A Deep Learning-Based Decentralized Application Traffic Identification Method and System

Abstract

This invention relates to a method and system for identifying decentralized application (Decentralized Application) traffic based on deep learning. The method includes: collecting network traffic data during the use of decentralized applications; preprocessing the collected network traffic data, including traffic filtering, and converting the filtered network traffic data into image format; training a neural network model using the image-formatted network traffic data; and classifying and identifying the actual network traffic of decentralized applications using the trained neural network model. This invention transforms the network traffic classification problem into an image classification problem, utilizing the powerful learning capabilities of convolutional neural networks in image recognition to train an image traffic classifier, which can significantly improve the test accuracy of the classifier and help network service providers and network administrators optimize the network environment.

Description

Technical Field

[0001] This invention relates to the field of blockchain smart contract security technology, specifically to a method and system for identifying decentralized application traffic based on deep learning. Background Technology

[0002] With the rapid development of digital cryptocurrencies, blockchain technology has gradually become familiar to the public, attracting widespread attention from political, business, and technology sectors. The number of related research and applications is increasing daily. More and more decentralized applications (DApps) are being deployed on blockchains to achieve anonymous communication and data sharing. These applications often use SSL / TLS (Secure Sockets Layer / Transport Layer Security) to encrypt data transmission and ensure the security of traffic payloads. Furthermore, DApps based on the same blockchain platform typically have similar SSL / TLS architectures. Traditional traffic identification methods are struggling to achieve satisfactory classification results in this new context, necessitating the exploration of more targeted classification methods. Identifying DApp traffic can help internet service providers analyze the number of DApp users and their usage habits, contributing to DApp market research. Network administrators can also optimize the network environment based on traffic classification results.

[0003] To address the problem of traffic identification, academia and industry have proposed a series of methods, which can be mainly categorized into port identification, deep packet inspection, behavioral pattern recognition, and AI-enabled identification. The first three are generally referred to as traditional identification methods. Port identification distinguishes application protocols based on port numbers in the data packet transport layer, thereby identifying specific applications. It only requires configuring rules on basic network devices, requiring no other hardware or software, and boasts very fast identification speed and high accuracy. However, with the continuous expansion of the internet, many applications have begun using dynamic port technology for data transmission, significantly reducing the accuracy of port identification technology and rendering it unsuitable for the current network environment. Deep packet inspection delves into the payload of data packets, extracting packet content and performing pattern matching. It is not limited by changes in the 5-tuple and has a relatively high recognition rate, but it cannot identify encrypted traffic. Furthermore, delving into data packets to obtain payloads for matching consumes significant computational resources, increasing the burden on network devices. Behavioral pattern recognition technology no longer classifies based on the specific content information of individual data packets, but rather on the behavior of the entire application. The same application accumulates sufficient information (such as periodicity) when transmitting data streams to different host targets to eliminate differences between hosts, thereby identifying the application. Artificial intelligence-enabled identification technology introduces AI into the traffic classification process, using machine learning algorithms to learn characteristic information from network traffic, thereby improving the accuracy and timeliness of classification. Compared with traditional classification methods, AI-powered traffic classification in the current network environment offers significantly improved accuracy and speed. Summary of the Invention

[0004] To overcome the shortcomings of the prior art, this invention provides a method and system for identifying decentralized application traffic based on deep learning, which is used to identify traffic generated by different types of decentralized applications and provide a reference for network optimization.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] A method for identifying decentralized application traffic based on deep learning includes the following steps:

[0007] Collect network traffic data during the use of decentralized applications;

[0008] The collected network traffic data is preprocessed, including traffic filtering, and the filtered network traffic data is converted into image format.

[0009] Train a neural network model using network traffic data in the form of images;

[0010] The trained neural network model is used to classify and identify the actual network traffic of decentralized applications.

[0011] Furthermore, the traffic filtering includes: domain filtering, packet filtering, and stream filtering; the purpose of domain filtering is to filter out traffic that is irrelevant to the target application; the purpose of packet filtering is to filter out data packets that do not contribute to describing traffic characteristics; the purpose of stream filtering is to segment data streams, dividing the traffic of the target application into streams according to 5-tuples and time intervals, where a stream represents the temporal sequence of TCP data packets exchanged between two peers during a single TCP session.

