An efficient method for identifying encrypted voice traffic.

Abstract

This invention relates to an efficient method for identifying encrypted voice traffic, comprising: obtaining a temporal feature sequence based on the transmission direction and length characteristics of each encrypted voice traffic data packet in an encrypted voice data stream, wherein the encrypted voice stream sequence includes encrypted voice traffic data packets; mapping the temporal feature sequence from the temporal space to the frequency domain space using a frequency domain mapping method to obtain a frequency domain feature sequence; reconstructing the frequency domain feature sequence using a stacked autoencoder to obtain encoded reconstructed features; and inputting the encoded reconstructed features into a convolutional neural network model to obtain a classification result. This invention ensures the real-time performance and effectiveness of encrypted traffic classification, effectively improves the accuracy of network traffic classification, and enhances the flexibility and generalization ability of network traffic identification.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of flow recognition, and relates to an efficient encrypted voice flow recognition method. BACKGROUND

[0002] Encrypted flow recognition technology is widely used in the field of network flow data communication, and is often used for malicious software behavior detection, malicious flow behavior analysis, and intrusion detection, virus detection, etc. The purpose is to analyze the behavior and content of encrypted flow data without decrypting the flow load content, so as to provide support for network flow behavior content supervision through content rule matching, flow feature detection, etc.

[0003] Traditional encrypted flow detection technology mainly includes two types, which are deep packet detection technology based on encrypted rule matching and flow feature classification technology based on machine learning.

[0004] The traditional deep packet detection technology mainly realizes the matching of services through the feature field in the application layer. The technical scheme mainly calculates the feature code carried by the packet load in the network communication process according to the searchable encryption rule, and matches the content of the flow data according to the feature code. However, the calculation cost required by the searchable encryption technology is large, and it is difficult to realize flexible and real-time detection of encrypted flow in a real network environment with large flow and low latency.

[0005] The encrypted flow recognition technology based on machine learning mainly extracts the flow features into feature vectors, and then constructs a complex high-dimensional adaptive classification model by machine learning and deep neural network model. Compared with the deep packet detection technology, this technology has better real-time performance and flexibility. The existing flow recognition technology based on machine learning mainly includes:

[0006] (CN110059747B) first adopts a deep neural network flow denoising algorithm based on self-learning to train a network flow classification model, and then adopts a model compression technology of regularized loss knowledge distillation to compress the network flow classification model into a lightweight network flow classification model. This scheme can effectively improve the robustness, classification accuracy and classification speed of the network flow classification method.

[0007] (CN112329839A) first extracts a unidirectional burst flow sequence with high distinguishability and low spatial complexity from unidirectional flow, then extracts packet element information in the unidirectional burst flow sequence to construct flow features, and finally adopts a deep neural network such as a convolutional neural network to perform flow recognition, which can realize fine classification of encrypted flow in the scene of unidirectional flow or bidirectional flow.

[0008] Existing technology (CN112329839A) struggles to construct complex traffic features within the time window of encrypted voice traffic transmission, making it difficult to balance the model's recognition accuracy with time efficiency. Existing technology (CN110059747B) primarily focuses on building complex classification models; however, in changing network environments, overly complex classification models can lead to severe overfitting, thereby reducing the model's generalization ability. Summary of the Invention

[0009] To address the problem of difficulty in identifying encrypted voice traffic behavior in real-world network environments, this invention provides an efficient method for identifying encrypted voice traffic. The technical problem to be solved by this invention is achieved through the following technical solution:

[0010] This invention provides an efficient method for identifying encrypted voice traffic, the method comprising:

[0011] Step 1: Obtain a time sequence feature based on the transmission direction characteristics and data packet length characteristics of each data packet in the encrypted voice data stream. The encrypted voice stream sequence includes N data packets.

[0012] Step 2: Map the time-series feature sequence from the time-series space to the frequency-domain space using a frequency-domain mapping method to obtain the frequency-domain feature sequence;

[0013] Step 3: Use a stacked autoencoder to map and reconstruct the frequency domain feature sequence to obtain the encoded reconstructed features;

[0014] Step 4: Input the encoded reconstructed features into the convolutional neural network model to obtain the classification result.

