A dual-mode hierarchical encoder-based encrypted traffic classification model and method

Abstract

The application discloses an encrypted traffic classification model and method based on a dual-mode hierarchical encoder, constructs a dual-domain hierarchical flow representation (DFHR) matrix, extracts and fuses traffic byte and timing depth features through a dual-mode hierarchical encoder (DMHE), completes self-supervised pre-training by using a hierarchical mask multi-task mask autoencoder (HM-MAE), and outputs a classification result through an adaptive gating classification head (AGCH) after supplementing features through a traffic feature enhancement module (TFEM). The application solves the problems of insufficient single-mode feature extraction capability, small-size matrix information loss, large deviation between pre-training and downstream tasks, and poor generalization of the classification head of the prior art, greatly reduces the model training time, maintains high classification accuracy and robustness in small sample and lightweight scenarios, and adapts to the deployment requirements of edge resource-limited devices.

Description

Technical Field

[0001] This invention relates to the field of network traffic classification technology, and in particular to an encrypted network traffic classification model and method based on self-supervised learning. Background Technology

[0002] Network traffic classification is a core foundational technology for network security management, intrusion detection, and quality of service assurance. With the widespread application of encrypted traffic and anonymous network technologies, traditional traffic classification methods based on port numbers and rule matching have become ineffective; machine learning-based methods rely on manually designed statistical features and lack generalization ability; deep learning-based methods can automatically extract features from raw traffic bytes and have become the mainstream technical solution.

[0003] In existing technologies, the traffic classification scheme called YaTC uses a multi-level flow representation (MFR) matrix to model the original traffic and combines Traffic Transformer with masked autoencoder (MAE) self-supervised pre-training, achieving leading classification results on multiple public datasets. However, this scheme still has the following technical shortcomings in practical applications.

[0004] First, the encoder structure has limitations. YaTC uses a single-modal encoder, which only processes traffic byte features and cannot effectively fuse the temporal features of traffic (packet interval, packet length); at the same time, its packet-level and flow-level global attention computation complexity is high, and the feature utilization rate drops significantly in scenarios where the MFR matrix size is reduced, making it unsuitable for resource-constrained edge deployment scenarios.

[0005] Second, the pre-training strategy lacks adaptability. YaTC uses a 90% random global masking strategy, which is prone to losing key features carrying strong semantics, such as the packet header. This problem is further amplified under small-sized MFR matrices. At the same time, it only uses single-byte reconstruction loss, and the features learned by pre-training have a large deviation from the downstream classification task, resulting in insufficient robustness in small-sample scenarios.

[0006] Third, small-sized matrices suffer from information loss. To achieve lightweight models, the size of the MFR matrix needs to be reduced. However, after the matrix is ​​reduced, the byte feature dimension is significantly reduced, resulting in the loss of effective information and directly leading to a significant decrease in classification performance. Existing solutions cannot balance lightweight design with classification accuracy.

[0007] Fourth, the classification header has weak generalization and adaptation capabilities. YaTC uses a single MLP classification header and applies a unified classification logic to different types of traffic such as VPN, Tor, and IoT. However, under the small-size MFR, the differences in the characteristic distribution of different traffic are further amplified, making it difficult for a single classification header to adapt and limiting the classification accuracy. Summary of the Invention

[0008] The purpose of this invention is to overcome the shortcomings of the prior art and provide an encrypted traffic classification model and method based on a dual-modal hierarchical encoder, solving the following technical problems:

[0009] 1. Address the issues of existing single-modal encoders being unable to effectively fuse byte and temporal features, having high attention computational complexity, and low feature utilization under small-size MFRs;

[0010] 2. Address the issues of existing random global masks easily losing key features and large deviations between single-task pre-training and downstream classification tasks;

[0011] 3. Address the issues of feature information loss and the inability to balance input lightweighting with classification accuracy after reducing the size of the MFR matrix;

[0012] 4. Solve the problems of poor adaptability of a single classification head to different flow types and insufficient classification accuracy under small-sized MFRs.

