Multimodal encrypted network traffic classification method based on traffic image and low-frequency information

Abstract

The present invention relates to a multimodal encrypted network traffic classification method based on traffic images and low-frequency information, comprising: constructing a training data set, the training data set being a single type of traffic data; constructing a multimodal network, wherein the multimodal network comprises: a two-dimensional traffic image anomaly detection model and a low-frequency information anomaly detection model, the two-dimensional traffic image anomaly detection model and the low-frequency information anomaly detection model having the same structure, both being anomaly detection learning networks based on GAN and AE; training the multimodal network using the training data set to obtain a trained multimodal network model; and using the trained multimodal network model to classify and identify traffic data to be tested. The multimodal encrypted network traffic classification method of the present invention can automatically learn encrypted traffic features through the anomaly detection network, thereby reducing the difficulty and complexity of feature engineering, saving the manpower and time required for encrypted network traffic classification, and lowering the threshold for traffic classification.

Description

Technical Field

[0001] The present invention belongs to the field of cyberspace security technology, and specifically relates to a multimodal encrypted network traffic classification method based on traffic images and low-frequency information. Background Art

[0002] With the continued development of information infrastructure and the accelerated innovation of next-generation network information technology, the internet has flourished. Simultaneously, network throughput has also rapidly expanded, generating massive amounts of data traffic and leading to a complex and diverse network traffic application types and protocols. This presents significant challenges for network traffic classification. Network traffic classification, a core technology in cyberspace security, holds significant guiding significance and practical value for defending against network intrusions, preventing malware, optimizing network management, and improving network service quality.

[0003] Currently, network traffic classification methods can be categorized into four main categories: port-based methods, deep packet inspection (DPI)-based methods, statistical feature-based machine learning methods, and deep learning-based methods. Due to the prevalence of dynamic port numbers and port masquerading techniques, the classification accuracy of port-based methods has been significantly reduced. Deep packet inspection (DPI)-based methods, on the other hand, require matching traffic fingerprints, which consumes significant computational and memory resources. Furthermore, DPI-based methods can only detect plaintext traffic and become completely ineffective once the traffic is encrypted. Statistical feature-based machine learning methods, on the other hand, require domain experts to extract handcrafted features for specific scenarios, such as packet arrival time intervals and packet lengths. Manually designing and extracting these features is labor-intensive and cannot guarantee the effectiveness of the extracted features for traffic classification.

[0004] Deep learning-based methods, on the other hand, reduce the manual feature extraction stage and leverage the strong fit of neural networks to data distribution, further improving classification accuracy. Currently, most deep learning-based network traffic classification approaches utilize supervised deep learning methods. These methods not only require large amounts of labeled data but also suffer from poor generalization and an inability to process unknown traffic samples. Real network environments are dynamic, which can easily degrade the performance of supervised classifiers in real-world deployments. Furthermore, these methods utilize unimodal traffic information, resulting in a relatively uniform data distribution for model learning. Summary of the Invention

[0005] To address the above-mentioned problems in the prior art, the present invention provides a multimodal encrypted network traffic classification method based on traffic images and low-frequency information. The technical problem to be solved by the present invention is achieved through the following technical solutions:

[0006] The present invention provides a multimodal encrypted network traffic classification method based on traffic images and low-frequency information, comprising:

[0007] Constructing a training data set, wherein the training data set is a single type of traffic data;

[0008] Constructing a multimodal network, wherein the multimodal network includes: a two-dimensional traffic image anomaly detection model and a low-frequency information anomaly detection model, wherein the two-dimensional traffic image anomaly detection model and the low-frequency information anomaly detection model have the same structure and are both anomaly detection learning networks based on GAN and AE;

[0009] Using the training data set to train the multimodal network to obtain a trained multimodal network model;

[0010] The trained multimodal network model is used to classify and identify the traffic data to be tested.

[0011] In one embodiment of the present invention, constructing a training data set includes:

[0012] Get network traffic data packets in pcap format, including Tor and non-Tor types of network traffic data;

[0013] Preprocessing the network traffic data packets and converting them into corresponding traffic images to obtain a traffic image dataset;

[0014] The traffic image dataset is divided into Tor traffic data and non-Tor traffic data according to the network traffic data type, and one type of traffic data is used as a training dataset.

[0015] In one embodiment of the present invention, the network traffic data is pre-processed and converted into a corresponding traffic image to obtain a traffic image dataset, including:

[0016] Removing redundant pcap header information from the network traffic data;

[0017] Split the remaining data after removing the pcap header information into an array of data packets;

[0018] Filter the data packets to remove empty payloads, DNS and ARP protocol packets;

[0019] The source / destination IP and TCP addresses in the filtered data packets are erased and the MAC frame header is removed to remove redundant information in the data packets.

