A GCNN and MoE-based encrypted network traffic classification method

Abstract

The application belongs to the field of computer artificial intelligence, and particularly relates to an encrypted network traffic classification method based on GCNN and MoE, which comprises the following steps: dividing traffic data of a mobile application in a period of time into multiple traffic blocks with the same length; converting the traffic blocks into a graph data set with node features and edge weights; constructing an encrypted network traffic classification model of the mobile application based on a graph convolutional neural network (GCNN) and a hybrid expert system, and training the model; inputting a graph data set of to-be-tested data into the encrypted network traffic classification model to obtain a classification result; and the application realizes higher classification performance, and solves the problems of low classification accuracy and poor performance of traditional machine learning methods and traditional CNN, RNN and other neural network models.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of computer artificial intelligence, and particularly relates to an encrypted network traffic classification method based on GCNN and MoE. BACKGROUND

[0002] With the increasing development of Internet communication technology in recent years, the popularity of communication technologies including 5G has led to a significant increase in intelligent and mobile devices. It is generally predicted that the number of Internet of Things (IoT) devices, including smart phones, will reach hundreds of billions by 2023, and the network has become an integral part of people's work and life. In today's network management system, network traffic classification is a key task, and the main goal is to predict network data flow protocols and application types.

[0003] In recent years, with the rapid development of the demand for protecting the transmission data and the privacy and security of users, more and more application protocols have begun to use encryption technology to send data, and the proportion of encrypted traffic in the network has also increased sharply. Encryption technology is becoming more and more complex. Encryption traffic classification has been considered one of the most important network security directions since the birth of the Internet. However, due to the popularity of encryption technology and the high-speed growth of network throughput, it becomes more and more difficult to achieve fast and accurate classification of encrypted traffic. The emergence of encryption technology also leads to an increase in the possibility of various malicious traffic and network abnormal traffic, and hackers use encryption technology to carry out a large number of malicious attack activities. When there is a large amount of encrypted traffic in the network, it is very important to quickly classify the encrypted traffic and further analyze the traffic in detail.

[0004] Most of the existing mobile application classification work overcomes the challenge of encrypted traffic. For example, the AppScnner method uses a flow-based detection method that extracts side-channel features from packet headers and calculates statistical features to train a machine learning model for mobile application classification. In addition, the FlowPrint method builds application fingerprints by considering the communication graph between mobile devices and other destinations (such as CDNs and third-party services) and related attributes (such as destination IP, destination port, and TLS certificate). In the inference stage, the past collected fingerprints are compared with the new fingerprints to determine the application. However, due to the challenge in building a communication graph of all possible behaviors of an application, only short communication time is considered. Therefore, if the user changes their usage behavior or uses different functions of the application, it may not work properly.

[0005] Based on the current research on deep learning-based network traffic classification, it is found that there are still some challenges in using deep learning methods to classify network traffic:

[0006] 1. More than 80% of mobile traffic is encrypted or uses Transport Layer Security (TLS), so it may not be possible to classify traffic using payload-based methods that analyze application layer protocols in certain areas;

[0007] 2. Port-based classification methods cannot classify mobile traffic because applications mainly use HTTPS to deliver data and use text formats such as XML or JSON to send data back and forth. Some information, such as the number of files or file size, is not available for web classification.

[0008] 3. User behavior changes dynamically over time, depending on the functions used. Traffic captured in a short time (e.g., 5 minutes) of a mobile application may not represent its complete traffic behavior. SUMMARY

[0009] To solve the above problems, the present application provides an encrypted network traffic classification method based on GCNN and MoE, which specifically comprises the following steps:

[0010] S1, dividing the traffic data of the mobile application in a period of time into a plurality of traffic blocks with the same length;

[0011] S2, converting the traffic block into a graph data set with node features and edge weights;

[0012] S3, constructing an encrypted network traffic classification model of the mobile application based on the graph convolutional neural network GCNN and the hybrid expert system, and training the model;

[0013] S4, inputting the graph data set of the to-be-tested data into the encrypted network traffic classification model to obtain a classification result.

[0014] Further, when dividing the traffic data of the mobile application in a period of time into a plurality of traffic blocks with the same length, the duration and the overlap time are set, and the traffic blocks are divided by the duration and the overlap time, specifically including: the length of each traffic block is set as the length of the duration, and except for the first traffic block and the last traffic block, each traffic block has an overlap with its previous traffic block with a length of the overlap time, and also has an overlap with its next traffic block with a length of the overlap time.

