Class text-based network traffic classification method, device, and storage medium

Abstract

The present invention provides a network traffic classification method, device and storage medium based on text-like representation. The method includes: obtaining the packet features of each data packet in multiple flow data included in network traffic, where the packet features include the inter-packet time and the packet size; classifying the data packets in the multiple flow data according to the differences in the packet features and constructing a packet mapping table, and converting the flow data into discrete sequence traffic data of a preset length according to the packet mapping table, where each packet category corresponds to a unique ID and each packet category contains multiple data packets; inputting the discrete sequence traffic data corresponding to the multiple flow data included in the network traffic into a text classification model, and obtaining the result of network traffic classification as the output, where the type of the text classification model is a machine learning model, a multi-scale convolutional neural network model or a natural language processing model based on a feature transformer. The present invention can achieve efficient and accurate traffic classification for encrypted network traffic.

Description

Technical Field

[0001] The present invention relates to the technical field of natural language processing, and in particular, to a network traffic classification method, device, and storage medium based on text-like transformation. Background Art

[0002] With the rapid growth of data and the wide use of network applications, the problem of network security risks has attracted more and more attention from experts and scholars. Network traffic classification is a basic measure for network planning and network management, and it is also an effective method to reduce network security risks. In the field of network planning, according to the classification results of traffic application protocols, obtaining the distribution of various network applications is beneficial to predicting the development trend of network services; in the field of network intrusion detection, traffic classification can be used to identify traffic with malicious attack intentions and ensure the security of the network space. As people's awareness of network security continues to increase, encrypted network traffic technology has become the main transmission form, but traditional traffic classification methods cannot handle encrypted traffic well.

[0003] Although there are technical solutions that directly use traffic feature data to perform feature learning through machine learning algorithms to achieve the identification of traffic protocols and attack categories, this solution requires obtaining high-precision evaluation results in a specific field (the field of network security technology).

[0004] Therefore, how to provide an efficient and accurate traffic classification method in a complex scenario including encrypted network traffic is an urgent problem to be solved. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a network traffic classification method, device, and storage medium based on text-like transformation to eliminate or improve one or more defects existing in the prior art.

[0006] One aspect of the present invention provides a network traffic classification method based on text-like transformation, the method including the following steps:

[0007] Obtain the packet features of each packet in multiple flow data included in network traffic, the packet features including the inter-packet time and the packet size;

[0008] Classify the packets in the multiple flow data according to the differences in the packet features and construct a packet mapping table, and convert the flow data into discrete sequence traffic data of a preset length according to the packet mapping table, each packet category corresponding to a unique ID, and each packet category including multiple packets;

[0009] Input the discrete sequence traffic data corresponding to multiple flow data included in the network traffic into a text classification model, and obtain the result of network traffic classification as the output. The type of the text classification model is a machine learning model, a multi-scale convolutional neural network model, or a natural language processing model based on a feature transformer.

[0010] In some embodiments of the present invention, classifying the data packets in the flow data according to the differences in the data packet features and constructing a data packet mapping table includes: using a clustering algorithm to aggregate the data packets with similar data packet features to the same clustering center, so that each data packet has a uniquely corresponding clustering center; numbering each clustering center with a unique ID, thereby constructing a data packet mapping table.

[0011] In some embodiments of the present invention, converting the flow data into discrete sequence traffic data according to the data packet mapping table includes: querying the data packet mapping table, and arranging the IDs of the clustering centers corresponding to the data packets in the order of the data packets in the flow data to form discrete sequence traffic data; for the discrete sequence traffic data with a length less than the preset length, supplement it with a preset symbol; for the discrete sequence traffic data with a length greater than the preset length, delete the content exceeding the preset length part.

[0012] In some embodiments of the present invention, when the text classification model is a machine learning model, inputting the discrete sequence traffic data corresponding to multiple flow data included in the network traffic into the text classification model, and obtaining the result of network traffic classification as the output includes: the machine learning model randomly initializes the embedding features based on the features of the IDs included in the discrete sequence traffic data in the embedding layer, then sums the embedding features of the IDs included in each discrete sequence traffic data, and finally classifies the network traffic represented by the embedding features using a support vector machine algorithm, a random forest algorithm, or a gradient boosting decision tree algorithm to obtain the result of network traffic classification.