[0020] After removing redundant information, all data packets are unified to form data packets with a length of 1600 bytes. For data packets longer than 1600 bytes, the last byte in the data packet payload is discarded. For data packets shorter than 1600 bytes, zero padding is performed at the end of the payload until it reaches 1600 bytes.

[0021] Each data packet after the length unification operation is converted into a traffic image of length 40*40 to obtain a traffic image dataset.

[0022] In one embodiment of the present invention, the anomaly detection learning network based on GAN and AE includes: an AE network, a second encoder and a discriminator, wherein:

[0023] The AE network includes a cascaded first encoder and decoder;

[0024] An input end of the second encoder is connected to an output end of the decoder, and the second encoder is used to introduce latent space feature loss;

[0025] The discriminator includes a cascaded third encoder and a Sigmoid layer, wherein the input of the AE network and the output of the decoder serve as the input of the third encoder.

[0026] In one embodiment of the present invention, the first encoder, the second encoder, and the third encoder have the same structure, and all include a first encoding unit, a plurality of second encoding units, and a convolutional layer cascaded in sequence, wherein:

[0027] The first encoding unit includes a convolutional layer, a LeakyReLU activation function layer and a CBAM module cascaded in sequence;

[0028] The second encoding unit includes a convolutional layer, a batch normalization layer, a LeakyReLU activation function layer and a CBAM module cascaded in sequence;

[0029] The convolution kernel size of all convolutional layers in the encoder is 4*4, the stride is 2*2, and the padding length is 1*1.

[0030] In one embodiment of the present invention, the decoder includes a plurality of first decoding units and second decoding units cascaded in sequence, wherein:

[0031] The first decoding unit includes a deconvolution layer, a batch normalization layer, a LeakyReLU activation function layer and a CBAM module cascaded in sequence;

[0032] The second decoding unit includes a deconvolution layer and a Tanh activation function layer cascaded in sequence;

[0033] The convolution kernel size of the deconvolution layer is 4*4, the step size is 2*2, and the padding length is 1*1.

[0034] In one embodiment of the present invention, the multimodal network is trained using the training data set to obtain a trained multimodal network model, including:

[0035] Performing low-pass filtering on each image in the training data set to obtain a corresponding low-frequency flow image, thereby forming a low-frequency flow image set;

[0036] Inputting the training data set into the two-dimensional traffic image anomaly detection model for training, and inputting the corresponding low-frequency traffic image set into the low-frequency information anomaly detection model for training, and obtaining a trained multimodal network model after the training is completed;

[0037] In the training process of each anomaly detection model, the network parameters of the anomaly detection model are updated using back propagation according to the total loss function L, where:

[0038] L=w enc L enc +w con L con +w adc L adv ;

[0039] L con =||x n -G(x n )||1;

[0040] L enc =||G E (x n )-E(G(x n ))||1;

[0041] L adv =(D(x n )-D(G(x n ))) 2 ;

[0042] Where, L con represents the image reconstruction loss function, wc on Represents the weight of the image reconstruction loss function, L enc represents the latent space feature loss function, w enc Represents the weight of the latent space feature loss function, L adv represents the adversarial loss function, w adc represents the weight of the adversarial loss function, x n Represents the input sample of the anomaly detection model, G() represents the output of the AE network, GE () represents the output of the first encoder, E() represents the output of the second encoder, D() represents the output of the discriminator, and ||||1 represents the norm operation.

[0043] In one embodiment of the present invention, each image in the training data set is subjected to low-pass filtering to obtain a corresponding low-frequency flow image, thereby forming a low-frequency flow image set, including:

[0044] Convert each image in the training data set from the spatial domain to the frequency domain using Fourier transform;

[0045] Each image is low-pass filtered in the frequency domain using an ideal low-pass filter function, and the filtered frequency domain image is converted to the spatial domain to obtain the corresponding low-frequency flow image;

[0046] The low-frequency flow images corresponding to all images in the training data set form the low-frequency flow image set.

