Real-time traffic terminal identification method and device based on CNN+LSTM

Abstract

The present invention discloses a method and device for real-time identification of traffic terminals based on CNN+LSTM. The method comprises: reorganizing a transmission control protocol TCP session; extracting traffic features from the session and preprocessing the extracted traffic features; constructing a deep learning model combining a convolutional neural network (CNN) and a long short-term memory (LSTM) neural network; constructing a sample data set using the preprocessed traffic features as samples and terminal information as labels; using transfer learning to train the model using the sample data set to obtain a classifier; and using the trained classifier to classify and label traffic. The method for real-time identification of traffic terminals of the present invention is based on CNN+LSTM and utilizes the idea of ​​transfer learning. By learning traffic statistical features and traffic useragent features, real-time classification of traffic terminals is achieved.

Description

Technical Field

[0001] The present invention relates to the technical field of network data stream processing, and in particular to a method and device for real-time traffic terminal identification based on CNN+LSTM. Background Art

[0002] As cyberspace becomes increasingly intertwined with human production and daily life, it has become the fifth frontier after land, sea, air, and space. Cyberspace governance is a critical need for national security and social stability. Network information transmission is primarily carried out through network messages between network devices, using different network protocols to transmit different network content. Therefore, a fundamental requirement for cyberspace governance is to differentiate between different users, applications, and content, and then adopt different governance approaches. A key focus is determining the terminal device that generates the traffic packet. Because application traffic from different terminals is intermingled on the same line, network administrators find it difficult to simply distinguish traffic from different users. Furthermore, with the widespread use of encrypted network protocols, content extraction methods are reducing the amount of terminal information that can be extracted, making refined cyberspace governance difficult.

[0003] Traditional management methods distinguish traffic generated by different terminals by identifying the IP address or MAC address information contained in traffic packets. However, with the widespread use of mobile devices and the increasing use of MAC address obfuscation, the IP and MAC addresses corresponding to the same terminal in traffic packets are constantly changing. This makes it increasingly difficult to identify the terminal to which traffic belongs using traditional methods. The key issue that needs to be addressed in cyberspace governance is how to effectively identify the terminal to which network traffic belongs.

[0004] Machine learning algorithms are currently being researched for traffic endpoint classification. Machine learning algorithms learn from labeled traffic to derive corresponding label characteristics, enabling traffic classification at different levels. Machine learning classification methods based on flow statistics do not consider the specific content of protocol payloads, but instead describe protocols based on data flow behavior. Flow statistics-based methods perform well in classifying known protocols. Because each program generates traffic with distinct flow statistics, analyzing these characteristics can distinguish between different applications. However, these methods require packet caching, session reassembly, and flow statistics calculation, resulting in increased complexity, cost, and overhead when processing high-speed traffic. Because flow statistics-based classifiers target different flow statistics, different flow statistics must be selected for different protocol combinations. These techniques overcome the shortcomings of deep packet inspection by avoiding packet content inspection. This feature allows for statistical classification and analysis of encrypted traffic.

[0005] Prior art proposes a terminal tracing method based on the XGBoost model. This method reconstructs data stream conversations, extracts user agent information, ID information, timestamp information, and session information from the conversations, and calculates session features. XGBoost is then used to learn from the conversations containing terminal information, ultimately tracing traffic to the terminal. This method finds terminal features from basic network session information and uses XGBoost learning to identify terminal features, ultimately tracing traffic to the terminal.

[0006] While the above method achieves basic traffic tracing, it has the following shortcomings. First, the XGBoost algorithm does not handle discrete features well, and all the features extracted from UserAgent are discrete features. Second, when dealing with the classification problem of mixed multi-terminal traffic, the XGBoost algorithm converts the multi-classification problem into multiple binary classification problems for solution. This results in a larger model and higher model complexity when dealing with actual classification problems. More importantly, this method does not solve the problem of real-time traffic classification. The algorithm needs to cache data for a period of time, use the labeled data in the data set for training, and further classify the unlabeled data. Therefore, it is difficult to implement in actual scenarios with large traffic. Summary of the Invention

[0007] The present invention provides a method and device for real-time traffic terminal identification based on CNN+LSTM, so as to solve the problems in the prior art that the XGBoost algorithm uses a decision tree to process discrete features as continuous features, resulting in large errors; the prior art converts multi-classification problems into multiple binary classification problems, resulting in a large model scale and slow calculation; and the prior art is difficult to solve the technical problems of real-time traffic classification.