[0012] Furthermore, the domain filtering includes: filtering out data packets within the local area network and background traffic generated by the local machine based on the results of the background traffic analysis above; using session statistics information, combined with network information, session duration, and packet quantity, to perform secondary filtering on IP addresses, with the aim of removing irrelevant flows and related flows with small data volumes, while retaining related flows with larger data volumes that have more obvious behavioral characteristics.

[0013] Furthermore, the time threshold for dividing the stream in the stream filtering is selected as 4.5 seconds.

[0014] Furthermore, the step of converting the filtered network traffic data into an image format includes: setting the number of packets used to construct the image in each stream to 25; extracting the first 40 bytes of data from each packet, including the header information of the network layer and the transport layer, and removing the encrypted payload information; and filling streams with insufficient packet counts with black pixels.

[0015] Furthermore, the neural network model is a convolutional neural network model; the convolutional neural network model includes:

[0016] The input layer is used to read preprocessed image data. The input is a single-channel image data of 1×25×320 pixels.

[0017] Convolutional layer C1 uses a convolutional kernel of size 3 and a stride of 1, outputting 5 channels of data. After convolution, the output tensor size becomes 5×23×318. After one convolution, the output tensor is activated by ReLU to introduce nonlinearity and improve the learning speed.

[0018] Pooling layer P1 uses a 2×2 pooling kernel with a sliding step size of 2. It employs max pooling to compress features, resulting in an output tensor size of 5×11×159.

[0019] The output tensor of convolutional layer C2 and pooling layer P1 is used as the input tensor of convolutional layer C2. The downsampling size of convolutional layer C2 is 3×3, the sliding stride is 1, and it contains 10 convolutional kernels. After convolution, the tensor size becomes 10×9×157. The convolution result is then passed through the ReLU activation function again.

[0020] Pooling layer P2 has the same structure as pooling layer P1, with a pooling kernel size of 2×2, a stride of 2, and uses max pooling. The output tensor size is 10×4×78.

[0021] The fully connected layer Fc1 contains 120 neurons, which maps the 3120 elements in the output tensor of the pooling layer to a 120-dimensional feature space, and then passes them through the ReLU function;

[0022] The fully connected layer Fc2 contains 84 neurons, which map 120-dimensional features to 84 dimensions, and then connects to the ReLU function;

[0023] The Output layer aims to map the high-dimensional features in the hidden layer to the label space. This output layer contains 9 neurons, resulting in 9-dimensional features. The Softmax function is used to obtain the probability of a corresponding sample being mapped to each label.

[0024] Furthermore, the hyperparameters of the convolutional neural network model include Epoch, Batch Size, Learning Rate, Optimizer, and activation function. During the training phase, each hyperparameter is changed individually, and the magnitude of the hyperparameter is increased or decreased by estimating the gradient direction of the hyperparameter. After this process is completed, the best result of all hyperparameters is selected and combined. Accuracy is used as the performance index for evaluating the gradient direction of the hyperparameters. Accuracy is defined as the proportion of all correctly classified samples to the total number of samples.

[0025] A decentralized application traffic identification system based on deep learning, comprising:

[0026] The traffic data acquisition module is used to collect network traffic data during the use of decentralized applications;

[0027] The traffic data preprocessing module is used to preprocess the collected network traffic data. The preprocessing includes traffic filtering and converting the filtered network traffic data into image format.

[0028] The model training module is used to train neural network models using network traffic data in the form of images.

[0029] The traffic identification module is used to classify and identify the actual network traffic of decentralized applications using a trained neural network model.

[0030] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0031] (1) The method proposed in this invention to convert traffic features into graph form for storage can represent the detailed features of network traffic more completely and can achieve more refined identification.

[0032] (2) The decentralized application identification method proposed in this invention can identify different types of decentralized applications on different blockchains. The details of the SSL / TLS protocol differ between different blockchains, and the data exchange process of different types of applications varies. The traffic filtering process of this invention focuses on extracting the temporal characteristics of the data exchange process, which can better express the differences in the protocol implementation process, thereby enabling the convolutional neural network to better learn the characteristics of different types of applications on different chains.

