Deep neural network based encrypted traffic classification method

Abstract

The application discloses a kind of encrypted traffic classification methods based on deep neural network.The application is aimed at the identification classification of user online behavior in application software for the first time, collects the data set based on target application, innovatively applies the corresponding information obtained to the accurate marking of user behavior, carries out image processing to the input information extracted to be learned by deep neural network, then carries out abstract information extraction of deep neural network learning, and outputs high discrimination recognition model based on deep neural network learning, not only effectively solves the problem that marking user behavior flow is not accurate in the process of deep neural network learning, but also improves the abstract discrimination of model to encrypted traffic type by improved deep neural network learning method, so that deep neural network learning model can filter out the features effective for distinguishing fine-grained traffic in network encrypted traffic, so as to learn more effectively the distinguishable features existing in network traffic.

Description

Technical Field

[0001] The present invention belongs to the field of network data artificial intelligence analysis technology, and in particular relates to an encrypted traffic classification method based on deep neural network learning. Background Art

[0002] According to Gartner's 2019 data, over half of all online traffic is encrypted, and over 80% of enterprise network traffic will be encrypted. The Google Transparency Report indicates that the internet's data encryption rate has now reached over 80%. According to data from the China Internet Network Information Center, the number of Internet users in my country has grown significantly in recent years, reaching 1.032 billion in 2021, creating a massive market for information security. With increasing attention paid to online privacy and security, encrypted network communications have become a major trend, with explosive growth in encrypted network traffic. Various applications on the market are adopting encrypted transmission protocols. The resulting encrypted traffic is diverse and complex, making it difficult to decrypt. This poses new challenges to internet regulation. Therefore, how to effectively identify users' online behavior from encrypted network traffic has become a hot research topic in recent years.

[0003] Among network traffic classification methods, traditional identification methods based on predefined or fixed port numbers are ineffective due to random port selection, port masquerading, and tunnel encryption technologies. Traditional traffic identification methods based on deep packet inspection and flow statistics can only achieve classification by analyzing inherent features in data packets. This requires matching packet content, relies too much on manually defined matching rules, and cannot handle encrypted traffic. Neither method can intelligently classify and identify existing encrypted traffic.

[0004] In this environment, deep neural network learning technology in the field of artificial intelligence is undoubtedly a direction worth exploring. However, existing deep neural network learning methods are mainly used for two traffic classification tasks: malicious traffic identification and application software differentiation. They can only identify whether a section of encrypted traffic belongs to a malicious flow attack or identify which application a section of encrypted data traffic comes from. They cannot provide accurate predictions for a certain user behavior traffic within a certain application. Summary of the Invention

[0005] To address the problems of the existing technology, the present invention provides a method for classifying encrypted traffic based on deep neural networks. This method, for the first time, targets the identification and classification of user online behavior within application software. It collects data sets based on one or more applications and innovatively applies the obtained plaintext and ciphertext information to accurately label user behavior. The extracted input information for deep neural network learning is then processed into images and used as input for abstract information extraction. The output is a high-discrimination recognition model based on deep neural network learning. This not only effectively solves the problem of inaccurate labeling of user behavior traffic during deep neural network learning, but also, through the improved deep neural network learning method, enhances the model's abstract discrimination of encrypted traffic types, enabling the deep neural network learning model to filter out features in network encrypted traffic that are effective for distinguishing fine-grained traffic, thereby more effectively learning discernible features present in network traffic.

[0006] To solve the above technical problems, the present invention adopts the following technical solution: an encrypted traffic classification method based on a deep neural network, comprising the following steps:

[0007] Step S1: Select one or more target application software, collect the original traffic data of various users' Internet behavior in the target application software, and obtain the corresponding plaintext and encrypted text information;

[0008] Step S2, preprocessing the original sample traffic collected in step S1 to obtain input dimension information suitable for the deep neural network learning model;

[0009] Step S3, building and training the deep neural network learning model:

[0010] (1) A neural network model is constructed based on the Bi-LSTM model to learn the correlation between data packets; residual connections are used to reduce model complexity, highlight subtle changes in features, reduce overfitting problems, and obtain the required discernible features;

[0011] (2) In the constructed neural network model, four convolution and pooling layers are designed to extract data packet features, and the output results are subjected to batch standard operations to normalize the output data to the same distribution, thereby accelerating the convergence of the model;