[0008] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0009] On the one hand, the present invention provides a real-time traffic terminal identification method based on CNN+LSTM, and the real-time traffic terminal identification method based on CNN+LSTM includes:

[0010] Reassemble the Transmission Control Protocol TCP session;

[0011] Extract traffic features from the session and preprocess the extracted traffic features;

[0012] Build a deep learning model that combines convolutional neural network (CNN) and long short-term memory (LSTM) neural network;

[0013] A sample data set is constructed using the preprocessed traffic features as samples and the terminal information as labels; a transfer learning method is adopted to train the model using the sample data set to obtain a classifier;

[0014] Use the trained classifier to classify and mark traffic.

[0015] Furthermore, the reorganizing of the Transmission Control Protocol TCP session includes:

[0016] Extract the source IP address, source port, destination IP address, destination port, and transport layer protocol number from the traffic packet and classify the TCP packets of different sessions;

[0017] Sort the packets according to the seq information in the packets and delete duplicate packets.

[0018] Furthermore, extracting traffic features from the session includes:

[0019] Extract IP quintuple, IP-Time to Live, IP-ID, TCP-Window Size, TCP-ISN, and TCP-MSS information from the SYN packet of the TCP session; extract UserAgent information from the message containing the HTTP request; count the number of bytes of uplink and downlink messages, the number of uplink and downlink messages, and the session duration based on the entire session;

[0020] From UserAgent, the user_agent package in Python is used to process the extracted information into device type, device model, browser type, browser model, operating system type, and operating system model.

[0021] Furthermore, the preprocessing of the extracted traffic features includes:

[0022] Perform data cleaning on the extracted traffic features and remove data with zero downstream traffic;

[0023] For the data that has completed data cleaning, the preset data standardization algorithm is used to standardize the data;

[0024] The discrete features of the four text representations of browser type, browser model, operating system type, and operating system model are processed into 26-dimensional features using OneHotEncoder;

[0025] For device type and device model, use LabelEncoder to process them into 2-dimensional features.

[0026] Furthermore, a deep learning model combining CNN and LSTM is constructed, including:

[0027] Use TensorFlow to build a sequential neural network, use one-dimensional convolutional layers and batch normalization layers to extract data features, and use one-dimensional maximum pooling layers for feature selection and information filtering;

[0028] Two LSTM layers are added after the convolutional layer to further learn terminal features;

[0029] Finally, add the fully connected layer and the output layer.

[0030] Furthermore, the model is trained using the sample data set to obtain a classifier, including:

[0031] Take 100 terminals as a group, and collect 200 pieces of label data from each terminal;

[0032] Collect 20 sets of sample data as pre-training data; use the collected sample data to pre-train the model; in each set of pre-training, reinitialize the output layer; train each set of data for 200 rounds;

[0033] Remove the output layer, store the pre-trained model, and complete the classifier pre-training;

[0034] Collect labeled terminal sessions over a period of time and use them as training sets to retrain the classifier;

[0035] Load the pre-trained model;

[0036] Add output layers equal to the number of terminals;

[0037] Train the model for 200 rounds;

[0038] The classifier is stored, and the classifier retraining is completed to obtain the trained classifier.

[0039] Furthermore, the traffic classification and labeling using the trained classifier includes:

[0040] Load the trained classifier;

[0041] Use the trained classifier to classify the collected traffic based on the preprocessed traffic features;

[0042] Accept the classification results that are greater than the preset threshold as the traffic of the corresponding terminal and mark the original traffic.

[0043] On the other hand, the present invention also provides a real-time flow terminal identification device based on CNN+LSTM, the real-time flow terminal identification device based on CNN+LSTM comprising:

[0044] A session reassembly module is used to reassemble the Transmission Control Protocol TCP session;

[0045] Traffic feature extraction and processing module, used to extract traffic features from sessions and pre-process the extracted traffic features;

[0046] A deep learning model building module, used to build a deep learning model that combines convolutional neural network (CNN) and long short-term memory (LSTM) neural network;

[0047] A model training module is used to construct a sample data set using preprocessed traffic features as samples and terminal information as labels; a transfer learning method is used to train the model constructed by the deep learning model construction module using the sample data set constructed by the traffic feature extraction and processing module to obtain a classifier;

[0048] The traffic classification and marking module is used to classify and mark traffic using the trained classifier.