[0033] (3) The decentralized application identification method proposed in this invention can train an effective convolutional neural network model, which can accurately distinguish a large amount of decentralized application traffic in a short time.

[0034] (4) This invention transforms the network traffic classification problem into an image classification problem, and utilizes the powerful learning capabilities of convolutional neural networks in the field of image recognition to train a graph traffic classifier. Traffic data from nine decentralized applications running on mainstream blockchain platforms, totaling 52,797 data packets and 864 streams, were collected using traffic acquisition software for training. The classifier's test accuracy reached over 90%, which helps network service providers and network administrators optimize the network environment. Attached Figure Description

[0035] Figure 1 This is a schematic diagram of the network traffic collection process in the method described in the embodiment of the present invention.

[0036] Figure 2 This is a flowchart of the stream segmentation algorithm in the method described in the embodiment of the present invention.

[0037] Figure 3 This is a flowchart of the flow graph transformation algorithm in the method described in the embodiments of the present invention.

[0038] Figure 4 This is a pseudocode diagram of the flow graph algorithm in the method described in the embodiments of the present invention.

[0039] Figure 5 This is a schematic diagram of the convolutional neural network model in the method described in the embodiment of the present invention.

[0040] Figure 6 This is a diagram of the convolutional neural network algorithm in the method described in the embodiments of the present invention.

[0041] Figure 7 This is an example diagram of Wireshark traffic data in the method described in this embodiment of the invention.

[0042] Figure 8 This is an example of the transformed flow graph in the method described in the embodiments of the present invention.

[0043] Figure 9This is a diagram showing the selection of hyperparameters for the convolutional neural network model in the method described in this embodiment of the invention.

[0044] Figure 10 This is a comparison chart of the accuracy of the DApp traffic classifier based on convolutional neural networks of this invention with other classifiers. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. However, it should be understood that the specific embodiments described herein are only for explaining the invention and are not intended to limit the scope of the invention.

[0046] This invention discloses a method for identifying decentralized application traffic based on deep learning. The method consists of four parts: traffic data acquisition, traffic data preprocessing, establishment of a convolutional neural network model, and training of the convolutional neural network model.

[0047] 1. Traffic data collection:

[0048] Figure 1 This demonstrates the process of collecting network traffic data during the use of decentralized applications. Before formally collecting application traffic, it is necessary to first collect the background traffic generated during computer operation. This invention uses a network packet capture tool to collect traffic data in a local environment, collecting two minutes of system background traffic before formally collecting data for each decentralized application. Subsequently, the pages of each decentralized application are accessed multiple times using the Chrome browser on the PC. Each page is accessed multiple times to obtain redundant traffic, with a time interval between two accesses to ensure that the previous session has ended when the next session begins. The entire process can be automatically controlled by a script.

[0049] 2. Traffic data preprocessing:

[0050] The collected network traffic is captured by a packet capture tool and saved locally. Background traffic generated by the system's operating environment, as well as other data packets that do not provide any additional information to describe the traffic characteristics, such as retransmission packets, acknowledgment packets, and TCP handshake packets, are filtered out. The information displayed for each data packet includes: the packet number, the time the packet arrived, the source IP address and port number, the destination IP address and port number, the protocol used for transmission, the packet length, and some information contained in the packet. The filtered traffic is saved as a pcap format file for subsequent processing by the program.

[0051] Traffic filtering mainly consists of three steps: domain filtering, packet filtering, and flow filtering. This invention uses Wireshark software for the first two steps, while flow filtering is handled by a Python script.

[0052] (1) Domain filtering

[0053] The main purpose of domain filtering is to filter out traffic that is irrelevant to the target application. This invention utilizes the filtering capabilities of Wireshark to filter out data packets within the local area network and background traffic generated by the local machine, based on the background traffic analysis results described above.

[0054] To further improve the relevance of remaining data packets to the application and filter out new irrelevant traffic that may be generated during browser operation, this invention uses session statistics information, combined with network information, session duration, and packet quantity, to perform secondary filtering on IP addresses. The purpose is to filter out irrelevant flows and relevant flows with small data volumes, while retaining relevant flows with larger data volumes that have more obvious behavioral characteristics.