[0015] In one embodiment of the invention, step 1 includes:

[0016] Step 1.1: Extract the transmission direction features and data packet length features of each data packet in the encrypted voice data stream;

[0017] Step 1.2: Convert the transmission direction feature and data packet length feature of the data packet into a binary tuple to obtain the feature binary tuple;

[0018] Step 1.3: Multiply the elements in the feature tuple corresponding to each data packet to obtain the time-series feature sequence.

[0019] In one embodiment of the invention, step 2 includes:

[0020] Step 2.1: The time-series feature sequence is mapped and transformed using frequency domain mapping to obtain the mapped feature sequence. Each feature in the mapped feature sequence includes a real part and an imaginary part.

[0021] Step 2.2: Obtain the real number feature of each feature based on the real and imaginary parts of the mapped feature sequence;

[0022] Step 2.3: Combine the real-valued features corresponding to all features in the mapped feature sequence to form the frequency domain feature sequence.

[0023] In one embodiment of the invention, the real part of the i-th feature in the mapped feature sequence is:

[0024]

[0025] Among them, a i Let s be the real part of the i-th feature. i Let d be the packet length feature of the i-th feature. i Let k be the transmission direction feature of the i-th feature, where 0 ≤ k < N;

[0026] The imaginary part of the i-th feature in the mapped feature sequence, b i for:

[0027]

[0028] Among them, b i The imaginary part of the i-th feature;

[0029] The real-valued feature of the i-th feature in the mapped feature sequence is:

[0030]

[0031] Among them, f i Let i be a real-valued feature of the i-th feature.

[0032] The frequency domain feature sequence is:

[0033] F = <f1,f2,…,f N >

[0034] Where F is the frequency domain feature sequence.

[0035] In one embodiment of the invention, the stacked autoencoder has e layers, each of which is a linear layer, and the dimension of the input data is N. F =|F|, the first The output dimension of the layer is The output dimension of the last linear layer is equal to the dimension of the input data. The structure of the linear layer is as follows:

[0036] L = LeakyReLU(w i *f i +β)

[0037] Among them, w i Let f be the weight for adaptive learning of the i-th feature, β be the bias value, F be the frequency domain feature sequence, and f be the weight for adaptive learning of the i-th feature. i Let i be the real number feature of the i-th feature.

[0038] In one embodiment of the invention, step 3 includes:

[0039] Based on the error function, the error is calculated according to the traffic characteristics after reconstruction by the stacked autoencoder and the frequency domain feature sequence. Then, the Adam optimizer is used to backpropagate and optimize the stacked autoencoder according to the error to obtain the final encoded reconstruction features output by the stacked autoencoder.

[0040] In one embodiment of the invention, the error function is:

[0041]

[0042] in, The traffic feature sequence after reconstruction by the stacked autoencoder. This is the i-th traffic feature after reconstruction by the stacked autoencoder.

[0043] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0044] The method provided by this invention mainly targets the identification of temporal characteristics of network flow data. Extracting the temporal characteristics of network traffic does not require deep detection and analysis of data packets, thus ensuring the real-time performance of the method. The temporal characteristics of data flows can fully reflect the distribution and changing characteristics of traffic transmission behavior over time, providing a valid basis for classification models, thereby ensuring the effectiveness of the method.

[0045] The method provided in this invention employs frequency domain feature transformation combined with a stacked autoencoder to encode and reconstruct features, aiming to propose an adaptive processing method for network traffic features. Encoding traffic features can significantly improve the utilization rate of features by the classification model, thereby effectively improving the accuracy of network traffic classification. Simultaneously, the adaptive traffic feature encoding technology can adapt to flexible and ever-changing network environments, thereby improving the flexibility and generalization ability of network traffic identification.

[0046] Other aspects and features of the invention will become apparent from the following detailed description with reference to the accompanying drawings. However, it should be understood that the drawings are for illustrative purposes only and not as a limitation of the scope of the invention, as reference should be made to the appended claims. It should also be understood that, unless otherwise indicated, the drawings are not necessarily drawn to scale; they are merely intended to conceptually illustrate the structures and processes described herein. Attached Figure Description

[0047] Figure 1 This is a flowchart illustrating an efficient encrypted voice traffic recognition method provided in an embodiment of the present invention.

[0048] Figure 2 This is a flowchart illustrating another efficient encrypted voice traffic recognition method provided in an embodiment of the present invention;

[0049] Figure 3 This is a schematic diagram of a stacked self-encoder structure provided in an embodiment of the present invention. Detailed Implementation

[0050] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0051] Example 1

[0052] Existing deep packet inspection technologies primarily rely on searchable encryption techniques to perform rule matching on encrypted traffic data payloads. However, user voice commands are often complex and varied, making it difficult to reuse traffic rules generated based on the payload, resulting in significant computational overhead and compromising the real-time performance of the solution.