[0013] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0014] An encrypted traffic classification model based on a dual-modal hierarchical encoder is obtained through the following steps:

[0015] S1. Collect raw network traffic and divide it according to session flow. Construct a fixed-size dual-model flow hierarchical representation (DFHR) matrix containing features such as header, payload, packet interval, and packet length. Gradually reduce the matrix size through gradient experiments to generate a lightweight DFHR matrix with a size of 20×20~40×40.

[0016] S2, construct a dual-modal hierarchical encoder DMHE, extract byte depth features of the DFHR matrix through byte branch, extract time-series depth features of traffic through time-series branch, and generate fusion depth features after adaptive fusion by cross-modal gating fusion unit;

[0017] S3. Construct a hierarchical masked multi-task masked autoencoder HM-MAE, adopt a differentiated non-uniform masking strategy for different regions of the DFHR matrix, and perform multi-task joint pre-training through an encoder-decoder architecture to learn a general latent representation of the traffic.

[0018] S4. Construct the traffic feature enhancement module TFEM, extract supplementary features from three dimensions: flow-level statistical features, byte distribution features, and temporal correlation features. After layer normalization of the supplementary features and the fusion depth features, they are concatenated to generate enhanced classification features.

[0019] S5 constructs an adaptive gating classification head AGCH. Based on enhanced classification features, it dynamically matches the lightweight MLP sub-classification head corresponding to the traffic type through gating units and outputs the final traffic classification result.

[0020] In S1, the construction process of the DFHR matrix includes:

[0021] The raw traffic is divided into independent session streams according to the five-tuple. Five consecutive data packets are extracted from a single stream. Each data packet is divided into a header part and a payload part. A fixed number of header lines and payload lines are allocated to each data packet. The packets are stacked according to the flow time sequence to form the byte area of ​​the DFHR matrix.

[0022] Extract the packet interval sequence and packet length sequence of consecutive data packets within the stream, map them into fixed-dimensional feature vectors, and supplement them to the temporal feature region of the DFHR matrix to form a complete DFHR matrix;

[0023] Perform zero-puffing or truncation on the DFHR matrix, with a fixed matrix size. The matrix size was gradually compressed through gradient ablation experiments to select the smallest matrix size that met the classification accuracy requirements.

[0024] In S1, the standard size of the DFHR matrix is ​​40×40, containing 5 consecutive data packets. Each data packet is allocated 2 header rows and 5 payload rows, with each row having a fixed length of 40 bytes. At the bottom of the payload row of each data packet, a time-series feature row is added. Through gradient ablation experiments, the matrix size can be gradually compressed to a 20×20 specification.

[0025] In S2, the feature encoding process of the dual-modal hierarchical encoder DMHE includes:

[0026] S21, Byte branching: Divide the byte region of the DFHR matrix into non-overlapping micro-packet patches, and after linear mapping and positional encoding, input them into the micro-packet level attention module and output the byte depth feature B;

[0027] S22, Temporal branching: Normalize the packet interval and packet length sequences, add temporal position bias encoding, input the input to the stream segment-level attention module through linear mapping, and output temporal depth features T;

[0028] S23, Cross-modal gated fusion: The fusion weight is calculated through the gated unit, and the byte depth feature B and the temporal depth feature T are adaptively fused to generate the final fusion depth feature F.

[0029] In S21, the processing procedure of the micro-packet level attention module includes:

[0030] By dividing the micro-packet patch within a single packet into multiple micro-packet groups and performing multi-head self-attention computation only within these micro-packet groups, the time complexity is reduced to... Where N is the total number of patches and M is the number of data packets in a single stream;

[0031] The micropacket patch is 2×2 in size and is mapped to a 192-dimensional vector through a linear layer. After adding learnable positional encoding, it is input into a stacked 4-layer Transformer block and finally outputs a 192-dimensional byte-depth feature B.

[0032] In S22, the processing procedure of the segment-level attention module includes:

[0033] The data packets within a flow are divided into fixed-length segments according to time sequence, and multi-head self-attention calculation is performed only within the segments to capture the local temporal correlation patterns of the traffic.

