Application type identification method and device based on traffic characteristics

Abstract

The present application provides a method and apparatus for identifying application types based on traffic characteristics. The method comprises: extracting features from multiple types of traffic feature data corresponding to bidirectional session traffic generated during the operation of a target application based on convolution kernels with different dimensions and weights, obtaining feature result data corresponding to each type of traffic feature data; and identifying the application type of the target application based on each of the feature result data and a preset fully connected layer. The present application can effectively improve the accuracy and effectiveness of identifying application types based on traffic characteristics, reduce the resources required to identify the application type to which traffic belongs, and effectively improve the efficiency of identifying traffic types.

Description

Technical Field

[0001] The present application relates to the technical field of network traffic analysis, and in particular to a method and device for identifying application types based on traffic characteristics. Background Art

[0002] With the continuous expansion of the Internet and the continued development of various network applications, the Internet has become an indispensable infrastructure for human production and life. Traffic classification and application identification, as an effective network protection method, can detect unknown attack behaviors and provide important support for network situational awareness.

[0003] At present, the existing method of identifying application types based on traffic is to use a classifier to identify target traffic while excluding background traffic. However, since this method does not analyze the actual structure and characteristics of the traffic data, it is difficult to distinguish the differences between the traffic generated by different applications. In addition, the existing method of identifying application types based on traffic can also use heterogeneous graph convolutional neural networks to obtain the embedding of the communication graph corresponding to the application to be classified, and use homogeneous graph convolutional neural networks to obtain the embedding of the flow graph corresponding to the application to be classified, thereby realizing the classification of traffic. However, the graph neural network method consumes more resources during the detection process, and cannot perform timely analysis and feedback when performing application identification and traffic classification, and cannot meet the requirements of fast and efficient monitoring tasks in intelligent operation and maintenance.

[0004] In other words, the existing traffic-based application type identification method has the problem of being unable to meet the requirements of classification accuracy and identification efficiency at the same time. Summary of the Invention

[0005] In view of this, embodiments of the present application provide a method and apparatus for identifying application types based on traffic characteristics to eliminate or improve one or more defects in the prior art.

[0006] One aspect of the present application provides a method for identifying application types based on traffic characteristics, including:

[0007] Based on convolution kernels with different dimensions and weights, feature extraction is performed on multiple types of traffic feature data corresponding to the bidirectional session traffic generated when the target application is running, and feature result data corresponding to each type of traffic feature data is obtained;

[0008] The application type of the target application is obtained according to each of the feature result data and the preset fully connected layer identification.

[0009] In some embodiments of the present application, the types of feature data include:

[0010] Traffic session header characteristic data used to represent information transmitted by both parties in a two-way session;

[0011] and, traffic data sequence characteristic data for representing functional characteristics of the target application;

[0012] Correspondingly, before extracting the feature data of multiple types of traffic features corresponding to the bidirectional session traffic generated when the target application is running, the method further includes:

[0013] The traffic session header characteristic data and the traffic data sequence characteristic data corresponding to the bidirectional session traffic generated when the target application is running are acquired.

[0014] In some embodiments of the present application, obtaining the traffic session header characteristic data and the traffic data sequence characteristic data corresponding to the bidirectional session traffic generated when the target application is running includes:

[0015] Capture the original traffic data of the two-way conversations generated when the target application is running;

[0016] Preprocessing the original flow data of the two-way conversation to obtain corresponding flow data of the two-way conversation;

[0017] Extracting the first N bytes from the two-way session traffic data as the traffic session header characteristic data, and extracting the first M bytes from the two-way session traffic data as the traffic data sequence characteristic data;

[0018] Among them, M≥2N.

[0019] In some embodiments of the present application, preprocessing the original traffic data of the two-way session to obtain corresponding traffic data of the two-way session includes:

[0020] The original flow data of the two-way conversation is cleaned to obtain the two-way conversation flow data after erroneous data and duplicate data are removed.

[0021] In some embodiments of the present application, the convolution kernels with different dimensions and weights are used to extract features from multiple types of traffic feature data corresponding to the bidirectional session traffic generated when the target application is running, and feature result data corresponding to each type of traffic feature data is obtained, including:

[0022] Performing data splicing processing on the traffic session header feature data to obtain corresponding traffic session header feature splicing data;

[0023] Performing feature extraction on the traffic session header feature splicing data based on the first convolution kernel to obtain feature result data corresponding to the traffic session header feature splicing data;

[0024] and, performing feature extraction on the characteristic data of the flow data sequence based on the second convolution kernel to obtain feature result data corresponding to the characteristic data of the flow data sequence;

[0025] The dimensions and weights of the first convolution kernel and the second convolution kernel are different.

[0026] In some embodiments of the present application, obtaining the application type of the target application according to each of the feature result data and a preset fully connected layer identification includes:

[0027] Performing splicing processing on the feature result data corresponding to the traffic session header feature splicing data and the feature result data corresponding to the traffic data sequence feature data to obtain a target feature sequence corresponding to the bidirectional session traffic;

[0028] The target feature sequence is input into a fully connected layer to determine the application type of the target application based on result data output by the fully connected layer.