[0055] Such a filtering method may save irrelevant streams with large amounts of data generated during browser operation. By comparing the filtering rules of multiple application traffic collections horizontally, it can be ensured that there are no large streams with the same IP.

[0056] (2) Packet Filtering

[0057] Packet filtering aims to remove packets that do not contribute to describing traffic characteristics, such as TCP handshake packets, retransmitted packets, and ACK packets. Due to limitations in the domestic network environment, the collected traffic is filled with a large number of retransmitted and out-of-order packets.

[0058] (3) Flow filtration

[0059] The purpose of stream filtering is to segment data streams, dividing the traffic of a target application into streams based on a five-tuple (source IP address, source port, destination IP address, destination port, and transport protocol) and a time interval. In this invention, a stream represents the temporal sequence of TCP packets exchanged between two peers during a single TCP session. The specific process is as follows: Figure 2 As shown.

[0060] To facilitate subsequent processing by the convolutional neural network, the selected target application traffic needs to be processed into image format and divided into test and training sets. First, the scapy module in Python is used to read the pcap file containing traffic from a single application. To obtain network flow-based features, the overall traffic needs to be divided into streams based on a quintuple and a time threshold. 95% of the packets will arrive within 4.43 seconds of the previous packet's arrival; this invention selects a time threshold of 4.5 seconds for stream division. The number of packets used to construct the image in each stream will also affect the classifier's performance. The process for constructing the image is as follows... Figure 3As shown. To achieve high accuracy with appropriate time overhead, this invention sets the number of packets selected for each stream to 25, extracting the first 40 bytes of data from each packet, including the network and transport layer header information and discarding the encrypted payload information. Streams with insufficient packet counts are padded with black pixels. Finally, the processed data is divided into training and validation sets using a 10-fold cross-validation method.

[0061] Figure 3 The method for "converting a stream into a graph" is as follows: each data packet in the application stream is stored as a bit array, so that each stream can be represented as a 0-1 matrix formed by multiple bit arrays. Then, the 0s in the 0-1 matrix are converted into black pixels and the 1s into white pixels, thus converting the stream into a graph. For detailed algorithm information, see [link to algorithm]. Figure 4 This allows the application stream to be transformed into an image format that retains most of the latent features, while also facilitating subsequent processing by convolutional neural networks.

[0062] 3. Establishment of the convolutional neural network model:

[0063] After converting traffic data into image format, the problem of classifying traffic in decentralized applications can be transformed into an image classification problem. The introduction of convolutional neural networks has greatly improved the field of image classification. LeNet-5 is a classic convolutional neural network model with a seven-layer structure, achieving extremely high accuracy in handwritten character image recognition. The model used in this invention is based on the LeNet-5 model, and improvements have been made to the model to address the specific problem. The specific model structure is as follows: Figure 5 As shown.

[0064] (1) Input layer, used to read preprocessed image data. The input of this invention is single-channel image data of 1×25×320 pixels.

[0065] (2) Convolutional layer C1: The first convolutional layer uses a kernel of size 3 and a stride of 1. It outputs 5 channels of data. After convolution, the output tensor size becomes 5×23×318. After one convolution, the output tensor is activated by ReLU to introduce nonlinearity and improve the learning speed.

[0066] (3) Pooling layer P1: The first pooling layer uses a 2×2 pooling kernel with a sliding step of 2, and employs max pooling to compress features. Max pooling selects the largest value within the pooling kernel as the representative of the kernel. After the pooling operation, the image size is halved, the number of feature surfaces remains unchanged, and the output tensor size becomes 5×11×159.

[0067] (4) The output tensor of convolutional layer C2 and pooling layer P1 is used as the input tensor of the second convolutional layer. The convolutional downsampling size of this layer is 3×3, the sliding stride is 1, and it contains 10 convolutional kernels. After convolution, the tensor size becomes 10×9×157. The convolution result is then activated by the ReLU function again.

[0068] (5) Pooling layer P2, the second pooling layer has the same structure as pooling layer P1, the pooling kernel size is 2×2, the step size is set to 2, the max pooling method is used, and the output tensor size is 10×4×78.