[0015] Further, the process of converting the traffic block into a graph data set with node features and edge weights includes the following steps:

[0016] Removing the dns protocol in the traffic block;

[0017] Obtaining the IP address and port number in the mobile application and merging the IP address into the port number;

[0018] When constructing the graph data of the mobile application,

[0019] The maximum number of nodes N required for obtaining one MApp graph, and all the graph data of each MApp is generated according to the weight between two nodes;

[0020] All the graph data of each MApp is saved in two csv format files, the node features are stored in the features.csv file, and the weight between nodes is stored in the weights.csv file.

[0021] Further, the encryption network traffic classification model of the mobile application based on the graph convolutional neural network GCNN and the hybrid expert system includes multiple cascaded GCN layers, a sortpooling layer, an Expert network, and a softmax layer. The graph latent representation output of the four cascaded GCN layers is input into the sortpooling layer to select the maximum K values of the graph latent representation. The Expert network includes multiple Expert units. The selected graph latent representation is input into the multiple Expert units. The product of the output of each Expert unit and the weight corresponding to the Expert unit is input into the softmax layer after being accumulated. The softmax layer obtains the classification result.

[0022] Further, if there are L GCN layers in cascade, the output of the l+1th GCN layer is represented as:

[0023]

[0024] wherein, is the output of the l+1th graph convolutional layer, c l is the number of features of each graph node extracted at the lth layer, n is the number of nodes, and l=0...L-1, Z 0 =X, represents a node feature matrix, and c represents the number of features of a node in the node feature matrix; is a diagonal matrix of the graph; is an adjacency matrix with self-loops added; is a trainable parameter at the lth layer.

[0025] Further, G represents a graph data, and is represented as is a set of nodes in the graph data, and ε is a set of edges in the graph data. If A is an adjacency matrix of the graph data, then the adjacency matrix with self-loops added is represented as:

[0026]

[0027] wherein, I is an identity matrix.

[0028] Further, the edge relationship between nodes is established by the cross-correlation between nodes, that is, if the cross-correlation of two nodes is not 0, there is an edge relationship between the two nodes, and the edge weight is the cross-correlation between the two nodes, and the calculation process of the cross-correlation of the two nodes includes the following steps:

[0029] The graph nodes are generated according to the traffic captured in a given time window, and the given time window is divided into T slices of different durations;

[0030] The number of traffic packets sent by the mobile application in each slice to the service deployed on the destination IP address and port, or received by the service deployed on the destination IP address and port, is counted as the cross-correlation between two nodes, denoted as:

[0031]

[0032] Wherein, C i,j is the cross-correlation between nodes i and j, r i (t) represents a binary variable of whether node i is active in time slice t, r i (t) = 1 when node i is active, otherwise r i (t) = 0.

[0033] Further, the Adam algorithm is used to optimize the mobile application encrypted network traffic classification model based on graph convolutional neural network GCNN and hybrid expert system, and the optimization process includes:

[0034] Get historical data as a training data set, and slice the training data set, that is, divide the training data set into multiple independent and orthogonal sub-data sets, each sub-data set is a slice;

[0035] When training the network, each slice is input into the classification model to obtain the prediction result, and the prediction result and the label corresponding to the training data are used for training;

[0036] When the loss result converges or reaches the maximum training times, the optimization is completed.

[0037] Further, in the process of optimizing the training data, the model's logical loss function is used to optimize the model in the direction of propagation, and the model's logical loss function is represented as:

[0038]

[0039] Wherein, is the logical loss function of the network, and Θ is the parameterized Expert network, represented as θ Mrepresents the Mth Expert unit, d is the dimension of an Expert network, M is the number of Expert units in the Expert network, n is the number of training data, y i is the label of the ith training data; F(x i ; Θ, W) is the output of the Expert network, x i is the ith training data, and W is the weight of the MoE gating network. is a sigmoid function, and is represented as

[0040] Further, the output F(x i ; Θ, W) of the MoE gating network is represented as:

[0041]

[0042]

[0043]

[0044] wherein, is a set of selected indicators, and π m (x; Θ) is the gating value of the mth Expert network, h m (x; Θ) is the output of the mth Expert network, [P] is a piece of data set, [M] is a set of Expert gating networks, and f m (x; W) is the output of the mth Expert network, [J] represents a set of filters, σ(·) is an activation function, P represents the number of training data in a piece of data set, and w m,j represents the weight vector of the jth filter in the mth Expert network, x (p) represents that the input data is the pth data in a piece of data set; and x represents the input data.