[0029] In some embodiments of the present application, further comprising:

[0030] Risk identification is performed on the target application according to the application type of the target application.

[0031] Another aspect of the present application provides an application type identification device based on traffic characteristics, including:

[0032] A convolution module is used to extract features of multiple types of traffic feature data corresponding to the bidirectional session traffic generated when the target application is running based on convolution kernels with different dimensions and weights, and obtain feature result data corresponding to each type of traffic feature data;

[0033] The fully connected module is used to obtain the application type of the target application according to each of the feature result data and the preset fully connected layer identification.

[0034] Another aspect of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method for identifying application types based on traffic features when executing the computer program.

[0035] Another aspect of the present application provides a computer-readable storage medium having a computer program stored thereon, which implements the aforementioned method for identifying application types based on traffic features when executed by a processor.

[0036] The traffic feature-based application type identification method of the present application uses convolution kernels with different dimensions and weights to extract features from multiple types of traffic feature data corresponding to the bidirectional session traffic generated during the operation of the target application, thereby obtaining feature result data corresponding to each type of traffic feature data. The application type of the target application is identified based on each of the feature result data and a preset fully connected layer. By using multiple types of feature data corresponding to the bidirectional session traffic generated during the software operation to identify the application type, the accuracy and effectiveness of identifying the application type based on the traffic features can be effectively improved. By using convolution kernels with different dimensions and weights to extract features from each type of feature data, information loss can be effectively avoided based on the different structures and information content corresponding to different types of feature data, and the proportion of each group of features in the result determination can be effectively balanced, thereby further improving the accuracy of the identified software traffic type. By using convolution kernels and fully connected layers to finally identify the application type to which the bidirectional session traffic belongs, compared with graph convolutional neural networks, etc., the resources required to identify the application type to which the traffic belongs can be effectively reduced, and the efficiency of traffic type identification can be effectively improved.

[0037] Additional advantages, purposes, and features of the present application will be described in part in the following description and will become apparent to those skilled in the art upon study of the following or may be learned from practice of the present application. The purposes and other advantages of the present application may be achieved and obtained by the structures specifically pointed out in the specification and drawings.

[0038] Those skilled in the art will understand that the purposes and advantages that can be achieved by the present application are not limited to the above specific description, and the above and other purposes that can be achieved by the present application will be more clearly understood based on the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The drawings described herein are intended to provide a further understanding of the present application, constitute a part of the present application, and do not constitute a limitation of the present application. The components in the drawings are not drawn to scale, but are only for the purpose of illustrating the principles of the present application. In order to facilitate the illustration and description of some parts of the present application, the corresponding parts in the drawings may be enlarged, that is, they may become larger than other components in the exemplary device actually manufactured according to the present application. In the drawings:

[0040] Figure 1 This is a first flow chart of a method for identifying application types based on traffic characteristics in an embodiment of the present application.

[0041] Figure 2 This is a second flow chart of the method for identifying application types based on traffic characteristics in an embodiment of the present application.

[0042] Figure 3 This is a third flow chart of the method for identifying application types based on traffic characteristics in an embodiment of the present application.

[0043] Figure 4 This is a schematic diagram of a specific flow chart of a method for identifying application types based on traffic characteristics in one embodiment of the present application.

[0044] Figure 5 A flow chart of the application type identification method based on traffic characteristics provided for the application example of this application.

[0045] Figure 6 This is a structural diagram of an application type identification device based on traffic characteristics in another embodiment of the present application.

[0046] Figure 7 This is a schematic structural diagram of an electronic device in another embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail in conjunction with the embodiments and drawings. Here, the illustrative embodiments of this application and their descriptions are used to explain this application, but are not intended to limit this application.

[0048] It should also be noted here that in order to avoid obscuring the present application due to unnecessary details, the accompanying drawings only show structures and / or processing steps that are closely related to the scheme according to the present application, while other details that are not closely related to the present application are omitted.

[0049] It should be emphasized that the term "include / comprises" when used herein refers to the existence of features, elements, steps or components, but does not exclude the existence or addition of one or more other features, elements, steps or components.

[0050] It should also be noted that, unless otherwise specified, the term "connection" herein may refer not only to a direct connection but also to an indirect connection involving an intermediate.

[0051] Hereinafter, embodiments of the present application will be described with reference to the accompanying drawings. In the accompanying drawings, the same reference numerals represent the same or similar components, or the same or similar steps.

[0052] The internet has become an indispensable infrastructure for human production and life. At the same time, various cyberattacks, such as denial-of-service attacks, computer worms, and ransomware, are becoming increasingly rampant, posing significant risks to cybersecurity. These malicious activities and applications generate traffic that differs from normal network activity. Traffic classification and application identification, as effective network protection measures, can detect unknown attacks and provide crucial support for network situational awareness.

