] A method for detecting and generating samples from encrypted traffic anomalies, the method comprising: Step 1: Collect and preprocess data to build a dataset of normal encrypted traffic in multiple scenarios and a dataset of a small number of real malicious samples; Step 2: Based on the large model, perform deep behavioral modeling on normal encrypted traffic in multiple scenarios to build a benchmark security behavior knowledge base; Step 3: Based on the improved contrastive learning algorithm, the encrypted traffic to be detected is compared with the normal encrypted traffic features in the benchmark security behavior knowledge base in a fine-grained manner to uncover hidden abnormal features and perform screening and quantification to achieve anomaly judgment and unknown attack identification. Step 4: Based on the controllable generation architecture of the large model, combined with the hidden anomaly features and known attack patterns, generate encrypted malicious samples and perform de-identification and compliance processing. Step 5: Optimize the encrypted traffic anomaly detection model using the generated encrypted malicious samples, and feed the optimized encrypted traffic anomaly detection model back to the anomaly feature mining stage to form a closed-loop iterative optimization system.

[0015] Optionally, in step 1, during data collection, normal encrypted traffic data and a small amount of real encrypted malicious traffic data are collected in multiple scenarios, including the enterprise intranet, carrier network, and office environment. The normal encrypted traffic data collected includes normal TLS encrypted traffic, short video encrypted traffic, and office encrypted traffic. When collecting a small amount of real encrypted malicious traffic data, encrypted Trojans, encrypted tunnels, and zero-day attacks are collected through enterprise security logs, security device alarm records, public vulnerability platforms, and cooperation with security vendors. The collected normal encrypted traffic data and a small amount of real encrypted malicious traffic data are preprocessed, including: data cleaning, data standardization, traffic session segmentation, preliminary feature extraction, and data anonymization.

[0016] Optionally, step 2 includes: Step 21: Perform the selection and initialization of the large model. The selected large model is an improved Transformer large model. The optimization measures of the improved Transformer large model include hierarchical attention mechanism, temporal convolution module and model distillation technique. Step 22: Using the normal encrypted traffic dataset as training data, supervised training is performed on the improved Transformer large model. The supervised training process adopts a scenario-based training, contrastive learning warm-up training, and multi-task joint training strategy. Step 23: Use the improved Transformer large model after training to extract deep features of all normal sessions in the normal encrypted traffic dataset, and construct the benchmark security behavior knowledge base. The benchmark security behavior knowledge base is optimized by clustering algorithm, establishes a dynamic incremental update mechanism, and stores the deep feature vectors and behavior pattern clusters of normal encrypted traffic according to scenario classification.

[0017] Optionally, step 3 includes: Step 31: Preprocess the encrypted traffic to be detected, including: data cleaning, data standardization, traffic session segmentation, preliminary feature extraction and data desensitization, to obtain the feature sequence of the encrypted traffic session to be detected; Step 32: Input the feature sequence of the encrypted traffic session to be detected into the trained improved Transformer large model to obtain the deep feature vector of the encrypted traffic to be detected. Step 33: Using the deep feature vector of the encrypted traffic to be detected as the query sample, construct comparison sample pairs from the benchmark security behavior knowledge base. The comparison sample pairs include positive sample pairs and negative sample pairs. Perform improved cosine similarity calculation and design an improved comparison loss function. The improved comparison loss function introduces an anomaly penalty term and similarity threshold constraints. Input the constructed comparison sample pairs into the comparison learning model. Iteratively train the model with the improved comparison loss function as the target. During the training process, the comparison learning model gradually explores the fine-grained differences between the features of the encrypted traffic to be detected and the normal encrypted traffic, i.e., the hidden anomaly features, by continuously adjusting the feature weights and similarity calculation parameters. Step 34: The hidden anomaly features obtained by mining are subjected to feature screening and feature quantization. The feature screening of the hidden anomaly features adopts a dual strategy of mutual information and analysis of variance, and the feature quantization adopts a normalization quantization method. Step 35: Based on the concealed abnormal features after feature quantization, perform anomaly judgment to distinguish between normal encrypted traffic and malicious encrypted traffic. The anomaly judgment adopts a weighted summation comprehensive score method, and the unknown attack identification is based on the similarity judgment of abnormal features.

[0018] Optionally, in step 33, the process of inputting the constructed contrastive sample pairs into the contrastive learning model and performing iterative training with the improved contrastive loss function as the target includes: (a) Initialize the parameters of the contrastive learning model, including attention weights. Temperature parameters Weight of abnormal penalty items Random initialization is used; (b) Input the constructed contrast samples into the contrast learning model and calculate the improved cosine similarity and the improved contrast loss value; (c) The AdamW optimizer is used to backpropagate and update the parameters of the contrastive learning model to minimize the loss value; (d) Repeat steps (b)-(c) for multiple iterations until the loss value converges; (e) After training, extract the difference features between the feature vector of the encrypted traffic to be detected and the feature vector of the positive sample pair. These difference features are the hidden anomaly features of the encrypted traffic to be detected.

[0019] Optionally, step 4 includes: Step 41: Design a controllable generation architecture for the large model based on the improved Transformer large model. The controllable generation architecture includes a feature encoding module, a controllable generation module, a protocol constraint module, and a quality evaluation module. The controllable generation module adopts a strategy of instruction fine-tuning, adversarial training, and real-time protocol verification. The evaluation indicators of the quality evaluation module include authenticity, compliance, consistency and diversity of abnormal features, and only samples that meet the quality standards are retained for model optimization. Step 42: Based on the controllable generation architecture of the large model, and combined with the hidden anomaly features and known attack patterns, generate encrypted malicious samples in batches. Step 43: Establish a controllable AI-generated and desensitized compliance mechanism for encrypted malicious traffic. Perform comprehensive desensitization and compliance processing on the generated encrypted malicious samples. The desensitization and compliance processing includes network identifier desensitization, payload content desensitization, metadata desensitization, and protocol field desensitization. At the same time, establish a compliance verification and security control mechanism.

[0020] Optionally, in step 42, firstly, the constraints for sample generation are determined, including: attack type constraints, protocol type constraints, anomaly feature constraints, and sample quantity constraints; secondly, based on the determined constraints, targeted generation instructions are constructed, with standardized instruction formats including attack type, protocol type, anomaly features and quantization range, sample quantity, and session requirements; thirdly, the constructed generation instructions are input into the controllable generation module, which generates a feature sequence of encrypted malicious samples according to the generation instructions, and then transmits it to the protocol constraint module for real-time verification; the protocol constraint module verifies the number of encrypted malicious samples according to preset encryption protocol rules. Each packet sequence, protocol field, and session flow is verified one by one. If any content that does not conform to the protocol specifications is found, the verification result is immediately fed back to the controllable generation module. The generation parameters are adjusted, and the encrypted malicious sample is regenerated until an encrypted malicious sample that conforms to the protocol specifications is generated. Then, the encrypted malicious sample that passes the protocol verification is input into the quality assessment module, and a comprehensive evaluation is carried out according to the preset evaluation index system to select encrypted malicious samples that meet the quality standards. Finally, the above steps are repeated to generate encrypted malicious samples in batches according to the requirements of the generation instructions. After generation, the encrypted malicious samples are classified and stored according to attack type, protocol type, and abnormal feature type. Optionally, step 5 includes: Step 51: Construct the encrypted traffic anomaly detection model based on the improved Transformer. Based on the trained improved Transformer model, add an anomaly classification layer and a feature fusion layer to complete the anomaly detection and attack type identification of encrypted traffic. Step 52: Use the de-identified encrypted malicious samples, a small amount of real malicious sample datasets, and normal encrypted traffic datasets as training data to optimize and train the encrypted traffic anomaly detection model. Step 53: Feed the optimized encrypted traffic anomaly detection model back to the hidden anomaly feature mining stage in Step 3, adjust the parameters and weights of the comparative learning algorithm, and achieve closed-loop iterative optimization.

[0021] An apparatus for detecting and generating samples from encrypted traffic anomalies, the apparatus comprising: The data acquisition and preprocessing unit collects and preprocesses data to build datasets of normal encrypted traffic in multiple scenarios and a small number of real malicious sample datasets. The baseline modeling unit, based on a large model, performs in-depth behavioral modeling of normal encrypted traffic in multiple scenarios and builds a baseline security behavior knowledge base. The anomaly detection unit, based on an improved contrastive learning algorithm, performs fine-grained comparison between the encrypted traffic to be detected and the normal encrypted traffic features in the benchmark security behavior knowledge base, mines hidden anomaly features and filters and quantifies them, thereby realizing anomaly judgment and unknown attack identification. The sample generation unit, based on a large model controllable generation architecture, combines the aforementioned hidden anomaly features and known attack patterns to generate encrypted malicious samples and perform desensitization and compliance processing. The closed-loop optimization unit optimizes the encrypted traffic anomaly detection model using the generated encrypted malicious samples, and feeds the optimized encrypted traffic anomaly detection model back to the anomaly feature mining stage, forming a closed-loop iterative optimization system.

[0022] A computer-readable storage medium having a computer program stored thereon, the computer program being executed by a processor to perform the steps of the encrypted traffic anomaly mining and sample generation method.

[0023] This invention provides a method for encrypted traffic anomaly mining and sample generation. Addressing the limitations of existing GAN-based sample generation, conventional deep learning detection schemes in achieving fine-grained hidden anomaly mining, controllable generation of large models, compliance with anonymization requirements, and closed-loop iterative optimization, this method leverages the strong representational capabilities of large models, the fine-grained feature discrimination capabilities of contrastive learning, and the controllable generation capabilities of large models. It breaks through the limitations of independent stages in existing technologies, constructing a closed-loop encrypted traffic anomaly detection and sample generation system. This solves the common industry problems of scarce labeled encrypted malicious traffic samples, lack of samples of novel and unknown encrypted attacks, and difficulty in mining hidden anomaly features, improving the accuracy, generalization, and real-time performance of encrypted traffic anomaly detection. It overcomes the limitations of traditional technologies, providing efficient and reliable technical support for network security protection. Compared with existing technologies, this invention has significant beneficial effects, with core advantages reflected in the following aspects: This invention addresses common industry challenges in existing technologies, such as uncontrollable generation of single GAN samples, difficulty in detecting fine-grained anomalies, lack of desensitization compliance, and lack of closed-loop optimization. It proposes an integrated technical solution that achieves three core breakthroughs: overcoming the bottleneck of hidden anomaly feature mining; overcoming the bottleneck of malicious sample scarcity; and overcoming the bottleneck of baseline modeling accuracy.