[0045] The present application considers the limitation of a single graph convolutional neural network GCNN model for encrypted traffic classification, in order to better identify and classify encrypted traffic, the single GCNN model is split into multiple Experts networks for simultaneous training and prediction by adding MoE Expert networks in the graph convolutional network GCN structure, and then joint decision is made, through the joint classification decision of GCNN and MoE, the accuracy of classification and identification of network encrypted traffic is improved, higher classification performance is achieved, and the problems of low classification accuracy and poor performance of traditional machine learning methods and traditional CNN, RNN and other neural network models are solved. BRIEF DESCRIPTION OF DRAWINGS

[0046] Figure 1 is the overall flowchart of the present application;

[0047] Figure 2 A diagram for splitting of traffic blocks of the present application;

[0048] Figure 3 A model diagram of the encrypted network traffic classification method of the present application based on DGCNN and MoE;

[0049] Figure 4 A structure diagram of the Expert network of the present application. DETAILED DESCRIPTION

[0050] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0051] The present application proposes an encrypted network traffic classification method based on GCNN and MoE, specifically comprising the following steps:

[0052] S1, traffic data of a mobile application (Mobile Application, referred to as MApp) in a period of time is divided into a plurality of traffic blocks with the same length;

[0053] S2, the traffic blocks are converted into a graph data set with node features and edge weights;

[0054] S3, an encrypted network traffic classification model of the mobile application based on a graph convolutional neural network GCNN and a hybrid expert system is constructed, and the model is trained;

[0055] S4, the graph data set of the to-be-tested data is input into the encrypted network traffic classification model to obtain a classification result.

[0056] In this embodiment, the traffic data of a certain MApp is split into a plurality of small MApp traffic blocks with the same length and shorter duration time by splitting a large MApp traffic block with long duration time into a plurality of small MApp traffic blocks with the same length and shorter duration time through duration time T duration and overlap time T overlap , as shown in Figure 2 , the MApp traffic blocks with the same length obtained after splitting are composed of duration time T duration and overlap time T overlap , the MApp traffic block overlaps with the previous traffic block by a length of overlap time T overlap , and overlaps with the next traffic block by a length of overlap time T overlap , and if duration time T durationT is short enough, T does not need to be set overlap , how to determine whether the duration T duration is short enough, according to the experience of those skilled in the art, the specific steps of dividing the flow block include:

[0057] Step 1.1, use traffic collection tools such as Wireshark to collect raw traffic data, and the sample data set is the encrypted traffic data of MApp in raw form, and the data is processed;

[0058] Step 1.2, first split the original MApp traffic data block, according to the duration T duration and the overlap time T overlap , split the MApp traffic block with long duration into many small blocks with the same length and short duration;

[0059] Step 1.3, save the above MApp traffic block data set as a csv format file after splitting processing.

[0060] In this embodiment, each pair (IP:Port) after merging the IP address to the port number is defined as a node in the graph data, that is, the node in the graph data in this embodiment is the combination of IP address and port number. In this embodiment, the optimal value of the number N of nodes in a graph data is 20, if the value of N is high, all nodes of the graph must be zero-padded to the feature vector (in the case of MLP) or the latent representation vector (in the case of the present application), on the one hand, the zero value feature may mislead the model learning, on the other hand, using a small number of nodes may lose useful information from discarded nodes, thereby affecting the performance of the model, most graphs have about 10 nodes, 90% of the graphs have less than 35 nodes, and 86% of the graphs have less than 30 nodes, when using a large number of nodes, the performance increases to the optimal value N before decreasing again. It is worth mentioning that the optimal value of N is different for MLP and the present application, the present application needs more information about the topology of the graph to distinguish mobile applications, and the present application has better performance than MLP in various experimental scenarios.

[0061] Generate graph data used as a deep neural network model from each MApp traffic data block obtained, which specifically includes the following steps:

[0062] Step 2.1, remove the dns protocol in the data block;

[0063] Step 2.2, obtain the IP address and port number in the MApp and merge the IP address to the port number (the same tuple (IP, port number) - the same network target);

[0064] Step 2.3, the traffic blocks of each MApp are taken as data frames, and all graph data of each MApp are generated by constructing the maximum number of nodes N required by the MApp graph and the weight between two nodes, and all graph data of each MApp are saved in two csv format files, a features.csv format file with node characteristics and a weights.csv format file with weights between nodes.