[0034] Packet interval and packet length sequences are mapped to 192-dimensional vectors through a linear layer. After adding temporal position bias encoding, the vectors are input into a stacked 2-layer Transformer block, and the final output is a 192-dimensional temporal depth feature T.

[0035] In S23, the calculation formula for cross-modal gating fusion is:

[0036] The formula for calculating the gating weight G is:

[0037] The formula for calculating the fusion feature F is:

[0038] Where σ is the Sigmoid activation function, W b W t Let b be the learnable weight matrix, and b be the bias term. For Hadama accumulation.

[0039] In S3, the process of multi-task pre-training of layered masks includes:

[0040] Differentiated masking rates are set for the Header layer, Payload layer, and temporal features of the DFHR matrix, and only the unmasked visible patches are input into the encoder;

[0041] An asymmetric encoder-decoder architecture is adopted. Based on the encoder output and mask token, the original DFHR matrix and temporal features are reconstructed. At the same time, a weak supervision head for coarse traffic classification is added to perform binary classification pre-training for encrypted / unencrypted traffic.

[0042] The model parameters are optimized by using a multi-task joint loss function. After pre-training, the encoder weights are retained for fine-tuning initialization in downstream classification tasks.

[0043] The rules for setting the differential mask rate are as follows:

[0044] The header layer is set with a low masking rate of 10% to 20%, the payload layer is set with a high masking rate of 80% to 95%, and the timing features use a dynamic masking rate. Tor anonymous traffic is set with a masking rate of 90%, and IoT traffic is set with a masking rate of 70%.

[0045] Multi-task joint loss function The calculation formula is:

[0046] Among them, L byte For the MSE loss of DFHR byte region reconstruction, L seq For the MSE loss of temporal feature reconstruction, L cls Cross-entropy loss for coarse traffic classification; α, β, and γ are adjustable weight coefficients, with default settings of α=0.6, β=0.2, and γ=0.2.

[0047] In S4, the processing procedure of the Flow Feature Enhancement Module (TFEM) includes:

[0048] Extract flow-level statistics for a single flow and generate an 8-dimensional statistical feature vector;

[0049] Perform histogram statistics on the byte values ​​of the DFHR matrix to generate a 256-dimensional byte distribution feature vector;

[0050] The statistical features and byte distribution features are concatenated into a supplementary feature vector. Layer normalization is then performed on the supplementary feature vector and the fused deep features respectively. Finally, they are concatenated along the feature dimension to generate enhanced classification features.

[0051] Among them, the flow-level statistics include the mean packet length, the variance of packet length, the mean packet interval, the variance of packet interval, the packet sending rate, and the total number of packets in the flow;

[0052] Byte distribution characteristics include the information entropy, mean, standard deviation, maximum value, and minimum value of byte values.

[0053] In S5, the processing of the adaptive gating classification head AGCH includes:

[0054] For different traffic types, separate lightweight MLP sub-classification headers are built;

[0055] Based on the enhanced classification features of the input, the matching weight of each subclass head is calculated through a gating unit;

[0056] The final classification output is a weighted sum of the outputs of all sub-classification headers, yielding the probability distribution of traffic categories.

[0057] The sub-class headers correspond to VPN traffic, Tor traffic, IoT traffic, and regular Internet traffic, respectively. Each sub-class header adopts a two-layer fully connected layer structure to adapt to the feature distribution of the corresponding traffic type.

[0058] The formula for calculating the matching weight of the gating unit is:

[0059] Where i is the index of the subclass header, F enhanced To enhance classification features, W is the shared weight matrix, b i Let σ be the bias term for the i-th subclass head, and σ be the Sigmoid activation function;

[0060] The final classification output is calculated using the following formula:

[0061] Where K is the total number of subclass headers, MLP i (F) represents the output of the i-th subclass header, and y represents the final traffic category probability distribution.

[0062] The method also includes a model fine-tuning step:

[0063] After the model pre-training is completed, the weights of the DMHE encoder are loaded into the classification network, the encoder's underlying parameters are frozen, and labeled traffic data is used to fine-tune the upper layer of the encoder, the TFEM module, and the AGCH classification head with cross-entropy loss as the optimization objective, thus completing the adaptation for downstream traffic classification tasks.