[0053] At the same time, with the increasing intelligence of monitoring technology, applying artificial intelligence to the field of operation and maintenance and using machine learning to discover and solve problems that traditional automated operation and maintenance cannot solve has become a mainstream trend.

[0054] Analyzing software traffic and classifying application types can, on the one hand, promptly detect intrusions and malicious behaviors, and on the other hand, supervise the software running within the company, thereby ensuring the safe and orderly operation of the company's network.

[0055] This application captures the two-way conversation flow generated by the software runtime, cleans the captured raw data, and then splits the traffic data into two parts: the traffic header and the data segment. One-dimensional convolution kernels of different dimensions and weights are used for feature extraction. Finally, the processed feature sequences are spliced ​​and input into the fully connected layer for traffic classification and application identification.

[0056] IT operations and maintenance require real-time monitoring of application software running on the network. Network traffic classification is used to categorize network traffic into specific application types, such as chat, video, and email, to better monitor software and promptly detect software with abnormal functionality. Application identification, as an effective network analysis tool, can determine whether current traffic belongs to a known application or a new application. New applications can then be further identified as malicious. This plays a crucial role in network management and network security, providing crucial support for network situational awareness.

[0057] One existing approach to traffic-based application type identification is to provide a mobile application traffic identification method based on a multi-layer classifier. This method takes into account the traffic distribution in real networks. Even without a complete background traffic dataset, it learns the characteristics of target traffic samples layer by layer, enabling the classifier to simultaneously identify target traffic and exclude background traffic, thus reducing the number of false positives. However, this method does not analyze the actual structure and characteristics of traffic data, making it difficult to distinguish between traffic generated by different applications.

[0058] A second existing approach to traffic-based application type identification is to provide an encrypted traffic classification method and device based on graph convolutional neural networks. This method splits the encrypted traffic data of the application to be classified into multiple flows and obtains statistical information for each flow. This method's advantage lies in using a heterogeneous graph convolutional neural network to obtain the embedding of the communication graph corresponding to the application to be classified, and a homogeneous graph convolutional neural network to obtain the embedding of the flow graph corresponding to the application to be classified, thereby achieving encrypted traffic classification. However, compared to machine learning methods, graph neural network methods consume more resources during the detection process and cannot provide timely analysis and feedback during application identification and traffic classification, failing to meet the requirements for fast and efficient monitoring tasks in intelligent operations and maintenance.

[0059] Based on this, to address the problem that existing traffic-based application type identification methods cannot simultaneously meet the requirements of classification accuracy and identification efficiency, embodiments of the present application provide a method for identifying application types based on traffic features. Based on convolution kernels with different dimensions and weights, feature extraction is performed on multiple types of traffic feature data corresponding to bidirectional session traffic generated during the operation of a target application to obtain feature result data corresponding to each type of traffic feature data. The application type of the target application is identified based on each of the feature result data and a preset fully connected layer. By using multiple types of feature data corresponding to bidirectional session traffic generated during software operation to identify the application type, the accuracy and effectiveness of identifying the application type based on traffic features can be effectively improved. By using convolution kernels with different dimensions and weights to extract features from each type of feature data, information loss can be effectively avoided based on the different structures and information content corresponding to different types of feature data, and the proportion of each group of features in the result determination can be effectively balanced, thereby further improving the accuracy of the identified software traffic type. By using convolution kernels and fully connected layers to finally identify the application type to which the bidirectional session traffic belongs, compared to graph convolutional neural networks, the resources required for identifying the application type to which the traffic belongs can be effectively reduced, and the efficiency of traffic type identification can be effectively improved.

[0060] Based on the above content, the present application also provides an application type identification device based on traffic features for implementing the application type identification method based on traffic features provided in one or more embodiments of the present application. The application type identification device based on traffic features can be a server. The application type identification device based on traffic features can communicate with the client device by itself or through a third-party server, etc., to capture the two-way conversation traffic data of the application software installed in the client device; then, based on convolution kernels with different dimensions and weights, feature extraction is performed on multiple types of traffic feature data corresponding to the two-way conversation traffic generated when the target application is running, to obtain feature result data corresponding to each type of traffic feature data; the application type of the target application is obtained based on each of the feature result data and the preset fully connected layer identification. In addition, the application type identification device based on traffic features can also send the identification results to other client devices, etc. for result display, so as to improve the efficiency and convenience of analysis by operation and maintenance personnel or risk control personnel.

[0061] The part of the application type identification device based on traffic characteristics that performs application type identification based on traffic characteristics can be executed in the server as described above, and in another practical application scenario, all operations can also be completed in the client device. The specific selection can be based on the processing capacity of the client device and the limitations of the user's usage scenario. This application is not limited to this. If all operations are completed in the client device, the client device may also include a processor for specific processing of application type identification based on traffic characteristics.