[0013] In some embodiments of the present invention, when the text classification model is a multi-scale convolutional neural network model, inputting the discrete sequence traffic data corresponding to multiple flow data included in the network traffic into the text classification model, and obtaining the result of network traffic classification as the output includes:

[0014] In the embedding layer, map the input discrete sequence traffic data to a vector of a preset dimension, and the vectors of the preset dimension to which the discrete sequence traffic data is mapped form an embedding matrix;

[0015] In the convolutional layer, use three different sizes of convolutional kernels to extract features from the embedding matrix respectively to obtain more different feature combinations, and use the max pooling method to obtain a feature with the maximum weight value respectively, and combine the three features with the maximum weight value to obtain a hidden layer representation;

[0016] At the classification layer, the Softmax function is used to process the hidden layer representation output by the convolutional layer to obtain the result of network traffic classification.

[0017] In some embodiments of the present invention, when the text classification model is a natural language processing model based on a feature transformer, the discrete sequence traffic data corresponding to multiple flow data included in the network traffic is input into the text classification model, and the result of network traffic classification is obtained as the output, including:

[0018] At the embedding layer, the input discrete sequence traffic data is mapped to a vector of a preset dimension;

[0019] In the stack formed by the encoders of the multi-layer feature transformer, based on the self-attention mechanism, differential weighting is performed on the importance of each part of the vector of the preset dimension, and important features are globally extracted;

[0020] At the classification layer, the Softmax function is used to process the result output by the stack formed by the encoders of the multi-layer feature transformer to obtain the result of network traffic classification.

[0021] In some embodiments of the present invention, when the natural language processing model based on the feature transformer is a BERT model, the multi-layer feature transformer is a stack composed of 12 encoders of the feature transformer, and each encoder of the feature transformer contains 12 attention heads.

[0022] In some embodiments of the present invention, when the natural language processing model based on the base feature transformer is an ELECTRA model, the multi-layer feature transformer is a stack composed of 12 encoders of the feature transformer, and each encoder of the feature transformer contains 4 attention heads.

[0023] Another aspect of the present invention provides a network traffic classification device based on class textification, including a processor core memory, where computer instructions are stored in the memory, and the processor is used to execute the computer instructions stored in the memory. When the computer instructions are executed by the processor, the device implements the steps of the method described in any one of the above embodiments.

[0024] Another aspect of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, it implements the steps of the method described in any one of the above embodiments.

[0025] The network traffic classification method, device, and storage medium based on class textification of the present invention transform the flow data included in network traffic into the form of discrete sequence traffic data based on the idea of class textification, so as to use a machine learning model, a multi-scale convolutional neural network, or a natural language processing model based on a feature transformer to perform efficient and accurate traffic classification in a scenario including encrypted traffic.

[0026] Additional advantages, objects, and features of the present invention will be partially described below and will become partially apparent to those of ordinary skill in the art after studying the following text, or can be learned from the practice of the present invention. The objects and other advantages of the present invention can be achieved and obtained by the structures specifically pointed out in the specification and the drawings.

[0027] Those skilled in the art will understand that the objects and advantages that can be achieved by the present invention are not limited to the above specifically described, and the above and other objects that the present invention can achieve will be more clearly understood according to the following detailed description. Brief Description of the Drawings

[0028] The drawings described herein are used to provide a further understanding of the present invention, form a part of this application, and do not limit the present invention. In the drawings:

[0029] Figure 1 It is a flowchart of the network traffic classification method in an embodiment of the present invention.

[0030] Figure 2 It is a general flowchart of traffic classification in an embodiment of the present invention.

[0031] Figure 3 It is to generate a data packet mapping table based on a clustering algorithm in an embodiment of the present invention.

[0032] Figure 4 It is a flowchart of the traffic classification method based on a machine learning model in an embodiment of the present invention.

[0033] Figure 5 It is a flowchart of the traffic classification method based on a multi-scale convolutional neural network model in an embodiment of the present invention.

[0034] Figure 6 It is a flowchart of the traffic classification method based on a natural language processing model in an embodiment of the present invention.

[0035] Figure 7 It is the result of the F1 metric obtained by each model for protocol classification and attack type classification of traffic in the ISCXIDS2012 dataset.

[0036] Figure 8The results of the F1 metrics obtained by various models for protocol classification and attack type classification of traffic under the UNSW NB15 dataset. Detailed implementation manner

[0037] To make the objectives, technical solutions and advantages of the present invention clearer and more understandable, the present invention will be further described in detail below in conjunction with the implementation manners and the drawings. Herein, the illustrative implementation manners of the present invention and their descriptions are used to explain the present invention, but do not limit the present invention.