[0064] Based on the above classification model, this invention also proposes a network traffic classification method, which involves porting the trained classification model to the corresponding network device, the network device collecting network traffic in real time and inputting it into the classification model, and the classification model outputting the traffic category.

[0065] The beneficial effects of this invention are:

[0066] Compared with the prior art, the present invention has the following significant advantages:

[0067] 1. The dual-modal hierarchical encoder designed in this invention encodes byte features and temporal features in a targeted manner. Micro-packet level attention and stream segment level attention significantly reduce computational complexity. Cross-modal gating fusion realizes adaptive matching of dual-modal features. It can still maintain high feature utilization under a small 20×20 DFHR matrix, improve inference speed, and adapt to edge resource-constrained scenarios.

[0068] 2. The hierarchical masking multi-task pre-training strategy of the present invention protects key features such as the Header by using differentiated masking rates, avoiding the loss of effective information under small-sized matrices; the multi-task joint loss combines byte reconstruction, temporal reconstruction and weakly supervised classification, making the pre-trained features more suitable for downstream classification tasks and significantly enhancing robustness.

[0069] 3. The newly added traffic feature enhancement module of this invention supplements features from three dimensions: statistics, byte distribution, and temporal correlation. It effectively makes up for the information loss caused by the compression of small-sized DFHR matrix. When the matrix size is compressed from 40×40 to 20×20, the classification accuracy loss is controlled within 3%, achieving a balance between lightweight input and classification accuracy.

[0070] 4. The adaptive gating classification head of the present invention designs exclusive sub-classification heads for different traffic types. By dynamically adapting the traffic feature distribution through the gating unit, it solves the problem of insufficient generalization ability of a single classification head. In multiple scenarios such as VPN, Tor, and IoT, the classification accuracy is improved by an average of more than 3%, especially in small-sized DFHR matrices, the accuracy improvement effect is more significant.

[0071] 5. This invention supports gradient compression of DFHR matrix size, which can flexibly adjust the matrix specifications according to the computing resources of the deployment scenario. While maintaining state-of-the-art classification performance, it significantly reduces computing and storage overhead and can be widely used in various network security and management scenarios such as intrusion detection, traffic auditing, and quality of service assurance. Attached Figure Description

[0072] Figure 1 This is a flowchart illustrating the overall architecture of the encrypted traffic classification method described in this invention.

[0073] Figure 2 This is a schematic diagram of the structure of the dual-modal layered encoder DMHE of the present invention.

[0074] Figure 3 This is a schematic diagram of the flow characteristic enhancement module TFEM of the present invention.

[0075] Figure 4 This is a schematic diagram of the adaptive gating classification head AGCH of the present invention. Detailed Implementation

[0076] This invention provides an encrypted traffic classification model and method based on a dual-modal hierarchical encoder. First, a dual-domain hierarchical flow representation (DFHR) matrix is ​​constructed based on network traffic data. Then, traffic bytes and temporal depth features are extracted and fused using a dual-modal hierarchical encoder (DMHE). Self-supervised pre-training is completed using a hierarchical masked multi-task autoencoder (HM-MAE). After feature enhancement by a traffic feature enhancement module (TFEM), the classification result is output through an adaptive gated classification head (AGCH). This invention solves the problems of insufficient single-modal feature extraction capability, information loss in small-sized matrices, large deviation between pre-training and downstream tasks, and poor generalization of classification heads in existing methods. It significantly reduces model training time, maintains high classification accuracy and robustness even in small-sample, lightweight scenarios, and adapts to the resource-constrained deployment requirements of edge computing.