[0053] Existing technologies require the extraction of various features from traffic data. However, the time window for encrypted voice traffic transmission and response is relatively small, making it difficult for existing solutions to extract complex traffic features within a short time window. Therefore, an efficient traffic feature construction technique is needed. Existing technologies mainly focus on building complex classification models. However, in changing network environments, overly complex classification models can lead to severe overfitting. Once the network traffic environment changes, it will significantly affect the model's recognition efficiency, resulting in reduced recognition accuracy and poor generalization ability.

[0054] Therefore, this invention addresses the problem of classifying and identifying encrypted voice traffic data, a problem neglected in existing technologies, and proposes a method for identifying encrypted voice traffic. For details, please refer to [link to relevant documentation]. Figure 1 and Figure 2 , Figure 1 This is a flowchart illustrating an efficient encrypted voice traffic recognition method provided in an embodiment of the present invention. Figure 2 This is a flowchart illustrating another efficient encrypted voice traffic identification method provided by an embodiment of the present invention. The efficient encrypted voice traffic identification method provided by this embodiment of the present invention may specifically include steps 1 to 4, wherein:

[0055] Step 1: Obtain a time sequence feature based on the transmission direction characteristics and data packet length characteristics of each data packet in the encrypted voice data stream. The encrypted voice stream sequence includes N data packets.

[0056] Among them, the encrypted voice stream sequence is the encrypted traffic data stream sequence transmitted by the smart speaker device during the transmission and response to voice commands. This sequence can be distinguished by the TCP five-tuple (source IP address, destination IP address, protocol number, source port, destination port); the temporal characteristics of the encrypted voice stream sequence refer to the characteristics of the data packets changing over time during the data transmission process.

[0057] Step 1.1: Extract the transmission direction features and data packet length features of each data packet in the encrypted voice data stream.

[0058] Specifically, the encrypted voice data stream P is obtained from the network during the transmission and response of encrypted voice commands. This encrypted voice data stream P contains N data packets, i.e., P = <p1,p2,…,p N >where p i Let i represent the i-th data packet in the encrypted voice data stream, where 1 ≤ i ≤ N.

[0059] Step 1.2: Convert the transmission direction feature and data packet length feature of the data packet into a tuple form to obtain the feature tuple.

[0060] Specifically, the transmission direction feature and data packet length feature of each data packet in the encrypted voice data stream are extracted, and these features are labeled as binary tuples.<s,d> Where s represents the data packet length characteristic and d represents the data packet transmission direction characteristic.

[0061] Step 1.3: Multiply the elements in the feature tuple corresponding to each data packet to obtain the time-series feature sequence, which is as follows:

[0062] F = <s1*d1,s2*d2,...,s N *d N >

[0063] Where F is the time-series feature sequence, s i Let d be the data packet length characteristic of the i-th data packet. i Let represent the transmission direction characteristic of the i-th data packet.

[0064] Step 2: Use frequency domain mapping to map the time-series feature sequence from the time-series space to the frequency domain space to obtain the frequency domain feature sequence.

[0065] Step 2.1: The time-series feature sequence is transformed by frequency domain mapping to obtain the mapped feature sequence. Each feature in the mapped feature sequence includes a real part and an imaginary part.

[0066] In this embodiment, the real part of the i-th feature in the mapped feature sequence is:

[0067]

[0068] Among them, a i Let s be the real part of the i-th feature. i Let d be the packet length feature of the i-th feature. i Let k be the transmission direction feature of the i-th feature, and k be the ordinal number, where 0 ≤ k < N.

[0069] In this embodiment, the imaginary part feature b of the i-th feature in the mapped feature sequence i for:

[0070]

[0071] Among them, b i Let i be the imaginary part of the i-th feature.

[0072] Step 2.2: Obtain the real-valued features of each feature based on its real and imaginary parts in the mapped feature sequence.

[0073] Specifically, the modulus of the frequency domain features is calculated to obtain the real-valued features of the frequency domain features. The sequence of these real-valued features is then used as the input to the feature encoding part. The real-valued feature of the i-th feature in the mapped feature sequence is:

[0074]

[0075] Among them, f i Let i be the real number feature of the i-th feature.

