A vulnerability exploit attack encrypted traffic classification method based on multi-head self-attention mechanism

Abstract

The present invention provides a vulnerability exploitation attack encrypted traffic classification method based on a multi-head self-attention mechanism. The method comprises: step 1: parsing the encrypted traffic data to be classified into json format data, and filtering and cleaning the parsed data; step 2: analyzing the key features in the metadata and TLS protocol in the vulnerability exploitation attack encrypted traffic, extracting the core features required for traffic classification, and finally converting it into a CSV format file; step 3: dividing the processed encrypted traffic data into a training set and a test set in proportion, taking the malicious attack traffic type as a label, training the multi-head self-attention mechanism model with the training set, judging the model with the test set, and then optimizing the model to obtain the final vulnerability exploitation attack encrypted traffic classification model; step 4: pre-processing the encrypted traffic to be tested according to step 1, then extracting features according to step 2, inputting the extracted features into the trained classification model, and obtaining the final traffic classification result.

Description

Technical Field

[0001] The present invention belongs to the field of network traffic vulnerability attack classification, and relates to a vulnerability exploitation attack encrypted traffic classification method based on a multi-head self-attention mechanism. Background Art

[0002] In recent years, with the improvement of users' awareness of network privacy and security, the use of TLS protocol to protect communication information has become more and more popular. However, hackers who carry out malicious attacks through the network have also noticed and used the excellent characteristics of this protocol to conceal vulnerabilities and malicious attacks. Since the encryption protocol encrypts most of the information in the data packet through an asymmetric encryption algorithm, the data content in the traffic packet cannot be forcibly decrypted. Traditional traffic classification methods such as load matching cannot work on such malicious encrypted traffic, which poses a severe challenge to network protection and management. Therefore, it is urgent to study how to classify and detect encrypted malicious attack traffic without decryption.

[0003] Considering the need to classify encrypted malicious attack traffic without decryption, the present invention first conducts a detailed study of the TLS protocol, and performs feature selection around the relevant features of TLS traffic, thereby classifying benign and malicious TLS traffic, such as extracting metadata-related information and TLS protocol-related information, etc., so as to achieve classification and identification of different malicious attack encrypted traffic. After extracting the features, the mainstream approach is to simply reduce the dimension of the traffic data features, but ignores the correlation between the traffic features, resulting in low accuracy of traffic classification. In order to effectively utilize TLS traffic features, the present invention proposes to use a multi-head self-attention mechanism to learn the key features in TLS traffic and find potential connections between different features. Different types of features are mapped to the same low-dimensional space, feature cross-modeling is performed in the low-dimensional space, and a multi-head self-attention mechanism is used to identify highly correlated feature combinations, and key high-order features are constructed and used for model classification. Based on this, the present invention constructs a vulnerability exploitation attack encrypted traffic classification (Transport Layer Security-Multi Headed Self Attention, TLS-MHSA) model based on the multi-head self-attention mechanism, which can not only classify the encrypted traffic without decryption, but also enable the neural network to pay more attention to the TLS protocol characteristics of the vulnerability exploitation attack encrypted traffic, so as to achieve high-accuracy classification of malicious encrypted traffic by the model. Summary of the invention

[0004] Based on the fact that there is still room for improvement in the accuracy of classifying encrypted traffic for vulnerability exploitation attacks in the prior art, and the current deep learning model cannot fully utilize the relevant features of malicious encrypted traffic, the present invention provides a method for classifying encrypted traffic for vulnerability exploitation attacks based on a multi-head self-attention mechanism to solve the above problem.

[0005] The present invention provides a vulnerability exploit attack encrypted traffic classification method based on a multi-head self-attention mechanism, comprising the following steps:

[0006] Step 1: parse the encrypted traffic data to be classified into JSON format data, and filter and clean the parsed data;

[0007] Step 2: Analyze the key features of metadata and TLS protocol in the encrypted traffic of vulnerability exploitation attack, extract the core features required for traffic classification, and finally convert them into CSV format files;

[0008] Step 3: Divide the processed encrypted traffic data into training sets and test sets in proportion, use the malicious attack traffic types as labels, use the training set to train the multi-head self-attention mechanism network model, use the test set to judge the model, and then optimize the model to obtain the final vulnerability exploit attack encrypted traffic classification model;

[0009] Step 4: pre-process the encrypted traffic to be tested according to step 1, then extract features according to step 2, input the extracted features into the trained classification model to obtain the final traffic classification result.