[0069] (6) Fully connected layer Fc1: The first fully connected layer Fc1 contains 120 neurons. It maps the 3120 elements in the output tensor of the pooling layer to a 120-dimensional feature space and then passes them through the ReLU function.

[0070] (7) Fully connected layer Fc2: The second fully connected layer has 84 neurons, mapping the 120-dimensional features to 84 dimensions, and then connecting it to the ReLU function. Increasing the number of fully connected layers can significantly improve the model's ability to fit nonlinear features.

[0071] (8) Output Layer: The purpose of the output layer is to map the high-dimensional features in the hidden layer to the label space. In this model, the output layer contains 9 neurons, obtaining 9-dimensional features. The Softmax function is used to obtain the probability of each sample being mapped to each label. The Softmax function can map the input values ​​to the range of 0-1 and normalize them to ensure that the sum is 1, which can conveniently calculate the difference between labeled samples. Let there be an array V, V... i Let be the i-th element in V, then V i The Softmax value is shown in equation (1).

[0072]

[0073] In machine learning, loss functions are used to quantitatively analyze the difference between the classifier's predictions and the actual sample labels, thereby measuring the quality of the model's predictions. This is often used to adjust the gradient direction during model training. In this invention, the cross-entropy loss function is selected. Using the probability results obtained through the Softmax function, the cross-entropy function often exhibits better convergence than the mean squared error (MSE) function.

[0074] The formula for the cross-entropy function is shown in equation (2).

[0075]

[0076] Li represents the loss value of the sample, and the log function contains the softmax value of the sample.

[0077] 4. Training the convolutional neural network model:

[0078] The training process requires inputting data from the feature extraction process into the established model. The neural network will gradually adjust the weight matrix based on the deviation between the training data and the actual values ​​of the samples. The pseudocode for a convolutional neural network is as follows: Figure 6 As shown, a crucial step in training a convolutional neural network is tuning its hyperparameters. Hyperparameter tuning is used to balance variance, bias, and classification performance. Due to the large number of hyperparameters in a neural network, finding the optimal hyperparameters is a very challenging task. Hyperparameters mainly consist of five parts: Epoch, Batch Size, Learning Rate, Optimizer, and Activation Function.

[0079] (1) Epoch: refers to the process of sending all the data into the network to complete one forward calculation and back propagation. Generally speaking, increasing the number of Epochs can make the model more accurate on the training set, but too many Epochs can also lead to model overfitting.

[0080] (2) Batch Size: Affects the convergence speed of the model and the noise of the stochastic gradient. Experience shows that when the training error is small, the generalization performance of the model will decrease if the batch size is too large.

[0081] (3) Learning Rate: Used to control the utilization rate during error backpropagation. The generalization ability of deep learning networks is negatively correlated with the ratio of batch size to learning rate. When the batch size is fixed, a larger learning rate will result in better generalization ability of the model.

[0082] (4) Optimizer: Used to update and compute algorithms that affect model training and model output, so that they approach or reach the optimal value, thereby minimizing (or maximizing) the loss function.

[0083] (5) Activation function: used to increase the model’s ability to fit nonlinear functions.

[0084] This invention allows for individual modification of each hyperparameter during the training phase, determining whether to increase or decrease the size of each hyperparameter by estimating its gradient direction. After this process, the optimal result for all hyperparameters is selected and combined. Accuracy is used as the performance metric for evaluating the hyperparameter gradient direction; accuracy is defined as the proportion of correctly classified samples out of the total number of samples.

[0085] 5. Key contents of this invention

[0086] As can be seen from the foregoing content, the key contents of this invention include:

[0087] 1) A graph-based method for extracting network traffic features, comprising the following steps:

[0088] (1) Network traffic data collection: Use network traffic collectors (such as Wireshark) to collect network traffic generated during the use of decentralized applications;

[0089] (2) Filter out background traffic that is irrelevant to the application from the collected traffic and construct traffic features based on network flow. During the collection of target application traffic, traffic of non-target applications will also be collected. The higher the proportion of target application traffic in the total traffic, the better the accuracy of the trained classifier. Therefore, we need to clean the collected traffic and remove irrelevant traffic.