[0065] Step 2.4, the edges between nodes are connected by cross-correlation: given the traffic captured in a time window, which generates the above-mentioned graph nodes, the time window is further divided into multiple slices with a predefined slice duration t slice . Let T be the number of slices, and in each slice time, if the MApp sends or receives at least one traffic packet to the service deployed on the destination IP address and port number, the node (the destination IP address and port number are a pair) is considered active. Let r i (t) be a binary variable indicating whether node i is active at time slice t, r i (t) = 1 when node i is active, otherwise r i (t) = 0. The cross-correlation of two nodes i and j is defined as:

[0066]

[0067] Using cross-correlation, the relationship between nodes is established, and the weight of the edge is set accordingly. Specifically: if C i,j ≠ 0, an edge is established between two nodes i and j, and the weight is C i,j .

[0068] To avoid feature bias when graph data is fed into a neural network classification model for training and prediction, C i,j is normalized to the range [0, 1] using min-max scalar normalization. The mathematical definition of min-max scalar normalization is as follows:

[0069]

[0070] Where x' represents the normalized value of a single data, x represents the value of a single data before normalization; min represents the minimum value of the column where the data is located, and max represents the maximum value of the column where the data is located.

[0071] Each node in the graph data needs to construct a feature vector, that is, node features. Since the mobile application connects to various services, each service is represented by a node of the graph as a tuple of IP address and port number, so the traffic behavior from the mobile device to the server of each service may be different in various traffic features, such as packet size, packet number, flow duration, etc. To promote to encrypted and unencrypted traffic, only information extracted from the packet header is used, without analyzing the packet payload. In addition to packet features, flow features are also extracted, such as the number of flows, the average number of packets in each flow, and the average flow size in bytes, only TCP flows and UDP flows are considered in this embodiment, and the Wireshark tool is relied on to collect and analyze traffic features. The feature vectors of all nodes in the graph data constitute a node feature matrix X, where n is the number of nodes, and c is the number of node features.

[0072] An encrypted traffic classification model based on a graph convolutional neural network GCNN and a hybrid expert MoE is constructed, statistical features and derived features of the data are extracted through the GCNN model, and the data processed by the SortPooling layer through the MoE model is fed to different MoE sub-networks for training and testing, which specifically includes the following steps:

[0073] Step 3.1, build an encrypted traffic classification framework of GCNN and MoE, use a cross-entropy loss function to determine the degree of approximation between the actual output (output as probability) and the expected output (output as probability), and use an Adam optimizer; the mathematical calculation of cross-entropy is as follows:

[0074]

[0075] The learning rate during training is adjusted at a fixed cycle interval, and after training step_size epochs, the learning rate is adjusted as lr=lr*decay, step_size=10, initial lr=0.0001, and decay=0.9;

[0076] Step 3.2, reference Figure 3 , the GCNN network model part includes: a GCN structure composed of 4 graph convolutional layers, the size of the first 3 graph convolutional layers is 1024, and the size of the last graph convolutional layer is 512, and the activation function is tanh;

[0077] In the graph convolutional layer part, a graph G is given Assume that A is the adjacency matrix of G, so that A is a symmetric binary matrix, and assume that the graph has no self-loop. The node feature matrix is defined as where The node latent representation is calculated in the graph convolutional layer as where is the adjacency matrix of the graph added with self-loops, is the diagonal matrix of the graph such that is the trainable graph convolution parameter matrix shared among nodes, and is the output activation matrix.

[0078] Intuitively, Figure 3 The graph data fed into the GCN layer is shown in FIG. 1, where the nodes are defined by their adjacent nodes and edges connecting between nodes, thus the latent representation of a node is influenced by its adjacent nodes. The graph convolution layer allows information to propagate between adjacent nodes through the multiplication of its node features (XW) and the adjacency matrix (AXW). The final node’s latent representation is defined as where l = 0…L-1, Z 0 : = X, is the output of the l-th graph convolution layer; c l is the number of output channels of the l-th layer (i.e., the number of features extracted for each graph node at the l-th layer); is the trainable parameter of the l-th layer. After the convolution process of all the above convolution layers, the latent representation of nodes from the whole graph can be obtained.