[0010] Furthermore, the specific implementation of step 1 includes the following steps:

[0011] Step 1.1 Parse the encrypted traffic data set into JSON format data;

[0012] Step 1.2: Clean and filter the parsed traffic data, delete the redundant traffic data, and only keep the TLS encrypted traffic data;

[0013] Step 1.3 disrupts the order of the original traffic data to improve the generalization ability of the model after learning.

[0014] Furthermore, the specific implementation of step 2 includes the following steps:

[0015] Step 2.1, TLS protocol encrypted traffic feature selection: obtain the difference between the parameters and extended information of the TLS protocol used by the vulnerability exploit attack encrypted traffic and the normal encrypted traffic, and extract the difference parameters and difference extended information in the TLS protocol as the key features of the TLS protocol encrypted traffic;

[0016] Step 2.2, metadata feature extraction: extract metadata features in traffic data, such as IP address, port, inbound and outbound bytes, etc., as auxiliary features;

[0017] Step 2.3, label each flow data after feature extraction, that is, mark the actual type of the flow.

[0018] Furthermore, the specific implementation of step 3 includes the following steps:

[0019] Step 3.1, divide the processed traffic data into training set and test set in a ratio of 8:2;

[0020] Step 3.2, construct a neural network vulnerability exploitation attack encrypted traffic classification model TLS-MHSA based on the multi-head self-attention MHSA mechanism, input the preprocessed traffic data into TLS-MHSA, and the model includes an input layer, an embedding layer, a multi-head self-attention layer, and an output layer; first, input the preprocessed network traffic feature vector x into the input layer, and then map all features to the same low-dimensional space through the embedding layer and output a low-dimensional vector; then, map these vectors to multiple subspaces through the multi-head self-attention mechanism and combine them into different high-order features; multiple high-order feature combinations can be obtained by stacking multiple multi-head self-attention layers, and the effectiveness of the feature combination can be judged by the attention mechanism; finally, the feature combination vector obtained from the upper layer is input into the fully connected layer, and the classification result is output through the softmax function;

[0021] Step 3.3, use the training set divided in step 3.1 to train the classification model, use the corresponding test set for evaluation and parameter optimization, and obtain the final vulnerability exploitation attack encrypted traffic classification model.

[0022] Furthermore, it also includes extracting cipher suites, TLS extensions and TLS extension-related information as features, which is an important part of the handshake process when the TLS protocol establishes a connection. At the same time, non-critical parameter information in the TLS protocol, such as the client key length, is retained as an auxiliary feature.

[0023] Furthermore, the steps for obtaining high-order feature combinations are as follows. If it is feature a, then:

[0024] (1) Select any other feature b and calculate the correlation score between features a and b under attention head h. The calculation formula is as follows:

[0025]

[0026] Among them, S (h) For the attention scoring function, a common dot product model is selected, and the formula is as follows:

[0027]

[0028] in, They all belong to transformation matrices, and their dimensions are d′×d, which is the original embedding space R d Mapping to the new space R d′ The transformation matrix can be used to transform the traffic characteristics x a and x b The vector is represented by e a and e b , that is, changing the feature vector from the d-dimensional space to the d′-dimensional space;

[0029] (2) Pass coefficient Guide all related features to update the attention weight of feature a in subspace h, that is, each feature is represented as the weighted sum of all other related features. The learned new features can be expressed as the following formula:

[0030]

[0031] in, The dimension is also d′×d, a characteristic of d′-dimensional space is the feature x in the subspace h a The combined feature obtained by crossing the related features represents a new combined feature learned by the method of the present invention;

[0032] (3) The multi-head self-attention mechanism is used to expand self-attention from one head to multiple heads, so that different feature cross-information can be learned from the subspaces represented by different heads. The feature cross-information learned by different heads can be connected in series according to the following formula, where The symbol represents the concatenated operation, H represents the number of heads used by the multi-head self-attention mechanism, is the feature x in subspace i (i=1,2,…,H) a The combined features obtained by crossing the related features, the feature crossing result The formula is as follows:

[0033]

[0034] In order to enable the model to retain the low-order original traffic features while learning high-order traffic features, the present invention also adds the classic residual network to the multi-head self-attention layer, where W Res In order to a The dimensions and Alignment, ReLU(t)=max(0,t) is a nonlinear activation function, the formula is as follows:

[0035]

[0036] The output layer is a classifier composed of a fully connected layer and a softmax layer. The fully connected layer maps the input feature vector to the sample label space R through a linear transformation. c In the above example, we obtain the vector z∈R C , where C is the total number of traffic categories to be classified. Then the softmax classification function is used for classification to obtain the final classification result.

