Method and system for anonymous network traffic classification based on multi-feature sequence

Abstract

The application provides a kind of anonymous network traffic classification method and system based on multi-feature sequence, comprising: step S1: collecting network traffic files, extracting features, data normalization and flow sequence generation;Step S2: the importance of the extracted features is sorted, the feature sequence corresponding to the most important continuity feature in the traffic sequence is obtained, and is converted into a frequency domain feature vector;Step S3: the frequency domain feature vector is converted into an intermediate feature vector by the frequency domain feature extraction network, and the other features of the flow sequence are converted into an intermediate feature vector by the other feature extraction network;Step S4: splice the intermediate feature vector, and get the probability distribution of different categories after passing through the classification network.The application can extract important continuous features in anonymous communication flow sequence, and mine the implicit information in the frequency domain, and fully exert the sequence feature capture ability of the Transform framework for continuous data.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, deep learning and anonymous communication network, in particular, to an anonymous network traffic classification method and system based on multi-feature sequence. BACKGROUND

[0002] In recent years, with the development of the information age, the services carried by the Internet are more and more, while the Internet brings convenience to people, it also makes the user's various privacy information be collected and transmitted in the Internet. The traditional network security represented by the security protocol mainly focuses on the protection of information content, but lacks effective protection for the identity information of the communication parties which is equally important. Therefore, under the background of the growing demand of users for the protection of identity information, anonymous communication technology emerges as the times require.

[0003] Anonymous communication technology is a privacy protection technology that hides the communication content and relationship by using data forwarding, content encryption, traffic obfuscation and other measures. In order to improve the anonymity of communication, these data forwarding links are usually composed of multi-hop encrypted proxy service nodes, and all service nodes together constitute an anonymous communication network. In recent years, in response to the needs of different users, anonymous communication technology has developed various types of anonymous communication networks. For example, The Onion Router (Tor), Invisible Internet Project (I2P) based on Tor, Freenet, etc., among which Tor is the most widely used, with the largest number of users and the largest scale, and is the research hotspot in recent years.

[0004] However, while the anonymous network provides stronger privacy for legitimate users, it is also used by some criminals as a carrier and breeding ground for illegal activities. Some common illegal activities on the anonymous network at present include arms smuggling, drug trading, child-related pornography, planning of various violent events and hiring of assassins, etc. Therefore, how to quickly and effectively complete the network traffic analysis has great significance for strengthening the traffic monitoring and blocking of anonymous network and maintaining the security of network space.

[0005] Network traffic analysis refers to capturing data packets in the network, then analyzing and counting relevant information through other means, and then diagnosing the running state of the network to help supervisors troubleshoot potential problems in the network and improve network protection capabilities. In an anonymous network, network administrators can monitor traffic information in the network, analyze possible malicious behavior, and classify traffic to redirect malicious traffic and achieve the purpose of protecting the network. At present, methods based on machine learning such as CNN, LSTM, etc. are generally used to classify anonymous traffic. Although these methods can automatically extract flow features, they ignore the spatiotemporal correlation between flows. The Transformer framework can treat multiple consecutive flows within a certain time range as a sequence and take the features of the sequence as input data to capture the correlation between flows and potential features, achieving better classification results.

[0006] Patent document CN110059747B (application number: CN201910314300.X) discloses a network traffic classification method, including constructing a lightweight classification model; the construction of the lightweight classification model includes the following steps: S1: training a network traffic classification model based on a self-step learning deep neural network traffic denoising algorithm; S2: model compression technology based on regularization loss knowledge distillation, compressing the network traffic classification model into a lightweight network traffic classification model. However, this invention does not extract important continuity features in anonymous communication flow sequences and mine implicit information in the frequency domain. SUMMARY

[0007] In view of the defects in the prior art, the purpose of the present application is to provide an anonymous network traffic classification method and system based on multiple feature sequences.