[0024] This invention constructs a closed-loop system of "baseline modeling - anomaly detection - sample generation - model optimization", which organically combines the representational ability of large models, the fine-grained discrimination ability of contrastive learning, and the controllable generation ability of large models, realizing the synergistic optimization of each technical link, which is different from the limitation of independent links in existing technologies.

[0025] This invention is not a simple combination of existing security technologies and AI technologies, but rather an original technical solution formed through innovation in core algorithms and technical architecture. The specific innovations are reflected in: innovation in improved contrastive learning algorithms; innovation in controllable generation architecture of large models; innovation in closed-loop system; and innovation in desensitization and compliance mechanism.

[0026] This invention strictly adheres to relevant laws and regulations such as the Cybersecurity Law, the Personal Information Protection Law, and the Data Security Law. It has established a comprehensive desensitization compliance mechanism and security control mechanism, and performs comprehensive desensitization processing on the collected traffic data and generated samples to ensure that they do not contain any sensitive information and avoid privacy leaks. At the same time, it clarifies the scope and permissions for the use of samples, and establishes a secure storage, use, and destruction process to ensure the compliance of the technical solution, making it suitable for application in various scenarios with high compliance requirements.

[0027] This invention differs from single GAN sample generation schemes by employing large-scale model controllable generation combined with protocol constraints. The generated samples have an authenticity of ≥90% and a compliance rate of 100%, and can be directly used for model training. At the same time, it combines improved contrastive learning to achieve fine-grained discovery of hidden anomalies, resulting in a higher rate of unknown attack identification. Closed-loop iteration can continuously improve detection performance, and the overall technical effect is significantly better than existing schemes. Attached Figure Description

[0028] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly described below. Obviously, the drawings described below are merely some embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0029] Figure 1 This is a flowchart of a method for detecting and generating encrypted traffic anomalies in a specific embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of the encrypted traffic anomaly mining and sample generation device in a specific embodiment of the present invention. Detailed Implementation

[0030] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0031] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0032] like Figure 1 The diagram shown is a flowchart of the encrypted traffic anomaly mining and sample generation method in an embodiment of the present invention, including the following steps: Step 1: Data collection and preprocessing, constructing a dataset of normal encrypted traffic in multiple scenarios and a dataset of a small number of real malicious samples.

[0033] This method collects normal encrypted traffic data from multiple scenarios and a small amount of real encrypted malicious traffic data. Through preprocessing to eliminate noise and standardize the format, it provides a high-quality data foundation for subsequent baseline modeling, anomaly detection, and sample generation. Unlike existing datasets that suffer from single-scenario limitations and high noise levels, this method achieves data diversity, integrity, and purity. The specific steps include: S1.1 Data Acquisition.

[0034] In various scenarios such as enterprise intranets, carrier networks, and office environments, normal encrypted traffic data and a small amount of real encrypted malicious traffic data are collected. The collection process strictly follows relevant privacy protection regulations, and sensitive information undergoes preliminary de-identification processing.

[0035] 1a. Normal encrypted traffic collection: Covering three scenarios to ensure data diversity and representativeness, specifically including: Normal TLS encrypted traffic: Collects encrypted traffic from different versions of the TLS (Transport Layer Security) protocol, covering scenarios such as web browsing, file transfer, and email communication. The collected parameters include session handshake process, packet size, packet exchange frequency, session duration, and payload length distribution. Encrypted traffic for short videos: Collects encrypted transmission traffic from mainstream short video platforms, covering interactive behaviors such as video playback, comments, likes, and reposts, with a focus on collecting traffic characteristics under different resolutions and bitrates; Encrypted office traffic: Collects encrypted traffic in enterprise office scenarios, including instant messaging traffic of office software, file transfer traffic of cloud office platforms, and encrypted traffic of remote office (such as VPN).

[0036] The data collection period should be no less than 30 days to ensure that the collected data can cover normal traffic behavior under different time periods and different loads. A total of no less than 1 million sessions of normal encrypted traffic data should be collected, and each session should contain complete data packet sequences, protocol fields, interaction timing and other information.

[0037] 2a. Collection of real encrypted malicious traffic data: Collect a small amount of real encrypted malicious traffic data through channels such as enterprise security logs, security device alarm records, public vulnerability platforms, and security vendor collaborations. This data includes types such as encrypted Trojans, encrypted tunnels, and zero-day attacks. A total of no fewer than 1000 real malicious sessions will be collected, with each sample labeled with key information such as attack type, attack purpose, and anomaly characteristics. Due to the scarcity of real malicious samples, this step does not prioritize quantity but focuses on ensuring the authenticity and representativeness of the samples for reference in subsequent anomaly feature mining and sample generation.

[0038] S1.2 Data Preprocessing.

[0039] Preprocessing the collected normal and malicious encrypted traffic data to remove noise, standardize the format, and extract effective features is crucial to avoid the impact of invalid data on subsequent model training and feature mining. This includes the following steps: 1b. Data cleaning: Removing invalid data, including: Incomplete session data (such as TLS sessions with incomplete handshakes or interrupted packet sequences); Abnormal noise data (such as data with packet size exceeding the normal range, or session duration that is abnormally short or excessively long); Duplicate data (such as repeatedly collected data from the same session); Abnormal protocol data (such as data that does not conform to the specifications of encryption protocols such as TLS and VPN).

[0040] A dual cleaning mechanism based on statistical thresholds and protocol rules is adopted, and the data retention rate after cleaning is no less than 95%.

[0041] 2b. Data Standardization: Standardize traffic data from different scenarios and in different formats, specifically including: Timestamp standardization converts the timestamps of all sessions into a unified time format (such as Unix timestamps), which facilitates the extraction of time-series features. Data packet feature standardization converts continuous features such as data packet size, payload length, and interaction interval into standardized values ​​in the [0,1] interval. The Min-Max standardization algorithm is used, and the formula is as follows:

[0042] in, These are the original eigenvalues. This is the minimum value of the feature. The maximum value of this feature. These are the standardized eigenvalues; Protocol field encoding converts discrete features such as TLS version, encryption algorithm type, and session state into one-hot encoding, which facilitates model processing.

[0043] 3b. Traffic Session Segmentation: Continuous traffic data is segmented into sessions. A complete session is defined as the period from TCP connection establishment (SYN packet) to connection closure (FIN packet). For connectionless UDP encrypted traffic, sessions are segmented in fixed time windows (e.g., 30 seconds) to ensure the integrity and independence of each session.

[0044] 4b. Preliminary feature extraction: Extract the basic features of each session, including surface features and shallow temporal features, specifically: Surface features: protocol type, port number, session duration, total number of packets, average packet size, maximum packet size, minimum packet size, mean packet interaction interval, and variance of packet interaction interval; Shallow temporal features include statistical characteristics such as the mean, variance, and peak value of the packet size sequence, interaction interval sequence, and payload length sequence. These initially extracted features are used as input for subsequent large-scale model baseline modeling and comparative learning.

[0045] 5b. Data anonymization: Anonymize the preprocessed traffic data to prevent the leakage of sensitive information. This includes: IP address desensitization uses a hash algorithm to encrypt IP addresses, hiding the real IP information; Port desensitization involves randomly mapping non-standard ports (other than commonly used ports such as 80 and 443) while retaining the port's type characteristics (such as client port or server port). Payload anonymization involves truncating or hashing the encrypted payload content while preserving characteristics such as payload length and distribution, without disclosing the original payload content. The anonymization process strictly adheres to relevant laws and regulations such as the Cybersecurity Law and the Personal Information Protection Law to ensure data compliance.

[0046] After preprocessing, a dataset of normal encrypted traffic from multiple scenarios is obtained. and a small dataset of real encrypted malicious traffic This is used for model training and feature mining in subsequent steps.

[0047] Step 2: Based on the baseline model of normal encrypted traffic, construct a baseline security behavior knowledge base.

[0048] Unlike existing technologies that rely on simple statistical modeling or shallow deep learning modeling, this invention leverages the strong representational and semantic understanding capabilities of large models to perform deep behavioral modeling of normal encrypted traffic across multiple scenarios. It extracts deep features from normal traffic, constructs a benchmark security behavior knowledge base, and provides a precise reference benchmark for subsequent mining of hidden anomaly features. Specifically, it includes the following sub-steps: S2.1 Large Model Selection and Initialization.

[0049] Selection criteria: Considering the temporal and sequential characteristics of encrypted traffic, a large model that supports sequence feature processing and has strong representation capabilities is selected as the basic model for baseline modeling. Large models with Transformer architecture are preferred. These models can effectively capture the contextual dependencies of sequence data and are suitable for processing the data packet sequence and interaction temporal features of encrypted traffic. This is different from the existing solutions that use ordinary deep learning models such as CNN and LSTM, thus improving the accuracy and generalization of baseline modeling.

[0050] This invention preferably employs an improved Transformer large model, performing lightweight optimization on the original Transformer model to reduce model parameters, improve modeling efficiency, and retain its strong representational capabilities. Specific optimization measures include: A hierarchical attention mechanism is adopted to assign different attention weights to different features of traffic (surface features and temporal features), with a focus on features that have a greater impact on the representation of normal behavior. A temporal convolutional module (TCN) is introduced to enhance the model's ability to capture temporal features of traffic and solve the gradient vanishing problem of the Transformer model in long sequence processing; By employing model distillation technology, knowledge from large Transformer models is distilled into smaller models, reducing computational overhead and facilitating practical deployment.