[0077] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0078] This embodiment provides an encrypted traffic classification model and method based on a dual-modal hierarchical encoder, the overall architecture of which is as follows: Figure 1 As shown, the specific implementation steps are as follows:

[0079] Example 1: Construction of DFHR Matrix for Multi-Level Flow Representation

[0080] This embodiment uses publicly available traffic datasets ISCXVPN2016, ISCXTor2016, USTC-TFC2016, and CICIoT2022 for model training and validation. The specific steps for constructing the DFHR matrix are as follows:

[0081] 1. Traffic preprocessing: Divide the raw pcap traffic into independent session flows according to the five-tuples;

[0082] 2. Packet Truncation: Truncates 5 consecutive packets within a single stream. Each packet is divided into a Header section and a Payload section. Each packet is allocated 2 Header lines and 5 Payload lines, with each line having a fixed length of 40 bytes. The Header line can fully contain the IP header, TCP / UDP header, and optional headers. Any Payload lines exceeding 240 bytes are truncated, and any insufficient portions are padded with 0 values.

[0083] 3. Temporal feature supplementation: Extract the packet interval sequence and packet length sequence of 5 data packets and supplement them to the next row of the corresponding data packet Payload row in the DFHR matrix;

[0084] 4. Fixed matrix size: The final standard DFHR matrix of 40 rows × 40 columns is formed. Through gradient ablation experiments, the matrix is ​​gradually compressed to a 20×20 size. The 20×20 matrix contains 5 data packets, each data packet is allocated 3 byte rows and 1 temporal feature row to verify its classification performance robustness.

[0085] Example 2: Implementation of the Dual-Mode Layered Encoder DMHE

[0086] The DMHE structure in this embodiment is as follows: Figure 2 As shown, the specific implementation parameters and process are as follows:

[0087] 1. Embedding layer settings: The DFHR matrix is ​​divided into 2×2 non-overlapping patches. For a 40×40 DFHR matrix, a total of 400 patches are generated. These patches are mapped to 192-dimensional patch embedding vectors through a linear layer, and learnable positional codes are added as encoder inputs.

[0088] 2. Byte Branch: The input is the Header and Payload region patches of the DFHR matrix. A micro-packet attention module is used to divide the 80 patches in a single packet into 4 micro-packet groups, with 20 patches in each micro-packet group. Self-attention calculation is performed only within the micro-packet group, and a total of 4 layers of Transformer blocks are stacked. The time complexity is reduced from O(400²) to O(20²×20), and the computation is reduced by 95%. The final output is a 192-dimensional byte depth feature B.

[0089] 3. Temporal Branch: The input is a sequence of packet intervals and packet lengths. Temporal position bias encoding is added and mapped to a 192-dimensional vector. Then, a segment-level attention module is used to divide the 5 data packets into 2 segments. Eight-head self-attention calculation is performed only within the segment. Two layers of Transformer blocks are stacked to output a 192-dimensional temporal depth feature T.

[0090] 4. Cross-modal gating fusion: The fusion weights are calculated through gating units. The Sigmoid activation function outputs weight values ​​of 0 to 1. The final fusion feature F is the weighted sum of byte features and temporal features. The model adaptively learns the bimodal weights under different traffic types. For example, the temporal feature weights are higher under Tor traffic, while the byte feature weights are higher under regular HTTP traffic.

[0091] Example 3: Layered Mask Multi-Task Pre-training

[0092] The pre-training process in this embodiment is as follows: Figure 1 As shown, the specific implementation is as follows:

[0093] 1. Pre-training dataset: A pre-training set was constructed using traffic data from four publicly available datasets, totaling over 2 million session streams;

[0094] 2. Layered masking settings: The masking rate of the Header layer is set to 20%, the masking rate of the Payload layer is set to 90%, the masking rate of the timing features of Tor traffic is set to 90%, and the masking rate of the timing features of IoT traffic is set to 70%; a mask matrix is ​​randomly generated, and only the visible patches that are not masked are input into the encoder;

[0095] 3. Model Architecture: An asymmetric encoder-decoder architecture is adopted. The encoder is a ViT-based HM-MAE, and the decoder uses only 2 layers of Transformer blocks. The input is the features and mask tokens output by the encoder, and the output is the reconstructed DFHR matrix. At the same time, a 2-class weak supervision head is added to perform encrypted / unencrypted traffic classification.