[0012] (3) The normalized output result of step (2) is used as the input of the bidirectional LSTM, and the traffic timing characteristics are obtained through random batch cycles. At the same time, in order to learn the timing correlation between data packets as much as possible, a two-layer bidirectional LSTM is designed for model training;

[0013] (4) For non-one-dimensional output results, the linear transformation function of the fully connected layer is used to transform them into one-dimensional vectors, and the classification prediction results are output;

[0014] (5) Repeat the training in the set batch size, and save the parameters of the model with the best accuracy during the training process (the specific value of the batch operation is affected by the performance of the personal computer. The better the performance, the given value can be increased appropriately to improve the processing speed. In this study, it is set to 128);

[0015] In step S4, the target application software is recaptured and selected, traffic data is collected, and documents with clear and ciphertext correspondences are obtained. Then, based on the neural network model trained in step S3, the user behavior in the collected data is accurately labeled and classified, the model's prediction results are output, and relevant evaluation indicators are calculated.

[0016] Preferably, the preprocessing process in step S2 is to set a behavior label for each user's online behavior for the selected target application software; at the same time, based on the obtained plaintext and ciphertext output information, the remaining undefined other online behaviors are defined as interference information and set to the nothing label.

[0017] Preferably, the target application software selected in step S1 adopts a private encryption protocol and is open source. By modifying the source code of the selected application software related to user behavior, the first 32 bytes of information of each payload that triggers user behavior action are obtained, thereby outputting the plaintext and ciphertext correspondence in real time.

[0018] Preferably, the target application software selected in step S1 is encrypted using the standard encryption protocol TLS. By modifying the boringssl source code in the Android system, outputting the tls key, and importing the key into wireshark, plaintext and ciphertext analysis can be achieved.

[0019] Preferably, the original sample flow preprocessing process in step S2 is as follows:

[0020] a. Network traffic data samples are divided into different directions, with data from the client to the server being positive and data from the server to the client being negative, and traffic is integrated in the form of bidirectional flows;

[0021] b. Cleaning: Filter out all packets that do not meet the requirements, including bad packets with no payload information, and record the data length of packets that exceed the Maximum Transmission Unit (MTU) of 1500 as the maximum length of 1500.

[0022] c. Segmentation: Data flows with the same five-tuple information are grouped as a session. Based on this classified session, each data flow is intercepted by a time period of t seconds and then stored in blocks. The specific requirement is that the difference between the maximum arrival time and the minimum arrival time in a saved record must not exceed t seconds. Combined with the positive and negative directions divided in step a, bidirectional network data flow data is obtained;

[0023] The five-tuple information includes source and sink IP addresses, source and sink port numbers, and protocol types;

[0024] d. According to the flow extraction software tool, extract the data packet arrival time and packet length information of each data message

[0025] e. The clear and ciphertext correspondence information obtained during the data collection process is used to extract flow features using data flow extraction software tools, and the corresponding action labels of each data flow are determined and recorded;

[0026] f. Construct an input matrix: Convert the extracted three-dimensional information into an image as the input to the neural network. Specifically, map the extracted packet arrival time, which is stored in blocks of t seconds, to the X-axis [0-255]. Superimpose the data flow direction information on the packet length and map it to the Y-axis [-127, 128]. This results in a two-dimensional statistical matrix that reflects the bidirectional feature flow. The distribution of data direction and packet length is then reflected through color and color depth. The two-dimensional statistical matrix obtained by the above method is reconstructed into three-dimensional statistical information according to the resolution requirements, which serves as the input matrix for the deep neural network learning model.

[0027] Preferably, the evaluation indicators in step S4 include confusion matrix, accuracy, precision, recall, and F1 value, wherein:

[0028] The confusion matrix, also known as the error matrix, is a standard format for expressing accuracy evaluation. It is used to reflect the parts of the true value and the predicted value that match or do not match each other, and to visualize the prediction results. It is usually represented in the form of a matrix with n rows and n columns, where each column represents the predicted category, and the total number of each column represents the number of data predicted to be in that category; each row represents the true category of the data, and the total number of data in each row represents the number of data instances in that category.

[0029] The accuracy rate represents the ratio of the number of correctly classified samples to the total number of samples; the higher the accuracy rate, the better the performance of the model.

[0030] The precision rate indicates the ratio of the number of samples predicted by the model to the number of samples predicted to be true.