[0051] The improved Transformer large model is initialized by setting the following parameters: hidden layer dimension 512-1024, number of attention heads 8-16, number of encoder layers 6-12, number of decoder layers 6-12, dropout probability 0.1-0.3, learning rate 1e-5 - 5e-5, AdamW optimizer, and the initial loss function is set to cross-entropy loss (to be optimized later using contrastive learning). The initialized model is denoted as [model name missing]. .

[0052] S2.2 large model training enables modeling of normal encrypted traffic behavior.

[0053] With preprocessed normal encrypted traffic dataset To use the training data, supervised training was performed on the improved Transformer large model, allowing the model to learn the behavior patterns of normal encrypted traffic and extract deep features of normal traffic. The specific training process is as follows: 1c. Training data construction: Will Each session data point is converted into a sequence input that the model can process. Specifically, the preliminary extracted features (surface features, shallow temporal features) of each session are concatenated in temporal order to form a feature sequence X = [x1, x2, ..., x...]. T ], where T is the number of packets in the session, x T Let be the feature vector of the t-th data packet (with dimension d, composed of surface features and shallow temporal features). Simultaneously, label each normal session with y=0 (representing normal traffic) for supervised training.

[0054] 2c. Scene-specific training: Because the normal encrypted traffic behavior patterns differ across scenarios (e.g., the data packet exchange frequency of short video encrypted traffic is higher than that of office encrypted traffic), a scenario-based training strategy is adopted, specifically: The traffic was divided into three subsets based on the scenario: TLS traffic, short video traffic, and office traffic. The model was trained separately for each subset. The training process for each scenario was carried out independently. After training was completed, the training parameters of each scenario were merged to obtain a baseline model that is adapted to multiple scenarios.

[0055] 3c. Training process optimization: To improve the model's accuracy in capturing normal traffic behavior patterns, the following optimization strategies are adopted: First, we introduce contrastive learning warm-up training: Before supervised training, the model undergoes contrastive learning warm-up training. Data augmentation is performed on the feature sequences of normal traffic (e.g., randomly shuffling data packets, adding minor noise, and adjusting feature values) to generate positive sample pairs (augmented sequences from the same normal session) and negative sample pairs (sequences from different normal sessions). Through contrastive learning, the model learns the feature similarity of normal traffic, improving its feature extraction ability. The loss function used for warm-up training is the Information Contrastive Estimation (InfoNCE) loss function, with the following formula:

[0056] in, For characteristic sequences and similarity, for Positive samples, The temperature parameter is set to 0.1-0.5, and N is the number of samples. The warm-up training iterations are 10-20 rounds to ensure the model initially grasps the characteristic patterns of normal flow.

[0057] Then, perform layered training and parameter fine-tuning: A hierarchical training strategy is adopted, first training the bottom feature extraction layer of the model, and then training the upper classification layer and attention layer to gradually improve the model's representation ability. During the training process, a learning rate decay strategy (such as cosine annealing decay) is adopted. As the number of iterations increases, the learning rate is gradually reduced to avoid model overfitting. At the same time, an early stopping mechanism is introduced. The accuracy of the validation set is used as the indicator. When the accuracy of the validation set does not improve for 5-10 consecutive rounds, training is stopped and the optimal model parameters are saved.

[0058] Finally, multi-task joint training is conducted: During training, multi-task joint training is introduced. In addition to the normal traffic classification task (determining whether traffic is normal), a traffic scenario classification task is added (determining whether normal traffic belongs to TLS, short video, or office scenarios). Multi-task training allows the model to better capture the behavioral differences of normal traffic in different scenarios, improving the model's generalization ability. The total loss function for multi-task training is... for:

[0059] in, The cross-entropy loss for normal traffic classification tasks, Cross-entropy loss for scene classification tasks, and Weighting coefficients ( =0.7, =0.3), which can be adjusted according to the training effect.

[0060] 4c. Validation of training results: Will The model is divided into training, validation, and test sets in a 7:2:1 ratio. After training, the model's performance is validated using the test set. Evaluation metrics include accuracy, recall, and F1 score. The model is required to achieve at least 99% accuracy, 98.5% recall, and 98.7% F1 score on the test set, ensuring that the model can accurately capture the behavioral patterns of normal encrypted traffic. If the model performance does not meet the requirements, the model parameters (such as the number of attention heads, learning rate, and dropout probability) are adjusted, and the model is retrained until the performance requirements are met.

[0061] S2.3 Construct a knowledge base for benchmark security behaviors.

[0062] Improved Transformer large model after training It possesses powerful features extraction capabilities for normal encrypted traffic; this model can be used to extract... By analyzing the deep characteristics of all normal sessions, a baseline security behavior knowledge base is constructed. The specific process is as follows: 1d. Deep Feature Extraction: [This section appears to be incomplete and requires further context.] Each normal conversation feature sequence X in the input is... In this process, the encoder of the model outputs the deep feature vector f∈[[...]] of the session. d (d is the feature dimension, consistent with the hidden layer dimension of the model). This deep feature vector can accurately represent the behavior pattern of normal traffic and contains fine-grained behavioral information that cannot be reflected by surface features and shallow time-series features (such as the implicit rules of data packet interaction and the subtle features of load distribution).

[0063] 2d. Knowledge Base Classification and Storage: The extracted deep feature vectors are classified according to scenarios, into subsets for TLS normal behavior, short video normal behavior, and office normal behavior. Each subset contains deep feature vectors for all normal sessions within that scenario. Simultaneously, metadata is added to each feature vector, including the session scenario type, collection time, feature dimension, and key statistical information, facilitating rapid querying and comparison during subsequent anomaly feature mining.

[0064] 3d. Knowledge base optimization: Optimization of the constructed baseline security behavior knowledge base. To optimize the system, clustering algorithms (such as K-Means and DBSCAN) are used to cluster the feature subsets of each scenario. Similar normal behavioral features are grouped together to form behavioral pattern clusters, each representing a typical normal encrypted traffic behavior pattern. During clustering, the silhouette coefficient is used to determine the optimal number of clusters, ensuring the reasonableness of the clustering results. The silhouette coefficient is required to be no less than 0.8. The optimized knowledge base can quickly locate the normal behavioral pattern most similar to the traffic to be detected, improving the efficiency and accuracy of subsequent anomaly feature mining.

[0065] 4d. Knowledge Base Update Mechanism: Establish a dynamic update mechanism for the baseline security behavior knowledge base, periodically (e.g., monthly) collect new normal encrypted traffic data, preprocess it, and input it into... Deep features are extracted to update the feature vectors and behavioral pattern clusters in the knowledge base, ensuring that the knowledge base can adapt to changes in the network environment (such as encryption protocol upgrades and the emergence of new office applications), and always maintain the accuracy and timeliness of the baseline behavior. During the update process, an incremental learning strategy is adopted, performing feature extraction and clustering only on newly added data, without retraining the entire model, thus reducing computational overhead.

[0066] Benchmark Safety Behavior Knowledge Base The construction of this method solves the problems of low accuracy and poor adaptability of baseline modeling in existing technologies, and provides an accurate and reliable reference benchmark for subsequent mining of hidden anomaly features. This is one of the core innovations that distinguishes this invention from existing technologies.

[0067] Step 3: Fine-grained mining of hidden anomaly features based on contrastive learning.

[0068] Unlike existing contrastive learning applications that are only used for traffic classification, this invention designs an improved contrastive learning algorithm to address the concealed anomaly characteristics of encrypted traffic. This algorithm compares the encrypted traffic to be detected with a baseline security behavior knowledge base. This involves fine-grained comparison of normal traffic characteristics to uncover subtle, hidden, and undetectable anomalies, enabling accurate identification of encrypted malicious traffic, especially new and unknown encryption attacks. Specifically, this includes the following sub-steps: S3.1 Preprocessing of encrypted traffic to be detected.

[0069] The encrypted traffic data to be detected is preprocessed, and the preprocessing process is the same as in step S1.2, including data cleaning, data standardization, session segmentation, preliminary feature extraction, and data anonymization, to obtain the feature sequence of the traffic session to be detected. This ensures that the data to be tested is in the same format as the data in the benchmark safety behavior knowledge base, facilitating subsequent comparative analysis.

[0070] S3.2 Deep feature extraction of the flow to be detected.

[0071] The preprocessed flow characteristic sequence to be detected Input into the training completed in step 2 In this process, the encoder of the model outputs a deep feature vector of the traffic to be detected. ∈ d This feature vector is consistent with the baseline security behavior knowledge base. The feature vectors in the model have the same dimension, which can accurately represent the behavior pattern of the traffic to be detected, providing a foundation for subsequent comparative learning.

[0072] S3.3 Design and implementation of an improved contrastive learning algorithm.

[0073] This invention designs an improved contrastive learning algorithm, focusing on optimizing the contrastive loss function and similarity calculation method to enhance the ability to capture fine-grained anomaly features. Specifically, it includes the following: 1e. Construction of contrast sample pairs: With the deep feature vector of the traffic to be detected To retrieve samples, from the benchmark security behavior knowledge base Construct contrastive sample pairs, including positive sample pairs and negative sample pairs: Construction of positive sample pairs: from Selecting from and The K normal behavior feature vectors with the highest feature similarity (K set to 5-10) that are from the same scene are compared with... Forming positive sample pairs (k=1,2,...,K). The purpose of constructing positive sample pairs is to capture subtle differences between the traffic to be detected and the normal traffic. Even if there are hidden anomalies in the traffic to be detected, its similarity with the normal traffic may still be high. By comparing positive sample pairs, subtle abnormal features can be discovered.