[0090] (3) Further transform the flow characteristics into a graph for storage.

[0091] 2) An artificial intelligence model for classifying traffic characteristics, comprising the following steps:

[0092] (1) Construct a convolutional neural network model with appropriate expressive power based on the features of the input data;

[0093] (2) Use feature data to train the parameters of the convolutional neural network model;

[0094] (3) Classify and identify actual network traffic and summarize the results.

[0095] 6. Analysis and Evaluation:

[0096] Test environment:

[0097] To test the vulnerability detection capabilities and overhead of the method of this invention, the scripts used in the model of this invention are mainly implemented in Python, version 3.9. All processes were performed on a personal PC with Win10 Home Edition (Intel(R) Core(TM) i5-8300H CPU@2.30GHz) and 16GB of memory.

[0098] Data collection:

[0099] This test selected nine decentralized applications (DApps) with a high number of active users from the DApp ranking website www.dapp.com. Most of these applications are based on the Ethereum mainnet, while a few are deployed on Binance BSC (Binance SmartChain). Binance BSC is an ecosystem created by Binance that allows nodes, token holders, developers, and users to benefit. It natively supports cross-chain communication and transactions, making it a second choice besides the Ethereum public chain.

[0100] A total of 6155 background traffic packets were collected. After adjusting the filtering policy, it was found that 5564 of them were packets from within the local area network, accounting for 90.4%. 591 static traffic packets were generated by the local machine, accounting for 9.6%. Analysis revealed that these packets contained 61 TCP streams, 14 UDP streams, and a total of 44 IP addresses.

[0101] The number of packets in the collected decentralized application traffic bursts is mostly below 25, and such as Figure 7 The burst shapes shown have certain similarities, which provides some support for the feasibility of application classification through flow features.

[0102] All access to the collected dataset was conducted using the Chrome browser. A total of 52,797 data packets and 864 streams were collected from 9 decentralized applications. The collected applications and their corresponding data volumes are shown in Table 1.

[0103] Taking Cent as an example, 6258 data packets can be divided into 164 flows based on 5-tuples and time intervals. Analysis shows that the average number of data packets per flow is approximately 38.16, and the median is 5. A partial flow graph after transformation is shown below. Figure 8 As shown.

[0104] Table 1 Data Collection Volume

[0105] Decentralized applications Blockchain Number of packages Number of streams Aave ethernet 6392 225 Bancor ethernet 9731 99 Cent ethernet 6258 164 Ethermon ethernet 10755 46 Harvest ethernet 4429 143 idex ethernet 3143 87 joyso ethernet 1276 53 mdex binance BSC 1999 69 pancakeswap binance BSC 8814 38

[0106] Convolutional Neural Network Model Construction: This mainly involves adjustments to Epoch and Batch Size. Additionally, adjustments and tests were conducted on the number of image data packets to be constructed, specifically for this invention. The Optimizer selected is the Adam optimization algorithm, an extension of both the RMSprop and Momentum optimizers. It utilizes momentum and an adaptive learning rate to accelerate model convergence, achieving good results with relatively low memory usage. The Learning Rate uses Adam's default value of 0.01. The ReLU activation function is chosen because it effectively avoids gradient explosion and vanishing gradient problems while simplifying the computation process. The final hyperparameter selection results are as follows: Figure 9 As shown.

[0107] (1) Comparison of Epoch parameter selection

[0108] Table 2 shows the training time, test accuracy, and the difference between test accuracy and training accuracy for the model under different epoch settings. The classifier can achieve a classification accuracy of 0.87 within 5 epochs. Generally, increasing the number of epochs helps improve classification accuracy. When the number of epochs is greater than 10, the increase in accuracy gradually decreases with the increase in the number of epochs, while the classifier training time increases significantly. Therefore, this invention selects 20 epochs to achieve a balance between accuracy and training time.

[0109] Table 2 Epoch Selection

[0110] Epoch 1 5 10 15 20 Training time 1.988 10.139 21.138 35.483 44.405 Test accuracy 0.392 0.867 0.916 0.924 0.934 Difference 0.0882 0.0353 0.0771 0.0964 0.0663

[0111] (2) Comparison of Batch Size parameter selection

[0112] As shown in Table 3, the training time gradually decreases as the batch size increases, and the test accuracy and difference reach their optimal values ​​when the batch size is 9.