[0049] On the other hand, the present invention further provides an electronic device, comprising a processor and a memory; wherein the memory stores at least one instruction, and the instruction is loaded and executed by the processor to implement the above method.

[0050] In yet another aspect, the present invention further provides a computer-readable storage medium, wherein the storage medium stores at least one instruction, and the instruction is loaded and executed by a processor to implement the above method.

[0051] The beneficial effects brought about by the technical solution provided by the present invention include at least:

[0052] Traditional DPI technology is unable to achieve effective traffic terminal classification in the current prevalence of encrypted protocol traffic. This invention, based on CNN+LSTM and leveraging the concept of transfer learning, achieves traffic terminal classification by learning traffic statistical features and traffic useragent features. This addresses the existing technical issues of the XGBoost algorithm using decision trees, which treats discrete features as continuous features, resulting in large errors; the existing XGBoost algorithm converting a multi-classification problem into multiple binary classification problems, resulting in large model size and slow computation; and the existing technology's difficulty in achieving real-time traffic classification. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0054] Figure 1This is a schematic diagram of the execution flow of the real-time traffic terminal identification method based on CNN+LSTM provided by an embodiment of the present invention;

[0055] Figure 2 This is a schematic diagram of a traffic terminal classification model based on CNN+LSTM provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0056] To make the objectives, technical solutions and advantages of the present invention more clear, the embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

[0057] First embodiment

[0058] This embodiment provides a method for real-time traffic terminal identification based on CNN+LSTM. This method addresses the errors caused by treating discrete features as continuous features in existing technologies, as well as the waste of resources caused by using multiple binary classification models to solve the multi-terminal traffic classification problem. This method uses a hybrid neural network algorithm based on a combination of a convolutional neural network (CNN) and a long short-term memory neural network (LSTM). As existing solutions are difficult to solve for real-time traffic classification, this method uses transfer learning to pre-train the model, significantly reducing the number of labeled samples required for retraining and improving the accuracy of the algorithm.

[0059] Based on the above, the execution process of this method is as follows Figure 1 As shown, the following steps are included:

[0060] 1. TCP session reassembly: realize fast TCP session reassembly, remove duplicate packets and other operations.

[0061] Specifically, it extracts the source IP address, source port, destination IP address, destination port, and transport layer protocol number from the traffic packet, classifies the TCP packets of different sessions, sorts the packets based on the SEQ information in the packets, and removes duplicate packets.

[0062] 2. Traffic feature extraction: Based on feature selection requirements, extract and calculate corresponding features from the session.

[0063] Specifically, as shown in Table 1, this embodiment extracts information such as the IP quintuple, IP-Time Tolive, IP-ID, TCP-Window Size, TCP-ISN, and TCP-MSS from the SYN packet of a TCP session. UserAgent information is extracted from messages containing HTTP requests. Statistics are collected for the entire session, including the number of bytes in uplink and downlink messages, the number of uplink and downlink messages, and the session duration. Using tools such as deep packet inspection, terminal-related information is extracted from a portion of the network flow content, and the session is marked as a terminal.

[0064] Table 1 Extracted protocol features

[0065] Source-Protocol field Source-Message HTTP-UA The first HTTP request message in the five-tuple IP quintuple SYN message IP-Time to live SYN message IP-ID SYN message TCP-Window Size SYN message TCP-ISN SYN message Number of bytes in uplink messages Session statistics based on the entire session Number of bytes in downlink messages Session statistics based on the entire session Session duration Session statistics based on the entire session Number of uplink packets Session statistics based on the entire session Number of downlink packets Session statistics based on the entire session

[0066] 3. Preprocess traffic features: Clean, standardize, and recode the collected features according to their types. The specific processing steps are as follows:

[0067] a) Data cleaning

[0068] Data cleansing is the process of reexamining and verifying data, aiming to remove duplicate information, correct existing errors, and provide data consistency verification. Based on the characteristics of the internet traffic data collected in this embodiment, the output file generated by the stream parsing tool is parsed, and the resulting stream is transferred to a DataFrame. Because streams generated by different terminals need to be classified, this embodiment excludes data with zero downstream traffic. This data is generally a semi-connection generated by the other end not responding to requests and is not valuable for analysis.