[0076] Step 2.3: Combine the real-valued features corresponding to all features in the mapped feature sequence into a frequency domain feature sequence. The frequency domain feature sequence is as follows:

[0077] F = <f1,f2,…,f N >

[0078] Where F is the frequency domain feature sequence.

[0079] In this embodiment, the extracted time-series feature sequence is mapped using frequency domain feature transformation. Compared with the original time-domain features, frequency domain features are more conducive to expressing the sorting characteristics of traffic data packets. Based on the frequency domain feature sequence, the model can focus on the changing trend of traffic transmission sequence, thereby significantly improving the classification effect of the model.

[0080] Step 3: Use a stacked autoencoder to map and reconstruct the frequency domain feature sequence to obtain the encoded reconstructed features.

[0081] Specifically, please see Figure 3 The stacked autoencoder has e layers, each of which is a linear layer, and the input data has N dimensions.F =|F|, the first The output dimension of the layer is The output dimension of the last linear layer is equal to the dimension of the input data.

[0082] A linear layer is used as the intermediate layer structure of the stacked autoencoder. The structure of the linear layer is as follows:

[0083] L = LeakyReLU(w i *f i +β)

[0084] Among them, w i Let f be the weight for adaptive learning of the i-th feature, β be the bias value, F be the frequency domain feature sequence, and f be the weight for adaptive learning of the i-th feature. i Let i be the real number feature of the i-th feature.

[0085] In this embodiment, based on the error function, the error is calculated according to the traffic characteristics and frequency domain characteristic sequences after reconstruction by the stacked autoencoder. The Adam optimizer is then used to backpropagate and optimize the stacked autoencoder based on the error to obtain the final encoded reconstruction features output by the stacked autoencoder.

[0086] In other words, the error is calculated based on the output of the last layer of the stacked autoencoder and the original input data. This error is then used to backpropagate the stacked autoencoder, ultimately yielding the encoded reconstructed features of the traffic temporal characteristics. This ensures that the data reconstructed by the stacked autoencoder retains the classification features of the original data. The error function is:

[0087]

[0088] in, This is the traffic feature sequence reconstructed by a stacked autoencoder. This is the i-th traffic feature after reconstruction by a stacked autoencoder.

[0089] Through the aforementioned optimization and iteration process, the stacked autoencoder completes dimensionality reduction and reconstruction of the features. In this process, the stacked autoencoder uses a multi-layered linear model to reduce the dimensionality of the features. For the feature data in the resulting low-dimensional space, it can retain feature information sufficient to describe the original data, while eliminating the parts of the data features that are difficult to be used by the classification model, thereby further improving the utilization rate of frequency domain features in the classification model and improving the classification accuracy.

[0090] Step 4: Input the encoded reconstructed features into the convolutional neural network (CNN) model to obtain the classification result.

[0091] Specifically, the reconstructed encoded features from step S3 are input into a convolutional neural network model to obtain the classification result. The input to the convolutional neural network model is the traffic features encoded in step S3, and the output is the classification result of the desired voice command. This embodiment uses the cross-entropy loss function to estimate the error of the convolutional neural network and the Adam optimizer for optimization, ultimately obtaining the classification result of the encrypted voice traffic.

[0092] This invention employs frequency domain feature transformation to process the temporal characteristics of traffic. This transformation converts the input feature sequence from the time domain to the frequency domain, making it easier for the model to capture the temporal variations of the sequence. It can present the continuously changing features of the input samples and allows the classification model to focus more on the overall behavioral patterns of the encrypted voice data stream, thereby improving the model's utilization of features and increasing classification accuracy.

[0093] Building upon frequency domain feature transformation, this invention further employs a stacked autoencoder to process the features. The stacked autoencoder reconstructs the original input data into a latent feature representation. This latent feature representation is the core structure of the stacked autoencoder, mapping feature data from the high-dimensional observable space to a low-dimensional latent space. During this process, the stacked autoencoder uses multiple linear layers to reduce the dimensionality of the features. The resulting low-dimensional feature data retains sufficient information to describe the original data while eliminating features that are difficult for classification models to utilize. Furthermore, unlike dimensionality reduction methods such as principal component analysis, the new features obtained by this invention do not necessarily need to be independent. Therefore, it retains more data features and correlations between features compared to principal component analysis.