[0047] In one embodiment of the present invention, the trained multimodal network model is used to classify and identify the traffic data to be measured, including:

[0048] The flow data to be measured is divided, filtered, de-redundant, and length-uniformed, and then converted into a corresponding flow image to be measured;

[0049] Performing low-pass filtering on the flow rate image to be measured to obtain a corresponding low-frequency flow rate image to be measured;

[0050] Input the traffic image to be measured into the trained two-dimensional traffic image anomaly detection model, and input the low-frequency traffic image to be measured into the trained low-frequency information anomaly detection model, to obtain prediction results corresponding to the two-dimensional traffic image anomaly detection model and the low-frequency information anomaly detection model;

[0051] Among them, for each anomaly detection model, its prediction result is expressed as:

[0052]

[0053] in, represents the prediction result of the anomaly detection model, represents the test image of the input anomaly detection model, G() represents the output of the AE network, G E () represents the output of the first encoder, E() represents the output of the second encoder;

[0054] The prediction results of the two-dimensional flow image anomaly detection model and the prediction results of the low-frequency information anomaly detection model are fused to obtain a fused prediction result, which is expressed as:

[0055] A out =w orign A orign +w lpf A lpf ;

[0056] Among them, A out Represents the fusion prediction result, A orign represents the prediction result of the two-dimensional traffic image anomaly detection model on the traffic image to be tested, w orign represents the weight of the prediction result of the two-dimensional traffic image anomaly detection model, A lpf represents the prediction result of the low-frequency information anomaly detection model on the low-frequency traffic image to be tested, w lpf Represents the weight of the prediction results of the low-frequency information anomaly detection model;

[0057] The type of the flow data to be measured is determined based on the fusion prediction result. When the fusion prediction result is less than a preset threshold, the type of the flow data to be measured is consistent with the flow data type of the training data set. Otherwise, the type of the flow data to be measured is another type different from the flow data type of the training data set.

[0058] Compared with the prior art, the present invention has the following beneficial effects:

[0059] The multimodal encrypted network traffic classification method based on traffic images and low-frequency information of the present invention is an encrypted network traffic classification method based on automatic feature extraction of a deep learning network. Compared with the traditional machine learning method based on statistical features, the method of the present invention does not require manual design and extraction of traffic features. The encrypted traffic features can be automatically learned through anomaly detection networks, thereby reducing the difficulty and complexity of feature engineering, saving the manpower and time required for encrypted network traffic classification, and lowering the threshold for traffic classification. In addition, the present invention adopts a learning method based on anomaly detection, which only requires a single type of data, i.e., non-Tor non-encrypted data, in the training phase. It combines traffic information of different modalities, specifically by training a two-dimensional traffic image and a low-frequency information modal network model, and then aggregating the prediction information of multimodal data, so that the results are more complete and the classification accuracy is improved.

[0060] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the following preferred embodiments are specifically cited and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1Schematic diagram of a multimodal encrypted network traffic classification method based on traffic images and low-frequency information provided by an embodiment of the present invention;

[0062] Figure 2 This is a flow chart of network traffic data preprocessing provided by an embodiment of the present invention;

[0063] Figure 3 is a schematic diagram of multimodal network training and testing provided by an embodiment of the present invention;

[0064] Figure 4 Schematic diagram of an anomaly detection learning network based on GAN and AE provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0065] In order to further illustrate the technical means and effects adopted by the present invention to achieve the predetermined purpose of the invention, the following is a detailed description of a multimodal encrypted network traffic classification method based on traffic images and low-frequency information proposed in accordance with the present invention, in combination with the accompanying drawings and specific implementation methods.

[0066] The aforementioned and other technical contents, features, and effects of the present invention are clearly presented in the following detailed description of the specific embodiments in conjunction with the accompanying drawings. Through the description of the specific embodiments, a deeper and more specific understanding of the technical means and effects adopted by the present invention to achieve the intended purpose can be obtained. However, the accompanying drawings are provided for reference and illustration purposes only and are not intended to limit the technical solutions of the present invention.

[0067] Example 1

[0068] See Figure 1 and Figure 3 , Figure 1 Schematic diagram of a multimodal encrypted network traffic classification method based on traffic images and low-frequency information provided by an embodiment of the present invention; Figure 3 This is a schematic diagram of a multimodal network training and testing method provided by an embodiment of the present invention. As shown in the figure, the multimodal encrypted network traffic classification method based on traffic images and low-frequency information of this embodiment includes:

[0069] Step 1: Construct a training dataset, which is a single-type traffic dataset;

[0070] In an optional embodiment, step 1 includes:

[0071] Step 1.1: Obtain network traffic data packets in pcap format, including both Tor and non-Tor types of network traffic data;

[0072] In this embodiment, the traffic data types to be classified and identified are Tor (encrypted) and non-Tor (non-encrypted).