[0008] According to the anonymous network traffic classification method based on multiple feature sequences provided by the present application, the following steps are included:

[0009] Step S1: Collect network traffic files, extract features, perform data normalization and flow sequence generation;

[0010] Step S2: Sort the extracted features by importance, obtain the feature sequence corresponding to the most important continuity feature in the flow sequence, and convert it into a frequency domain feature vector;

[0011] Step S3: Convert the frequency domain feature vector into an intermediate feature vector through a frequency domain feature extraction network, and convert other features of the flow sequence into an intermediate feature vector through another feature extraction network;

[0012] Step S4: Concatenate the intermediate feature vectors, and get the probability distribution of different categories through a classification network.

[0013] Preferably, in the step S1:

[0014] Step S1.1: Capture anonymous network traffic packets flowing through the device. The captured packets are in pcap format.

[0015] Step S1.2: Divide the collected dataset into segments based on a preset time span;

[0016] Step S1.3: Extract features from the acquired and segmented pcap file and output the stream feature values ​​of the data packets;

[0017] Step S1.4: Use a normalization algorithm to uniformly map the data to the [0,1] interval;

[0018] Step S1.5: Select Z consecutive stream data as a block for processing.

[0019] Preferably, in step S2:

[0020] Step S2.1: Perform feature filtering on all extracted features, removing features including the initial timestamp, final timestamp, IP and TCP parameters of each stream data, and retaining a preset number of features;

[0021] Step S2.2: Calculate the importance of each selected feature using the random forest algorithm or principal component analysis, and rank the features according to their importance; select the most important preset features;

[0022] Step S2.3: For the selected features, denote them as features respectively. For Z consecutive stream data, construct Z-dimensional feature vectors and build a feature sequence of length Z. and , here =Z; The feature sequence is transformed into a frequency domain feature vector, and the calculation formula is:

[0023]

[0024] The transformation results are combined into frequency domain feature vectors. and The frequency domain feature vectors are used as inputs to the encoder of the Transformer framework, and two outputs are generated. The feature vectors are mapped into two by MLP. eigenvectors, where For custom parameters, concatenate as follows intermediate feature vector .

[0025] Preferably, in step S3:

[0026] For other features not selected, the selected importance is located in the top preset number of features, for the Z continuous flow data, Z vectors are constructed, mapped to Z vectors by DNN, input into the mean or maximum pooling layer after splicing, and an intermediate feature vector

[0027] Preferably, in the step S4:

[0028] For the output intermediate feature vector , after splicing, an final feature vector is mapped by MLP, where p is the number of final classification categories, and then a probability distribution is calculated by using a softmax function, and a classification result is determined according to the probability distribution.

[0029] According to the anonymous network flow classification system based on a plurality of feature sequences provided by the application, the anonymous network flow classification method based on a plurality of feature sequences is executed, comprising:

[0030] An anonymous network flow sequence acquisition and preprocessing module: network data flow flowing through a hardware device is acquired by using a data flow acquisition tool, and feature information in the data flow is extracted after the data flow is segmented and analyzed;

[0031] A feature principal component analysis and frequency domain feature extraction module: feature preprocessing is performed on the generated flow by using a feature selection method, frequency domain features are extracted for time domain features meeting a preset standard, and the extracted frequency domain feature sequence is input into an encoder to obtain an intermediate feature vector ；

[0032] An other feature extraction module: embedding of other feature sequences other than the preset standard in a high-dimensional space is obtained, and the embedding is integrated into a matrix, which is abstracted into an intermediate feature vector after being input into a mean or maximum pooling layer;

[0033] A classification result output module: the intermediate vector is integrated to obtain a final classification vector.

[0034] Preferably, in the anonymous network flow sequence acquisition and preprocessing module:

[0035] A flow capture tool is used to capture, and a flow analysis tool is used to complete feature extraction work after the capture is completed, and normalization and flow sequence generation are performed on the data for which the feature extraction is completed, wherein:

[0036] The flow capture tool: tcpdump or Wireshark is used to capture network data packets flowing through a hardware device running the tool, and the network data packets are stored in the pcap file format;

[0037] ​​Traffic analysis tool: the tool used is Tranalyzer2, which receives standard pcap format file data and processes and analyzes various network traffic according to user needs, and outputs corresponding feature subsets;

[0038] Data normalization and flow sequence generation: data normalization refers to a method of mapping the numerical values of all features to a unified interval to solve the comparability problem between data features; flow sequence generation refers to combining and splicing multiple continuous data flow information into a flow block to mine the implicit association relationship and feature information between continuous flows.