[0074] Construction of negative sample pairs: from Selecting from and M normal behavior feature vectors (M set to 10-20) with the same scene but low feature similarity, and N normal behavior feature vectors (N set to 5-10) with different scenes, are compared with... Forming negative sample pairs (m=1,2,...,M+N). The purpose of constructing negative sample pairs is to enhance the difference features between the detected flow and the normal flow, thereby improving the discriminative ability of contrastive learning.

[0075] 2e. Optimization of similarity calculation method: An improved cosine similarity calculation method is adopted, combined with an attention mechanism, to assign different weights to different dimensions of the feature vector, focusing on dimensions sensitive to anomalous features, thereby improving the accuracy of similarity calculation. The specific formula is as follows:

[0076] in, and Let's consider two feature vectors whose similarity is to be calculated. and Let i and n be the i-th eigenvalues ​​of the two eigenvectors, respectively. The attention weights for the i-th dimension feature are obtained by... The attention layer is automatically learned, assigning higher weights to dimensions sensitive to anomalous features and lower weights to common features of normal behavior. The improved cosine similarity can accurately capture fine-grained differences between feature vectors, solving the problem of traditional cosine similarity's insensitivity to minute differences.

[0077] 3e. Improved design of contrastive loss function: To address the minute nature of concealed anomalies, an improved contrastive loss function is designed by introducing an anomaly penalty term and a similarity threshold constraint on the Info NCE loss function. The specific formula is as follows:

[0078] in, The temperature parameter is consistent with the preheating training in step S2.2. The weight for the anomaly penalty item is set between 0.5 and 1.0. The similarity threshold is determined adaptively using training data, typically set to 0.8-0.9. The core advantage of this loss function lies in: By comparing positive and negative sample pairs, the model learns the difference between the traffic to be detected and normal traffic. An anomaly penalty term is introduced when the similarity between the traffic to be detected and all positive samples is below a threshold. At the same time, increase the loss value to enhance the capture of abnormal features; By averaging the similarity of positive samples, the influence of a single positive sample is reduced, thereby improving the stability of contrastive learning.

[0079] 4e. Contrastive learning training and anomaly feature discovery: The constructed contrastive sample pairs are input into the contrastive learning model, using an improved contrastive loss function. With the goal of [target], iterative training is conducted. During training, the model continuously adjusts feature weights and similarity calculation parameters to gradually uncover fine-grained differences between the traffic to be detected and normal traffic, i.e., hidden anomaly features. The contrastive learning model uses [method / mechanism] to... Based on this foundation, the encoder is reused for deep feature extraction. An improved cosine similarity calculation layer and an improved contrastive loss function layer are added to the feature output, forming a dedicated anomaly feature contrastive learning model for fine-grained anomaly feature mining. The specific training process is as follows: (a) Initialize the parameters of the contrastive learning model, including attention weights. Temperature parameters Weight of abnormal penalty items etc., using a random initialization method; (b) Input the comparison sample pairs into the model and calculate the improved cosine similarity and improved contrast loss; (c) The AdamW optimizer is used to backpropagate and update the model parameters to minimize the loss value; (d) Repeat steps (b)-(c) for 20-30 iterations until the loss value converges (convergence condition is that the change in the loss value is less than 1e-5 for 5 consecutive iterations); (e) After training is completed, extract the feature vector of the traffic to be detected. With positive sample feature vectors The differences in characteristics, these differences are the hidden anomalies of encrypted traffic, denoted as... .

[0080] S3.4 Screening and quantification of hidden anomaly features.

[0081] Hidden anomaly features obtained through mining It may contain invalid and redundant features, which need to be filtered and quantified to improve the accuracy of anomaly identification. The specific steps are as follows: 1f. Feature Filtering: A dual screening strategy based on mutual information and analysis of variance (ANOVA) is employed to eliminate invalid and redundant features: Mutual information filtering: Calculate the mutual information value between each abnormal feature and the traffic label (normal / malicious). The larger the mutual information value, the stronger the correlation between the feature and the abnormal behavior. Features with mutual information values ​​greater than the threshold (set to 0.1-0.2) are retained. Analysis of variance (ANOVA) screening: Calculate the variance of each abnormal feature in normal traffic and malicious traffic (a small number of real samples). The larger the variance, the stronger the ability of the feature to distinguish between normal and malicious traffic. Features with variance greater than the threshold (set to 0.05-0.1) are retained.

[0082] Through dual screening, an effective subset of hidden anomaly features was obtained. This process eliminates invalid and redundant features, improving the efficiency and accuracy of anomaly detection.

[0083] 2f. Feature quantization: For effective concealed anomaly feature subset Quantization processing is performed, converting each anomalous feature into a quantized value for subsequent anomaly detection and sample generation. Specifically, a normalized quantization method is used to convert the value range of each feature into the [0,1] interval. The quantization formula is as follows:

[0084] in, These are the original values ​​of the anomalous features. This is the minimum value of the feature. The maximum value of this feature. The quantized feature value (range [0,1]) represents the eigenvalue. The larger the quantized feature value, the more obvious the anomalous feature.

[0085] S3.5 Anomaly Detection and Unknown Attack Identification Based on quantized effective hidden anomaly features Anomaly detection is performed to distinguish between normal encrypted traffic and malicious encrypted traffic, especially new and unknown encrypted attack traffic. The specific detection logic is as follows: 1g. Calculate the comprehensive score of abnormal features: A weighted summation method is used to calculate the comprehensive score of the abnormal characteristics of the traffic flow to be detected. The formula is:

[0086] in, The weights for each anomalous feature are obtained through training with a logistic regression algorithm; the stronger the correlation between the anomalous feature and malicious behavior, the greater its weight.

[0087] 2g. Determination of anomaly detection threshold: Using a small dataset of real malicious samples and normal traffic dataset The ROC curve (Receiving Receiver Operating Characteristic) was used to determine the anomaly detection threshold. To ensure the reasonableness of the threshold, the recall rate on real malicious samples should be no less than 98%, and the false positive rate on normal samples should be no more than 1%.

[0088] 3g. Exception detection logic: like If the traffic to be detected is determined to be malicious encrypted traffic, its hidden abnormal characteristics are recorded. , used for subsequent sample generation; like If the traffic to be detected is determined to be normal encrypted traffic, its deep feature vector is added to the baseline security behavior knowledge base. In this way, the knowledge base content is enriched; For samples identified as malicious encrypted traffic, if their concealed abnormal characteristics... and If the similarity of the abnormal features of known malicious samples is less than 50%, it is judged as a new type of unknown encryption attack traffic. This type of traffic is the key target for sample generation and can effectively supplement new attack samples.

[0089] This step, through an improved contrastive learning algorithm, achieves accurate mining of hidden anomaly features in encrypted traffic, solving the problem that existing technologies cannot capture fine-grained anomaly features and are difficult to identify new and unknown attacks. This is one of the core innovations of this invention and is fundamentally different from existing contrastive learning applications.

[0090] Step 4: Generate and de-identify compliant encrypted malicious samples based on the controllable generation of a large model.

[0091] Unlike existing GAN-generated samples which suffer from poor controllability, low realism, and lack of compliance, this invention leverages the controllable generation capabilities of large models. Combined with the hidden anomaly features discovered in step 3 and known encryption attack patterns, it generates in batches realistic, diverse, and compliant novel private encryption Trojans, encryption tunnels, and zero-day encryption attack simulation samples. Simultaneously, it establishes a de-identification and compliance mechanism to ensure sample compliance, addressing the pain points of scarce encrypted malicious samples and a lack of novel, unknown attack samples. Specifically, it includes the following sub-steps: S4.1 Large Model Controllable Generation Architecture Design.

[0092] We design a controllable generation architecture based on an improved Transformer large model. This architecture consists of four parts: a feature encoding module, a controllable generation module, a protocol constraint module, and a quality evaluation module. It enables the controllable and high-quality generation of encrypted malicious samples. The specific architecture is as follows: 1h. Feature Encoding Module: The hidden anomaly features discovered in step 3 Known encryption attack patterns (from) The features extracted from the data and the encryption protocol rules (such as TLS 1.2, TLS 1.3, and VPN protocols) are encoded and converted into input vectors that can be processed by large models, serving as constraints for sample generation. The encoding process uses an embedding layer to convert discrete features into continuous vectors, combined with an attention mechanism to highlight core information about anomalies and attack patterns, ensuring that the generated samples reflect the target's anomalies.

[0093] 2h. Controllable generation module: Completed by step 2 training Based on this, a decoder module is added to build a generative large model. This module achieves controllable sample generation through instruction tuning and adversarial training. Specific optimization measures include: First, fine-tune the instructions: Design targeted generation instructions, incorporating constraints such as concealed anomaly characteristics, attack types, and protocol types into the instructions, so that the model can generate encrypted malicious samples that meet the requirements according to the instructions.

[0094] For example, the instruction format is: "Generate encrypted Trojan traffic samples conforming to the TLS 1.3 protocol, containing hidden abnormal features: packet interaction interval variance anomaly (quantization value 85), payload length distribution offset (quantization value 90), 100 samples, each sample containing a complete session sequence." Through a large number of instructions for fine-tuning, the model can master the sample generation rules under different constraints, improving the controllability of the generated samples.

[0095] Then, conduct adversarial training: Introducing adversarial mechanisms from Generative Adversarial Networks (GANs) will... As a generator, construct a discriminator. The discriminator's role is to distinguish generated samples from real malicious samples, while the generator's goal is to generate realistic samples that can deceive the discriminator. The loss function for adversarial training... A combination of generator loss and discriminator loss:

[0096] in, For the generator loss, cross-entropy loss is used, with the goal of minimizing the probability that a generated sample is identified as a "generated sample". For the discriminator loss, cross-entropy loss is also used, with the goal of maximizing the ability to distinguish between real and generated samples. Adversarial training is employed to improve the realism of generated samples, ensuring that their similarity to real malicious samples is no less than 90%.