[0073] Step 1.2: Preprocess the network traffic data packets and convert them into corresponding traffic images to obtain a traffic image dataset;

[0074] See Figure 2 The flowchart of a network traffic data preprocessing provided by an embodiment of the present invention is shown. In an optional implementation, step 1.2 includes:

[0075] Step a: Remove redundant pcap header information from network traffic data;

[0076] Step b: Divide the remaining data after removing the pcap header information into an array of data packets;

[0077] Step c: Filter the data packets and remove packets with empty payloads, DNS, and ARP protocols.

[0078] Step d: Perform zeroing on the source / destination IP and TCP addresses in the filtered data packets and remove the MAC frame header to remove redundant information in the data packets;

[0079] It should be noted that, in this embodiment, for a UDP message, after the address is erased, 12 bytes of 0x00 need to be added to the header.

[0080] Step e: performing a length unification operation on all data packets after removing redundant information to form a data packet with a length of 1600 bytes;

[0081] In this embodiment, for packets longer than 1600 bytes, the last byte in the packet payload is discarded; for packets shorter than 1600 bytes, zero padding is performed at the end of the payload, i.e., hexadecimal 0x00 bytes are added until the payload reaches 1600 bytes.

[0082] Step f: Convert each data packet after the length unification operation into a traffic image of length 40*40 to obtain a traffic image dataset.

[0083] Step 1.3: Divide the traffic image dataset into Tor traffic data and non-Tor traffic data according to the network traffic data type, and use one type of traffic data as the training dataset.

[0084] To facilitate subsequent training and testing of the multimodal network, in this embodiment, the traffic image dataset is randomly sampled and divided into corresponding training sets and test sets. The training set consists entirely of non-Tor traffic data, and the test set consists of both non-Tor and Tor traffic data.

[0085] Step 2: Construct a multimodal network. The multimodal network includes a two-dimensional traffic image anomaly detection model and a low-frequency information anomaly detection model. The two-dimensional traffic image anomaly detection model and the low-frequency information anomaly detection model have the same structure and are both anomaly detection learning networks based on GAN and AE.

[0086] Please refer to Figure 4 The embodiment of the invention shown is a schematic diagram of an anomaly detection learning network based on GAN and AE. In an optional implementation, the anomaly detection learning network based on GAN and AE includes: an AE network, a second encoder and a discriminator.

[0087] Among them, the AE network includes a cascaded first encoder and decoder; the input end of the second encoder is connected to the output end of the decoder, and the second encoder is used to introduce latent space feature loss; the discriminator includes a cascaded third encoder and a Sigmoid layer, wherein the input of the AE network and the output of the decoder serve as the input of the third encoder.

[0088] It should be noted that in this embodiment, the AE network is responsible for reconstructing the traffic images in the training set; an additional encoder, namely the second encoder, is attached to the AE network, which can introduce the latent space feature loss into the optimization objective to improve the reconstruction capability. The GAN network is introduced, and the AE network and its output are used as the generator of the GAN network. An additional discriminator is constructed, and the adversarial training idea is used to further improve the reconstruction quality of the traffic images in the training set. The Sigmoid layer added after the third encoder is used to convert the hidden layer vector into the probability of discriminating whether the input image is normal (non-Tor type traffic) or abnormal (Tor type traffic).

[0089] In this embodiment, the first encoder, the second encoder, and the third encoder have the same structure, each comprising a first encoding unit, a plurality of second encoding units, and a convolutional layer that are cascaded in sequence. Optionally, three second encoding units are provided.

[0090] Among them, the first encoding unit includes a convolutional layer, a LeakyReLU activation function layer and a CBAM module cascaded in sequence; the second encoding unit includes a convolutional layer, a batch normalization layer, a LeakyReLU activation function layer and a CBAM module cascaded in sequence.

[0091] In this embodiment, the decoder includes a plurality of first decoding units and second decoding units cascaded in sequence. Optionally, four first decoding units are provided.

[0092] Among them, the first decoding unit includes a deconvolution layer, a batch normalization layer, a LeakyReLU activation function layer and a CBAM module cascaded in sequence; the second decoding unit includes a deconvolution layer and a Tanh activation function layer cascaded in sequence.

[0093] In this embodiment, the convolution layers perform convolution operations on the output results of the previous layer respectively to extract data features. Specifically, a two-dimensional convolution layer is used. The convolution kernel size of all convolution layers in the encoder is 4*4, the step size is 2*2, and the padding length is 1*1. The deconvolution layer is used to gradually restore the image of the input layer. A two-dimensional network layer is also used. The convolution kernel size of the deconvolution layer is 4*4, the step size is 2*2, and the padding length is 1*1. The batch normalization layer is used to adjust and standardize the output vector of the previous layer to enhance the stability of network training. Specifically, the BatchNorm2d layer is used. The activation function layer is used to introduce network nonlinear factors and enhance the expression ability of the network. The CBAM module is used to introduce the attention mechanism to further improve the representation ability of the network.