[0039] Preferably, in the feature principal component analysis and frequency domain feature extraction module:

[0040] The feature selection method is used to sort the importance of the features. For a plurality of important time domain feature sequences with specific meanings, a discrete Fourier transform is used to convert the plurality of time domain feature sequences into a plurality of frequency domain feature sequences, and the frequency domain feature sequences are input into a plurality of encoders based on a Transformer framework to obtain an intermediate feature vector , wherein:

[0041] Feature selection method: the algorithm used is a random forest method or a principal component analysis method.

[0042] Preferably, in the other feature extraction module:

[0043] The other feature sequences are respectively input into a DNN to obtain their embeddings in a high-dimensional space, and the embeddings are integrated into a matrix, which is input into a mean or maximum pooling layer and abstracted into an intermediate feature vector .

[0044] Preferably, in the classification result output module:

[0045] The intermediate feature vector and is input into a multilayer perceptron and a softmax normalization processing to obtain a final classification vector, and a final classification probability distribution is calculated according to the final classification vector.

[0046] Compared with the prior art, the present application has the following beneficial effects:

[0047] 1. The present application can extract important continuity features in anonymous communication flow sequences and mine implicit information in the frequency domain, and fully utilize the sequence feature capturing capability of the Transformer framework for continuous data;

[0048] 2. The present application uses DNN to embed other features with lower importance, so that the method can classify anonymous network traffic to a certain extent while reducing the amount of calculation, thereby improving the feasibility of anonymous network traffic classification. BRIEF DESCRIPTION OF DRAWINGS

[0049] Other features, objects, and advantages of the application will become more apparent from the following detailed description of non-limiting embodiments thereof, when read in connection with the following drawings:

[0050] Fig. 1 A module structure schematic diagram of an anonymous network traffic classification method based on a multi-feature sequence provided by a preferred embodiment of the application;

[0051] Fig. 2 A flowchart schematic diagram of an anonymous network traffic classification method based on a multi-feature sequence provided by a preferred embodiment of the application. DETAILED DESCRIPTION

[0052] The application will be described in detail below with specific embodiments. The following embodiments will help those skilled in the art to further understand the application, but do not limit the application in any form. It should be noted that, for those skilled in the art, without departing from the concept of the application, a number of changes and improvements can be made. These all belong to the protection scope of the application.

[0053] Example 1

[0054] The application provides an anonymous network traffic classification method based on a multi-feature sequence. First, network traffic files are collected, and data preprocessing is completed through data set cutting, data stream feature extraction, data normalization, feature selection, etc. Then, the importance of the extracted features is sorted by principal component analysis, the feature sequence corresponding to the most important continuous features in the traffic sequence is obtained, and the frequency domain feature vector is converted through discrete Fourier transform. Then, the frequency domain feature vector is converted into an intermediate feature vector by a frequency domain feature extraction network based on a Transformer framework, and other features of the flow sequence are converted into an intermediate feature vector by other feature extraction networks based on deep neural networks (DNN). Finally, the two intermediate feature vectors are spliced, and the probability distribution of different categories is obtained through a classification network, completing the anonymous traffic classification work.

[0055] According to the anonymous network traffic classification method based on a multi-feature sequence provided by the application, as shown in Figs. 1-2 , comprising:

[0056] Step S1: Collecting network traffic files, extracting features, performing data normalization and flow sequence generation;

[0057] Specifically, in the step S1:

[0058] Step S1.1: Capture the anonymous network traffic data packets flowing through the device, and the captured packet format is pcap;

[0059] Step S1.2: Cut the collected data set into a preset time span;

[0060] Step S1.3: Feature extraction is performed on the collected and cut pcap files, and the flow feature value of the packet is output;

[0061] Step S1.4: Use the normalization algorithm to uniformly map the data to the [0, 1] interval;

[0062] Step S1.5: Select Z consecutive flow data as a block for processing.