[0038] Herein, it should also be noted that in order to avoid obscuring the present invention due to unnecessary details, only the structures and / or processing steps closely related to the solution of the present invention are shown in the drawings, while other details less related to the present invention are omitted.

[0039] It should be emphasized that the term "including / comprising" when used herein refers to the presence of features, elements, steps or components, but does not exclude the presence or addition of one or more other features, elements, steps or components.

[0040] Herein, it should also be noted that if not otherwise specified, the term "connection" in this document can not only refer to direct connection, but also represent indirect connection with an intermediate.

[0041] In the following, embodiments of the present invention will be described with reference to the drawings. In the drawings, the same reference numerals represent the same or similar components, or the same or similar steps.

[0042] In the process of traffic classification, traffic features are extracted as inputs, and traditional machine learning models or deep learning models, such as Convolutional Neural Network (CNN) and Recurrent Neural Network (RNN) models, are used for traffic classification and recognition. The specific content is as follows:

[0043] One is to adopt the method of traditional machine learning (ML). Traditional machine learning methods need to select artificial features to reduce the dimensionality of data. The performance of the model is largely determined by the features and classification algorithms, and the non-automation of the algorithms also consumes a lot of manpower. Since the application types are beginning to be diverse, traditional machine learning methods are still limited in this regard and are difficult to promote. In complex network traffic scenarios, machine learning methods based on artificial features have been difficult to meet the actual needs.

[0044] Second, the Deep Learning (DL) method is adopted. Deep learning is a new research direction in the field of machine learning. Compared with traditional machine learning methods, deep learning does not require feature selection and can learn deeper features and more complex data scenarios, with better feature representation ability. However, for network traffic encrypted by technology, the number of features that can be obtained is very small, and directly using the method of feature input will affect the performance of the model.

[0045] To solve the problem that traffic classification in the existing network scenario containing encrypted traffic is difficult to execute accurately and efficiently, the present invention provides a network traffic classification method based on text-like transformation, which uses the text-like transformation idea (Similar to Text, ST) to serialize features, that is, converts data packets into discrete sequence traffic data in discrete sequence form according to data packet features and the constructed data packet mapping table, so that a natural language model (Natural Language Processing, NLP) based on a feature transformer (Transformer) can be used for traffic classification, and traditional machine learning models and multi-scale convolutional neural network models can also be used for traffic classification.

[0046] Regarding the text-like transformation (ST) idea, in the field of network traffic classification, network flow data corresponds to sentences, and data packets correspond to words. Similar to flow features, data packet features can also represent data packets. However, there is a problem - the features are continuous, and a data packet has multiple features, which cannot be one-to-one corresponding. If only one data packet feature is selected, a large amount of data packet information will be lost, and a data packet cannot be accurately represented. Therefore, we need to aggregate all the features of the data packet to represent the data packet. In machine learning algorithms, clustering algorithms are a class of classical unsupervised classification methods. In the case of no known labels, similar samples are grouped into the same category. In this way, we use data packet features to cluster data packets and group data packets with similar features into the same clustering center. Each data packet after clustering has a unique clustering center. By assigning a number ID to each clustering center, a data packet mapping table can be constructed to map the relationship between the data packet and the clustering center number ID.

[0047] Figure 1 The flowchart of the network traffic classification method in an embodiment of the present invention is as follows. The method includes the following steps:

[0048] Step S100: Obtain the data packet features of each data packet in multiple flow data included in the network traffic. The data packet features include the Inter-Packet Time (IPT) and the Packet Size (PS).

[0049] Among them, the network traffic contains multiple flow data, and each flow data consists of a certain number of data packets. These data packets are encrypted by an encryption algorithm and are difficult to parse and split. Only some basic features can be extracted, such as the inter-packet time and the packet size. The inter-packet time is the time gap between data packets during transmission, and the packet size is the size of the data packet. It should be noted that the data packet features of the present invention are not limited to this. For example, the data packet features also include one or more of the transmission protocol type, the encryption algorithm type, the source IP address, or the destination IP address.

[0050] Step S200: Classify the data packets in the multiple flow data according to the differences in the data packet features and construct a data packet mapping table. Convert the flow data into discrete sequence traffic data of a preset length according to the data packet mapping table. Each data packet category corresponds to a unique ID, and each data packet category contains multiple data packets. This method is the sequence-to-text (ST) method. The sequence-to-text method discretizes and serializes the traffic features, refines the packet granularity, and thus can obtain results based on a small number of traffic features and can better adapt to the scenario of encrypted traffic.