[0037] Compared with the prior art, the present invention has the following beneficial effects:

[0038] 1. Making full use of the key feature information carried by the TLS protocol in encrypted traffic, a vulnerability exploitation attack encrypted traffic classification model TLS-MHSA based on a multi-head self-attention mechanism is proposed. This model uses the self-attention mechanism to learn the key features in the pre-processed traffic data and the potential correlation of different features, and uses the multi-head mechanism to further learn important high-order combined feature information, thereby improving the accuracy of malicious attack encrypted traffic classification. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is an overall flow chart of a vulnerability detection method based on an improved temporal convolutional network.

[0040] Figure 2 This is a framework diagram of the malicious attack encrypted traffic classification method based on the multi-head self-attention mechanism.

[0041] Figure 3 This is the TLS-MHSA model structure diagram.

[0042] Figure 4 This is the structure diagram of the multi-head self-attention layer in the TLS-MHSA model.

[0043] Figure 5 It is the data sample set information used in the experimental link of the present invention.

[0044] Figure 6 is the confusion matrix of TLS-MHSA classification results.

[0045] Figure 7 It is a comparison of the classification results of three malicious attack encrypted traffic classification methods.

[0046] Figure 8 It is a comparison of the accuracy of the comparative experiments of three vulnerability exploit attack encrypted traffic classification models: RF, DeepFM and TLS-MHSA proposed in this invention.

[0047] Fig. 9It is a comparison of the recall rates of three vulnerability exploit attack encrypted traffic classification models: RF, DeepFM and TLS-MHSA proposed in this invention.

[0048] Fig.10 It is the comparison of F1-measure values ​​of the comparative experiments of three vulnerability exploitation attack encrypted traffic classification models: RF, DeepFM and TLS-MHSA proposed in this invention. DETAILED DESCRIPTION

[0049] The present invention is further described below in conjunction with the accompanying drawings and implementation examples. It should be noted that the implementation examples described are only intended to facilitate the understanding of the present invention and do not have any limiting effect on it.

[0050] The present invention aims to classify encrypted traffic of vulnerability exploit attacks and proposes a classification method of encrypted traffic of vulnerability exploit attacks based on a multi-head self-attention mechanism to effectively classify encrypted traffic of vulnerability exploit attacks. The invention provides a complete classification model and conducts sufficient experiments to prove the effectiveness and feasibility of the method.

[0051] like Figure 1-10 As shown, the present invention proposes a vulnerability exploit attack encrypted traffic classification method based on a multi-head self-attention mechanism, comprising:

[0052] Step 1: parse the encrypted traffic data to be classified into JSON format data, and filter and clean the parsed data;

[0053] Step 1.1, parse the encrypted traffic data set into JSON format data;

[0054] Step 1.2, clean and filter the parsed traffic data, delete the redundant traffic data, and only keep the TLS encrypted traffic data;

[0055] Step 1.3, disrupt the order of the original traffic data.

[0056] The purpose of parsing the data into json format in the implementation case of the present invention is to facilitate subsequent traffic filtering and cleaning operations. The purpose of deleting redundant traffic data is to prevent the model from learning useless information and reducing the classification effect. Disrupting the original order of traffic data can make the model have stronger generalization ability after learning.

[0057] Step 2: Analyze the key features of metadata and TLS protocol in the encrypted traffic of vulnerability exploitation attacks to extract the core features required for traffic classification;

[0058] Step 2.1, TLS protocol encrypted traffic feature selection: obtain the difference between the parameters and extended information of the TLS protocol used by the vulnerability exploit attack encrypted traffic and the normal encrypted traffic, and extract the difference parameters and difference extended information in the TLS protocol as the key features of the TLS protocol encrypted traffic;

[0059] Step 2.2, metadata feature extraction: extract metadata features in traffic data, such as IP address, port, inbound and outbound bytes, etc., as auxiliary features;

[0060] Step 2.3, label each flow data after feature extraction, that is, mark the actual type of the flow.