[0063] Step S2: Sort the extracted features by importance, obtain the feature sequence corresponding to the most important continuity feature in the traffic sequence, and convert it into a frequency domain feature vector;

[0064] Specifically, in the step S2:

[0065] Step S2.1: Feature screening is performed on all extracted features, and the features including the initial timestamp, the final timestamp, the IP and the TCP parameters of each flow data are removed, and a preset number of features are retained;

[0066] Step S2.2: The importance of each feature is calculated using a random forest algorithm or principal component analysis method, and the features are sorted according to the importance; the most important preset number of features are selected;

[0067] Step S2.3: The selected features are denoted as features , respectively, for Z consecutive flow data, a Z-dimensional feature vector is constructed, and a feature sequence with a length of Z is constructed and , where =Z; the feature sequence is converted into a frequency domain feature vector, and the calculation formula is:

[0068]

[0069] The transformed results are combined into a frequency domain feature vector and , the frequency domain feature vector is input into the encoder of the Transformer framework, and two feature vectors are output, which are mapped into two feature vectors through MLP, where is a custom parameter, and the two feature vectors are spliced into an intermediate feature vector .

[0070] Step S3: converting the frequency domain feature vector into an intermediate feature vector through a frequency domain feature extraction network, and converting other features of the flow sequence into an intermediate feature vector through an other feature extraction network;

[0071] Specifically, in the step S3:

[0072] For the other features that are not selected, the features with importance located in the first pre-set number of features are selected, and for the Z continuous flow data, Z vectors are constructed, which are mapped into Z vectors through a DNN, and then input into a mean or maximum pooling layer after splicing to obtain an intermediate feature vector .

[0073] Step S4: splicing the intermediate feature vectors, and obtaining the probability distribution of different categories through a classification network.

[0074] Specifically, in the step S4:

[0075] For the output intermediate feature vector , after splicing, an final feature vector is mapped through an MLP, where p is the number of final classification categories, and then a probability distribution is calculated by using a softmax function, and a classification result is determined according to the probability distribution.

[0076] Embodiment 2:

[0077] Embodiment 2 is a preferred example of Embodiment 1, which is used to more specifically illustrate the present application.

[0078] The present application also provides an anonymous network flow classification system based on a multi-feature sequence, which can be realized by executing the flow steps of the anonymous network flow classification method based on a multi-feature sequence, that is, the anonymous network flow classification method based on a multi-feature sequence can be understood by those skilled in the art as a preferred embodiment of the anonymous network flow classification system based on a multi-feature sequence.

[0079] According to the anonymous network flow classification system based on a multi-feature sequence provided by the present application, the anonymous network flow classification method based on a multi-feature sequence is executed, which comprises:

[0080] An anonymous network flow sequence acquisition and preprocessing module: network data flow flowing through a hardware device is collected through a data flow acquisition tool, and feature information in the data flow is analyzed and extracted after the data flow is segmented;

[0081] Specifically, in the anonymous network flow sequence acquisition and preprocessing module: ​

[0082] Using the traffic capture tool, the feature extraction work is completed after the completion of the traffic analysis tool, and the data after the feature extraction is normalized and flow sequence is generated, wherein:

[0083] Traffic capture tool: the tool used is tcpdump or Wireshark, which captures network packets flowing through the hardware device running the tool and stores them in pcap file format;

[0084] Traffic analysis tool: the tool used is Tranalyzer2, which receives standard pcap format file data and adds, deletes or inserts plugins according to user needs, processes and analyzes various network traffic, and outputs corresponding feature subsets;

[0085] Data normalization and flow sequence generation: data normalization refers to the method of mapping the numerical values of all features to a unified interval to solve the comparability problem between data features, and flow sequence generation refers to the combination and splicing of multiple continuous data flow information into a flow block to mine the implicit association relationship and feature information between continuous flows.