[0079] Step 3.3, after the data processing of the above graph convolution layers, the output of this step is obtained by feeding the data into the SortPooling layer, and sorting the nodes by the sum of the node features of the l-th layer (the last layer of the graph convolution process);

[0080] If two nodes have the same value at the l-th layer, the sum of the node features of the l-1-th layer is used, i.e., if the sum of the features of two nodes at the current layer is the same, the sum of the features of the previous layer is used to sort the two nodes until the tie is broken. Since the number of nodes in each graph is heterogeneous, the pooling layer also truncates or expands the latent representation of the graph to a predefined size. Given a predefined size of the graph latent representation (e.g., k), if there are more than k values in the graph latent representation vector, truncation is performed. Otherwise, zero padding is performed. The value of k is defined heuristically according to the input data. For example, define k, 90% of the graph nodes are used to construct the graph latent representation vector to avoid losing node features in the final graph latent representation.

[0081] Referring to FIG. 2, Figure 3 As shown in FIG. 2, after the SortPooling layer, the MoE network model is constructed for expert subnetwork training and testing, which includes the following steps:

[0082] Step 4.1, MoE layer, composed of a group of M “Expert networks” f1,...,f M and a gating network, which is usually set to be linear. Define f m(x; W) is the output of the mth Expert network. The output of the MoE layer can be defined as:

[0083]

[0084] in is the set of selected indicators, π m (x; Θ) is the gate value of the mth Expert network, and its value is determined by the following definition:

[0085]

[0086] For the mth expert network, this embodiment considers it as a convolutional neural network (CNN) structure, which is defined as follows:

[0087]

[0088] in, is the weight vector of the jth filter (i.e., neuron) in the mth expert, j is the number of filters (i.e., neurons), and d is the dimension of an Expert network; x (p) Indicates that the input data is the p-th data in the sharded dataset; x represents the input data; [P] is a sharded dataset, [M] is the set of expert gating networks; [J] is the set of filters, σ(·) is the activation function, and P represents the number of training data in a sharded dataset.

[0089] In this embodiment, there is actually a Router when the SortPooling layer outputs to the Weight. The Router adds noise as perturbation and uses the perturbation experience loss gradient to update the weight. The perturbation experience loss at time t after the Router adds perturbation is defined as:

[0090]

[0091] in, and is random noise; W (0) is the initialization value of the weight matrix, and the weight update rule of Router is defined as:

[0092]

[0093] Where η>0 is the expert learning rate, || F represents the norm operation, represents the weight update gradient at the mth expert network.

[0094] is the weight matrix of the mth expert, and further assumes W = {W m} m∈[M]As a set of expert weight matrices.

[0095] Step 4.2, training the constructed MoE network model, including:

[0096]

[0097] wherein, denotes the logical loss function of the network, defined as and Θ (0) is initialized to 0.

[0098] Step 4.3, using the constructed graph convolutional neural network GCNN and the multi-Experts network of MoE structure to jointly train the data processed by the SortPooling layer, and outputting the probability through the Softmax function to predict and classify the encrypted network flow data.

[0099] This embodiment also gives a schematic diagram of an Expert unit, as shown in Figure 4 The Expert unit includes cascaded Conv1D layers, MaxPool1D layers, Conv1D layers, Dense layers, Dropout layers, and Dense layers.

[0100] Although the embodiments of the present application have been shown and described, it can be understood by those of ordinary skill in the art that various changes, modifications, replacements and variations can be made to these embodiments without departing from the principles and spirits of the present application, and the scope of the present application is defined by the appended claims and their equivalents.

Claims

1. A GCNN and MoE based encrypted network traffic classification method, characterized in that, Specifically comprising the following steps: S1, the traffic data of a mobile application in a period of time is divided into a plurality of traffic blocks with the same length, that is, the duration and the overlap time are set, the traffic blocks are divided by the duration and the overlap time, specifically comprising: the length of each traffic block is set to the length of the duration, except for the first traffic block and the last traffic block, each traffic block has an overlap with its previous traffic block with a length of the overlap time, and also has an overlap with its next traffic block with a length of the overlap time; S2, converting the traffic block into a graph data set with node features and edge weights, comprising the following steps: Removing the dns protocol in the traffic block; Obtaining the IP address and port number in the mobile application and merging the IP address into the port number; When constructing the graph data of the mobile application, Obtaining the maximum number of nodes N required for one MApp graph, and generating all graph data of each MApp according to the weight between two nodes; All graph data of each MApp is saved in 2 csv format files, the node features are saved in the features.csv file, and the weight between nodes is saved in the weights.csv file; S3, constructing a mobile application encrypted network traffic classification model based on graph convolutional neural network GCNN and hybrid expert system, and training the model; the mobile application encrypted network traffic classification model based on graph convolutional neural network GCNN and hybrid expert system comprises a plurality of cascaded GCN layers, a sortpooling layer, an Expert network, and a softmax layer, the graph latent representation output of the four cascaded GCN layers is input into the sortpooling layer to select the maximum K values of the graph latent representation value, the Expert network comprises a plurality of Expert units, the selected graph latent representation is input into the plurality of Expert units, the product of the output of each Expert unit and the weight corresponding to the Expert unit is input into the softmax layer after being accumulated, and the softmax layer obtains the classification result; the sortpooling layer is provided with a Router when outputting the weight, the Router adds noise as disturbance, and uses the disturbance experience loss gradient to update the weight; S4, inputting the graph data set of the to-be-tested data into the encrypted network traffic classification model to obtain the classification result.