[0031] The recall rate indicates the ratio of the number of samples predicted by the model to the total number of samples in the prediction dataset that are actually true.

[0032] The F1 value is the average of the accuracy and recall rates, which combines the output results of the accuracy and recall rates. The value ranges from 0 to 1. The larger the value, the better the output effect of the model.

[0033] Preferably, the number of batch repeated training operations in step (5) in step S3 is set to 128.

[0034] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0035] (1) This invention explores a new identification direction, shifting from traditional identification of malicious flows or application types to identification of user behavior within applications, providing a reference for more accurate network management services in the future;

[0036] (2) The internal structure of the deep neural network model provided by the present invention can be appropriately modified according to the number of types of distinguished behaviors. It is only necessary to ensure that the output dimension of the final model is consistent with the total number of classification labels, thereby improving the applicability of the method proposed by the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is a preprocessing method for classified data in an embodiment of the present invention;

[0038] Figure 2 is an overall flow chart of the classification method in an embodiment of the present invention;

[0039] Figure 3 This is a model architecture diagram of the classification method in an embodiment of the present invention;

[0040] Figure 4 Figure 1 is a graph showing the loss rate of the training set during the training of the classification model in an embodiment of the present invention; (a) is a visualization graph with the number of iterations as the horizontal axis and the loss as the vertical axis; (b) is a visualization graph with the training time as the horizontal axis and the loss as the vertical axis;

[0041] Figure 5 Graphs showing the Acc (accuracy) of the training set during the model training process of the classification method according to an embodiment of the present invention; (a) is a visualization graph with the number of iterations as the horizontal axis and Acc as the vertical axis; (b) is a visualization graph with the training time as the horizontal axis and Acc as the vertical axis;

[0042] Figure 6 Graphs showing the Acc (accuracy) of the test set during the model training process of the classification method according to an embodiment of the present invention; (a) is a visualization graph with the number of iterations as the horizontal axis and Acc as the vertical axis; (b) is a visualization graph with the test time as the horizontal axis and Acc as the vertical axis;

[0043] Figure 7 This is a schematic diagram of an analysis of open source software using Telegream as an example in an embodiment of the present invention;

[0044] Figure 8 The figure is a schematic diagram of analyzing the application of the standard encryption protocol using Sina Weibo as an example in an embodiment of the present invention. DETAILED DESCRIPTION

[0045] The present invention will be further described below with reference to specific embodiments in conjunction with the accompanying drawings. It should be understood that these embodiments are intended only to illustrate the present invention and are not intended to limit the scope of the present invention. After reading this invention, modifications to various equivalent forms of the present invention made by those skilled in the art fall within the scope defined by the appended claims.

[0046] like Figure 1-3 As shown, the encrypted traffic classification method based on deep neural network of the present invention specifically includes the following steps:

[0047] S1. Select one or more target applications and collect various user online behaviors within the target applications. To achieve accurate labeling and classification of behavioral samples, improve the accuracy of user behavior labels during deep neural network learning, and thus improve the model's prediction accuracy, for open-source applications using private encryption protocols, such as Telegram, by pre-modifying the selected application's source code related to user behavior, while capturing messages, output the first 32 bytes of information for each payload that triggers user behavior, and output the cleartext and ciphertext correspondence in real time, that is, the encrypted traffic and its corresponding user behavior. For standard encryption protocols, such as Sina Weibo, Twitter, and other applications that use TLS encryption, by modifying the BoringSSL source code in the Android system, output the TLS key, and import the key into Wireshark to achieve cleartext and ciphertext analysis.

[0048] S2. Preprocess the original collected sample traffic to obtain the input dimension information of the deep neural network learning model. For the selected target application software, set a behavior label for each user's online behavior. Based on the obtained plaintext output information, define the remaining undefined other online behaviors as interference information and set them to the "nothing" label.

[0049] Figure 7This is an analysis method for open source software in an embodiment of the present invention. Taking Telegraph as an example, the 32 bytes of information circled in the figure are in a one-to-one correspondence. The pcap data packet information displayed in Wireshark is shown on the left, and the plaintext and ciphertext corresponding information output in real time during the collection of this pcap data packet is on the right, which is triggered by the corresponding user behavior. The present invention will use this data information to mark the user behavior label corresponding to each flow in the pcap data packet, and at the same time mark the label that is not in this corresponding document as nothing, that is, the interference information label.