[0086] Feature principal component analysis and frequency domain feature extraction module: the generated traffic is preprocessed by feature selection method, and the frequency domain features are extracted for time domain features that meet the preset standard. The extracted frequency domain feature sequence is input into the encoder to obtain the intermediate feature vector ；

[0087] Specifically, in the feature principal component analysis and frequency domain feature extraction module:

[0088] The feature selection method is used to sort the importance of the features. For important time domain feature sequences with specific meanings for multiple numerical values, discrete Fourier transform is used to convert them into multiple frequency domain feature sequences, and the frequency domain feature sequences are input into multiple encoders based on the Transformer framework to obtain the intermediate feature vector , wherein:

[0089] Feature selection method: the algorithm used is random forest method or principal component analysis method.

[0090] Other feature extraction module: other feature sequences outside the preset standard are embedded in a high-dimensional space respectively, and the embeddings are integrated into a matrix, which is input into the mean or maximum pooling layer and abstracted into an intermediate feature vector;

[0091] Specifically, in the other feature extraction module:

[0092] The other feature sequences are embedded in a high-dimensional space respectively by DNN, and the embeddings are integrated into a matrix, which is input into the mean or maximum pooling layer and abstracted into an intermediate feature vector .

[0093] The classification result output module integrates the intermediate vectors to obtain a final classification vector.

[0094] Specifically, in the classification result output module:

[0095] The intermediate feature vector And The final classification vector is obtained through a multilayer perceptron and a softmax normalization process, and the final classification probability distribution is calculated according to the final classification vector.

[0096] Embodiment 3

[0097] Embodiment 3 is a preferred example of Embodiment 1, to more specifically illustrate the present application. In view of the deficiencies of the prior art, the present application proposes an anonymous network traffic classification method based on multiple feature sequences, which improves the accuracy of traffic classification by focusing on the important continuity features of traffic. The method proposed by the present application aims to utilize the statistical features of anonymous communication traffic, multiple important feature sequences and their implicit context association to realize the classification of anonymous communication network traffic. First, network traffic pcap data is collected through tcpdump or Wireshark, features are extracted using Tranalyzer2, and data normalization and flow sequence generation are performed; then, the frequency domain information of multiple important feature sequences is extracted through the discrete Fourier transform algorithm, the frequency domain intermediate feature vector is obtained by inputting the encoder based on the Transformer framework, and another intermediate feature vector is obtained by inputting other features into the DNN; finally, the two intermediate feature vectors are spliced, mapped through MLP and normalized through softmax to obtain the final classification vector, and the classification process is completed.

[0098] The module structure diagram of the anonymous network traffic classification method based on multiple feature sequences provided by the preferred embodiment of the present application is shown in Fig. 1 .

[0099] Further, the flowchart of the anonymous network traffic classification method based on multiple feature sequences provided by the preferred embodiment of the present application is shown in Fig. 2 . The method specifically includes the following steps: anonymous network flow sequence acquisition and preprocessing, principal component analysis of features and frequency domain feature extraction, other feature extraction, and classification result output.

[0100] S1. Anonymous network flow sequence acquisition and preprocessing: including anonymous network dataset acquisition, data stream segmentation of the collected data, data stream feature extraction, data normalization, etc.

[0101] S2. Principal component analysis of features and frequency domain feature extraction: and the important feature components that are continuous in the time domain are converted into frequency domain feature intermediate vectors through frequency domain conversion methods.

[0102] S3. Other feature extraction: construct other feature matrix, and obtain intermediate feature vector of other features in high-dimensional space.

[0103] S4. Multi-sequence anonymous traffic classification: concatenate the frequency domain feature vector and the other feature vector, input into the traffic classification model, and generate the traffic classification result label.

[0104] Preferably, the step S1 specifically comprises the following steps:

[0105] A1. Capture the anonymous network traffic data packets flowing through the device by running tcpdump or Wireshark on the switch or other device, and the captured packet format is pcap

[0106] A2. Cut the collected data set at a certain time span, and through experimental comparison and analysis, it is found that the traffic classification performance is best when the time span is 10s

[0107] A3. Use Tranalyzer2 tool to extract features from the collected and cut pcap files, and output 124 kinds of feature values of packet flow basic characteristics information, statistical information, etc. through the plug-in.