[0113] Table 3 Batch Size Selection

[0114] Batch Size 5 7 9 10 15 Training time 42.823 37.356 32.916 32.051 30.595 Test accuracy 0.94 0.922 0.958 0.928 0.904 Difference 0.0602 0.0783 0.0422 0.0723 0.0949

[0115] (3) Comparison of data packet quantity selection

[0116] The number of data packets used to construct image data in each stream also affects the classifier's performance. Too few packets cannot extract more representative application traffic features, while too many packets will reduce the classifier's generalization performance. This invention adjusts the number of data packets within the range of 6-40. To obtain higher accuracy, the number of packets is set to 25. The changes in accuracy with the number of data packets are shown in Table 4.

[0117] Table 4 Number of data packets

[0118] Number of data packets 6 10 20 25 30 Test accuracy 0.842 0.866 0.916 0.924 0.922

[0119] Classifier performance evaluation:

[0120] There are many evaluation metrics for multi-class classification problems. This invention only uses accuracy to evaluate the performance of the model. Accuracy represents the proportion of correctly classified samples out of the total number of samples. For a multi-class classification problem with m samples, the accuracy of classification f can be expressed as equation (3).

[0121]

[0122] Where x i Let y represent the i-th sample. i This represents the label corresponding to the i-th sample.

[0123] This experiment was conducted in a closed-world setting. In this closed-world environment, the goal was to identify user access to a monitored set of decentralized applications, which can be considered a multi-classification problem.

[0124] like Figure 10 As shown, under the same dataset, compared with the classifier implemented by the shallow neural network model and the traditional message length-based classifier, the DApp traffic classifier based on the convolutional neural network of this invention has a significantly higher accuracy than the former two types of classifiers.

[0125] Due to the invisibility and disorder of decentralized application traffic, the performance of message length-based feature classifiers is not very good, with an accuracy of only 0.618. This indicates that features related to message length are not obvious in decentralized application traffic. This is because decentralized applications based on blockchain technology will fill the encrypted traffic to a certain length when transmitting data at the network layer, and information that can be accurately classified cannot be obtained solely based on message length.

[0126] Shallow network classifiers are less capable of learning image data than convolutional neural networks, and shallower network layers are less able to effectively learn high-dimensional features. Their classification accuracy still does not exceed that of the classifier constructed in this invention.

[0127] Another embodiment of the present invention provides a decentralized application traffic identification system based on deep learning, comprising:

[0128] The traffic data acquisition module is used to collect network traffic data during the use of decentralized applications;

[0129] The traffic data preprocessing module is used to preprocess the collected network traffic data. The preprocessing includes traffic filtering and converting the filtered network traffic data into image format.

[0130] The model training module is used to train neural network models using network traffic data in the form of images.

[0131] The traffic identification module is used to classify and identify the actual network traffic of decentralized applications using a trained neural network model.

[0132] For the specific implementation process of each module, please refer to the description of the method of the present invention above.

[0133] Another embodiment of the present invention provides a computer device (computer, server, smartphone, etc.) including a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the steps of the method of the present invention.

[0134] Another embodiment of the present invention provides a computer-readable storage medium (such as ROM / RAM, disk, optical disk) storing a computer program that, when executed by a computer, implements the various steps of the method of the present invention.

[0135] Those skilled in the art can modify or make equivalent substitutions to the technical solutions of this invention without departing from the spirit and scope of this invention. The scope of protection of this invention shall be determined by the claims.