[0051] Among them, the step of classifying the data packets in the multiple flow data according to the differences in the data packet features and constructing a data packet mapping table specifically includes: First, use a clustering algorithm to aggregate the data packets with similar data packet features to the same clustering center, so that each data packet has a uniquely corresponding clustering center; then, number each clustering center with a unique ID to construct a data packet mapping table.

[0052] Among them, the step of converting the flow data into discrete sequence traffic data according to the data packet mapping table includes: Query the data packet mapping table and arrange the IDs of the corresponding clustering centers of the data packets in the order of the data packets in the flow data to form discrete sequence traffic data. For the discrete sequence traffic data with a length less than the preset length, use a preset symbol to supplement it. For the discrete sequence traffic data with a length greater than the preset length, delete the content exceeding the preset length. In some embodiments of the present invention, the symbol [BOF] is used as the start of the discrete sequence traffic data, and the symbol [EOF] is used as the end of the discrete sequence traffic data. The preset symbol used for supplementation is [PAD]. That is, if the number of data packets in a flow data is less than the preset length, it is filled with the symbol [PAD]. If it exceeds the preset length, the excess data packets are deleted.

[0053] Step S300: Input the discrete sequence traffic data corresponding to multiple flow data included in the network traffic into a text classification model, and obtain the result of network traffic classification as the output. The type of the text classification model is a machine learning model, a multi-scale convolutional neural network model, or a natural language processing (NLP) model based on a feature transformer.

[0054] In an embodiment of the present invention, the text classification model is a machine learning model. Step S300 includes: The machine learning model randomly initializes to obtain embedding features based on the features of the IDs included in the discrete sequence traffic data in the embedding layer, then sums up the embedding features of the IDs included in each discrete sequence traffic data, and finally classifies the network traffic represented by the embedding features using a support vector machine algorithm, a random forest algorithm, or a gradient boosting decision tree algorithm to obtain the result of network traffic classification.

[0055] Figure 4 This is a flowchart of a traffic classification method based on a machine learning model in an embodiment of the present invention. First, the traffic data is transformed into discrete sequence traffic data based on a text-like method. The packet features (abbreviated as packet features) are obtained by parsing the traffic data through a flow analysis framework. A packet mapping table is formed through a clustering algorithm. Figure 3 It can be seen that the traffic data is transformed into discrete sequence traffic data in the form of an id sequence through the packet mapping table, and the discrete sequence traffic data is input into the embedding layer of the machine learning model; the machine learning model randomly initializes to obtain embedding features (randomly becoming Figure 4 a 64*128-dimensional vector matrix) based on the features of the IDs included in the discrete sequence traffic data in the embedding layer, then sums up the embedding features of the IDs included in each discrete sequence traffic data (at this time becoming a 1*64-dimensional vector), and finally classifies the network traffic represented by the embedding features using a support vector machine algorithm, a random forest algorithm, or a gradient boosting decision tree algorithm to obtain the result of network traffic classification. The classification result is an output in the form of label probabilities.

[0056] The present invention proposes three machine learning models: STSVM (ST-Support Vector Machines), STRandomForest (STRF), and STXGBoost (Gradient Boosting, STXGB). The above three models select the text-like (ST) method to convert network flows into discrete sequence traffic. When the input is text, word2vec is used to obtain the features of each cluster center ID. The embedding layer of TextCNN is used to randomly initialize the embedding features of the cluster center ID. For example, a 1*100-dimensional vector is randomly changed to a 100*128-dimensional vector. Then, all the embeddings of the network flow are summed to obtain the feature representation of the entire flow, that is, the 100*128-dimensional vector is reduced to a 1*128-dimensional vector by summation. Finally, the input features are processed based on the Support Vector Machines (SVM) algorithm, the Random Forest (RF) algorithm, or the Gradient Boosting Decision Tree (XGBoost) algorithm.