[0094] Step 3: Use the training data set to train the multimodal network to obtain a trained multimodal network model;

[0095] In an optional embodiment, step 3 includes:

[0096] Step 3.1: Perform low-pass filtering on each image in the training dataset to obtain the corresponding low-frequency flow image and form a low-frequency flow image set;

[0097] In an optional embodiment, each image in the training data set is converted from the spatial domain to the frequency domain using Fourier transform; each image is low-pass filtered in the frequency domain using an ideal low-pass filter function, and the filtered frequency domain image is converted to the spatial domain to obtain a corresponding low-frequency flow image; the low-frequency flow images corresponding to all images in the training data set form a low-frequency flow image set.

[0098] In this embodiment, the ideal low-pass filter function H(u, v) is as follows, where the cutoff frequency D r Set to 23, D(u, v) represents the distance from the (u, v) coordinate to the center point coordinate of the two-dimensional image frequency domain:

[0099]

[0100] Step 3.2: Input the training dataset into the 2D traffic image anomaly detection model for training. Input the corresponding low-frequency traffic image set into the low-frequency information anomaly detection model for training. After training, a trained multimodal network model is obtained.

[0101] In this embodiment, the original image before filtering (i.e., the training data set) and the low-frequency image after filtering (i.e., the low-frequency flow image set) are respectively sent to the deep learning network with the same architecture (i.e., the two-dimensional flow image anomaly detection model and the low-frequency information anomaly detection model) for modeling to obtain the representation learning model of the original image and the low-pass filtered image.

[0102] In the training process of each anomaly detection model, the network parameters of the anomaly detection model are updated using back propagation according to the total loss function L, where:

[0103] L=w enc L enc +w con L con +w adc L adv (2);

[0104] L con =||x n -G(x n )||1 (3);

[0105] L enc =||G E (x n )-E(G(x n ))||1 (4);

[0106] L adv =(D(x n )-D(G(x n ))) 2 (5);

[0107] Where, L con represents the image reconstruction loss function, w con Represents the weight of the image reconstruction loss function, L enc represents the latent space feature loss function, w enc Represents the weight of the latent space feature loss function, L adv represents the adversarial loss function, w adc represents the weight of the adversarial loss function, x n Represents the input sample of the anomaly detection model, G() represents the output of the AE network, G E () represents the output of the first encoder, E() represents the output of the second encoder, () represents the output of the discriminator, and ||||1 represents the norm operation.

[0108] It should be noted that in this embodiment, training images are batched into the input layer of the AE network. By minimizing image reconstruction loss and latent space feature loss, the network parameters are continuously adjusted to complete the representation learning of non-Tor traffic data. Simultaneously, a GAN network discriminator is used to input the network input image and the AE-reconstructed image into the discriminator for prediction. The two predicted probabilities are then added to the AE network training after calculating the MSE loss to enhance the network's ability to learn the representation of non-Tor traffic data in the training set. When training is complete, the final loss function value will reach a sufficiently low level, and the model will have learned the distribution of the training set data. For the data category of the training set (non-Tor traffic), the image will be reconstructed well, while the reconstruction quality of the non-training set data (Tor traffic) in the test set will be very poor.

[0109] In this embodiment, two models are trained on the original flow images and low-pass filtered images in the training dataset. After training, the two models learn the characteristic distributions of the original flow images and low-frequency information, respectively, and model the multimodal two-dimensional flow images and low-frequency information data.

[0110] Step 4: Use the trained multimodal network model to classify and identify the traffic data to be tested.

[0111] In an optional embodiment, step 4 includes:

[0112] Step 4.1: The traffic data to be measured is segmented, filtered, de-redundant, and length-uniformed, and then converted into the corresponding traffic image to be measured;

[0113] Step 4.2: Perform low-pass filtering on the flow image to be measured to obtain the corresponding low-frequency flow image to be measured;

[0114] In this embodiment, the preprocessing and low-pass filtering of the flow data to be measured are similar to the processing of the training data set, and will not be described in detail here.

[0115] Step 4.3: Input the traffic image to be measured into the trained 2D traffic image anomaly detection model, and input the low-frequency traffic image to be measured into the trained low-frequency information anomaly detection model to obtain the corresponding prediction results of the 2D traffic image anomaly detection model and the low-frequency information anomaly detection model;

[0116] Among them, for each anomaly detection model, its prediction result is expressed as:

[0117]

[0118] in, represents the prediction result of the anomaly detection model, represents the test image of the input anomaly detection model, G() represents the output of the AE network, G E () represents the output of the first encoder, and E() represents the output of the second encoder.