[0050] Figure 8 This is an analysis method for the application of standard encryption protocols in an embodiment of the present invention. Taking Sina Weibo as an example, the original pcap data packet information displayed in Wireshark is shown on the left, and the process of importing the tls key obtained in the process of collecting this pcap data packet through Wireshark's "Edit → Preferences → Protocols → TLS" on the right is shown. It can be seen that: the TLS encrypted information circled on the left is decrypted into HTTP2 plain text display, the plain text information is analyzed, and the user behavior-related information in the plain text is grouped and saved again from the message, and marked as the corresponding behavior label information. The rest will be defaulted to the nothing label, that is, the interference information label.

[0051] S3. Sample data preprocessing. The specific content and process are as follows:

[0052] 1) Network traffic data samples are direction-specific, with data from client to server being positive and data from server to client being negative, and traffic integration is performed in the form of bidirectional flows;

[0053] 2) Cleaning: filtering out all packets that do not meet the requirements. Specifically, bad packets with no payload information are not processed, and the data length of packets exceeding the Maximum Transmission Unit (MTU) of 1500 is recorded as the maximum length of 1500.

[0054] 3) Segmentation strategy: Data flows with the same five-tuple information are considered a session. The five-tuple includes the source and destination IP addresses, source and destination port numbers, and protocol type. Based on this categorized session, each flow is intercepted by a time period of t seconds and then stored in blocks. The specific requirement is that the difference between the maximum arrival time and the minimum arrival time in a saved record must not exceed t seconds. Combined with the positive and negative directions of the division in 1) above, bidirectional network data flow data information is obtained;

[0055] 4) Using Joy, a third-party open source software flow extraction tool provided by Cisco, the arrival time and packet length information of each data packet are extracted;

[0056] 5) Based on the clear and ciphertext correspondence information obtained during the data collection process, while using Joy to extract flow features, determine and record the corresponding action label of each flow;

[0057] 6) Construct an input matrix and convert the extracted three-dimensional information into an image as the input of the neural network. Specifically, the extracted data packet arrival time, which is saved in blocks of t seconds, is mapped to the X-axis [0-255]. The data flow direction information is superimposed on the data packet length and mapped to the Y-axis [-127, 128] to obtain a two-dimensional statistical matrix reflecting the bidirectional feature flow. The distribution of data direction and packet length is then reflected by color and color depth. The two-dimensional statistical matrix obtained by the above method is reconstructed into three-dimensional statistical information according to the resolution requirements, which serves as the input matrix of the deep neural network learning model.

[0058] S4. Construction and training of deep neural network learning model. The specific content and process are as follows:

[0059] 1) To address the burst traffic that occurs in real networks, the model design plans to use convolutional neural networks to extract burst traffic signal features. Considering the temporal characteristics of traffic and the problem of vanishing gradients during training, a bidirectional long short-term memory (Bi-LSTM) model is established to learn the correlation between packets. Residual connections are used to reduce model complexity, highlight subtle changes in features, and reduce overfitting, thereby obtaining the required discernible features.

[0060] 2) In the custom combined model structure, a four-layer convolution and pooling layer is designed to extract packet features. The output results are batch normalized to normalize the output data to the same distribution, accelerating model convergence.

[0061] 3) The output of the previous model is used to influence the input of the next model. The normalized results are used as the input of the bidirectional LSTM. Traffic timing characteristics are obtained through random batch cycles. To learn the timing correlation between data packets as much as possible, a two-layer bidirectional LSTM is designed for model training.

[0062] 4) For non-one-dimensional output results, they are converted into one-dimensional vectors through the linear transformation function of the fully connected layer, and the classification prediction results are output;

[0063] 5) Repeat the training in the set batch size, and save the parameters of the model with the best accuracy during the training process for model prediction.

[0064] S5: Predict based on the best model built and trained in step S4. The specific content and process are as follows:

[0065] 1) Using the same collection methods and approaches used during model training, recapture and select one or more target applications, collect documents that simultaneously capture the clear and ciphertext correspondence, accurately label and classify user behaviors in the collected data, and, using the same preprocessing methods used during model training, load the model parameters saved during training, output the model's prediction results, and calculate relevant evaluation metrics.