[0062] It is understood that the client device may include any mobile device capable of hosting an application, such as a smartphone, a tablet electronic device, a network set-top box, a portable computer, a personal digital assistant (PDA), a vehicle-mounted device, a smart wearable device, etc. The smart wearable device may include smart glasses, a smart watch, a smart bracelet, etc.

[0063] The client device may include a communication module (i.e., a communication unit) that can establish a communication connection with a remote server to implement data transmission with the server. The server may include a server on the task scheduling center side, and in other implementation scenarios, may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, a server cluster consisting of multiple servers, or a server structure of a distributed device.

[0064] The server and the client device may communicate using any suitable network protocol, including network protocols that have not yet been developed as of the filing date of this application. Examples of such network protocols include TCP / IP, UDP / IP, HTTP, and HTTPS. Furthermore, examples of such network protocols include RPC (Remote Procedure Call Protocol) and REST (Representational State Transfer) protocols, which are used on top of the aforementioned protocols.

[0065] The details are described in detail through the following embodiments and application examples.

[0066] In order to solve the problem that the existing application type identification method cannot simultaneously meet the requirements of classification accuracy and identification efficiency, the present application provides an embodiment of an application type identification method based on traffic characteristics, see Figure 1 The method for identifying an application type based on traffic characteristics, performed by the device for identifying an application type based on traffic characteristics, specifically includes the following contents:

[0067] Step 100: Based on convolution kernels with different dimensions and weights, feature extraction is performed on multiple types of traffic feature data corresponding to the bidirectional session traffic generated when the target application is running, and feature result data corresponding to each type of the traffic feature data is obtained.

[0068] It is understandable that different types of traffic feature data have some differences in feature dimensions, and each set of traffic feature data has different structures and information content. Using the same set of weighted convolution kernels will result in information loss. In order to balance the proportion of each set of traffic feature data in the result determination, step 100 uses 1D-Conv convolution kernels with different weights and sizes to convolve different types of traffic feature data separately.

[0069] Step 200: Obtain the application type of the target application according to each of the feature result data and the preset fully connected layer identification.

[0070] It is understandable that 1D-conv is the abbreviation of one-dimensional convolutional neural network, which is a commonly used model composed of a pooling layer, a convolution layer, and a fully connected layer. This application only uses the convolution layer of a one-dimensional convolutional neural network. In the usual application of convolutional neural networks, after the features are input into the convolutional neural network, they will be processed by the pooling layer, and the processed features will be input into the convolution layer, the convolution layer will be processed again, and the processed features will be input into the fully connected layer. In this application, the pooling layer is ignored, and the flow feature data is directly input into the convolution layer. Since convolutional neural networks have undergone many years of development, open source tools such as TensorFlow are very mature and can allow adjustments and modifications directly in the model.

[0071] From the above description, it can be seen that the application type identification method based on traffic characteristics provided in the embodiment of the present application can effectively improve the accuracy and effectiveness of identifying application types based on traffic characteristics by using multiple types of feature data corresponding to the two-way session traffic generated during software operation to identify the application type; by using convolution kernels with different dimensions and weights to extract features of each type of feature data separately, it can effectively avoid information loss for the different structures and information volume characteristics corresponding to different types of feature data, and can effectively balance the proportion of each group of features in the result judgment, which can further improve the accuracy of the identified software traffic type; by using convolution kernels and fully connected layers to finally identify the application type to which the two-way session traffic belongs, compared with graph convolutional neural networks, etc., it can effectively reduce the resources for identifying the application type to which the traffic belongs, and can effectively improve the efficiency of traffic type identification.

[0072] To further improve the accuracy and effectiveness of the identified software traffic types, in an embodiment of a method for identifying application types based on traffic features provided by this application, the types of the feature data include at least the following:

[0073] (1) Traffic session header feature data used to represent information transmitted by both parties in a two-way session;

[0074] (2) Traffic data sequence characteristic data used to represent the functional characteristics of the target application.

[0075] Based on this, see Figure 2 , the step before step 100 also specifically includes the following contents:

[0076] Step 010: Acquire the traffic session header characteristic data and the traffic data sequence characteristic data corresponding to the bidirectional session traffic generated when the target application is running.

[0077] From the above description, it can be seen that the application type identification method based on traffic characteristics provided in the embodiment of the present application can further improve the accuracy and effectiveness of the identified software traffic type by selecting the traffic session header characteristic data and the traffic data sequence characteristic data corresponding to the two-way session traffic generated when the application is running.

[0078] In order to further improve the efficiency of identifying software traffic types, in one embodiment of the application type identification method based on traffic characteristics provided in this application, see Figure 3 Step 010 of the method for identifying application types based on traffic characteristics specifically includes the following:

[0079] Step 011: Capture the original traffic data of the two-way session generated when the target application is running.

[0080] Step 012: Preprocess the original traffic data of the two-way session to obtain corresponding traffic data of the two-way session.