[0061] In the implementation case of the present invention, the feature extraction of traffic can be divided into two types: metadata feature selection and TLS protocol encrypted traffic feature selection. The TLS protocol encrypted traffic features mainly refer to the parameter information and TLS extension information in the protocol. The present invention extracts the cipher suite, TLS extension and TLS extension related information as features. As an important part of the handshake process when the TLS protocol establishes a connection, the relevant information of the TLS certificate is also very worthy of being used as a traffic feature. In addition, the present invention also retains non-critical parameter information in the TLS protocol such as the client key length as an auxiliary feature, which makes the overall TLS encrypted traffic features more comprehensive and enables the subsequent classification process to achieve better results.

[0062] Metadata features are features in metadata that all traffic has, and are also traffic features used in traditional traffic classification, such as IP addresses, ports, inbound and outbound bytes, etc. Since most of the time, IP addresses are meaningless for the identification of malicious traffic and are easy to mislead the judgment of the model, all IP address information is deleted during feature extraction in the present invention. Some metadata malicious attackers cannot control, such as the number of inbound and outbound bytes, inbound and outbound data packets, etc. Since these data are only affected by the transmitted data, and considering that normal traffic and malicious traffic will also have certain differences in these behaviors, it is meaningful to retain them as features. The present invention draws on the traditional standard port matching identification method and uses the port as one of the traffic features. Taking into account some differences in the behavior of malicious traffic and benign traffic, the present invention also considers adding relevant features of window sequence statistics, and in the window sequence statistical features, the system adopts the method of using Markov transfer matrix to capture the relationship between adjacent data packets. In addition to some of the above features, the present method also retains the byte distance average, standard deviation and byte entropy value for feature identification. These features can help the model improve the classification accuracy of malicious attack encrypted traffic as metadata of traffic.

[0063] Step 3: Divide the preprocessed encrypted traffic data into training sets and test sets according to appropriate proportions, use different types of malicious attack traffic as labels, use the training set data to train the multi-head self-attention mechanism network model, use the test set data to judge the model, and construct the final vulnerability exploit attack encrypted traffic classification model after optimization;

[0064] Step 3.1, divide the processed traffic data into training set and test set according to appropriate proportions;

[0065] Step 3.2, build a neural network vulnerability exploitation attack encrypted traffic classification model TLS-MHSA based on the multi-head self-attention mechanism, input the preprocessed traffic data into TLS-MHSA, and the model includes an input layer, an embedding layer, a multi-head self-attention layer, and an output layer.

[0066] The input layer converts the input features into corresponding feature vectors according to the feature types. For example, discrete features will be converted into one-hot vectors. A represents the total number of feature categories, and x represents the number of feature vectors. i Represents the i-th feature category.

[0067] x=[x1;x2;...;x A ]

[0068] The main function of the embedding layer is to transform the sparse feature vector into a dense feature vector suitable for learning. The feature vector processed by the input layer is mapped to a low-dimensional space, and each traffic classification feature is represented by multiple low-dimensional vectors. i represents the embedding matrix corresponding to feature type i, x i It is the unique hot encoding representation vector of the feature type corresponding to the feature. The conversion formula is as follows:

[0069] e i =O i x i If the feature is a multi-valued feature, in this case the categorical variable x i It is not a one-hot vector but a multi-hot vector. In order to be compatible with this multi-value input situation, the multi-value feature type S is represented as the average value of the corresponding feature vector vector to normalize the feature, where v represents the number of multi-value feature types. The conversion formula is as follows:

[0070] e i =1 / vO i x i

[0071] Malicious attack encrypted traffic classification features include both discrete features such as TLS certificate categories and continuous features such as the average number of inbound and outbound bytes. In order to combine discrete features and continuous features, the continuous features are mapped to a low-dimensional dense feature vector space and represented as the result of multiplying their feature values ​​with their corresponding embedding vectors. a is the embedding vector of feature type a, x a Is a scalar value. Continuous features can be expressed as follows:

[0072] e a =v a x a

[0073] The role of the multi-head self-attention layer is to capture the correlation between multiple traffic features and select meaningful features for high-order combination. The core operation in the attention mechanism is to directly obtain the attention weight of the feature combination through calculation, and then judge the importance of the feature combination through weights and judgments. The multi-head self-attention mechanism is to perform multiple groups of self-attention processing on the input classification feature vector, and then splice the processing results of all groups of self-attention together for linear transformation to obtain the final result.