[0066] 2) The evaluation indicators of the model include confusion matrix, accuracy, precision, recall rate, and F1 value. The confusion matrix is ​​for the prediction results. As a visualization method of model prediction, it can clearly reflect the parts where the true value and the predicted value are consistent or inconsistent with each other, making the prediction results clear at a glance; the accuracy is for the prediction results. It refers to the ratio of the number of samples correctly classified by the model to the total number of samples for a given prediction data set. The higher the accuracy, the better the model performance; the precision is for the prediction results. It describes the ratio of the number of samples predicted by the model to be true and actually true to the total number of samples predicted by the model to be true; the recall rate is for the original samples. It describes the ratio of the number of samples predicted by the model to be true and actually true to the total number of samples in the prediction data set that are actually true; the F1 value combines the output results of the precision rate and the recall rate. In calculation, it is the harmonic mean of the two. It takes a value between 0 and 1. The larger the value, the better the output effect of the model.

[0067] Figure 4 : is a Loss (loss rate) curve of the training set during the classification method model training process in an embodiment of the present invention, wherein Figure 4 (a) is a visualization graph with the number of iterations as the horizontal axis and the loss as the vertical axis; Figure 4 (b) is a visualization graph with training time on the horizontal axis and loss on the vertical axis. As can be seen from the graph, the model loss rate gradually decreases with increasing iterations and time. This demonstrates that the model structure is well designed and continues to learn during training until it reaches its own learning iteration threshold and stabilizes.

[0068] Figure 5 The Acc (accuracy) curve of the training set in the classification method model training process in the embodiment of the present invention is shown in FIG. Figure 5 (a) is a visualization graph with the number of iterations as the horizontal axis and Acc as the vertical axis; Figure 5 (b) is a visualization graph with training time on the horizontal axis and Acc on the vertical axis. The graph shows that as the number of iterations and iteration time increase, the model accuracy gradually improves, demonstrating the effectiveness of the model's learning during training. The model's classification ability improves and gradually stabilizes at the optimal value.

[0069] Figure 6The Acc (accuracy) curve of the test set during the classification method model training process in the embodiment of the present invention is shown in FIG. Figure 6 (a) is a visualization graph with the number of iterations as the horizontal axis and Acc as the vertical axis; Figure 6 (b) is a visualization graph with test time as the horizontal axis and Acc as the vertical axis. As can be seen from the graph, as the number of iterations and iteration time increase, the accuracy of the model test gradually improves, and the model's discriminative ability becomes better and better, demonstrating the effectiveness of model learning in the training set.

[0070] The core of this invention lies in: 1) Precise labeling method: For open-source applications using private encryption protocols, such as Telegram, by pre-modifying the source code of the selected application software related to user behavior, while capturing the message, the first 32 bytes of the payload of each triggering user behavior action are output, and the clear text and cipher text correspondence is output in real time, that is, the encrypted traffic and its corresponding user behavior action. For standard encryption protocols, such as Sina Weibo, Twitter, etc., which use TLS encryption, by modifying the BoringSSL source code in the Android system, the TLS key is output, and the key is imported into Wireshark to achieve clear text and cipher text analysis. This method allows the pre-processed sample data to achieve precise labeling and classification of behavior samples before entering training, thereby improving model accuracy. 2) Predicting multiple user behavior identification solutions within one or more applications: The classification goal is to focus on fine-grained classification, rather than the traditional coarse classification direction. Without manual analysis of the specific content of the traffic, the method combines two deep learning models and a customized model design to extract spatial and temporal features of the traffic in a serial manner, and can distinguish user online behavior within the application with an accuracy rate ranging from 95%.