[0094] This invention uses the output of the latent feature representation as the input to the decoder to construct feature data that approximates the input. In this process, the linear decoder, through its own generalization ability, constructs input data that is easily understood by the convolutional neural network model and retains the original data features to the greatest extent possible. Similarly, in this process, this invention again reconstructs the low-dimensional latent space variables into a high-dimensional observable space. During this process, the decoder's construction capabilities can also reduce data loss during dimensionality reduction. This further improves the model's feature utilization and generalization ability.

[0095] This invention uses a convolutional neural network as a classification model. Compared with existing solutions, convolutional neural networks have fewer large integer operations, which can significantly reduce the time complexity of the model and make the model have better real-time performance.

[0096] In the description of the invention, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of the invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0097] In the description of this specification, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or feature data points described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or feature data points described can be combined in any suitable manner in one or more embodiments or examples. Furthermore, those skilled in the art can combine and integrate the different embodiments or examples described in this specification. The above description is a further detailed explanation of the present invention in conjunction with specific preferred embodiments, and it should not be considered that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, several simple deductions or substitutions can be made without departing from the concept of the present invention, and all such deductions or substitutions should be considered to fall within the protection scope of the present invention.

Claims

1. A method for efficient encrypted voice traffic identification, characterized by, The encrypted voice traffic recognition method comprises: Step 1, obtaining a time sequence according to the transmission direction feature and the data packet length feature of each data packet in the encrypted voice data stream, the encrypted voice stream sequence including N data packets; Step 2, the time sequence feature sequence is mapped from time sequence space to frequency domain space by using frequency domain mapping, and a frequency domain feature sequence is obtained; Step 3, the frequency domain feature sequence is mapped and reconstructed by using a stack autoencoder, and an encoded reconstructed feature is obtained; Step 4, the encoded reconstructed feature is input into a convolutional neural network model, and a classification result is obtained; The step 1 comprises: Step 1.1, extracting the transmission direction feature and the packet length feature of each data packet in the encrypted voice data stream; Step 1.2, converting the transmission direction feature and the packet length feature of the data packet into a binary tuple form to obtain a feature binary tuple; Step 1.3, multiplying the elements in the feature binary tuple corresponding to each data packet to obtain the time sequence feature sequence.

2. The encrypted voice traffic identification method of claim 1, wherein, The step 2 comprises: Step 2.1, mapping and transforming the time sequence feature sequence by using frequency domain mapping to obtain a mapped feature sequence, each feature in the mapped feature sequence comprising a real part feature and an imaginary part feature; Step 2.2, obtaining a real number feature of each feature in the mapped feature sequence according to the real part feature and the imaginary part feature of the feature; Step 2.3, grouping the real number features corresponding to all features in the mapped feature sequence to obtain the frequency domain feature sequence.

3. The encrypted voice traffic identification method of claim 2, wherein, The mapped feature sequence of the first The real part of each feature is: wherein, is a real component feature of the th feature, is a data packet length feature of the th feature, is a transmission direction feature of the th feature, 0 ≤ k < 1, N ; The imaginary part feature of the mapped feature sequence at the :​ wherein is the imaginary part characteristic of the first feature The mapped feature sequence of the first The real-valued features of the features are: wherein is a real feature of the th feature; The frequency domain feature sequence is: wherein, is a sequence of frequency domain features.

4. The encrypted voice traffic identification method of claim 1, wherein, The number of layers of the stack auto-encoder is e Each layer is a linear layer, the dimension of the input data is , the output dimension of the first layer is , and the output dimension of the last linear layer is equal to the dimension of the input data, and the structure of the linear layer is: wherein, is a weight of adaptive learning of the th feature, is a bias value, is a frequency domain feature sequence, is a real feature of the th feature.

5. The encrypted voice traffic identification method of claim 4, wherein, The step 3 comprises: Based on an error function, an error is calculated according to the traffic feature after reconstruction of the stack autoencoder and the frequency domain feature sequence, and an Adam optimizer is used to perform back propagation and optimization on the stack autoencoder according to the error, so as to obtain the encoded reconstructed feature finally output by the stack autoencoder.

6. The encrypted voice traffic identification method of claim 5, wherein, The error function is: in, The traffic feature sequence after reconstruction by the stacked autoencoder. The first one after reconstruction by the stacked autoencoder Traffic characteristics.

Images