[0108] A4. Since the value range of different features is quite different, normalization processing is needed to balance the comparability between data features. Normalize the data to map it to the [0, 1] interval.

[0109] A5. Since the input of the encoder of the Transformer framework needs to accept a block (or sequence) as input, the input sequence is composed of multiple consecutive data, and through experimental comparison and analysis, choose consecutive flow data as a block for processing.

[0110] Preferably, the step S2 specifically comprises the following steps:

[0111] B1. Feature selection is performed on all features extracted in step A3, and features that do not provide useful information such as initial timestamp, final timestamp, partial IP, TCP parameters, etc. are removed, and finally features are retained.

[0112] B2. Calculate the importance of each feature using the random forest algorithm or principal component analysis method, and sort the features according to the importance. Select several features whose numerical values have specific meanings (the numerical values do not represent categories) such as the number of received packets and data flow symmetry.

[0113] B3. For the features selected in step B2, denoted as features respectively. Regarding the steps described in step A5 Each continuous stream of data is used to construct... A feature vector of length 1 can be constructed. sequence and , here That is Using the Discrete Fourier Transform or other time-domain to frequency-domain methods, it is transformed into a frequency-domain feature vector, as a sequence. Taking the Discrete Fourier Transform as an example, its calculation formula is as follows:

[0114]

[0115] in, The imaginary unit;

[0116] The transformation results can be combined into frequency domain feature vectors. and The input and output of the encoder based on the Transformer framework are respectively... indivual The feature vectors are then mapped into two by MLP. eigenvectors (where) (For custom parameters), concatenated as intermediate feature vector .

[0117] Preferably, step S3 specifically includes the following steps:

[0118] C1. For other features not selected in step B2, select those with higher importance. The characteristics described in step A5 A continuous stream of data, constructing indivual The vector is mapped to by the DNN. indivual The vectors are concatenated and then input into a mean or maximum / minimum pooling layer to obtain... intermediate feature vector .

[0119] Preferably, step S4 specifically includes the following steps:

[0120] D1. For the intermediate feature vectors output in steps B3 and C1 After concatenation, it is mapped to a single MLP. The final feature vector (here p is the number of final classification categories) is obtained, and then a probability distribution is calculated using a softmax function, and the classification result is determined according to the distribution.

[0121] The anonymous network flow classification method based on multiple feature sequences performs frequency domain feature extraction on multiple important feature sequences input, considers and extracts other features as a whole, integrates the intermediate feature vectors in the two parts, and inputs the integrated intermediate feature vectors into a classification module to complete the anonymous network flow classification. Specifically, the following modules are included: an anonymous network stream sequence acquisition and preprocessing module, a feature principal component analysis and frequency domain feature extraction module, an other feature extraction module, and a classification result output module. Among them:

[0122] The anonymous network stream sequence acquisition and preprocessing module collects network data streams flowing through hardware devices such as switches and gateways through a data stream acquisition tool, analyzes and extracts feature information in the data stream after splitting the data stream, thereby supporting subsequent feature screening, model training, and classification steps.

[0123] The feature principal component analysis and frequency domain feature extraction module removes unimportant features in the generated traffic through a feature selection method, so that the features input into the model are more in line with effectiveness and timeliness. For important time domain features with specific numerical meanings, discrete Fourier transform is used to extract frequency domain features. The extracted multiple frequency domain feature sequences are input into an encoder with a Transformer framework to obtain an intermediate feature vector a .

[0124] The other feature extraction module obtains the embedding of other feature sequences in high-dimensional space through DNN, and integrates these embeddings into a matrix. After inputting into a mean or maximum pooling layer, the matrix is abstracted into an intermediate feature vector .

[0125] The classification result output module integrates the intermediate vectors to obtain a final classification vector, which is used for training the network and obtaining the classification result.

[0126] The anonymous network sequence acquisition and preprocessing module uses a traffic capture tool to capture the traffic, and uses a traffic analysis tool to complete the feature extraction work after the capture is completed. The data after feature extraction is normalized and stream sequence is generated, wherein:

[0127] The traffic capture tool: the main tools used are tcpdump or Wireshark, which can capture network data packets flowing through hardware devices running this tool and store them in pcap file format.