[0081] Step 013: extracting the first N bytes from the two-way session traffic data as the traffic session header characteristic data, and extracting the first M bytes from the two-way session traffic data as the traffic data sequence characteristic data; wherein M≥2N.

[0082] Specifically, traffic session header features are very important for traffic analysis. They contain information such as the IP, port, and protocol of both parties. The IP directly indicates the addresses of the two communicating parties, and the port and application type are often directly related. For example, port 80 or port 8080 is usually used to access a website. For traffic session header features, this method retains the first N bytes during the connection establishment process. The selection of N must ensure that the first N bytes contain the five-tuple in the bidirectional flow, namely {source IP, destination IP, source port, destination port, transport layer protocol}; on the other hand, the selected data should not contain too much invalid data, which will reduce the detection efficiency. After experimental comparison and verification, it was finally determined that the data length N = 740-800 has the best effect. Accordingly, the original byte data of a single encrypted session can be expressed as shown in formula (1).

[0083]

[0084] For the traffic data sequence feature, this method selects the first M bytes of session data as the software's running traffic feature. The traffic features generated when the software is running can reflect the software's functionality, but if the selected data is too long, it will affect the detection efficiency. The traffic representation of the traffic data sequence feature can be expressed as formula (2):

[0085]

[0086] Traffic data sequences record the network behavior of applications. Generally speaking, observing an application for a period of time (not continuously) can summarize its behavioral patterns, so we only need to analyze the first M bytes. The selection of M is determined based on experience. In this method, for subsequent calculations, M is required to be greater than or equal to 2N. Experimental results show that if N meets the requirements, M = 2N is sufficient. Therefore, N = 750 and M = 2N are preferred.

[0087] From the above description, it can be seen that the application type identification method based on traffic characteristics provided in the embodiment of the present application extracts the first N bytes from the two-way session traffic data as the traffic session header characteristic data, and extracts the first M bytes as the traffic data sequence characteristic data, and M≥2N. This can effectively prevent the selected data from incorporating too much invalid data as much as possible, thereby further improving the efficiency of identifying software traffic types.

[0088] In order to further improve the accuracy of the application identification result based on traffic characteristics, in one embodiment of the application type identification method based on traffic characteristics provided in this application, see Figure 4 , the step 012 specifically includes the following contents:

[0089] Step 0121: Clean the original traffic data of the two-way conversation to obtain the two-way conversation traffic data after removing erroneous data and duplicate data.

[0090] Specifically, the original traffic data is cleaned to remove erroneous data and duplicate data; erroneous data includes but is not limited to connection establishment failure, connection disconnection, packet loss, etc., that is, it includes all traffic generated by abnormal connection processes.

[0091] From the above description, it can be seen that the application type identification method based on traffic characteristics provided in the embodiment of the present application can effectively improve the reliability of the traffic session header feature data and the traffic data sequence feature data corresponding to the two-way session traffic data generated when the target application is running by performing data cleaning on the original traffic data of the two-way session, thereby further improving the accuracy of the application identification results based on traffic characteristics.

[0092] In order to further improve the accuracy and effectiveness of the identified software traffic type, in one embodiment of the application type identification method based on traffic characteristics provided in this application, see Figure 4 Step 100 of the method for identifying application types based on traffic characteristics specifically includes the following:

[0093] Step 110: Perform data splicing processing on the traffic session header feature data to obtain corresponding traffic session header feature splicing data.

[0094] It is understandable that when the traffic header data is input to the convolution layer, the traffic session header feature data Splicing process to obtain the corresponding traffic session header feature splicing data: input vector

[0095] Step 120: Perform feature extraction on the traffic session header feature splicing data based on the first convolution kernel to obtain feature result data corresponding to the traffic session header feature splicing data.

[0096] Step 130: Extract features from the characteristic data of the traffic data sequence based on the second convolution kernel to obtain feature result data corresponding to the characteristic data of the traffic data sequence, wherein the dimensions and weights of the first convolution kernel and the second convolution kernel are different.

[0097] For example, after experimental comparison and verification, it was finally determined that the convolution kernel of size = 3 is the best for the TLS handshake raw byte features, and the convolution kernel of size = 5 is the best for the TLS record length sequence features.

[0098] From the above description, it can be seen that the application type identification method based on traffic characteristics provided in the embodiment of the present application can improve the accuracy and reliability of convolution of the traffic session header feature splicing data by performing data splicing processing on the traffic session header feature data and then extracting features from the spliced ​​traffic session header feature data based on the first convolution kernel, thereby further improving the accuracy and effectiveness of the identified software traffic type.

[0099] In order to further improve the efficiency of application type identification, in one embodiment of the application type identification method based on traffic characteristics provided by this application, see Figure 4 , the step 200 specifically includes the following contents:

[0100] Step 210: performing splicing processing on the feature result data corresponding to the traffic session header feature splicing data and the feature result data corresponding to the traffic data sequence feature data to obtain a target feature sequence corresponding to the bidirectional session traffic.