[0057] In an embodiment of the present invention, the text classification model is a multi-scale convolutional neural network model, and step S300 includes:

[0058] (1) In the embedding layer, the input discrete sequence traffic data is mapped to a vector of a preset dimension, and the vectors of the preset dimension to which the discrete sequence traffic data is mapped form an embedding matrix;

[0059] (2) In the convolutional layer, three different sizes of convolutional kernels are used to extract features from the embedding matrix respectively to obtain more different feature combinations, and the maximum pooling method is used to obtain a feature with the maximum weight respectively, and the three features with the maximum weight are combined to obtain the hidden layer representation;

[0060] (3) In the classification layer, the Softmax function is used to process the hidden layer representation output by the convolutional layer to obtain the result of network traffic classification.

[0061] Figure 5 It is a flow chart of a method for traffic classification based on a multi-scale convolutional neural network model in an embodiment of the present invention. First, the traffic data is converted into discrete sequence traffic data based on the text-like method, the packet features (referred to as packet features for short) are obtained by parsing the traffic data through a flow analysis framework, a packet mapping table is formed through a clustering algorithm, and combined with Figure 3It can be seen that the traffic data is converted into discrete sequence traffic data in the form of an id sequence through the data packet mapping table, and the discrete sequence traffic data is input into the embedding layer of the machine learning model; then, in the embedding layer of the multi-scale convolutional neural network model, the input discrete sequence traffic data is mapped to a vector of a preset dimension, and the vectors of the preset dimension to which the discrete sequence traffic data is mapped form an embedding matrix; in the multi-scale convolutional layer, three different sizes of convolutional kernels are used to extract features from the embedding matrix respectively to obtain more different feature combinations, and the max pooling method is used to obtain a feature with the maximum weight respectively, and the three features with the maximum weight are combined to obtain the hidden layer representation; finally, in the classification layer, the Softmax function is used to process the hidden layer representation output by the convolutional layer to obtain the result of network traffic classification.

[0062] Figure 5 The model selected in the invention embodiment is the STCNN model. The STCNN model is a classification model based on the convolutional neural network, mainly including a text-to-class (ST) layer, an embedding layer, a convolutional layer and a classification layer. We use three different sizes of convolutional kernels to extract features from the embedding matrix of the sequence to obtain more different feature combinations, and then use max pooling to select the most important features. The three important features obtained by different sizes of convolutional kernels are combined to obtain the hidden layer representation. Finally, the probability of each category is obtained through the softmax function.

[0063] In an embodiment of the present invention, the text classification model is a natural language processing model based on the Feature Transformer (Transformer). The Feature Transformer is an encoder-decoder architecture, where the encoder has two sub-layers. One is the multi-head attention layer, which uses self-attention to learn the relationships within the source sentence; the other is the feed-forward layer, that is, a fully connected network, which performs the same operation on the vectors at each position, including two linear transformations and an activation function, and then generates the output of the encoder to be passed to the decoder. The decoder has three sub-layers, including two multi-head attention layers. The following attention layer uses self-attention to learn the relationships within the target sentence, and then the output of this layer is input into the upper attention layer together with the result passed from the encoder. This attention layer is not multi-head self-attention, but encoder-decoder attention, which is used to learn the relationships between the source sentence and the target sentence. The present invention is mainly based on the encoder structure of the Feature Transformer. Specifically, step S300 includes:

[0064] (1) In the embedding layer, the input discrete sequence traffic data is mapped to a vector of a preset dimension;

[0065] (2) In the stack formed by the encoders of the multi-layer Feature Transformer, based on the self-attention mechanism, differential weighting is performed on the importance of each part of the vector of the preset dimension, and important features are globally extracted;

[0066] (3) At the classification layer, the Softmax function is used to process the result output by the stack formed by the encoders of the multi-layer feature transformers to obtain the result of network traffic classification.

[0067] Specifically, in an embodiment of the present invention, when the natural language processing model based on the feature transformer is the BERT model, this model is named the STBert model. This multi-layer feature transformer is a stack composed of 12 layers of encoders of the feature transformers, and each encoder of the feature transformer contains 12 attention heads.

[0068] Specifically, in an embodiment of the present invention, when the natural language processing model based on the feature transformer is the ELECTRA model, this model is named the STElectra model. This multi-layer feature transformer is a stack composed of 12 layers of encoders of the feature transformers, and each encoder of the feature transformer contains 4 attention heads. The STElectra model is a lightweight model of the STBert model.