[0097] 3h. Protocol Constraint Module: An encryption protocol constraint module is added to ensure that the generated samples conform to the corresponding encryption protocol specifications (such as TLS 1.2, TLS 1.3, VPN protocol), avoiding the generation of invalid samples that do not comply with the protocol rules. This module has built-in syntax rules, session flows, field requirements, etc. for various encryption protocols. During the sample generation process, the generated data packet sequence and protocol fields are validated in real time. If they do not conform to the protocol rules, they are fed back to the generator for adjustment until a sample that conforms to the protocol specifications is generated.

[0098] For example, for a TLS 1.3 protocol sample, verify whether the handshake process includes key steps such as Client Hello, Server Hello, and Encrypted Extensions, and verify whether the encryption algorithm field, session ID, etc., conform to the protocol specification.

[0099] 4h. Quality Assessment Module: Design a sample quality assessment index system to evaluate the quality of generated samples in real time, ensuring the validity and usability of the generated samples. The assessment indexes include: Authenticity: The feature similarity between the generated sample and the real malicious sample must be no less than 90%. It is evaluated by calculating the cosine similarity of the deep features between the generated sample and the real sample. Compliance: Whether the generated samples conform to the encryption protocol specifications is evaluated through the verification results of the protocol constraint module, and the compliance rate is required to reach 100%. Anomaly feature consistency: Whether the generated sample contains hidden anomaly features of the target is evaluated by comparing the anomaly features of the generated sample with the preset target features. The matching degree should not be less than 85%. Diversity: Whether the feature distribution of the generated samples is uniform and whether it covers different attack scenarios and abnormal feature combinations. It is evaluated by calculating the variance of the sample features and the cluster diversity. The diversity score should be no less than 80 points (out of 100).

[0100] The quality assessment module feeds back the assessment results to the controllable generation module. If the sample quality does not meet the requirements, the generation instructions and model parameters are adjusted, and the samples are regenerated until the assessment criteria are met.

[0101] Both the protocol constraint module and the quality assessment module serve the controllable generation module. They provide direct feedback to the controllable generation module during the sample generation process to optimize the generation quality.

[0102] S4.2 Controllable generation process of encrypted malicious samples.

[0103] Based on the above controllable generation architecture, and combined with the hidden anomaly features and known attack patterns discovered in step 3, encrypted malicious samples are generated in batches. The specific process is as follows: 1i. Determining Constraints for Sample Generation: Clearly define the constraints for sample generation, including: Attack type constraints: Specify the attack type of the generated sample, such as cryptographic trojan, cryptographic tunnel, zero-day attack, etc. Each attack type corresponds to different behavior patterns and abnormal characteristics; Protocol type constraints: Specify the encryption protocol followed by the generated sample, such as TLS 1.2, TLS 1.3, VPN protocol, etc., to ensure that the sample conforms to the actual application scenario; Anomaly feature constraints: The effective hidden anomaly features filtered in step 3 are... As a core constraint, the quantification range of each abnormal feature is clearly defined to ensure that the generated samples contain the hidden abnormal features of the target; Sample quantity constraint: Based on the needs of detection model optimization, the number of samples generated in batches can be set. The number of samples generated at one time can be adjusted to 1,000-10,000, and both batch generation and incremental generation modes are supported.

[0104] 2i. Generating instruction construction: Based on the defined constraints, targeted generation instructions are constructed, and the instruction format is standardized, including key information such as attack type, protocol type, anomaly characteristics and quantification range, sample quantity, and session requirements.

[0105] For example, the command to generate encrypted tunnel attacks is: "Generate encrypted tunnel attack traffic samples that conform to the VPN protocol, containing covert abnormal features: session duration fluctuations (quantization value 75-85), abnormal average data packet interaction intervals (quantization value 80-90), and peak offset in payload length distribution (quantization value 70-80). The number of samples is 5000, and each sample contains a complete TCP session sequence with a session duration between 120-300 seconds and a total number of data packets between 50-200." 3i. Sample generation and real-time verification: The constructed generation instructions are input into the controllable generation module. In the process, the model generates a feature sequence of encrypted malicious samples according to instructions, and then transmits it to the protocol constraint module for real-time verification. The protocol constraint module verifies the data packet sequence, protocol fields, and session flow of the generated samples one by one according to preset encryption protocol rules. If any content that does not conform to the protocol specifications is found (such as missing key steps in the TLS handshake process, incorrect protocol fields, etc.), the verification result is immediately fed back to the module. The model adjusts the generation parameters and regenerates samples until samples that conform to the protocol specifications are generated.

[0106] 4i. Quality Assessment and Screening: The generated samples that pass the protocol verification are input into the quality assessment module, where a comprehensive evaluation is conducted according to a preset assessment index system to select samples that meet the quality standards. The specific selection logic is as follows: Retain samples with ≥90% authenticity, 100% compliance, ≥85% consistency of anomalous features, and ≥80 diversity score; Remove samples that are substandard, have duplicate features, or do not meet the constraints. The selected samples are deduplicated to ensure their uniqueness and prevent duplicate samples from affecting the training effect of the detection model.

[0107] 5i. Batch generation and storage of samples: Repeat steps 2i-4i to generate encrypted malicious samples in batches according to the generation instructions. After generation, classify and store the samples according to attack type, protocol type, and abnormal feature type to establish an encrypted malicious sample library. This provides data support for subsequent detection model optimization. Each sample in the sample library contains complete session sequences, anomaly feature annotations, attack type annotations, protocol type annotations, and other metadata, facilitating subsequent model training and feature analysis.

[0108] The encrypted malicious samples generated in this step are different from those generated by existing GANs. They are characterized by high authenticity, strong controllability, sufficient diversity, and good compliance. They can effectively supplement samples of new private encrypted Trojans, encrypted tunnels, and zero-day attacks, solving the pain points of scarce malicious samples and lack of new unknown attack samples in existing technologies. Moreover, the generation process can adjust the constraints according to actual needs and flexibly adapt to different application scenarios.

[0109] S4.3 Desensitization compliance processing and security control.

[0110] To ensure that the generated encrypted malicious samples comply with relevant privacy protection regulations and prevent the leakage of sensitive information, this invention establishes a controllable AI generation and desensitization compliance mechanism for encrypted malicious traffic. The generated samples undergo comprehensive desensitization and security control, specifically including the following steps: 1j. Desensitization Process: The generated encrypted malicious samples undergo multi-level desensitization processing to ensure that the samples do not contain any sensitive information. Specific desensitization measures include: Network identifier anonymization: Network identifiers such as IP addresses, port numbers, and MAC addresses in the sample are anonymized. IP addresses are encrypted using a hash algorithm to hide the real IP information; non-standard ports are randomly mapped while retaining the port type characteristics (client port, server port), and standard ports (such as 80, 443, 445, etc.) are obfuscated, retaining only the port range; MAC addresses are replaced with random strings to ensure that they cannot be traced back to the real device.

[0111] Payload content anonymization: The encrypted payload content of the generated samples is anonymized using methods such as truncation, hashing, or random padding, preserving characteristics such as payload length, payload distribution, and payload entropy value without revealing any original payload content. For example, the payload content can be hashed to generate a fixed-length hash value to replace the original payload, ensuring that payload characteristics remain unchanged while preventing the leakage of sensitive information.

[0112] Metadata anonymization: The sample's metadata (such as collection time, device information, user information, etc.) is anonymized. The collection time is randomly offset to hide the real collection time; device information and user information are anonymized and replaced with randomly generated identifiers so that they cannot be associated with real devices and users.

[0113] Protocol field desensitization: Sensitive information (such as session ID, certificate information, key information, etc.) in the encryption protocol fields is desensitized. The session ID is replaced with a random string, and the certificate information and key information are replaced with simulated fake information to ensure compliance with the protocol specifications while not containing real sensitive information.

[0114] 2j. Compliance Verification: After the anonymization process is completed, the samples undergo compliance verification to ensure they comply with relevant regulations such as the Cybersecurity Law, the Personal Information Protection Law, and the Data Security Law. Specific verification content includes: Does it contain sensitive information that has not been anonymized? Does it comply with encryption protocol specifications? Is there a risk of privacy breach? Does it comply with industry safety standards?

[0115] The verification process combines automated tools with manual review. Automated tools are responsible for initial verification, while manual review is responsible for key verification and anomaly detection. The compliance verification pass rate is required to reach 100%. Samples that fail the verification must be de-identified again until they meet the requirements.

[0116] 3j. Security Management Mechanism: Establish a security management mechanism for generated samples to ensure their safe storage, use, and disposal. Specific measures include: Storage security: De-identify the sample library The sample data is stored in an encrypted server and encrypted using a symmetric encryption algorithm. Access control is set so that only authorized personnel can access the sample data to prevent sample leakage or tampering. The sample library is backed up regularly to ensure the security and integrity of the samples.

[0117] Safety of Use: Clearly define the scope and permissions for the use of the samples, which shall be used only for training, optimization and testing of the encrypted traffic anomaly detection model, and shall not be used for any illegal purposes; during use, the sample data shall be encrypted during transmission to prevent theft; establish a sample usage log to record information such as the time of use, the user, and the purpose of use for easy traceability.

[0118] Destruction security: For expired or useless sample data, establish a standardized destruction process and use methods such as complete deletion and data overwriting to ensure that the sample data cannot be recovered; the destruction process is recorded in its entirety and a destruction log is kept to ensure that the destruction process is traceable and auditable.

[0119] The desensitization compliance mechanism established in this step solves the problems of lack of compliance and privacy leakage risks in existing sample generation methods. It ensures that the generated encrypted malicious samples can not only meet the needs of detection model optimization, but also comply with relevant regulations and have extremely high practical application value. This is one of the core protection points of this invention.

[0120] Step 5: Optimize the detection model in a closed loop to achieve continuous improvement in detection performance.