[0096] 4. Training settings: batch size is set to 128, the optimizer is AdamW, the base learning rate is 1e-3, and the number of training steps is 150,000; in the total loss function, α=0.6, β=0.2, and γ=0.2, and the three tasks of byte reconstruction, temporal reconstruction, and coarse classification are optimized simultaneously.

[0097] 5. After pre-training is complete, retain the encoder's weight parameters and discard the decoder and coarse classification head for fine-tuning initialization in downstream classification tasks.

[0098] Example 4: Flow Feature Enhancement and Classification Output

[0099] The TFEM module structure in this embodiment is as follows: Figure 3 As shown, the AGCH classification head structure is as follows: Figure 4 As shown, the specific implementation is as follows:

[0100] 1. Supplementary feature extraction:

[0101] 1.1. Statistical features: Extract the mean packet length, variance of packet length, mean packet interval, variance of packet interval, packet sending rate, maximum packet length, minimum packet length, and maximum time interval of a single flow to generate 8-dimensional statistical features;

[0102] 1.2. Byte Distribution Features: Histogram statistics are performed on the 256 byte values ​​of the DFHR matrix to generate 256-dimensional features;

[0103] 2. Feature Fusion: The supplementary features are fused with the 192-dimensional deep features output by DMHE, and layer normalization is performed on each feature before concatenation to form enhanced classification features;

[0104] 3. Adaptive Gated Classification Headers: Four lightweight MLP sub-classification heads are constructed, corresponding to VPN, Tor, IoT, and regular traffic, respectively. Each sub-classification head adopts two fully connected layers with a hidden layer dimension of 128. The matching weight of each sub-classification head is calculated through the gating unit, and the final output is the weighted sum of the outputs of each sub-classification head, which yields the probability distribution of traffic categories.

[0105] 4. Fine-tuning settings: During the fine-tuning phase, the batch size is 128, the optimizer is AdamW, the base learning rate is 2e-3, the training is conducted for 200 epochs, the parameters of the bottom two Transformer layers of the encoder are frozen, and only the parameters of the upper layer, the TFEM module and the AGCH classification head are fine-tuned, with cross-entropy loss as the optimization target.

[0106] This invention also includes a network traffic classification method, which involves porting the trained classification model to a corresponding network device (such as a network device for intrusion detection, a network device for traffic auditing, a network device for quality of service assurance, etc.), collecting network traffic in real time through the network device and inputting it into the classification model, and then outputting the traffic category by the classification model.

[0107] Example 5 Experimental Verification Results

[0108] This embodiment compares the method of this invention with state-of-the-art methods such as YaTC and ET-BERT on four public datasets. The core experimental results are as follows:

[0109] 1. In the scenario of fully labeled data, when using a 40×40 DFHR matrix, this invention achieves an accuracy of 96.36% and an F1 score of 96.26% on the ISCXVPN2016 dataset, and an accuracy of 98.35% and an F1 score of 98.36% on the ISCXTor2016 dataset, both of which are superior to the YaTC method, with a lead of 1.64%~1.96%.

[0110] 2. In scenarios with small-sized matrices, when this invention uses a 20×20 DFHR matrix, the average F1 score on the four datasets is 95.35%, which is only 0.77% lower than that of a 40×40 matrix;

[0111] 3. In terms of performance, the training time of each scheme of the present invention, regardless of the matrix size, is only 5% to 7% of that of the YaTC40×40 scheme, achieving a significant improvement in training efficiency.

[0112] The detailed descriptions listed above are merely specific descriptions of feasible embodiments of the present invention, and are not intended to limit the scope of protection of the present invention. All equivalent methods or modifications that do not depart from the technology of the present invention should be included within the scope of protection of the present invention.