[0069] Figure 6 This is a flowchart of a traffic classification method based on a natural language processing model in an embodiment of the present invention. First, the traffic data is converted into discrete sequence traffic data based on the class textification method. The packet features (abbreviated as packet features) are obtained by parsing the traffic data through the flow analysis framework. The packet mapping table is formed through the clustering algorithm. Combining Figure 3 It can be seen that the traffic data is converted into discrete sequence traffic data in the form of an id sequence through the packet mapping table, and the discrete sequence traffic data is input into the embedding layer of the machine learning model; then, at the embedding layer, the input discrete sequence traffic data is mapped to a vector of a preset dimension; in the multi-layer feature transformers containing encoders, the importance of each part of the vector of the preset dimension is differentially weighted based on the self-attention mechanism, and important features are globally extracted; finally, at the classification layer, the Softmax function is used to process the result output by the multi-layer feature transformers to obtain the result of network traffic classification.

[0070] In an embodiment of the present invention, the natural language processing model based on the feature transformer includes the STBert model and the STElectra model. The STBert model is the BERT model combined with the class textification (ST) method, and the STElectra model is the ELECTRA model combined with the class textification (ST) method. The STElectra model is a lightweight model of the STBert model.

[0071] The STBert model, a bidirectional encoder based on feature transformers, has been proven to achieve SOTA (state-of-the-art model) performance in multiple natural language processing tasks. The STBert consists of a stack of a text-like (ST) layer, an embedding layer, a stack of encoders of multiple layers of feature transformers (Transformer), and a classification layer. The embedding layer maps the input into a fixed-dimensional vector. The multi-layer feature transformer layer is a stack composed of 12 encoders of feature transformers. The transformer encoder is part of the feature transformer (Transformer), and there are 12 attention heads in each encoder of the feature transformer. The classification layer is a fully connected layer with a dropout mechanism and a softmax function.

[0072] The STElectra model is a lightweight model of the STBert model. As Figure 3 shown, the STElectra model includes a stack of a text-like (ST) layer, an embedding layer, a stack of encoders of multiple layers of feature transformers (Transformer), and a classification layer. The embedding layer maps the input into a fixed-dimensional vector. The stack composed of the encoders of the multi-layer feature transformer consists of 12 hidden layers. Each hidden layer is the encoder structure of a feature transformer, which is the same as that of the STBert, but there are 4 attention heads in each encoder of the feature transformer, while there are 12 attention heads in the corresponding part of the STBert. The classification layer is a fully connected layer with a dropout mechanism and a softmax function.

[0073] Figure 2 This is the overall flowchart of traffic classification in an embodiment of the present invention. Among them, in the first step, the packet features included in the network traffic data are extracted to obtain packet features, as Figure 2 shown; in the second step, the packet features are classified using a classification algorithm including a clustering algorithm to obtain multiple cluster centers and assign numbers ID to the cluster centers. Each cluster center corresponds to multiple packets, thereby obtaining a packet mapping table; in the third step, the traffic data is converted into discrete sequence traffic data according to the packet mapping table, as Figure 2 shown; in the fourth step, the discrete sequence traffic data is input into a text classification model. The text classification model includes a machine learning model, a multi-scale convolutional neural network model, and a natural language processing model based on feature transformers. In the present invention, the discrete sequence traffic data obtained based on the text-like idea is regarded as "text", and a text classification model is used for text classification (i.e., traffic classification); in the fifth step, a classification result is obtained.

[0074] It should be noted that the packet classification method of the present invention uses a clustering algorithm to textify traffic data into discrete sequence traffic data. This method can also be replaced by other discretization methods to realize the serialization process of traffic data and perform subsequent classification tasks. For example, the packet classification method can also be a binary discretization method and a 1R discretization method. Discretizing and serializing traffic characteristics breaks the barrier between traffic classification and the NLP field, making the NLP model an option for traffic classification tasks. At the same time, discretizing and serializing traffic characteristics and using them as the input of the traffic classification model can improve the learning ability of the traffic classification model, optimize the performance of the traffic classification model, and improve the accuracy of traffic classification by the traffic classification model.

[0075] Figure 3 This is a packet mapping table generated based on a clustering algorithm in an embodiment of the present invention. Analyze traffic data based on a flow analysis framework (such as Nfstream) to extract packet characteristics from the original traffic data. In an encrypted network flow, it is difficult to obtain packet characteristics. We select two relatively easy-to-obtain packet characteristics, namely packet size and inter-packet time (i.e., packet time interval), as shown in Figure 3 Select the K-means clustering algorithm to classify according to the two characteristics of inter-packet time and packet size of the packet. Packets with similar packet characteristics are aggregated into the same cluster center, and each packet has a unique cluster center corresponding to it. By continuously iterating the clustering algorithm, the number of cluster centers is finally obtained. Each cluster center is numbered to construct a packet mapping table. Through the mapping table, the conversion between flow data and discrete sequence data can be realized. We select two classification tasks: protocol classification and attack type classification, and use the textification method as the pre-method of the classification model. Based on the clustering algorithm, cluster centers 0, 1, 2... are obtained. Each cluster center corresponds to multiple packets and a type of packet characteristics. An ID is assigned to each cluster center to form an ID dictionary, thus completing the construction of the packet mapping table.