2. The GCNN and MoE-based encrypted network traffic classification method of claim 1, wherein, If there are L GCN layers in cascade, the output of the l+1th GCN layer is represented as: wherein, is the output of the (l+1)th graph convolution layer, c l is the number of features extracted for each graph node at the lth layer, n is the number of nodes, l = 0...L-1, Z 0 = X, denotes a node feature matrix, c denotes the number of features of a node in the node feature matrix; is a diagonal matrix of the graph; is the adjacency matrix with self-loops added; is a trainable parameter of the lth layer.

3. The GCNN and MoE-based encrypted network traffic classification method of claim 2, wherein, Let G denote a graph data, denoted as Let A denote the adjacency matrix of G, and let ε denote the edge set of G. If A is the adjacency matrix of G, then the adjacency matrix with self-loops is denoted as Wherein, I is a unit matrix.

4. The GCNN and MoE-based encrypted network traffic classification method of claim 1, wherein, The edge relationship between nodes is established through the cross correlation between nodes, that is, if the cross correlation between two nodes is not 0, there is an edge relationship between the two nodes, and the edge weight is the cross correlation between the two nodes, the calculation process of the cross correlation between two nodes comprises the following steps: According to the traffic captured in a given time window, the graph nodes are generated, and the given time window is divided into T slices with different durations; The number of traffic packets sent by the mobile application in each slice to the service deployed on the destination IP address and port, or the number of traffic packets received by the service deployed on the destination IP address and port, is counted as the cross-correlation between the two nodes, denoted as: where C i,j is the cross-correlation between node i and node j, r i (t) is a binary variable indicating whether node i is active in time slice t, r i (t) = 1 when node i is active, otherwise r i (t) = 0.

5. The GCNN and MoE-based encrypted network traffic classification method of claim 1, wherein, The Adam algorithm is used to optimize the encryption network traffic classification model of the mobile application based on the graph convolutional neural network GCNN and the hybrid expert system, and the optimization process includes: Obtain historical data as a training data set, and perform slicing on the training data set, that is, divide the training data set into multiple independent and orthogonal sub-data sets, each of which is a slice; When training the network, each slice is input into the classification model to obtain a prediction result, and the prediction result and the corresponding label of the training data are used for training; When the loss result converges or reaches the maximum training times, the optimization is completed.

6. The GCNN and MoE-based encrypted network traffic classification method of claim 5, wherein, During the optimization process using the training data, the model's logical loss function is used to optimize the model in the direction of propagation, and the model's logical loss function is represented as: where, is the network's logical loss function, Θ is the parameterized Expert network, represented as θ M represents the Mth Expert cell, d is the dimension of an Expert network, M is the number of Expert cells in the Expert network; n is the number of training data; y i is the label of the ith training data; F(x i ; Θ, W) is the output of the Expert network, x i is the ith training data, W is the weight of the MoE gating network; is the sigmoid function, represented as 7. The GCNN and MoE-based encrypted network traffic classification method of claim 5, wherein, The output F(x i of the Expert network is represented as: wherein, is a set of selected indicators, π m (x; Θ) is the gating value of the mth Expert network, h m (x; Θ) is the output of the mth Expert network, [P] is a set of shards, [M] is a set of Expert gating networks; f m (x; W) is the output of the mth Expert network, [J] represents a set of filters, σ(·) is an activation function, P represents the number of training data in a shard, w m,j represents the weight vector of the jth filter in the mth Expert network, x (p) represents that the input data is the pth data in a shard; x represents the input data.

Images