[0074] The steps to obtain the important high-order feature combination are as follows. Taking feature a as an example, we explain how to find the important high-order features of design feature a:

[0075] (1) Select any other feature b and calculate the correlation score between features a and b under attention head h. The calculation formula is as follows:

[0076]

[0077] Among them, S (h) As the attention scoring function, this paper chooses the common dot product model, the formula is as follows:

[0078]

[0079] in, They all belong to transformation matrices, and their dimensions are d′×d, which is the original embedding space R d Mapping to the new space R d′ The transformation matrix can be used to transform the traffic characteristics x a and x b The vector is represented by e a and e b , that is, changing the feature vector from the d-dimensional space to the d′-dimensional space.

[0080] (2) Pass coefficient Guide all related features to update the attention weight of feature a in subspace h, that is, each feature is represented as the weighted sum of all other related features. The learned new features can be expressed as the following formula:

[0081]

[0082] in, The dimension is also d′×d, a characteristic of d′-dimensional space is the feature x in the subspace h a The combined feature obtained by crossing the related features represents a new combined feature learned by the method of the present invention.

[0083] (3) The multi-head self-attention mechanism is used to expand self-attention from one head to multiple heads, so that different feature cross-information can be learned from the subspaces represented by different heads. The feature cross-information learned by different heads can be connected in series according to the following formula, where The symbol represents the concatenated operation, H represents the number of heads used by the multi-head self-attention mechanism, is the feature x in subspace i (i=1,2,…,H) a The combined features obtained by crossing the related features, the feature crossing result The formula is as follows:

[0084]

[0085] In order to make the model retain the low-order original traffic features while learning high-order traffic features, the present invention also adds the classic residual network to the multi-head self-attention layer. Res In order to a The dimensions and Alignment, ReLU(t)=max(0,t) is a nonlinear activation function, the formula is as follows:

[0086]

[0087] The output layer is a classifier composed of a fully connected layer and a softmax layer. The fully connected layer maps the input feature vector to the sample label space R through a linear transformation. c In the above example, we obtain the vector z∈R C , where C is the total number of traffic categories to be classified. Then the softmax classification function is used for classification to obtain the final classification result.

[0088] Step 3.3, use the training set divided in step 3.1 to train the classification model, use the corresponding test set for evaluation and parameter optimization, and obtain the final vulnerability exploitation attack encrypted traffic classification model.

[0089] The optimization method used in the present invention is the Adaptive Momentum Estimation (Adam) algorithm. After training the optimal model, the model parameters are saved. i Represents the probability vector of the predicted detection result, y i represents the category of the actual sample label, K represents the total number of sample label categories, and the specific calculation formula of Adam is:

[0090]

[0091] Step 4: parse and clean the encrypted traffic to be detected according to the process of step 1, extract features according to the method of step 2, input the extracted feature data into the trained classification model to obtain the final traffic classification result.