[0076] Among them, the classification situations of protocol classification and attack type classification are both known. For example, protocol classification includes DNS protocol, HTTP protocol, NFS protocol, SMTP protocol, and BGP protocol, and attack type classification includes DoS attack, DDOS attack, worm attack, and backdoor attack.

[0077] Figure 7 This is the result of the F1 metric obtained by each model for protocol classification and attack type classification of traffic under the ISCXIDS2012 dataset. Figure 8The results of the F1 metric for each model to classify traffic protocols and attack types under the UNSW NB15 dataset. The F1 metric is an indicator used in statistics to measure the accuracy of binary classification models. As can be seen from the figure, the stability and classification effect of the STBert model are better than those of other models. This shows that:

[0078] (1) Traffic classification and recognition can be achieved through NLP models and good results can be obtained;

[0079] (2) Compared with other models, the traffic classification and recognition effect of the STBert model is more competitive.

[0080] (3) In text classification, the Electra model is better than the Bert model, but in the traffic classification test experiment, the STBert model has a better effect than the STElectra model, indicating that the STBert model is more suitable for the scenario of traffic classification and recognition.

[0081] In summary, the network traffic classification method based on text-like provided by the present invention uses the ST method to transform traffic features into sequence traffic features in a discrete sequence form, and uses NLP models based on transformers, multi-scale CNNs and traditional ML methods to classify traffic based on the sequence traffic features. In particular, the introduction of NLP models based on transformers greatly expands the application scope of the model. Discretizing and serializing traffic features refines the packet granularity, so that results can be obtained based on a small number of traffic features and it can better adapt to the scenario of encrypted traffic. At the same time, discretizing and serializing traffic features breaks the barrier between traffic classification and the NLP field, making NLP models an option for traffic classification tasks. Finally, discretizing and serializing traffic features and using them as the input of the traffic classification model can improve the learning ability of the traffic classification model, optimize the performance of the traffic classification model, and improve the accuracy of traffic classification by the traffic classification model.

[0082] In multiple embodiments of the present invention, there are three machine learning models - the STSVM model, the STRandomForest model and the STXGBoost model, one STCNN model based on a convolutional neural network, and two natural language processing models - the STBert model and the STElectra model. Among them, the STBert model achieved the best traffic classification effect during the test. Generally, in text classification, the Electra model has a better effect than the Bert model, but in the present invention, in traffic classification, the STBert model has a better effect than the STElectra model.

[0083] Correspondingly to the above method, the present invention further provides a network traffic classification device based on text-like processing. The device includes a computer device, which includes a processor and a memory. Computer instructions are stored in the memory, and the processor is configured to execute the computer instructions stored in the memory. When the computer instructions are executed by the processor, the device implements the steps of the method described above.

[0084] An embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements the steps of the method as described above. The computer-readable storage medium may be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the art.

[0085] Those of ordinary skill in the art should understand that the various exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Specifically, whether to implement in hardware or software depends on the specific application and design constraints of the technical solution. A person skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention. When implemented in hardware, it can be, for example, an electronic circuit, an application-specific integrated circuit (ASIC), appropriate firmware, a plug-in, a functional card, etc. When implemented in software, the elements of the present invention are programs or code segments used to perform the required tasks. The program or code segment can be stored in a machine-readable medium or transmitted via a data signal carried in a carrier wave on a transmission medium or a communication link.

[0086] It should be clear that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order between steps after understanding the spirit of the present invention.

[0087] In the present invention, the features described and / or illustrated for one embodiment can be used in the same or a similar manner in one or more other embodiments, and / or combined with the features of other embodiments or replace the features of other embodiments.