[0069] b) Data standardization

[0070] The purpose of data normalization is to avoid the problem of large-amplitude features drowning out small-amplitude features due to the dynamic range of different features. Common normalization methods include Z-score normalization and maximum-minimum normalization. This embodiment uses the maximum-minimum normalization method to linearly transform the original data and map the data values ​​to the range [0, 1]. The formula is as follows:

[0071]

[0072] c) Discrete feature processing

[0073] In order to further explore the terminal features contained in the traffic, this embodiment extracts the UserAgent information from the TCP stream, and uses the user_agent package in Python to process the extracted information from the UserAgent into 6 values: device type, device model, browser type, browser model, operating system type, and operating system model. For this type of discrete features represented by text, this embodiment uses the commonly used OneHotEncoder and LabelEncoder methods to simultaneously process the discrete features and convert them into numerical expressions. Specifically: for the four types of discrete features represented by text, namely browser type, browser model, operating system type, and operating system model, OneHotEncoder is used to process them into 26-dimensional features, and LabelEncoder is used to process device type and device model into 2-dimensional features.

[0074] 4. Build Figure 2The deep learning model shown here combines CNN and LSTM; the details are as follows:

[0075] a) Use TensorFlow to build a sequential neural network, use one-dimensional convolutional layers and batch normalization layers to extract data features, and use one-dimensional max pooling layers to reduce the impact of small values ​​on the model;

[0076] b) Add two LSTM layers after the convolutional layer to further learn terminal features;

[0077] c) Finally, add the fully connected layer and the output layer.

[0078] It should be noted that this embodiment uses a one-dimensional convolutional neural network + recurrent neural network to build a classifier. The transfer learning method is used to pre-train a pre-classifier with good classification effect. When classifying specific terminals, only less data is needed to achieve good classification results.

[0079] Among them, the convolutional neural network is a feedforward neural network with a deep structure that includes convolution calculations. The convolutional neural network has the ability to represent learning and can effectively extract data features from chaotic data without the need for more feature selection steps.

[0080] Convolutional neural networks are mainly composed of convolutional layers, pooling layers, and fully connected layers. The convolutional layer is the core of the convolutional neural network, which uses convolution kernels to extract features from input data. The formula for a one-dimensional convolution kernel is as follows:

[0081]

[0082] After feature extraction in the convolutional layer, the output feature map is passed to the pooling layer for feature selection and information filtering. This article uses max-pooling, and the one-dimensional max-pooling function is as follows:

[0083]

[0084] To prevent inconsistent data distribution in each layer of a deep convolutional neural network, we use BatchNormalization (BN) to process the tensors obtained after convolution. The BN layer can speed up network training and convergence, control gradient explosion, prevent gradient vanishing, and prevent overfitting. The algorithm of the BN layer is as follows:

[0085]

[0086]

[0087]

[0088]

[0089] In the output layer, we use SoftMax as the output layer according to the terminal label based on Lable encoding. The probability of each element yi being selected in SoftMax is:

[0090]

[0091] 5. Classifier training: Using preprocessed traffic features as samples and terminal information as labels, we construct a sample dataset. We use transfer learning to train the model using the sample dataset. Specifically:

[0092] a) Classifier pre-training: Collect labeled data and perform pre-training as follows:

[0093] (1) Take 100 terminals as a group and collect 200 pieces of label data from each terminal.

[0094] (2) Collect 20 sets of data as pre-training data.

[0095] (3) Use the collected data for pre-training. During each pre-training session, the output layer is re-initialized. Each set of data is trained for 200 rounds.

[0096] (4) Remove the output layer and store the pre-trained model.

[0097] b) Classifier retraining: Use the data of the current scene for retraining to obtain a reliable classifier.

[0098] (1) Collect the labeled terminal conversations within a period of time, use the collected labeled terminal conversations within a period of time as a training set, and retrain the classifier.

[0099] (2) Load the pre-trained model.

[0100] (3) Add an output layer equal to the number of terminals.

[0101] (4) Train for 200 rounds.

[0102] (5)Store the classifier.

[0103] 6. Use the trained classifier to classify and label traffic, as follows:

[0104] a) Load the trained classifier.

[0105] b) Use the trained classifier to classify the collected traffic.

[0106] c) Accept the classification results that are greater than the preset threshold as the traffic of the corresponding terminal.

[0107] d) Mark the original traffic.