[0071] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for classifying encrypted traffic based on deep neural networks, characterized by The following steps are involved: Step S1: Select one or more target application software, collect the original traffic data of various users' Internet behavior in the target application software, and obtain the corresponding plaintext and encrypted text information; Step S2, preprocessing the original sample traffic collected in step S1 to obtain input dimension information suitable for the deep neural network learning model; Step S3, building and training the deep neural network learning model: (1) A neural network model is constructed based on the Bi-LSTM model to learn the correlation between data packets; residual connections are used to reduce model complexity, highlight subtle changes in features, reduce overfitting problems, and obtain the required discernible features; (2) In the constructed neural network model, four convolution and pooling layers are designed to extract data packet features, and the output results are subjected to batch standard operations to normalize the output data to the same distribution, thereby accelerating model convergence; (3) The normalized output result of step (2) is used as the input of the bidirectional LSTM, and the traffic timing characteristics are obtained through random batch cycles. At the same time, in order to learn the timing correlation between data packets as much as possible, a two-layer bidirectional LSTM is designed for model training; (4) For non-one-dimensional output results, they are transformed into one-dimensional vectors through the linear transformation function of the fully connected layer, and the classification prediction results are output; (5) Repeat the training in the set batch size and save the parameters of the model with the best accuracy during the training process; Step S4: Recapture the data traffic of the target application software, collect traffic data, and obtain documents showing the correspondence between plaintext and ciphertext. Then, based on the neural network model trained in step S3, accurately label and classify the user behavior in the collected data, output the model's prediction results, and calculate relevant evaluation indicators. The preprocessing process in step S2 is to set a behavior label for each user's online behavior for the selected target application software; at the same time, based on the obtained plaintext and ciphertext output information, the remaining undefined online behaviors are defined as interference information and set to the nothing label.

2. The encrypted traffic classification method based on deep neural network according to claim 1 is characterized by: The target application software selected in step S1 adopts a private encryption protocol and is open source. By modifying the source code of the selected application software related to user behavior, the first 32 bytes of information of each payload that triggers user behavior action are obtained, thereby outputting the plaintext and ciphertext correspondence in real time.

3. The encrypted traffic classification method based on deep neural network according to claim 1 is characterized by: The target application software selected in step S1 is encrypted using the standard encryption protocol TLS. By modifying the boringssl source code in the Android system, outputting the tls key, and importing the key into wireshark, plaintext and ciphertext analysis can be achieved.

4. The encrypted traffic classification method based on deep neural network according to claim 2 is characterized by: The original sample flow preprocessing process in step S2 is as follows: a. Network traffic data samples are divided into different directions, with data from the client to the server being positive and data from the server to the client being negative, and traffic is integrated in the form of bidirectional flows; b. Cleaning: Filter out all packets that do not meet the requirements, including bad packets with no payload information and record the length of packets exceeding 1500 as the maximum length of 1500; c. Segmentation: Data flows with the same five-tuple information are grouped as a session. Based on this classified session, each data flow is intercepted by a time period of t seconds and then stored in blocks. The specific requirement is that the difference between the maximum arrival time and the minimum arrival time in a saved record must not exceed t seconds. Combined with the positive and negative directions divided in step a, bidirectional network data flow data is obtained; The five-tuple information includes source and sink IP addresses, source and sink port numbers, and protocol types; d. Extract the data packet arrival time and packet length information of each data message using the flow extraction software tool; e. The clear and ciphertext correspondence information obtained during the data collection process is used to extract flow features using data flow extraction software tools, and the corresponding action labels of each data flow are determined and recorded; f. Construct the input matrix: Convert the extracted three-dimensional information into an image as the input of the neural network. Specifically, map the extracted packet arrival time, which is saved in blocks of t seconds, to the X-axis [0-255]. Superimpose the data flow direction information on the packet length and map it to the Y-axis [-127, 128]. This results in a two-dimensional statistical matrix that reflects the bidirectional feature flow. The distribution of data direction and packet length is then reflected through color and color depth. The obtained two-dimensional statistical matrix is ​​reconstructed into three-dimensional statistical information according to the resolution requirements, which serves as the input matrix of the deep neural network learning model.

5. The encrypted traffic classification method based on deep neural network according to claim 2 is characterized by: The evaluation indicators in step S4 include confusion matrix, accuracy, precision, recall, and F1 value, where: The confusion matrix is ​​used to reflect the parts where the true value and the predicted value are consistent or inconsistent with each other, so as to realize the visualization of the prediction results; The accuracy rate represents the ratio of the number of correctly classified samples to the total number of samples; the higher the accuracy rate, the better the performance of the model; The precision rate indicates the ratio of the number of samples predicted by the model to the number of samples predicted to be true. The recall rate indicates the ratio of the number of samples predicted by the model to the total number of samples in the prediction dataset that are actually true. The F1 value is the average of the precision and recall rates, and combines the output results of the precision and recall rates.

6. The encrypted traffic classification method based on deep neural network according to claim 1 is characterized by: The number of batch repetitive training operations in step (5) in step S3 is set to 128.

Images