[0121] Unlike existing technologies where each step is independent and cannot be optimized collaboratively, this invention combines the encrypted malicious sample generated in step 4 with a small number of real malicious samples to optimize the encrypted traffic anomaly detection model. Simultaneously, the optimized model is fed back to the anomaly feature mining stage to adjust the comparative learning parameters, forming a closed-loop system of "baseline modeling - anomaly mining - sample generation - model optimization," achieving continuous improvement in detection performance. Specifically, it includes the following sub-steps: S5.1 Detection Model Construction and Initialization.

[0122] Constructing an encrypted traffic anomaly detection model based on an improved Transformer The training was completed in step 2. Based on this foundation, an anomaly classification layer and a feature fusion layer are added to achieve anomaly detection and attack type identification in encrypted traffic. The specific construction process is as follows: 1k. Model Architecture Design: It consists of three parts: a feature extraction layer, a feature fusion layer, and an anomaly classification layer. Feature extraction layer: using The encoder module is responsible for extracting deep features of the traffic to be detected, ensuring the accuracy and generalization of feature extraction; Feature fusion layer: Combines the effective hidden anomaly features discovered in step 3. The deep features output by the feature extraction layer are fused together, and an attention fusion mechanism is used to assign different weights to different features, highlighting the role of abnormal features and improving the detection accuracy of the model. Anomaly Classification Layer: Employs a fully connected layer and the Softmax activation function to classify encrypted traffic into binary (normal / malicious) and multi-class (attack type) categories, outputting the anomaly probability and attack type of the traffic.

[0123] 2k. Model Initialization: right Perform initialization; parameter initialization is performed using... The pre-trained parameters are set to ensure the model has good feature extraction capabilities. The parameters of the anomaly classification layer and the feature fusion layer are randomly initialized. The model parameters are set as follows: the initial value of the attention weight of the feature fusion layer is 0.5-0.8, the hidden layer dimension of the fully connected layer is 256-512, the dropout probability is 0.2-0.4, the learning rate is 1e-5 - 5e-5, the optimizer is AdamW, and the loss function is the cross-entropy loss function, which is used for binary classification and multi-class classification tasks.

[0124] S5.2 Model Optimization Training Based on Generated Samples The de-identified and encrypted malicious sample library generated in step 4 and a small dataset of real malicious samples Normal encrypted traffic dataset For training data, Optimize the training to improve the model's anomaly detection accuracy and generalization ability. The specific training process is as follows: 1m. Training dataset construction: A hybrid training strategy of "real samples + generated samples" is adopted to construct the training dataset, specifically as follows: Normal sample: from 70% of the samples were randomly selected as normal training samples; Malicious samples: All samples and 80% of the samples are mixed and used as malicious training samples. The ratio of generated samples to real samples is set to 10:1-20:1, which ensures the authenticity of the samples and solves the problem of the scarcity of real samples. Validation set and test set: From 20% of the samples were selected as normal validation samples and test samples. Select the remaining 20% ​​of the samples and The remaining 20% ​​of the samples were mixed together as malicious verification samples and test samples, with the ratio of the verification set to the test set being 1:1.

[0125] 2m. Layered optimization training: A hierarchical optimization training strategy is adopted, training the model in two stages to ensure its detection performance. Phase 1: Freezing the Feature Extraction Layer The parameters of the encoder module are optimized, and only the feature fusion layer and the anomaly classification layer are trained. The focus is on optimizing the fusion effect of anomaly features and deep features, as well as the classification accuracy of the classification layer. The training iterations are 30-50 rounds, and a learning rate decay strategy is adopted. As the number of iterations increases, the learning rate is gradually reduced to avoid model overfitting. An early stopping mechanism is introduced, using the F1 score on the validation set as an indicator. When the F1 score on the validation set does not improve for 5-10 consecutive rounds, the training at this stage is stopped, and the optimal parameters are saved.

[0126] The second stage involves unfreezing some parameters of the feature extraction layer (only the parameters of the top 2-3 encoder layers) and fine-tuning the entire model to further optimize feature extraction capabilities and classification accuracy. The training iterations are 20-30 epochs, with the learning rate set to 1 / 10 of the first stage. A mini-batch gradient descent strategy is employed, with a batch size of 32-64 to ensure model convergence. Simultaneously, adversarial training is introduced to enhance the model's robustness and prevent it from being fooled by adversarial samples.

[0127] 3m. Training effect evaluation: After training, use the test set to... The performance of the model is evaluated using metrics including: accuracy, recall, precision, F1 score, false positive rate, and false negative rate. The specific evaluation criteria are: accuracy ≥ 98.5%, recall ≥ 98%, precision ≥ 97.5%, F1 score ≥ 97.8%, false positive rate ≤ 1.5%, and false negative rate ≤ 2%. If the model performance does not meet the evaluation criteria, the model parameters (such as attention weights, learning rate, and dropout probability) are adjusted, and the model is retrained until the requirements are met.

[0128] S5.3 Closed-loop feedback and parameter iterative optimization.

[0129] Optimized Feedback is sent to the hidden anomaly feature mining stage in step 3 to adjust the parameters and weights of the contrastive learning algorithm, achieving closed-loop iterative optimization. The specific process is as follows: 1n. Adjustment of weights for abnormal features: use The output of the anomaly classification layer is used to analyze the contribution of different hidden anomaly features to anomaly detection. Features with higher contribution are assigned higher attention weights, and the attention weights of the improved cosine similarity in step 3 are adjusted accordingly. Weighting of combined score with abnormal features This enhances the ability to capture high-contribution anomalous features and reduces the impact of invalid features.

[0130] 2n. Optimization of contrastive learning parameters: according to To adjust the false alarm and false negative rates, the parameters of the improved contrast loss function in step 3, including the temperature parameter, are adjusted. Weight of abnormal penalty items Similarity threshold : If the false positive rate is too high, the similarity threshold should be appropriately increased. Reduce the weight of abnormal penalty items This reduces the probability of legitimate traffic being misidentified as malicious traffic. If the false negative rate is too high, the similarity threshold should be appropriately lowered. Increase the weight of abnormal penalty items This enhances the ability to detect hidden anomalies.

[0131] 3n. Baseline Model and Knowledge Base Updates: Will Novel, unknown encryption attack samples identified during testing were preprocessed and anonymized before being added to the real malicious sample dataset. In the middle, the optimized Feature extraction layer parameters are fed back to ,right Perform incremental fine-tuning and update the baseline security behavior knowledge base. This ensures that the baseline model and knowledge base can adapt to changes in new types of attacks.

[0132] 4n. Sample generation strategy optimization: according to To address the shortcomings in detection, the sample generation strategy in step 4 was adjusted to focus on generating attack type samples and abnormal feature samples where the model's detection performance was poor, thus supplementing the sample library. Further optimize model performance. For example, if the model has a low accuracy rate in detecting encrypted tunnel attacks, increase the number of encrypted tunnel attack samples generated, adjust the anomaly feature constraints, and improve the relevance of the samples.

[0133] 5n. Closed-loop iteration: Repeat steps 3-5 to achieve continuous iteration of "baseline modeling - anomaly detection - sample generation - model optimization". The iteration cycle can be set according to the business cycle, and the parameters and strategies of each link can be continuously optimized according to changes in the network environment and the iteration of attack techniques to ensure that the performance of the detection model continues to improve and can always cope with the threat of new encryption attacks.

[0134] The closed-loop iterative optimization system of this invention comprises five stages: detection model construction and initialization, mixed sample training, parameter feedback adjustment, baseline model and knowledge base update, and sample generation strategy optimization, achieving continuous improvement in detection performance. This closed-loop iterative optimization system breaks through the limitations of independent stages in existing technologies, realizing synergistic optimization of each technical stage. This allows the detection model to continuously adapt to the iteration of attack techniques, solving the problem of existing detection models lagging behind the development of attack techniques.

[0135] In a specific embodiment of the present invention, the encrypted traffic anomaly mining and sample generation method of the present invention includes the following steps: Step 1: Data acquisition and preprocessing.

[0136] S1.1 Data Acquisition: In three scenarios—enterprise intranet, carrier network, and office environment—30 days of normal encrypted traffic data and a small amount of real encrypted malicious traffic data were collected. The normal encrypted traffic data included 1.2 million sessions, covering TLS 1.2 and TLS 1.3 protocol traffic (400,000 sessions), short video platform encrypted traffic (400,000 sessions), and office encrypted traffic (400,000 sessions). The real encrypted malicious traffic data included 1,200 sessions, including encrypted Trojans (400 sessions), encrypted tunnels (400 sessions), and zero-day attacks (400 sessions). Each malicious sample was labeled with attack type, abnormal characteristics, and other information.

[0137] S1.2 Data Preprocessing: Data cleaning: Incomplete sessions, abnormal noise, duplicate data, and protocol-abnormal data were removed, resulting in a data retention rate of 96.2%. Data standardization: The Min-Max standardization algorithm is used to convert continuous features into values ​​in the [0,1] interval, and discrete features are encoded using one-hot encoding; Session segmentation: TCP traffic is segmented into sessions from SYN to FIN packets, while UDP traffic is segmented into sessions with a 30-second time window. Preliminary feature extraction: Extract surface features and shallow temporal features to form a feature vector for each session; Data anonymization: IP addresses are hashed, non-standard ports are randomly mapped, and encrypted payloads are hashed to ensure data compliance.

[0138] After preprocessing, a normal encrypted traffic dataset is obtained. (1,154,400 sessions) and a dataset of real malicious samples (1200 sessions).

[0139] Step 2: Baseline modeling of normal encrypted traffic based on a large model.

[0140] S2.1 Large Model Selection and Initialization: An improved Transformer large model was selected, and optimization measures included hierarchical attention mechanism, temporal convolutional module (TCN), and model distillation. Initialization parameters were set as follows: hidden layer dimension 768, number of attention heads 12, number of encoder layers 8, number of decoder layers 8, dropout probability 0.2, learning rate 3e-5, optimizer AdamW, and initial loss function was cross-entropy loss. The initial model was denoted as [model name missing]. .