Claims

1. A cryptographic traffic classification model based on a dual-modal hierarchical encoder, characterized in that, The model was obtained through the following steps: S1. Collect raw network traffic and divide it according to session flow. Construct a fixed-size dual-domain hierarchical flow representation (DFHR) matrix containing features such as header, payload, packet interval, and packet length. Gradually reduce the matrix size through gradient experiments to generate DFHR matrices with specifications of 20×20~40×40. S2, construct a dual-modal hierarchical encoder DMHE, extract byte depth features of the DFHR matrix through byte branch, extract time-series depth features of traffic through time-series branch, and generate fusion depth features after adaptive fusion by cross-modal gating fusion unit; S3. Construct a hierarchical masked multi-task masked autoencoder HM-MAE, adopt a differentiated non-uniform masking strategy for different regions of the DFHR matrix, and perform multi-task joint pre-training through an encoder-decoder architecture to learn a general latent representation of encrypted traffic. S4. Construct the traffic feature enhancement module TFEM, extract supplementary features from two dimensions: flow-level statistical features and byte distribution features, and then concatenate the supplementary features and fusion depth features after layer normalization to generate enhanced classification features. S5 constructs an adaptive gating classification head AGCH. Based on enhanced classification features, it dynamically matches the lightweight MLP sub-classification head corresponding to the traffic type through gating units and outputs the final traffic classification result.

2. The traffic classification model based on a dual-modal hierarchical encoder according to claim 1, characterized in that, In S1, the process of constructing the DFHR matrix includes: The raw traffic is divided into independent session streams according to the five-tuple. Five consecutive data packets are extracted from a single stream. Each data packet is divided into a header part and a payload part. A fixed number of header lines and payload lines are allocated to each data packet. The packets are stacked according to the flow time sequence to form the byte area of ​​the DFHR matrix. Extract the packet interval sequence and packet length sequence of consecutive data packets within the stream, map them into fixed-dimensional feature vectors, and supplement them to the temporal feature region of the DFHR matrix to form a complete DFHR matrix; Perform zero-puffing or truncation on the DFHR matrix, with a fixed matrix size. The matrix size is gradually compressed through gradient ablation to select the smallest matrix size that meets the classification accuracy requirements.

3. The encrypted traffic classification model based on a dual-modal hierarchical encoder according to claim 2, characterized in that, The standard size of the DFHR matrix is ​​40×40, containing 5 consecutive data packets. Each data packet is allocated 2 header rows and 5 payload rows, with each row having a fixed length of 40 bytes. A time-series feature row is added to the bottom of the payload row of each data packet. Through gradient ablation experiments, the matrix size is gradually compressed to 20×20.

4. The encrypted traffic classification model based on a dual-modal hierarchical encoder according to claim 3, characterized in that, In S2, the feature encoding process of the dual-modal hierarchical encoder DMHE includes: S21, Byte branching: Divide the byte region of the DFHR matrix into non-overlapping micro-packet patches, and after linear mapping and positional encoding, input them into the micro-packet level attention module and output the byte depth feature B; S22, Temporal branching: Normalize the packet interval and packet length sequences, add temporal position bias encoding, input the input to the stream segment-level attention module through linear mapping, and output temporal depth features T; S23, Cross-modal gated fusion: The fusion weight is calculated through the gated unit, and the byte depth feature B and the temporal depth feature T are adaptively fused to generate the final fusion depth feature F.

5. The encrypted traffic classification model based on a dual-modal hierarchical encoder according to claim 4, characterized in that, In step S21, the processing procedure of the micro-packet level attention module includes: Divide the micro-packet patch within a single packet into multiple micro-packet groups, and perform multi-head self-attention calculation only within the micro-packet groups, reducing the time complexity to O(N² / M²), where N is the total number of patches and M is the number of data packets in a single stream; The micropacket patch is 2×2 in size, mapped to a 192-dimensional vector through a linear layer, and after adding learnable positional encoding, it is input into a stacked 4-layer Transformer block, and finally outputs a 192-dimensional byte depth feature B. In step S22, the processing procedure of the segment-level attention module includes: The data packets within a flow are divided into fixed-length segments according to time sequence, and multi-head self-attention calculation is performed only within the segments to capture the local temporal correlation patterns of the traffic. Packet interval and packet length sequences are mapped to 192-dimensional vectors through a linear layer. After adding temporal position bias encoding, the vectors are input into a stacked 2-layer Transformer block, and the final output is a 192-dimensional temporal depth feature T.