[0119] It should be noted that in order to facilitate the testing of the trained multimodal network model, the test set obtained in step 1 is directly used and the low-frequency traffic image corresponding to the test set is obtained, and it is input into the trained multimodal network model.

[0120] In this embodiment, the image to be tested is set in the test set Put it into the input layer of the AE network to get the reconstructed traffic image The image category is predicted based on the difference between the reconstructed image and the original image. The square of the latent space feature vector of the first encoder in the AE network and the latent space feature vector of the encoder after the AE network is taken as the difference, and this is defined as the anomaly score. This anomaly score, as the prediction result of the anomaly detection model, measures the probability of the image belonging to each category. A smaller score indicates that the difference between the test image and its reconstructed image is small, and the probability of it being a normal image (non-Tor traffic type) is relatively high. A larger score indicates that the difference between the test image and its reconstructed image is large, and the probability of it being an anomaly image (Tor traffic type) is relatively high.

[0121] Step 4.4: The prediction results of the two-dimensional flow image anomaly detection model and the prediction results of the low-frequency information anomaly detection model are fused to obtain a fused prediction result. The fused prediction result is expressed as:

[0122] A out = orign A orign + lpf A lpf (7);

[0123] Among them, A out Represents the fusion prediction result, A orign represents the prediction result of the two-dimensional traffic image anomaly detection model on the traffic image to be tested, w orign represents the weight of the prediction result of the two-dimensional traffic image anomaly detection model, A lpf represents the prediction result of the low-frequency information anomaly detection model on the low-frequency traffic image to be tested, w lpf Represents the weight of the prediction results of the low-frequency information anomaly detection model;

[0124] Step 4.5: Determine the type of the traffic data to be measured based on the fusion prediction result. When the fusion prediction result is less than the preset threshold, the type of the traffic data to be measured is consistent with the traffic data type of the training data set. Otherwise, the type of the traffic data to be measured is another type different from the traffic data type of the training data set.

[0125] In this embodiment, the training set is composed entirely of non-Tor type traffic data. Then, when the fusion prediction result is less than the preset threshold, the type of the traffic data to be tested is the non-Tor traffic type; otherwise, the type of the traffic data to be tested is the Tor traffic type.

[0126] In other embodiments, if the training set consists entirely of Tor-type traffic data, then when the fusion prediction result is less than a preset threshold, the type of the traffic data to be tested is a Tor traffic type; otherwise, the type of the traffic data to be tested is a non-Tor traffic type.

[0127] In this embodiment, in order to further improve the classification performance, multimodal traffic images are combined, and the prediction information of two-dimensional traffic image information and low-frequency information data is fused to make the results more complete and the classification more accurate. Specifically, two models with the same architecture are used to model the original traffic image and the low-pass filtered low-frequency image respectively during the training phase, and two network models of different modalities are obtained. In the testing phase, different modal information is combined through the post-fusion method. The image to be tested is sent to the network modeled for the original traffic image, and the image to be tested is subjected to the same filtering steps and then sent to the network modeled for the low-frequency image. Then, according to the calculation method of the abnormal score, two prediction scores of the original traffic image and the low-frequency image are obtained. The original traffic image and the low-frequency image belong to different modalities, and the proportion of their respective prediction importance is different, so a weighted sum is made for the two prediction scores. Different weights mean that the importance of each score is different, and the weighted sum result is used as the final prediction score, that is, the fusion prediction result A out .

[0128] It is worth noting that the weights of each loss function in the total loss function L and the fusion prediction result A out The weights of each prediction result and the judgment threshold of the fusion prediction result are preset based on experience.

[0129] The multimodal encrypted network traffic classification method based on traffic images and low-frequency information of this embodiment is an encrypted network traffic classification method based on automatic feature extraction of a deep learning network. Compared with the traditional machine learning method based on statistical features, the method of the present invention does not require manual design and extraction of traffic features. The encrypted traffic features can be automatically learned through an anomaly detection network, thereby reducing the difficulty and complexity of feature engineering, saving the manpower and time required for encrypted network traffic classification, and lowering the threshold for traffic classification. In addition, the present invention adopts a learning method based on anomaly detection, which only requires a single type of data, namely non-Tor data, in the training stage. It combines traffic information of different modes, specifically by training a two-dimensional traffic image and a low-frequency information modal network model, and then aggregating the prediction information of multimodal data, so that the result is more complete and the classification accuracy is improved.