[0141] S2.2 Large Model Training: Training data construction: Each session is converted into a feature sequence and labeled with y=0; Scene-specific training: It is divided into three subsets: TLS, short video, and office, and the parameters are trained separately and then fused. Training optimization: First, perform 15 rounds of contrastive learning warm-up training (Info NCE loss function, temperature parameter 0.3), then perform hierarchical training and multi-task joint training. =0.7, =0.3), using cosine annealing decay and early stop mechanism; Performance verification: The dataset was divided into training, validation, and test sets in a 7:2:1 ratio. The test set achieved an accuracy of 99.2%, a recall of 98.7%, and an F1 score of 98.9%, meeting the performance requirements.

[0142] S2.3 Constructing a baseline safety behavior knowledge base : extract Deep feature vectors (768 dimensions) for all sessions; Store data categorized by scenario and add metadata; The K-Means clustering algorithm was used, and each scene was clustered into 50 behavioral pattern clusters with a silhouette coefficient of 0.85. Establish a monthly incremental update mechanism to ensure the timeliness of the knowledge base.

[0143] Step 3: Fine-grained mining of hidden anomaly features based on contrastive learning.

[0144] S3.1 Preprocessing of the flow rate to be detected: The 100,000 encrypted traffic packets to be detected were preprocessed to obtain feature sequences. ; S32 Deep Feature Extraction: enter Extracting deep feature vectors ; S3.3 Improved Contrastive Learning Algorithm Implementation: Construct contrast sample pairs: K=8 (positive sample pairs), M=15, N=8 (negative sample pairs); Improved cosine similarity calculation: attention weights Depend on Automatic learning at the attention layer; Improved contrastive loss function: =0.3, =0.8, =0.85; Comparative training: After 25 iterations, the loss value converged (change < 1e-5 for 5 consecutive iterations), revealing hidden anomaly features. .

[0145] S3.4 Feature Filtering and Quantization: A subset of effective hidden anomaly features was obtained by using a dual screening method of mutual information (threshold 0.15) and analysis of variance (threshold 0.08). The normalization quantization method is used to convert the feature values ​​into quantized values ​​in the range of [0,1].

[0146] S3.5 Anomaly Detection and Unknown Attack Identification: Calculate the comprehensive score of abnormal features Weight Obtained through logistic regression training; Determined by ROC curve =75, the recall rate for real malicious samples was 98.3%, and the false positive rate for normal samples was 0.8%; Results: Among 100,000 traffic entries to be detected, 823 were identified as malicious, including 217 new and unknown attack traffic entries, with an accuracy rate of 98.6%.

[0147] Step 4: Generate and de-identify compliant encrypted malicious samples based on the controllable generation of a large model.

[0148] S4.1 Controllable Generation Architecture Construction: Constructing four modules: feature encoding, controllable generation, protocol constraints, and quality assessment; S4.2 Sample Generation: Constraints: Generate 5000 samples of each type: encrypted trojan, encrypted tunnel, and zero-day attack. These samples must adhere to TLS 1.2, TLS 1.3, and VPN protocols respectively. The target abnormal characteristics; Generate instruction construction: Construct the generation instruction according to the standardized format, input... ; Real-time verification and quality assessment: The compliance rate of the protocol constraint module was 100%, and the quality assessment module screened out 14,200 samples that met the quality standards, with a sample authenticity of 91.5% and a diversity score of 83. S4.3 Desensitization and Compliance Processing: The 14,200 generated samples underwent multi-level anonymization, achieving a 100% compliance verification pass rate. A secure storage, use, and destruction mechanism was established, with the samples stored on an encrypted server employing a symmetric encryption algorithm.

[0149] Step 5: Closed-loop optimization of the detection model S5.1 Detection Model Construction and Initialization: Build ,based on Add a feature fusion layer and an anomaly classification layer, and initialize the parameters; S5.2 Model Optimization Training: The training employed a hybrid approach of "real samples + generated samples," with a ratio of 15:1 between generated and real samples. The training was conducted in two phases: the first phase consisted of 40 epochs, and the second phase consisted of 25 epochs. The test set performance was as follows: accuracy 98.7%, recall 98.2%, precision 97.8%, F1 score 98.0%, false positive rate 1.2%, and false negative rate 1.8%, which met the evaluation criteria. S5.3 Closed-loop feedback and iteration: Will Feedback to step 3, adjust the comparison learning parameters ( =0.83, =0.9), Update and Optimize the sample generation strategy and repeat steps 3-5 to achieve closed-loop iteration.

[0150] This embodiment, through the above steps, achieves accurate mining of concealed abnormal features of encrypted traffic and batch generation of encrypted malicious samples, constructs a closed-loop optimization system, and verifies the implementation effect as follows: Hidden anomaly feature mining effect: It can accurately mine fine-grained hidden anomaly features such as data packet interaction interval variance and payload length distribution offset, with a mining accuracy of 92%, which is 35% higher than the existing technology; Sample generation results: The 14,200 generated malicious samples have an authenticity of 91.5%, compliance of 100%, and diversity of 83 points, which can effectively supplement the malicious sample library and solve the problem of sample scarcity. Detection model performance: The core metrics all outperform existing technologies. Compared to traditional machine learning methods (such as SVM), the accuracy is improved by 14%, the false positive rate is reduced by 23%, and the false negative rate is reduced by 28%. Compared to ordinary deep learning methods (such as CNN-LSTM), the accuracy is improved by 10%, the false positive rate is reduced by 20%, and the false negative rate is reduced by 25%. Closed-loop optimization results: After three rounds of closed-loop iteration, the model's F1 score increased from 98.0% to 98.5%, and the unknown attack recognition rate increased from 82% to 87%, demonstrating the advantages of the closed-loop system.

[0151] The encrypted traffic anomaly mining and sample generation method of this invention first utilizes a large model to perform deep behavioral modeling on normal encrypted traffic (normal TLS, short video, office encrypted traffic) in multiple scenarios, extracting deep features of normal traffic and constructing a baseline security behavior knowledge base, thus solving the problems of low accuracy and poor adaptability of existing baseline modeling. Unlike existing simple statistical modeling or shallow deep learning modeling, this invention captures fine-grained behavioral patterns of normal encrypted traffic through the semantic understanding and feature extraction capabilities of a large model, forming a multi-dimensional, high-precision baseline model that provides a reliable reference for anomaly detection.

[0152] Secondly, based on a contrastive learning algorithm, the encrypted traffic to be detected is compared with the normal traffic features in a benchmark security behavior knowledge base in a fine-grained manner to uncover subtle differences between the two, thereby achieving accurate extraction of hidden anomaly features. Unlike existing applications of contrastive learning that are only used for traffic classification, and unlike single GAN sample generation schemes, this invention optimizes the contrastive learning algorithm and designs a differentially sensitive contrastive loss function to address the hidden nature of encrypted traffic, thereby enhancing the ability to capture fine-grained anomaly features and solving the problem of difficult identification of hidden anomalies.

[0153] Then, based on the controllable generation technology of large models, combined with the discovered hidden anomaly features and known encryption attack patterns, novel private encryption Trojans, encryption tunnels, and zero-day encryption attack simulation samples are generated in batches, and the compliance of the samples is ensured through a de-identification and compliance mechanism. Unlike existing GAN-generated samples which suffer from poor controllability, low realism, and lack of de-identification and compliance, this invention utilizes the controllable generation capability of large models to generate samples that conform to encryption protocol specifications and closely resemble real attack scenarios through instruction fine-tuning and adversarial training, while simultaneously addressing the problem of a scarcity of novel and unknown attack samples.

[0154] Finally, the generated simulated samples are combined with a small number of real-world labeled samples to optimize the detection model. Simultaneously, the optimized detection model is fed back to the anomaly feature mining stage to adjust the weights of the contrastive learning parameters, forming a closed-loop system of "baseline modeling - anomaly mining - sample generation - model optimization," achieving continuous improvement in detection performance. This closed-loop system represents a core innovation not yet realized in existing technologies, breaking the limitations of independent stages, fully leveraging the synergistic effects of various technologies, and possessing originality and novelty; it is not merely an extension of traditional security technologies.

[0155] Accordingly, embodiments of the present invention also provide an encrypted traffic anomaly mining and sample generation device, such as... Figure 2 The image shown is a schematic diagram of one possible structure of the device. This encrypted traffic anomaly detection and sample generation device includes the following modules: The data acquisition and preprocessing unit 201 performs data acquisition and preprocessing to construct a dataset of normal encrypted traffic in multiple scenarios and a dataset of a small number of real malicious samples. Baseline Modeling Unit 202, based on a large model, performs in-depth behavioral modeling of normal encrypted traffic in multiple scenarios and builds a baseline security behavior knowledge base. The anomaly detection unit 203, based on an improved contrastive learning algorithm, performs fine-grained comparison between the encrypted traffic to be detected and the normal encrypted traffic features in the benchmark security behavior knowledge base, mines hidden anomaly features and filters and quantifies them, thereby realizing anomaly judgment and unknown attack identification. The sample generation unit 204, based on a large model controllable generation architecture, combines the aforementioned hidden abnormal features and known attack patterns to generate encrypted malicious samples and perform desensitization and compliance processing. The closed-loop optimization unit 205 optimizes the encrypted traffic anomaly detection model using the generated encrypted malicious samples, and feeds the optimized encrypted traffic anomaly detection model back to the anomaly feature mining stage, forming a closed-loop iterative optimization system.

[0156] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0157] The present invention also provides a storage medium, which is a computer-readable storage medium storing a computer program thereon, the computer program being executable when it runs. Figure 1 The method shown may include some or all of the steps. The storage medium may include read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, etc. The storage medium may also include non-volatile memory or non-transitory memory, etc.

[0158] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer program are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data provider to another website, computer, server, or data provider via wired or wireless means.