Claims

1. A method for identifying decentralized application traffic based on deep learning, characterized in that, Includes the following steps: Collect network traffic data during the use of decentralized applications; The collected network traffic data is preprocessed, including traffic filtering, and the filtered network traffic data is converted into image format. Train a neural network model using network traffic data in the form of images; The trained neural network model is used to classify and identify the actual network traffic of decentralized applications. The collection of network traffic data during the use of decentralized applications includes: collecting system background traffic before each decentralized application is officially collected, then accessing the page of each decentralized application, accessing each page multiple times to obtain redundant traffic, and paving a time interval between two accesses to ensure that the previous session has ended when the next session begins. The traffic filtering includes: domain filtering, packet filtering, and flow filtering; the purpose of domain filtering is to filter out traffic that is irrelevant to the target application; the purpose of packet filtering is to filter out data packets that do not provide any information that helps to describe the traffic characteristics. The purpose of the stream filtering is to segment data streams, dividing the traffic of the target application into streams based on a five-tuple and a time interval, where a stream represents the temporal sequence of TCP packets exchanged between two peers during a single TCP session; The domain filtering includes: filtering out data packets within the local area network and background traffic generated by the local machine based on the results of background traffic analysis; and using session statistics information, combined with network information, session duration, and number of packets, to perform secondary filtering on IP addresses, with the aim of removing irrelevant flows and related flows with small data volumes, while retaining related flows with larger data volumes that have more obvious behavioral characteristics. The neural network model is a convolutional neural network model; the convolutional neural network model includes: The input layer is used to read preprocessed image data. The input is a single-channel image data of 1×25×320 pixels. Convolutional layer C1 uses a convolutional kernel of size 3 and a stride of 1, outputting 5 channels of data. After convolution, the output tensor size becomes 5×23×318. After one convolution, the output tensor is activated by ReLU to introduce nonlinearity and improve the learning speed. Pooling layer P1 uses a 2×2 pooling kernel with a sliding step size of 2. It employs max pooling to compress features, and the output tensor size is 5×11×159. The output tensor of convolutional layer C2 and pooling layer P1 is used as the input tensor of convolutional layer C2. The downsampling size of convolutional layer C2 is 3×3, the sliding stride is 1, and it contains 10 convolutional kernels. After convolution, the tensor size becomes 10×9×157. The convolution result is then passed through the ReLU activation function again. Pooling layer P2 has the same structure as pooling layer P1, with a pooling kernel size of 2×2, a stride of 2, and uses max pooling. The output tensor size is 10×4×78. The fully connected layer Fc1 contains 120 neurons, which maps the 3120 elements in the output tensor of the pooling layer to a 120-dimensional feature space, and then passes them through the ReLU function; The fully connected layer Fc2 contains 84 neurons, which map 120-dimensional features to 84 dimensions, and then connects to the ReLU function; The Output layer aims to map the high-dimensional features in the hidden layer to the label space. This output layer contains 9 neurons, resulting in 9-dimensional features. The Softmax function is used to obtain the probability of a corresponding sample being mapped to each label.

2. The method according to claim 1, characterized in that, The time threshold for dividing the stream in the stream filtering is set to 4.5 seconds.

3. The method according to claim 1, characterized in that, The process of converting filtered network traffic data into image format includes: setting the number of packets used to construct the image in each stream to 25; extracting the first 40 bytes of data from each packet, including the header information of the network layer and transport layer, and removing the encrypted payload information; filling streams with insufficient packet counts with black pixels.

4. The method according to claim 1, characterized in that, The hyperparameters of the convolutional neural network model include Epoch, Batch Size, Learning Rate, Optimizer, and activation function. During the training phase, each hyperparameter is changed individually, and the magnitude of the hyperparameter is increased or decreased by estimating the gradient direction of the hyperparameter. After this process is completed, the best result of all hyperparameters is selected and combined. Accuracy is used as the performance index to evaluate the gradient direction of the hyperparameters. Accuracy is defined as the proportion of all correctly classified samples to the total number of samples.

5. A decentralized application traffic identification system based on deep learning, employing the method described in any one of claims 1 to 4, characterized in that, include: The traffic data acquisition module is used to collect network traffic data during the use of decentralized applications; The traffic data preprocessing module is used to preprocess the collected network traffic data. The preprocessing includes traffic filtering and converting the filtered network traffic data into image format. The model training module is used to train neural network models using network traffic data in the form of images. The traffic identification module is used to classify and identify the actual network traffic of decentralized applications using a trained neural network model.

6. A computer device, characterized in that, It includes a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the method of any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a computer, implements the method according to any one of claims 1 to 4.

Images