[0130] Furthermore, simulation experiments are conducted to verify the classification effect of the multimodal encrypted network traffic classification method based on traffic images and low-frequency information of this embodiment.

[0131] 1. Simulation conditions

[0132] This experiment was conducted on a CPU Intel(R) 11th Gen Core TM The system runs on i9-11900K@3.50GHz, 64G memory, 18.04.1-Ubuntu operating system, 3090 24GB turbo public version graphics card, and Python version 3.9.13.

[0133] 2. Simulation content

[0134] Experiments were conducted using the present embodiment on the ISCXTor2016 encrypted traffic dataset, and the classification results are shown in Table 1. The unimodal anomaly detection method uses an anomaly detection method to convert data packets into two-dimensional traffic images after preprocessing, then input them into the anomaly detection network model of the present invention. During the testing phase, an anomaly score is calculated, and classification is performed based on the score. The present invention's method, on the other hand, uses the present invention's model to model the original two-dimensional traffic image and the low-pass filtered image, respectively, learning the multimodal information of the original two-dimensional traffic image and the low-frequency information. The calculated multimodal prediction scores are then weighted, and the fused scores are ultimately used to represent the classification category of the traffic packet.

[0135] Table 1 Comparison of classification results of different methods

[0136] AUC value Accuracy F1 score The inventive method of this article 0.9292 0.8644 0.8710 Single-modal anomaly detection method 0.8606 0.7933 0.8010

[0137] In summary, the multimodal encrypted network traffic classification method of the present invention has achieved good results on Tor and non-Tor traffic datasets by fusing multimodal two-dimensional traffic images and low-frequency information, thereby improving the classification accuracy.

[0138] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations are intended to cover non-exclusive inclusion, so that an article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed. In the absence of further restrictions, an element defined by the statement "comprising a ..." does not exclude the presence of additional identical elements in the article or device comprising the element. Similar words such as "connected" or "connected" are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect.

[0139] The above is a further detailed description of the present invention in conjunction with specific preferred embodiments, and the specific implementation of the present invention should not be considered to be limited to these descriptions. For those skilled in the art of the present invention, without departing from the concept of the present invention, several simple deductions or substitutions can be made, which should be considered to fall within the scope of protection of the present invention.

Claims

1. A multimodal encrypted network traffic classification method based on traffic images and low-frequency information, characterized in that: include: Constructing a training data set, wherein the training data set is a single type of traffic data; Constructing a multimodal network, wherein the multimodal network includes: a two-dimensional traffic image anomaly detection model and a low-frequency information anomaly detection model, wherein the two-dimensional traffic image anomaly detection model and the low-frequency information anomaly detection model have the same structure and are both anomaly detection learning networks based on GAN and AE; Using the training data set to train the multimodal network to obtain a trained multimodal network model; Use the trained multimodal network model to classify and identify the traffic data to be tested; The anomaly detection learning network based on GAN and AE includes: an AE network, a second encoder and a discriminator, wherein the AE network includes a cascaded first encoder and a decoder; the input end of the second encoder is connected to the output end of the decoder, and the second encoder is used to introduce latent space feature loss; the discriminator includes a cascaded third encoder and a Sigmoid layer, wherein the input of the AE network and the output of the decoder serve as the input of the third encoder; The first encoder, the second encoder, and the third encoder have the same structure, and all include a first encoding unit, multiple second encoding units, and a convolutional layer cascaded in sequence, wherein the first encoding unit includes a convolutional layer, a LeakyReLU activation function layer, and a CBAM module cascaded in sequence; the second encoding unit includes a convolutional layer, a batch normalization layer, a LeakyReLU activation function layer, and a CBAM module cascaded in sequence; the convolution kernel size of all convolutional layers in the encoder is 4*4, the stride is 2*2, and the padding length is 1*1; The decoder includes a plurality of first decoding units and second decoding units cascaded in sequence, wherein the first decoding unit includes a deconvolution layer, a batch normalization layer, a LeakyReLU activation function layer and a CBAM module cascaded in sequence; the second decoding unit includes a deconvolution layer and a Tanh activation function layer cascaded in sequence; the convolution kernel size of the deconvolution layer is 4*4, the step size is 2*2, and the padding length is 1*1.