6. The encrypted traffic classification model based on a dual-modal hierarchical encoder according to claim 5, characterized in that, In S23, the calculation formula for cross-modal gating fusion is as follows: Gating weights: Fusion characteristics: Where σ is the Sigmoid activation function, W b W t Let b be the learnable weight matrix, and b be the bias term. For Hadama accumulation.

7. The encrypted traffic classification model based on a dual-modal hierarchical encoder according to claim 6, characterized in that, In S3, the process of multi-task pre-training of the layered mask includes: Differentiated masking rates are set for the Header layer, Payload layer, and temporal features of the DFHR matrix, and only the visible patches that are not masked are input into the encoder. The rules for setting the differentiated masking rates are as follows: a low masking rate of 10%~20% is set for the Header layer, and a high masking rate of 80%~95% is set for the Payload layer; a dynamic masking rate is used for the temporal features, with a 90% masking rate set for Tor anonymous traffic and a 70% masking rate set for IoT traffic. An asymmetric encoder-decoder architecture is adopted. The encoder is a ViT-based HM-MAE, and the decoder uses a 2-layer Transformer block. Its input is the features and mask token output by the encoder. The original DFHR matrix and temporal features are reconstructed. At the same time, a weak supervision head for coarse traffic classification is added to perform binary classification pre-training for encrypted / unencrypted traffic. The model parameters are optimized using a multi-task joint loss function. Encoder weights are retained after pre-training for fine-tuning initialization in downstream classification tasks. The multi-task joint loss function... The formula is: Among them, L byte For the MSE loss of DFHR byte region reconstruction, L seq For the MSE loss of temporal feature reconstruction, L cls α is the cross-entropy loss for coarse traffic classification; α, β, and γ are adjustable weighting coefficients.

8. The encrypted traffic classification model based on a dual-modal hierarchical encoder according to claim 7, characterized in that, In step S4, the processing procedure of the Flow Feature Enhancement Module (TFEM) includes: Extract flow-level statistics for a single flow to generate an 8-dimensional statistical feature vector; among which, the flow-level statistics include mean packet length, packet length variance, mean packet interval, packet interval variance, packet sending rate, maximum packet length, minimum packet length, and maximum time interval; Histogram statistics are performed on the byte values ​​of the DFHR matrix to generate a 256-dimensional byte distribution feature vector; where the byte distribution features include the information entropy, mean, standard deviation, maximum value, and minimum value of the byte value occurrence frequency; The statistical features and byte distribution features are concatenated into a supplementary feature vector. Layer normalization is then performed on the supplementary feature vector and the fused deep features respectively. Finally, they are concatenated along the feature dimension to generate enhanced classification features.

9. The encrypted traffic classification model based on a dual-modal hierarchical encoder according to claim 8, characterized in that, In S5, the processing procedure of the adaptive gated classification head AGCH includes: For different traffic types, separate lightweight MLP sub-class headers are constructed. The sub-class headers correspond to VPN traffic, Tor traffic, IoT traffic, and regular Internet traffic, respectively. Each sub-class header adopts a 2-layer fully connected layer structure to adapt to the feature distribution of the corresponding traffic type. Based on the input enhanced classification features, a matching weight for each sub-classification head is calculated using a gating unit; the matching weight... The calculation is as follows: Where i is the index of the subclass header, F enhanced To enhance classification features, W is the shared weight matrix, b i σ is the bias term for the i-th subclass head, and σ is the Sigmoid activation function; The final classification output is a weighted sum of the outputs of all sub-categories, yielding the probability distribution of traffic categories. The calculation formula is as follows: Where K is the total number of subclass headers, MLP i (F) represents the output of the i-th subclass header, and y represents the final traffic category probability distribution.

10. A traffic classification method based on the encrypted traffic classification model according to any one of claims 1-9, characterized in that, The trained model is then ported and loaded onto the corresponding network device. The network device collects network traffic in real time and inputs it into the classification model, which then outputs the traffic category.

Images