[0088] The above are only the preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, various modifications and variations can be made to the embodiments of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims

1. A network traffic classification method based on text-like transformation, characterized in that, The method includes the following steps: Obtain the packet features of each packet in multiple flow data included in network traffic, where the packet features include the inter-packet time and the packet size; Classify the packets in the multiple flow data according to the differences in the packet features and construct a packet mapping table. According to the packet mapping table, convert the flow data into discrete sequence traffic data of a preset length. Each packet category corresponds to a unique ID, and each packet category contains multiple packets. Among them, in the process of feature serialization based on the idea of text classification, the network flow data is corresponded to a sentence, the packet is corresponded to a word, the packet is represented by aggregating the packet features, and the relationship between the packet and the clustering center is mapped through the constructed packet mapping table; Input the discrete sequence traffic data corresponding to the multiple flow data included in the network traffic into a text classification model, and obtain the result of network traffic classification as the output. The type of the text classification model is a machine learning model, a multi-scale convolutional neural network model, or a natural language processing model based on a feature transformer.

2. The method according to claim 1, wherein The classifying the packets in the flow data according to the differences in the packet features and constructing a packet mapping table includes: Use a clustering algorithm to aggregate the packets with similar packet features to the same clustering center, so that each packet has a unique corresponding clustering center; Number each clustering center with a unique ID, thereby constructing a packet mapping table.

3. The method according to claim 2, wherein Converting the flow data into discrete sequence traffic data according to the packet mapping table includes: Query the packet mapping table and arrange the IDs of the clustering centers corresponding to the packets in the order of the packets in the flow data to form discrete sequence traffic data; For the discrete sequence traffic data with a length less than the preset length, use a preset symbol to make up the deficiency; For the discrete sequence traffic data with a length greater than the preset length, delete the content exceeding the preset length part.

4. The method according to claim 1, characterized in that When the text classification model is a machine learning model, inputting the discrete sequence traffic data corresponding to the multiple flow data included in the network traffic into the text classification model and obtaining the result of network traffic classification as the output includes: The machine learning model randomly initializes the embedding features based on the features of the IDs included in the discrete sequence traffic data in the embedding layer, then sums up the embedding features of the IDs included in each discrete sequence traffic data, and finally uses a support vector machine algorithm, a random forest algorithm, or a gradient boosting decision tree algorithm to classify the network traffic represented by the embedding features to obtain the result of network traffic classification.

5. The method according to claim 1, wherein When the text classification model is a multi-scale convolutional neural network model, inputting the discrete sequence traffic data corresponding to the multiple flow data included in the network traffic into the text classification model and obtaining the result of network traffic classification as the output includes: In the embedding layer, map the input discrete sequence traffic data to a vector of a preset dimension, and the vectors of the preset dimension to which the discrete sequence traffic data is mapped form an embedding matrix; In the convolutional layer, convolution kernels of three different sizes are used to extract features from the embedding matrix respectively to obtain more different feature combinations, and the max pooling method is used to obtain a feature with the maximum weight respectively, and the three features with the maximum weight are combined to obtain the hidden layer representation; In the classification layer, the Softmax function is used to process the hidden layer representation output by the convolutional layer to obtain the result of network traffic classification.

6. The method according to claim 1, wherein When the text classification model is a natural language processing model based on a feature transformer, the discrete sequence traffic data corresponding to multiple flow data included in the network traffic is input into the text classification model, and the result of network traffic classification is obtained as the output, including: In the embedding layer, the input discrete sequence traffic data is mapped to a vector of a preset dimension; In the stack formed by the encoders of the multi-layer feature transformers, based on the self-attention mechanism, differential weighting is performed on the importance of each part of the vector of the preset dimension, and important features are globally extracted; In the classification layer, the Softmax function is used to process the result output by the stack formed by the encoders of the multi-layer feature transformers to obtain the result of network traffic classification.

7. The method according to claim 6, wherein When the natural language processing model based on the feature transformer is a BERT model, the multi-layer feature transformers are a stack composed of 12 encoders of feature transformers, and each encoder of the feature transformer contains 12 attention heads.

8. The method according to claim 6, wherein When the natural language processing model based on the feature transformer is an ELECTRA model, the encoder of the multi-layer feature transformers is a stack composed of 12 feature transformers, and each encoder of the feature transformer contains 4 attention heads.

9. A network traffic classification device based on text-like transformation, comprising a processor and a memory, characterized in that Computer instructions are stored in the memory, and the processor is configured to execute the computer instructions stored in the memory. When the computer instructions are executed by the processor, the device implements the steps of the method according to any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps of the method according to any one of claims 1 to 8.

Images