[0101] Specifically, the output of the traffic head data after processing by the convolution layer is O1. x is determined by the model. The output of the traffic data sequence after the convolution layer is O 2, y is determined by the model. Then the splicing method is: Step 220: Input the target feature sequence into a fully connected layer to determine the application type of the target application based on the result data output by the fully connected layer.

[0102] Specifically, the convolutional feature map is input into the fully connected layer to achieve traffic classification and application identification tasks.

[0103] From the above description, it can be seen that the application type identification method based on traffic characteristics provided in the embodiment of the present application can effectively improve the accuracy of the fully connected layer output result data and further improve the efficiency of application type identification by splicing the feature result data corresponding to the traffic session header feature splicing data and the feature result data corresponding to the traffic data sequence feature data.

[0104] In order to provide important support for network situation awareness, in one embodiment of the application type identification method based on traffic characteristics provided in this application, see Figure 4 , the step 200 further specifically includes the following contents:

[0105] Step 300: Identify risks of the target application according to the application type of the target application.

[0106] From the above description, it can be seen that the application type identification method based on traffic characteristics provided in the embodiment of the present application can determine whether the current traffic belongs to a well-known application or a new application by identifying the risks of the target application according to the application type to which the two-way session traffic belongs, and the new application will be further determined to be a malicious application. It plays an important role in network management and network security protection, and can provide important support for network situation awareness.

[0107] In response to the above-mentioned embodiment of the application type identification method based on traffic features, the present application also provides a specific application example of the application type identification method based on traffic features for further explanation. The application example of the present application captures the bidirectional conversation flow generated during software runtime, and uses one-dimensional convolution kernels of different dimensions and weights to extract features from the traffic header and traffic data. Finally, the processed feature sequences are spliced ​​and input into the fully connected layer for traffic classification and application identification.

[0108] See also Figure 5 The application type identification method based on traffic characteristics specifically includes the following contents:

[0109] (1) Real-time collection of raw traffic, including but not limited to traffic packets captured by conventional traffic capture tools (such as Wireshark and Fiddler); traffic is collected in units of complete two-way communication sessions.

[0110] (2) Clean the original traffic data and remove erroneous data and duplicate data; erroneous data includes but is not limited to connection establishment failure, connection disconnection, packet loss, etc., that is, it includes all traffic generated by abnormal connection processes.

[0111] (3) After the above processing, the traffic session header features and traffic data sequence features are extracted respectively. The traffic session header features are very important for traffic analysis. They contain information such as the IP, port, protocol, etc. of both parties of the transmission. The IP directly indicates the address of the two communicating parties. The port and application type are often directly related. For example, ports 80 and 8080 are usually used to access a website. For the traffic session header features, this method retains the first N bytes during the connection establishment process. The selection of N needs to ensure that the first N bytes contain the five-tuple in the bidirectional flow, namely {source IP, destination IP, source port, destination port, transport layer protocol}; on the other hand, the selected data should not include too much invalid data as much as possible, which will reduce the detection efficiency. After experimental comparison and verification, it was finally determined that the data length N = 740-800 has the best effect. Accordingly, the original byte data of a single encrypted session can be expressed as shown in formula (1).

[0112]

[0113] For the traffic data sequence feature, this method selects the first M bytes of session data as the software's running traffic feature. The traffic feature generated when the software is running can reflect the software's functionality, but if the selected data is too long, it will affect the detection efficiency. The traffic representation of the traffic data sequence feature can be expressed as formula (2):

[0114]

[0115] Traffic data sequences record the network behavior of applications. Generally speaking, observing an application for a period of time (not continuously) can summarize its behavioral patterns, so we only need to analyze the first M bytes. The selection of M is determined based on experience. In this method, for subsequent calculations, M must be greater than or equal to 2N. Experimental results show that if N meets the requirements, M = 2N is sufficient. Therefore, N = 750 and M = 2N are preferred.

[0116] Traffic session header features and traffic data sequence features differ in their dimensionality. Furthermore, the two sets of features have different structures and information content. Using the same set of weighted convolution kernels will result in information loss. To balance the weight of the two sets of features in the decision-making process, this method uses two sets of 1D-Conv convolution kernels with different weights and sizes to convolve the features. Experimental comparison and verification ultimately determined that a convolution kernel of size = 3 is optimal for TLS handshake raw byte features, and a convolution kernel of size = 5 is optimal for TLS record length sequence features.

[0117] 1D-conv stands for one-dimensional convolutional neural network, a commonly used model consisting of pooling layers, convolutional layers, and fully connected layers. In this case, we only utilize the convolutional layers of a 1D convolutional neural network. In typical convolutional neural network applications, features are input into the convolutional neural network, processed by the pooling layer, and then fed into the convolutional layer. The convolutional layer further processes the features, and the processed features are then fed into the fully connected layer. Here, we omit the pooling layer and feed the features directly into the convolutional layer. Because convolutional neural networks have undergone years of development, open-source tools like TensorFlow are highly mature, allowing us to adjust and modify the model directly. It's worth noting that the convolution kernel size used for the TLS handshake raw byte feature and the TLS record length sequence feature can differ. In experiments, we found that using a kernel size of 3 and 5, respectively, yielded optimal results.