2. The multimodal encrypted network traffic classification method based on traffic image and low-frequency information according to claim 1 is characterized in that: Construct a training dataset, including: Get network traffic data packets in pcap format, including Tor and non-Tor types of network traffic data; Preprocessing the network traffic data packets and converting them into corresponding traffic images to obtain a traffic image dataset; The traffic image dataset is divided into Tor traffic data and non-Tor traffic data according to the network traffic data type, and one type of traffic data is used as a training dataset.

3. The multimodal encrypted network traffic classification method based on traffic image and low-frequency information according to claim 2 is characterized in that: The network traffic data is pre-processed and converted into corresponding traffic images to obtain a traffic image dataset, including: Removing redundant pcap header information from the network traffic data; Split the remaining data after removing the pcap header information into an array of data packets; Filter the data packets to remove empty payloads, DNS and ARP protocol packets; The source / destination IP and TCP addresses in the filtered data packets are erased and the MAC frame header is removed to remove redundant information in the data packets. After removing redundant information, all data packets are unified to form data packets with a length of 1600 bytes. For data packets longer than 1600 bytes, the last byte in the data packet payload is discarded. For data packets shorter than 1600 bytes, zero padding is performed at the end of the payload until it reaches 1600 bytes. Each data packet after the length unification operation is converted into a traffic image of length 40*40 to obtain a traffic image dataset.

4. The multimodal encrypted network traffic classification method based on traffic image and low-frequency information according to claim 1 is characterized in that: The multimodal network is trained using the training data set to obtain a trained multimodal network model, including: Performing low-pass filtering on each image in the training data set to obtain a corresponding low-frequency flow image, thereby forming a low-frequency flow image set; Inputting the training data set into the two-dimensional traffic image anomaly detection model for training, and inputting the corresponding low-frequency traffic image set into the low-frequency information anomaly detection model for training, and obtaining a trained multimodal network model after the training is completed; Among them, during the training process of each anomaly detection model, according to the total loss function L , back propagation is used to update the network parameters of the anomaly detection model, where ； ； ； ； Where, represents the image reconstruction loss function, represents the weight of the image reconstruction loss function, represents the latent space feature loss function, represents the weight of the latent space feature loss function, represents the adversarial loss function, represents the weight of the adversarial loss function, represents the input sample of the anomaly detection model, represents the output of the AE network, represents the output of the first encoder, represents the output of the second encoder, represents the output of the discriminator, Represents the norm operation.

5. The multimodal encrypted network traffic classification method based on traffic image and low-frequency information according to claim 4 is characterized in that: Each image in the training data set is low-pass filtered to obtain a corresponding low-frequency flow image, forming a low-frequency flow image set, including: Convert each image in the training data set from the spatial domain to the frequency domain using Fourier transform; Each image is low-pass filtered in the frequency domain using an ideal low-pass filter function, and the filtered frequency domain image is converted to the spatial domain to obtain the corresponding low-frequency flow image; The low-frequency flow images corresponding to all images in the training data set form the low-frequency flow image set.

6. The multimodal encrypted network traffic classification method based on traffic image and low-frequency information according to claim 1 is characterized in that: The trained multimodal network model is used to classify and identify the traffic data to be tested, including: The flow data to be measured is divided, filtered, de-redundant, and length-uniformed, and then converted into a corresponding flow image to be measured; Performing low-pass filtering on the flow rate image to be measured to obtain a corresponding low-frequency flow rate image to be measured; Input the traffic image to be measured into the trained two-dimensional traffic image anomaly detection model, and input the low-frequency traffic image to be measured into the trained low-frequency information anomaly detection model, to obtain prediction results corresponding to the two-dimensional traffic image anomaly detection model and the low-frequency information anomaly detection model; Among them, for each anomaly detection model, its prediction result is expressed as: ； in, represents the prediction result of the anomaly detection model, represents the image to be tested that is input to the anomaly detection model, represents the output of the AE network, represents the output of the first encoder, represents the output of the second encoder; The prediction results of the two-dimensional flow image anomaly detection model and the prediction results of the low-frequency information anomaly detection model are fused to obtain a fused prediction result, which is expressed as: ； in, represents the fusion prediction result, It represents the prediction result of the two-dimensional traffic image anomaly detection model on the traffic image to be tested, represents the weight of the prediction result of the two-dimensional traffic image anomaly detection model, It represents the prediction result of the low-frequency information anomaly detection model on the low-frequency traffic image to be tested, Represents the weight of the prediction results of the low-frequency information anomaly detection model; The type of the flow data to be measured is determined based on the fusion prediction result. When the fusion prediction result is less than a preset threshold, the type of the flow data to be measured is consistent with the flow data type of the training data set. Otherwise, the type of the flow data to be measured is another type different from the flow data type of the training data set.

Images