[0128] Traffic analysis tool: The main tool used is Tranalyzer2, which can receive standard pcap format file data and add or delete plug-ins according to user needs, effectively process and analyze various network traffic, and output corresponding feature subsets.

[0129] Data normalization and flow sequence generation: Data normalization refers to the method of mapping the numerical values of all features to a unified interval to solve the comparability problem between data features. Flow sequence generation refers to combining multiple continuous data stream information into a flow block to mine the implicit association relationship and feature information between continuous flows.

[0130] The feature principal component analysis and frequency domain feature extraction module uses a feature selection method to sort the importance of the features. For multiple important time domain feature sequences with specific meanings, discrete Fourier transform is used to convert them into multiple frequency domain feature sequences, and the frequency domain feature sequences are input into multiple encoders based on the Transformer framework to obtain intermediate feature vectors wherein:

[0131] Feature selection method: The main algorithm used is the random forest method or the principal component analysis method, which has the advantages of simple implementation and not easy to overfit. Its essence is a decision tree model based on the Bootstrap Aggregating idea.

[0132] Transformer framework: A deep learning framework based on encoder-decoder and focusing on self-attention mechanism, which can effectively solve the problem of recurrent neural network (RNN) unable to handle in parallel and convolutional neural network (CNN) unable to efficiently capture long-distance dependencies.

[0133] The other feature extraction module obtains the embedding of other feature sequences in high-dimensional space through DNN respectively, and integrates these embeddings into a matrix, and after inputting into the mean or max pooling layer, it is abstracted into an intermediate feature vector .

[0134] The classification result output module, the intermediate feature vector and , through the Multilayer Perceptron (MLP) and softmax normalization processing, obtains the final classification vector, and the final classification probability distribution can be calculated according to the vector.

[0135] MLP: A feed-forward structured artificial neural network that maps a set of input vectors to a set of output vectors, the dimension of the output vectors can be customized according to the needs.

[0136] Those skilled in the art know that, in addition to implementing the system, device and each module thereof provided by the present application in the form of pure computer readable program code, the same program can also be realized by logically programming the method steps to make the system, device and each module thereof provided by the present application in the form of logic gates, switches, application specific integrated circuits, programmable logic controllers and embedded microcontrollers. Therefore, the system, device and each module thereof provided by the present application can be considered as a hardware component, and the modules included therein for implementing various programs can also be considered as structures within the hardware component; the modules for implementing various functions can also be considered as both software programs for implementing methods and structures within hardware components.

[0137] The specific embodiments of the present application are described above. It needs to be understood that the present application is not limited to the specific embodiments described above, and various changes or modifications can be made by those skilled in the art within the scope of the claims, which does not affect the essential content of the present application. The embodiments of the present application and the features in the embodiments can be arbitrarily combined with each other without conflict.

Claims

1. A method for anonymous network traffic classification based on multi-feature sequences, characterized in that, Comprise: Step S1: collect network traffic files, extract features, normalize data and generate flow sequence; Step S2: sort the importance of the extracted features, obtain the feature sequence corresponding to the most important continuity feature in the traffic sequence, and convert it into a frequency domain feature vector; Step S3: convert the frequency domain feature vector into an intermediate feature vector through a frequency domain feature extraction network, and convert other features of the flow sequence into an intermediate feature vector through other feature extraction networks; Step S4: splice the intermediate feature vectors, and obtain the probability distribution of different categories through a classification network; In the step S2: Step S2.1: feature screening is performed on all extracted features, and features including initial timestamp, final timestamp, IP and TCP parameters of each flow data are removed, and a preset number of features are retained; Step S2.2: the importance of each feature is calculated using a random forest algorithm or principal component analysis method, and the features are sorted according to the importance; select the most important preset number of features; Step S2.3: for the selected features, respectively denoted as features For Z continuous stream data, respectively construct Z-dimensional feature vectors, and construct a feature sequence with length Z With Here =Z; convert the feature sequence into a frequency domain feature vector, and the calculation formula is: combining the transformation results into a frequency domain feature vector and respectively as the input of the encoder of the Transformer framework, output 2 feature vectors, which are mapped into 2 feature vectors through MLP, where is a self-defined parameter, and spliced into the intermediate feature vector ;​ In the step S3: For other features not selected, the selected importance is located in the first preset features, for the Z continuous stream data, construct Z vectors, mapped to Z vectors by DNN, input into the mean or max pooling layer after splicing, obtain intermediate feature vector ; In the step S4: For the output intermediate feature vector , after splicing, it is mapped to a final feature vector by an MLP, where p is the number of categories for final classification, and then a probability distribution is calculated by a softmax function, and the classification result is determined according to the probability distribution.