Claims

1. A vulnerability exploit attack encrypted traffic classification method based on multi-head self-attention mechanism, characterized in that: The steps include: Step 1: parse the encrypted traffic data to be classified into JSON format data, and filter and clean the parsed data; Step 2: Analyze the key features of metadata and TLS protocol in the encrypted traffic of vulnerability exploitation attack, extract the core features required for traffic classification, and finally convert them into CSV format files; Step 3: Divide the processed encrypted traffic data into training sets and test sets in proportion, use the malicious attack traffic types as labels, use the training set to train the multi-head self-attention mechanism network model, use the test set to judge the model, and then optimize the model to obtain the final vulnerability exploit attack encrypted traffic classification model; Step 4: pre-process the encrypted traffic to be tested according to step 1, then extract features according to step 2, input the extracted features into the trained classification model to obtain the final traffic classification result; The specific implementation of step 3 includes the following steps: Step 3.1, divide the processed traffic data into training set and test set in a ratio of 8:2; Step 3.2, construct a neural network vulnerability exploitation attack encrypted traffic classification model TLS-MHSA based on the multi-head self-attention MHSA mechanism, input the preprocessed traffic data into TLS-MHSA, and the model includes an input layer, an embedding layer, a multi-head self-attention layer, and an output layer; first, input the preprocessed network traffic feature vector x into the input layer, and then map all features to the same low-dimensional space through the embedding layer and output a low-dimensional vector; then, map these vectors to multiple subspaces through the multi-head self-attention mechanism and combine them into different high-order features; multiple high-order feature combinations can be obtained by stacking multiple multi-head self-attention layers, and the effectiveness of the feature combination can be judged by the attention mechanism; finally, the feature combination vector obtained from the upper layer is input into the fully connected layer, and the classification result is output through the softmax function; Step 3.3, use the training set divided in step 3.1 to train the classification model, use the corresponding test set for evaluation and parameter optimization, and obtain the final vulnerability exploit attack encrypted traffic classification model; The steps for obtaining high-order feature combinations are as follows. If it is feature a, then: (1) Select any other feature b and calculate the correlation score between features a and b under attention head h. The calculation formula is as follows: Among them, A represents the total number of feature categories, S (h) For the attention scoring function, a common dot product model is selected, and the formula is as follows: in, They all belong to transformation matrices, and their dimensions are d′×d, which is the original embedding space R d Mapping to the new space R d′ The transformation matrix of the flow characteristics a and b can be expressed as e a and e b , that is, changing the feature vector from the d-dimensional space to the d′-dimensional space; (2) Pass coefficient Guide all associated features to update the attention weight of feature a in subspace h, that is, each feature is represented as the weighted sum of all other related features. The learned new features can be expressed as the following formula: in, The dimension is also d′×d, a characteristic of d′-dimensional space It is a combined feature obtained by crossing feature a with features related to it in subspace h, which represents the learning of a new combined feature; (3) The multi-head self-attention mechanism is used to expand self-attention from one head to multiple heads, so that different feature cross-information can be learned from the subspaces represented by different heads. The feature cross-information learned by different heads can be connected in series according to the following formula, where The symbol represents the concatenated operation, H represents the number of heads used by the multi-head self-attention mechanism, It is a combined feature obtained by crossing feature a with features related to it in subspace i (i = 1, 2, ..., H). The feature crossing result The formula is as follows: In order to make the model learn the high-order features of the traffic while retaining the low-order original traffic features, the classic residual network is also added to the multi-head self-attention layer, where W Res In order to a The dimensions and Alignment, ReLU(t)=max(0,t) is a nonlinear activation function, the formula is as follows: The output layer is a classifier composed of a fully connected layer and a softmax layer. The fully connected layer maps the input feature vector to the sample label space R through a linear transformation. C In the above example, we obtain the vector z∈R C , where C is the total number of traffic categories to be classified. Then, the softmax classification function is used to classify the feature vector to obtain the final classification result.

2. A vulnerability exploit attack encrypted traffic classification method based on a multi-head self-attention mechanism as claimed in claim 1, characterized in that: The specific implementation of step 1 includes the following steps: Step 1.1 Parse the encrypted traffic data set into JSON format data; Step 1.2: Clean and filter the parsed traffic data, delete the redundant traffic data, and only keep the TLS encrypted traffic data; Step 1.3 disrupts the order of the original traffic data to improve the generalization ability of the model after learning.

3. The method according to claim 1, characterized in that: The specific implementation of step 2 includes the following steps: Step 2.1, TLS protocol encrypted traffic feature selection: obtain the difference between the parameters and extended information of the TLS protocol used by the vulnerability exploit attack encrypted traffic and the normal encrypted traffic, and extract the difference parameters and difference extended information in the TLS protocol as the key features of the TLS protocol encrypted traffic; Step 2.2, metadata feature extraction: extract the metadata features in the traffic data, including IP address, port, inbound and outbound bytes, as auxiliary features; Step 2.3, label each flow data after feature extraction, that is, mark the actual type of the flow.

4. The method according to claim 3, characterized in that: It also includes extracting cipher suites, TLS extensions, and TLS extension-related information as features, which is an important part of the handshake process when the TLS protocol establishes a connection. At the same time, non-critical parameter information in the TLS protocol is retained as an auxiliary feature. Non-critical parameter information in the TLS protocol includes the client key length.

Images