[0108] In summary, this embodiment, based on CNN+LSTM, leverages the concept of transfer learning. By learning traffic statistics and useragent features, it achieves terminal classification of traffic. This addresses the existing technical issues of the XGBoost algorithm, which uses decision trees to treat discrete features as continuous features, resulting in large errors; the existing XGBoost algorithm, which converts a multi-classification problem into multiple binary classification problems, resulting in large model size and slow computation; and the existing technology's difficulty in achieving real-time traffic classification.

[0109] Second embodiment

[0110] This embodiment provides a real-time traffic terminal identification device based on CNN+LSTM, which includes the following modules:

[0111] A session reassembly module is used to reassemble the Transmission Control Protocol TCP session;

[0112] Traffic feature extraction and processing module, used to extract traffic features from sessions and pre-process the extracted traffic features;

[0113] A deep learning model building module, used to build a deep learning model that combines convolutional neural network (CNN) and long short-term memory (LSTM) neural network;

[0114] A model training module is used to construct a sample data set using preprocessed traffic features as samples and terminal information as labels; a transfer learning method is used to train the model constructed by the deep learning model construction module using the sample data set constructed by the traffic feature extraction and processing module to obtain a classifier;

[0115] The traffic classification and marking module is used to classify and mark traffic using the trained classifier.

[0116] The CNN+LSTM-based real-time traffic terminal identification device of this embodiment corresponds to the CNN+LSTM-based real-time traffic terminal identification method of the first embodiment; wherein, the functions implemented by each functional module in the CNN+LSTM-based real-time traffic terminal identification device correspond one-to-one to each process step in the above-mentioned CNN+LSTM-based real-time traffic terminal identification method; therefore, they will not be repeated here.

[0117] Third embodiment

[0118] This embodiment provides an electronic device, which includes a processor and a memory; wherein the memory stores at least one instruction, and the instruction is loaded and executed by the processor to implement the method of the first embodiment.

[0119] The electronic device may have relatively large differences due to different configurations or performances, and may include one or more processors (central processing units, CPU) and one or more memories, wherein the memory stores at least one instruction, which is loaded by the processor to execute the above method.

[0120] Fourth embodiment

[0121] This embodiment provides a computer-readable storage medium storing at least one instruction, which is loaded and executed by a processor to implement the method of the first embodiment described above. The computer-readable storage medium may be a ROM, random access memory, CD-ROM, magnetic tape, floppy disk, or optical data storage device. The instructions stored therein can be loaded by a processor in a terminal to execute the method described above.

[0122] Furthermore, it should be noted that the present invention may be provided as a method, apparatus, or computer program product. Thus, embodiments of the present invention may take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of the present invention may take the form of a computer program product embodied on one or more computer-usable storage media containing computer-usable program code.

[0123] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the process in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0124] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device, so that a series of operation steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for implementing the process in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0125] It should also be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or terminal device comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or terminal device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or terminal device comprising the element.

[0126] Finally, it should be noted that the above is a preferred embodiment of the present invention. It should be noted that although the preferred embodiment of the present invention has been described, it is clear that those skilled in the art, once they understand the basic inventive concept of the present invention, can make various improvements and modifications without departing from the principles of the present invention. Such improvements and modifications should also be considered as within the scope of protection of the present invention. Therefore, the appended claims are intended to be interpreted as including the preferred embodiment and all changes and modifications that fall within the scope of the embodiments of the present invention.