2. The multi-feature sequence based anonymous network traffic classification method of claim 1, wherein, In the step S1: Step S1.1: capture anonymous network traffic data packets flowing through the device, and the captured packet format is pcap; Step S1.2: cut the collected data set at a preset time span; Step S1.3: extract features from the collected and cut pcap files, and output the flow feature values of the packets; Step S1.4: use a normalization algorithm to map the data uniformly to the [0, 1] interval; Step S1.5: select Z consecutive flow data as a block for processing.

3. A multi-feature sequence based anonymous network traffic classification system, characterized in that, The anonymous network traffic classification method based on multiple feature sequences of claim 1 comprises: An anonymous network flow sequence acquisition and preprocessing module: network data flow flowing through a hardware device is collected through a data flow acquisition tool, and feature information in the data flow is extracted after the data flow is segmented; The feature principal component analysis and frequency domain feature extraction module: the generated traffic is preprocessed by a feature selection method, and the frequency domain features of the time domain features meeting the preset standard are extracted. The extracted frequency domain feature sequence is input into an encoder to obtain an intermediate feature vector ； Other feature extraction module: other feature sequences outside the preset standard are embedded in a high-dimensional space respectively, and the embedding is integrated into a matrix, which is input into a mean or maximum pooling layer and abstracted into an intermediate feature vector; Classification result output module: integrate the intermediate vector to obtain the final classification vector.

4. The multi-feature sequence based anonymous network traffic classification system of claim 3, wherein, In the anonymous network flow sequence acquisition and preprocessing module: Use a traffic capture tool, and after capturing, use a traffic analysis tool to complete feature extraction, normalize the data after feature extraction, and generate flow sequences, wherein: Traffic capture tool: the tool used is tcpdump or Wireshark, which captures network packets flowing through the hardware device running the tool and stores them in pcap file format; Traffic analysis tool: the tool used is Tranalyzer2, which receives standard pcap format file data and adds, deletes or inserts plugins according to user requirements, processes and analyzes various network traffic, and outputs the corresponding feature subset; Data normalization and stream sequence generation: data normalization refers to the method of mapping the numerical values of all features to a unified interval, solving the comparability problem between data features, and stream sequence generation refers to the combination and splicing of multiple continuous data stream information into a stream block, mining the implicit association relationship and feature information between continuous streams.

5. The multi-feature sequence based anonymous network traffic classification system of claim 3, wherein, In the feature principal component analysis and frequency domain feature extraction module: The feature selection method is used to sort the importance of the features. For the important time domain feature sequence with specific meaning for multiple numerical values, the discrete Fourier transform is used to convert the frequency domain feature sequence into multiple frequency domain feature sequences. The frequency domain feature sequence is input into multiple encoders based on the Transformer framework to obtain the intermediate feature vector wherein: Feature selection method: the algorithm is random forest method or principal component analysis method.

6. The multi-feature sequence based anonymous network traffic classification system of claim 3, wherein, In the other feature extraction module: Other feature sequences are respectively obtained by DNN to obtain their embeddings in high-dimensional space, and the embeddings are integrated into a matrix, and after inputting a mean or maximum pooling layer, an intermediate feature vector is abstracted .

7. The multi-feature sequence based anonymous network traffic classification system of claim 3, wherein, In the classification result output module: The intermediate feature vector is obtained and The final classification vector is obtained through a multi-layer perceptron and a softmax normalization processing after splicing, and a final classification probability distribution is calculated according to the final classification vector.

Images