[0118] Finally, the convolutional feature map is input into the fully connected layer to realize traffic classification and application identification tasks.

[0119] Feature splicing is used in two places. The first place is when inputting traffic header data into the convolutional layer.

[0120] First splicing: input vector

[0121] Second splicing: The output of the traffic head data after processing by the convolution layer is O1. x is determined by the model. The output of the traffic data sequence after the convolution layer is O 2, y is determined by the model. Then the splicing method is: Current application identification is mostly targeted at non-encrypted traffic, while the application examples of this application can handle application classification of encrypted traffic; most current technologies process traffic header data and running traffic data separately, and this patent can combine the two methods.

[0122] In summary, the application example of the present application can be implemented through the Python language. By using multiple types of feature data corresponding to the two-way session traffic generated during software operation to identify the application type, the accuracy and effectiveness of identifying the application type based on the traffic characteristics can be effectively improved; by using convolution kernels with different dimensions and weights to extract features of each type of feature data respectively, it can effectively avoid information loss according to the different structures and information volume characteristics corresponding to different types of feature data, and can effectively balance the proportion of each group of features in the result judgment, which can further improve the accuracy of the identified software traffic type; by using convolution kernels and fully connected layers to finally identify the application type to which the two-way session traffic belongs, compared with graph convolutional neural networks, etc., it can effectively reduce the resources for identifying the application type to which the traffic belongs, and can effectively improve the efficiency of traffic type identification.

[0123] Based on the above content, the present application also provides an application type identification device based on traffic characteristics for implementing the application type identification method based on traffic characteristics provided in one or more embodiments of the present application. The specific implementation of the application type identification device based on traffic characteristics can be a server. In a specific example, see Figure 6 The application type identification device based on traffic characteristics specifically includes the following contents:

[0124] The convolution module 10 is used to extract features of multiple types of traffic feature data corresponding to the bidirectional session traffic generated when the target application is running based on convolution kernels with different dimensions and weights, and obtain feature result data corresponding to each type of traffic feature data.

[0125] The fully connected module 20 is configured to obtain the application type of the target application according to each of the feature result data and a preset fully connected layer identification.

[0126] The embodiment of the application type identification device based on traffic characteristics provided in this application can be specifically used to execute the processing flow of the embodiment of the application type identification method based on traffic characteristics in the above-mentioned embodiment. Its functions will not be repeated here, and reference can be made to the detailed description of the embodiment of the application type identification method based on traffic characteristics.

[0127] From the above description, it can be seen that the application type identification device based on traffic characteristics provided by the embodiment of the present application can effectively improve the accuracy and effectiveness of identifying application types based on traffic characteristics by using multiple types of feature data corresponding to the two-way session traffic generated during software operation to identify the application type; by using convolution kernels with different dimensions and weights to extract features of each type of feature data separately, it can effectively avoid information loss for the different structures and information volume characteristics corresponding to different types of feature data, and can effectively balance the proportion of each group of features in the result judgment, which can further improve the accuracy of the identified software traffic type; by using convolution kernels and fully connected layers to finally identify the application type to which the two-way session traffic belongs, compared with graph convolutional neural networks, etc., it can effectively reduce the resources for identifying the application type to which the traffic belongs, and can effectively improve the efficiency of traffic type identification.

[0128] The embodiment of the present invention further provides a computer device (ie, electronic device), such as Figure 7 As shown, the computer device may include a processor 810, a memory 820, a receiver 830, and a transmitter 840, wherein the processor 810 and the memory 820 may be connected via a bus or other means. Figure 7 In the example, a bus connection is used. The receiver 830 can be connected to the processor 810 and the memory 820 via a wired or wireless connection. The computer device is communicatively connected to the wireless multimedia sensor network and the video acquisition device to receive real-time motion data from the sensors in the wireless multimedia sensor network and receive raw video sequences from the video acquisition device.

[0129] The processor 810 may be a central processing unit (CPU). The processor 810 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0130] Memory 820, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer executable programs, and modules, such as the program instructions / modules corresponding to the method for shielding buttons on an in-vehicle display device in the embodiments of the present invention. Processor 810 executes the non-transitory software programs, instructions, and modules stored in memory 820 to perform various processor functions and data processing, thereby implementing the methods described in the above-mentioned method embodiments.

[0131] The memory 820 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store data created by the processor 810, etc. In addition, the memory 820 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 820 may optionally include a memory remotely located relative to the processor 810, and these remote memories may be connected to the processor 810 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0132] The one or more modules are stored in the memory 820 and, when executed by the processor 810 , perform the method for identifying application types based on traffic features in the embodiment.