Claims

1. A real-time traffic terminal identification method based on CNN+LSTM, characterized in that: include: Reassemble the Transmission Control Protocol TCP session; Extract traffic features from the session and preprocess the extracted traffic features; Build a deep learning model that combines convolutional neural network (CNN) and long short-term memory (LSTM) neural network; Using preprocessed traffic features as samples and terminal information as labels, a sample dataset is constructed. Using transfer learning, the model is trained using the sample dataset to obtain a classifier. Use the trained classifier to classify and mark traffic; Reassemble the Transmission Control Protocol (TCP) session, including: Extract the source IP address, source port, destination IP address, destination port, and transport layer protocol number from the traffic packet, and classify the TCP packets of different sessions; Sort the messages according to the seq information in the messages and delete duplicate data packets; Extract traffic features from sessions, including: Extract IP quintuple, IP-Time to Live, IP-ID, TCP-Window Size, TCP-ISN, and TCP-MSS information from the SYN packet of the TCP session; extract UserAgent information from the message containing the HTTP request; and count the number of bytes in the upstream and downstream messages, the number of upstream and downstream messages, and the session duration based on the entire session. From UserAgent, use the user_agent package in Python to process the extracted information into device type, device model, browser type, browser model, operating system type, and operating system model; Preprocess the extracted traffic features, including: Perform data cleaning on the extracted traffic features and remove data with zero downstream traffic; For the data that has completed data cleaning, the preset data standardization algorithm is used to standardize the data; The discrete features of the four text representations of browser type, browser model, operating system type, and operating system model are processed into 26-dimensional features using OneHotEncoder; For device type and device model, use LabelEncoder to process them into 2-dimensional features; Build a deep learning model combining CNN and LSTM, including: Use TensorFlow to build a sequential neural network, use one-dimensional convolutional layers and batch normalization layers to extract data features, and use one-dimensional maximum pooling layers for feature selection and information filtering; Two LSTM layers are added after the convolutional layer to further learn terminal features; Finally, add the fully connected layer and the output layer; The classifier training method is as follows: using pre-processed traffic features as samples and terminal information as labels to construct a sample dataset; using transfer learning to train the model using the sample dataset, specifically: Classifier pre-training: Collect labeled data and perform pre-training, including: (1) 100 terminals are grouped together, and each terminal collects 200 pieces of label data; (2) Collect 20 sets of data as pre-training data; (3) Use the collected data for pre-training; in each set of pre-training, the output layer is reinitialized; each set of data is trained for 200 rounds; (4) Remove the output layer and store the pre-trained model; Classifier retraining: Use the data of the current scene to retrain and obtain the final classifier, including; (1) Collect labeled terminal sessions within a period of time, use the collected labeled terminal sessions within a period of time as a training set, and retrain the classifier; (2) Load the pre-trained model; (3) Add an output layer equal to the number of terminals; (4) Train for 200 rounds; (5) Store the classifier.

2. The method for real-time traffic terminal identification based on CNN+LSTM according to claim 1 is characterized in that: The traffic classification and labeling using the trained classifier includes: Load the trained classifier; Use the trained classifier to classify the collected traffic based on the preprocessed traffic features; Accept the classification results that are greater than the preset threshold as the traffic of the corresponding terminal and mark the original traffic.

3. A device for real-time identification of traffic terminals for implementing the method for real-time identification of traffic terminals based on CNN+LSTM as described in any one of claims 1 to 2, characterized in that: include: A session reassembly module is used to reassemble the Transmission Control Protocol TCP session; Traffic feature extraction and processing module, used to extract traffic features from sessions and pre-process the extracted traffic features; A deep learning model building module, used to build a deep learning model that combines convolutional neural network (CNN) and long short-term memory (LSTM) neural network; A model training module is used to construct a sample data set using preprocessed traffic features as samples and terminal information as labels; a transfer learning method is used to train the model constructed by the deep learning model construction module using the sample data set constructed by the traffic feature extraction and processing module to obtain a classifier; Traffic classification and marking module, used to classify and mark traffic using the trained classifier; The reorganizing of the Transmission Control Protocol TCP session includes: Extract the source IP address, source port, destination IP address, destination port, and transport layer protocol number from the traffic packet and classify the TCP packets of different sessions; Sort the messages according to the seq information in the messages and delete duplicate data packets; Extracting traffic features from the session includes: Extract IP quintuple, IP-Time to Live, IP-ID, TCP-Window Size, TCP-ISN, and TCP-MSS information from the SYN packet of the TCP session; extract UserAgent information from the message containing the HTTP request; and count the number of bytes in the upstream and downstream messages, the number of upstream and downstream messages, and the session duration based on the entire session. From UserAgent, use the user_agent package in Python to process the extracted information into device type, device model, browser type, browser model, operating system type, and operating system model; The preprocessing of the extracted traffic features includes: Perform data cleaning on the extracted traffic features and remove data with zero downstream traffic; For the data that has completed data cleaning, the preset data standardization algorithm is used to standardize the data; The discrete features of the four text representations of browser type, browser model, operating system type, and operating system model are processed into 26-dimensional features using OneHotEncoder; For device type and device model, use LabelEncoder to process them into 2-dimensional features; Build a deep learning model combining CNN and LSTM, including: Use TensorFlow to build a sequential neural network, use one-dimensional convolutional layers and batch normalization layers to extract data features, and use one-dimensional maximum pooling layers for feature selection and information filtering; Two LSTM layers are added after the convolutional layer to further learn terminal features; Finally, add the fully connected layer and the output layer.

Images