[0159] The embodiments of the present invention have been described in detail above. Specific implementation methods have been used to illustrate the present invention. The descriptions of the embodiments above are only for the purpose of helping to understand the methods and systems of the present invention, and are merely some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention, and the content of this specification should not be construed as a limitation of the present invention. Therefore, any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for detecting and generating samples from encrypted traffic anomalies, characterized in that, The method includes: Step 1: Collect and preprocess data to build a dataset of normal encrypted traffic in multiple scenarios and a dataset of a small number of real malicious samples; Step 2: Based on the large model, perform deep behavioral modeling on normal encrypted traffic in multiple scenarios to build a benchmark security behavior knowledge base; Step 3: Based on the improved contrastive learning algorithm, the encrypted traffic to be detected is compared with the normal encrypted traffic features in the benchmark security behavior knowledge base in a fine-grained manner to uncover hidden abnormal features and perform screening and quantification to achieve anomaly judgment and unknown attack identification. Step 4: Based on the controllable generation architecture of the large model, combined with the hidden anomaly features and known attack patterns, generate encrypted malicious samples and perform de-identification and compliance processing. Step 5: Optimize the encrypted traffic anomaly detection model using the generated encrypted malicious samples, and feed the optimized encrypted traffic anomaly detection model back to the anomaly feature mining stage to form a closed-loop iterative optimization system.

2. The method for encrypted traffic anomaly mining and sample generation according to claim 1, characterized in that, In step 1, during data collection, normal encrypted traffic data and a small amount of real encrypted malicious traffic data are collected in multiple scenarios such as enterprise intranet, carrier network, and office environment. The normal encrypted traffic data collected includes normal TLS encrypted traffic, short video encrypted traffic, and office encrypted traffic. When collecting a small amount of real encrypted malicious traffic data, we collect encrypted Trojans, encrypted tunnels, and zero-day attacks by using enterprise security logs, security device alarm records, public vulnerability platforms, and cooperation with security vendors. The collected normal encrypted traffic data and a small amount of real encrypted malicious traffic data are preprocessed, including: data cleaning, data standardization, traffic session segmentation, preliminary feature extraction, and data anonymization.

3. The method for encrypted traffic anomaly mining and sample generation according to claim 1, characterized in that, Step 2 includes: Step 21: Perform the selection and initialization of the large model. The selected large model is an improved Transformer large model. The optimization measures of the improved Transformer large model include hierarchical attention mechanism, temporal convolution module and model distillation technique. Step 22: Using the normal encrypted traffic dataset as training data, supervised training is performed on the improved Transformer large model. The supervised training process adopts a scenario-based training, contrastive learning warm-up training, and multi-task joint training strategy. Step 23: Use the improved Transformer large model after training to extract deep features of all normal sessions in the normal encrypted traffic dataset, and construct the benchmark security behavior knowledge base. The benchmark security behavior knowledge base is optimized by clustering algorithm, establishes a dynamic incremental update mechanism, and stores the deep feature vectors and behavior pattern clusters of normal encrypted traffic according to scenario classification.

4. The method for encrypted traffic anomaly mining and sample generation according to claim 3, characterized in that, Step 3 includes: Step 31: Preprocess the encrypted traffic to be detected, including: data cleaning, data standardization, traffic session segmentation, preliminary feature extraction and data desensitization, to obtain the feature sequence of the encrypted traffic session to be detected; Step 32: Input the feature sequence of the encrypted traffic session to be detected into the trained improved Transformer large model to obtain the deep feature vector of the encrypted traffic to be detected. Step 33: Using the deep feature vector of the encrypted traffic to be detected as the query sample, construct comparison sample pairs from the benchmark security behavior knowledge base. The comparison sample pairs include positive sample pairs and negative sample pairs. Perform improved cosine similarity calculation and design an improved comparison loss function. The improved comparison loss function introduces an anomaly penalty term and similarity threshold constraints. Input the constructed comparison sample pairs into the comparison learning model. Iteratively train the model with the improved comparison loss function as the target. During the training process, the comparison learning model gradually explores the fine-grained differences between the features of the encrypted traffic to be detected and the normal encrypted traffic, i.e., the hidden anomaly features, by continuously adjusting the feature weights and similarity calculation parameters. Step 34: The hidden anomaly features obtained by mining are subjected to feature screening and feature quantization. The feature screening of the hidden anomaly features adopts a dual strategy of mutual information and analysis of variance, and the feature quantization adopts a normalization quantization method. Step 35: Based on the concealed abnormal features after feature quantization, perform anomaly judgment to distinguish between normal encrypted traffic and malicious encrypted traffic. The anomaly judgment adopts a weighted summation comprehensive score method, and the unknown attack identification is based on the similarity judgment of abnormal features.

5. The method for encrypted traffic anomaly mining and sample generation according to claim 4, characterized in that, Step 33 involves inputting the constructed contrastive sample pairs into the contrastive learning model and performing iterative training with the improved contrastive loss function as the target. (a) Initialize the parameters of the contrastive learning model, including attention weights. Temperature parameters Weight of abnormal penalty items Random initialization is used; (b) Input the constructed contrast samples into the contrast learning model and calculate the improved cosine similarity and the improved contrast loss value; (c) The AdamW optimizer is used to backpropagate and update the parameters of the contrastive learning model to minimize the loss value; (d) Repeat steps (b)-(c) for multiple iterations until the loss value converges; (e) After training, extract the difference features between the feature vector of the encrypted traffic to be detected and the feature vector of the positive sample pair. These difference features are the hidden anomaly features of the encrypted traffic to be detected.

6. The method for encrypted traffic anomaly mining and sample generation according to claim 3, characterized in that, Step 4 includes: Step 41: Design a controllable generation architecture for the large model based on the improved Transformer large model. The controllable generation architecture includes a feature encoding module, a controllable generation module, a protocol constraint module, and a quality evaluation module. The controllable generation module adopts a strategy of instruction fine-tuning, adversarial training, and real-time protocol verification. The evaluation indicators of the quality evaluation module include authenticity, compliance, consistency and diversity of abnormal features, and only samples that meet the quality standards are retained for model optimization. Step 42: Based on the controllable generation architecture of the large model, and combined with the hidden anomaly features and known attack patterns, generate encrypted malicious samples in batches. Step 43: Establish a controllable AI-generated and desensitized compliance mechanism for encrypted malicious traffic. Perform comprehensive desensitization and compliance processing on the generated encrypted malicious samples. The desensitization and compliance processing includes network identifier desensitization, payload content desensitization, metadata desensitization, and protocol field desensitization. At the same time, establish a compliance verification and security control mechanism.

7. The method for encrypted traffic anomaly mining and sample generation according to claim 6, characterized in that, In step 42, firstly, the constraints for sample generation are determined, including attack type constraints, protocol type constraints, anomaly feature constraints, and sample quantity constraints. Secondly, based on the determined constraints, targeted generation instructions are constructed. The instruction format is standardized and includes attack type, protocol type, anomaly features and quantification range, sample quantity, and session requirements. Thirdly, the constructed generation instructions are input into the controllable generation module, which generates a feature sequence of the encrypted malicious sample according to the generation instructions. This sequence is then transmitted to the protocol constraint module for real-time verification. The protocol constraint module processes the encrypted malicious sample data packets according to preset encryption protocol rules. The sequence, protocol fields, and session flow are verified one by one. If any content that does not conform to the protocol specifications is found, the verification result is immediately fed back to the controllable generation module, the generation parameters are adjusted, and the encrypted malicious sample is regenerated until an encrypted malicious sample that conforms to the protocol specifications is generated. Then, the encrypted malicious sample that passes the protocol verification is input into the quality assessment module, and a comprehensive evaluation is carried out according to the preset evaluation index system to screen out the encrypted malicious samples that meet the quality standards. Finally, the above steps are repeated to generate encrypted malicious samples in batches according to the requirements of the generation instructions. After generation, the encrypted malicious samples are classified and stored according to attack type, protocol type, and abnormal feature type.

8. The method for encrypted traffic anomaly mining and sample generation according to claim 3, characterized in that, Step 5 includes: Step 51: Construct the encrypted traffic anomaly detection model based on the improved Transformer. Based on the trained improved Transformer model, add an anomaly classification layer and a feature fusion layer to complete the anomaly detection and attack type identification of encrypted traffic. Step 52: Use the de-identified encrypted malicious samples, a small amount of real malicious sample datasets, and normal encrypted traffic datasets as training data to optimize and train the encrypted traffic anomaly detection model. Step 53: Feed the optimized encrypted traffic anomaly detection model back to the hidden anomaly feature mining stage in Step 3, adjust the parameters and weights of the comparative learning algorithm, and achieve closed-loop iterative optimization.

9. A device for detecting and generating encrypted traffic anomalies, characterized in that, The device includes: The data acquisition and preprocessing unit collects and preprocesses data to build datasets of normal encrypted traffic in multiple scenarios and a small number of real malicious sample datasets. The baseline modeling unit, based on a large model, performs in-depth behavioral modeling of normal encrypted traffic in multiple scenarios and builds a baseline security behavior knowledge base. The anomaly detection unit, based on an improved contrastive learning algorithm, performs fine-grained comparison between the encrypted traffic to be detected and the normal encrypted traffic features in the benchmark security behavior knowledge base, mines hidden anomaly features and filters and quantifies them, thereby realizing anomaly judgment and unknown attack identification. The sample generation unit, based on a large model controllable generation architecture, combines the aforementioned hidden anomaly features and known attack patterns to generate encrypted malicious samples and perform desensitization and compliance processing. The closed-loop optimization unit optimizes the encrypted traffic anomaly detection model using the generated encrypted malicious samples, and feeds the optimized encrypted traffic anomaly detection model back to the anomaly feature mining stage, forming a closed-loop iterative optimization system.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is run by the processor, it performs the steps of the encrypted traffic anomaly mining and sample generation method according to any one of claims 1 to 8.

Images