[0133] In some embodiments of the present disclosure, the user equipment may include a processor, a memory and a transceiver unit, which may include a receiver and a transmitter. The processor 810, the memory 820, the receiver 830 and the transmitter 840 may be connected through a bus system. The memory is used to store computer instructions, and the processor is used to execute the computer instructions stored in the memory to control the transceiver unit to send and receive signals.

[0134] As an implementation method, the functions of the receiver and transmitter in the present invention can be implemented by a transceiver circuit or a dedicated transceiver chip, and the processor can be implemented by a dedicated processing chip, a processing circuit or a general chip.

[0135] As another implementation, a general-purpose computer can be used to implement the server provided in the embodiments of the present invention. Specifically, the program code for implementing the functions of the processor, receiver, and transmitter is stored in a memory, and the general-purpose processor executes the code in the memory to implement the functions of the processor, receiver, and transmitter.

[0136] The present application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the aforementioned method for identifying application types based on traffic characteristics. The computer-readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the art.

[0137] It should be understood by those skilled in the art that the various exemplary components, systems and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software or a combination of the two. Whether it is specifically performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application. When implemented in hardware, it can be, for example, an electronic circuit, an application-specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of this application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link via a data signal carried in a carrier.

[0138] It should be understood that the present application is not limited to the specific configurations and processes described above and illustrated in the figures. For the sake of brevity, a detailed description of known methods is omitted here. In the above embodiments, several specific steps are described and illustrated as examples. However, the method process of the present application is not limited to the specific steps described and illustrated. Those skilled in the art can make various changes, modifications, and additions, or change the order of the steps after understanding the spirit of the present application.

[0139] In this application, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or replace features of other embodiments.

[0140] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations to the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. A method for identifying application types based on traffic characteristics, characterized in that: include: Capture the original traffic data of the two-way conversations generated when the target application is running; Preprocessing the original flow data of the two-way conversation to obtain corresponding flow data of the two-way conversation; Extracting the first N bytes from the two-way session traffic data as traffic session header feature data, and extracting the first M bytes from the two-way session traffic data as traffic data sequence feature data; wherein M≥2N; Performing data splicing processing on the traffic session header feature data to obtain corresponding traffic session header feature splicing data; Performing feature extraction on the traffic session header feature splicing data based on the first convolution kernel to obtain feature result data corresponding to the traffic session header feature splicing data; and, performing feature extraction on the characteristic data of the flow data sequence based on a second convolution kernel to obtain feature result data corresponding to the characteristic data of the flow data sequence; wherein the dimensions and weights of the first convolution kernel and the second convolution kernel are different; The application type of the target application is obtained according to each of the feature result data and the preset fully connected layer identification.

2. The method for identifying application types based on traffic characteristics according to claim 1, characterized in that: The preprocessing of the original flow data of the two-way session to obtain corresponding flow data of the two-way session includes: The original flow data of the two-way conversation is cleaned to obtain the two-way conversation flow data after erroneous data and duplicate data are removed.

3. The method for identifying application types based on traffic characteristics according to claim 1, characterized in that: Obtaining the application type of the target application according to each of the feature result data and a preset fully connected layer identification includes: Performing splicing processing on the feature result data corresponding to the traffic session header feature splicing data and the feature result data corresponding to the traffic data sequence feature data to obtain a target feature sequence corresponding to the bidirectional session traffic; The target feature sequence is input into a fully connected layer to determine the application type of the target application based on result data output by the fully connected layer.

4. The method for identifying application types based on traffic characteristics according to any one of claims 1 to 3, characterized in that: Also includes: Risk identification is performed on the target application according to the application type of the target application.

5. An application type identification device based on traffic characteristics, characterized in that: The application type identification device based on traffic characteristics is used to perform: Capture the original traffic data of the two-way conversations generated when the target application is running; Preprocessing the original flow data of the two-way conversation to obtain corresponding flow data of the two-way conversation; Extracting the first N bytes from the two-way session traffic data as traffic session header feature data, and extracting the first M bytes from the two-way session traffic data as traffic data sequence feature data; wherein M≥2N; The application type identification device based on traffic characteristics includes: A convolution module is configured to perform data splicing processing on the traffic session header feature data to obtain corresponding traffic session header feature splicing data; perform feature extraction on the traffic session header feature splicing data based on a first convolution kernel to obtain feature result data corresponding to the traffic session header feature splicing data; and perform feature extraction on the traffic data sequence feature data based on a second convolution kernel to obtain feature result data corresponding to the traffic data sequence feature data; wherein the first convolution kernel and the second convolution kernel have different dimensions and weights; The fully connected module is used to obtain the application type of the target application based on each of the feature result data and the preset fully connected layer identification.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method for identifying application types based on traffic characteristics according to any one of claims 1 to 3 is implemented.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for identifying application types based on traffic characteristics as described in any one of claims 1 to 3 is implemented.

Images