A method, apparatus, electronic device, and storage medium for identifying malicious encrypted traffic.

Abstract

This application provides a method, apparatus, electronic device, and storage medium for identifying malicious encrypted traffic, relating to the field of network security technology. The method includes acquiring encrypted traffic; preprocessing the encrypted traffic to obtain preprocessed data; and inputting the preprocessed data into a pre-trained and fine-tuned detection model to obtain detection results. This method uses pre-training and fine-tuning to obtain the detection model, pre-training with a large amount of unlabeled encrypted traffic and fine-tuning with a small amount of labeled encrypted traffic. This enables the detection of malicious encrypted traffic even with a relatively small dataset of labeled malicious encrypted traffic, solving the problem of low recognition rates in existing machine learning or deep learning-based traffic identification methods.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a malicious encrypted traffic identification method and device, an electronic device and a storage medium. BACKGROUND

[0002] With the wide application of encryption technologies such as Secure Socket Layer (SSL) and Transport Layer Security (TLS) in network communication, more and more malicious software hides its malicious behavior under encrypted content by using encryption or tunneling technology. These malicious software based on encrypted traffic communication usually steal user information or perform malicious behaviors such as ransomware, which endangers the privacy and property safety of users.

[0003] Machine learning methods based on artificial feature extraction mainly focus on classifying encrypted traffic without decryption, often based on statistical features or time series features, relying on expert knowledge for feature extraction and using machine learning algorithms for modeling and detection. This method often targets specific application types, and the recognition effect is usually related to the features extracted according to the field expert knowledge, and the classification effect has great uncertainty, and the features are easy to fail and need to be updated constantly. Deep learning based on raw data can extract more essential and effective data features from raw byte streams without human intervention, and learn more complex patterns. However, the recognition effect of this method depends on the number and quality of samples.

[0004] In the current field of malicious encrypted traffic identification, the labeled data set is too small, and self-labeling data set is difficult and costly, and there is a lack of universally accepted data collection and data labeling methods. This situation leads to the problem of low recognition rate of traffic identification methods based on machine learning or deep learning. SUMMARY

[0005] The purpose of the embodiments of the present application is to provide a malicious encrypted traffic identification method, device, electronic device and storage medium, which obtains a detection model by pre-training and fine-tuning, pre-trains a large amount of unlabeled encrypted traffic, and fine-tunes a small amount of labeled encrypted traffic, can obtain high recognition accuracy in the case of small malicious encrypted traffic labeled data set, realize the detection of malicious encrypted traffic, and solve the problem of low recognition rate of existing traffic identification methods based on machine learning or deep learning.

[0006] The embodiments of the present application provide a malicious encrypted traffic identification method, which comprises:

[0007] Obtaining encrypted traffic;

[0008] Preprocessing the encrypted traffic to obtain preprocessed data;

[0009] input the pretreated data into the detection model pre-trained and fine-tuned to obtain a detection result.

[0010] In the implementation process, the detection model is obtained by combining pre-training and fine-tuning, a large amount of unlabeled encrypted traffic is used for pre-training to learn general features, and a small amount of labeled encrypted traffic is used for fine-tuning to learn malicious encrypted traffic characteristics. In the case that the malicious encrypted traffic annotation dataset is small, a high recognition accuracy can be obtained to realize detection of malicious encrypted traffic, and the problem of low recognition rate of the existing traffic recognition method based on machine learning or deep learning is solved.

[0011] Further, the pretreatment of the encrypted traffic to obtain pretreated data comprises:

[0012] The encrypted traffic is divided into sessions according to five-tuples to obtain payload data.

[0013] Sequence features of the encrypted traffic are extracted, and the sequence features include packet length sequence, arrival time interval sequence, and direction sequence.

[0014] In the implementation process, the encrypted traffic is extracted to obtain payload data and sequence feature data, which facilitates detection and recognition by the detection model.

[0015] Further, before the step of inputting the pretreated data into the detection model pre-trained and fine-tuned, the method further comprises:

[0016] The training data is pretreated to obtain payload data, sequence feature data, and pseudo-labels of unlabeled traffic, and the pseudo-labels are determined according to the packet length and direction of the training data.

[0017] The payload data, sequence feature data, and pseudo-labels are input into a pre-training model for pre-training.

[0018] A training model is constructed based on the pre-training model.

[0019] The payload data and sequence feature data of the labeled encrypted traffic are input into the training model for training to obtain the detection model.

[0020] In the implementation process, the detection model is obtained by combining pre-training and fine-tuning, and in the case that the malicious encrypted traffic annotation dataset is small, a high recognition accuracy can be obtained.

[0021] Further, the input of the payload data, sequence feature data, and pseudo-labels into the pre-training model for pre-training comprises:

[0022] Copy the load data of the training data to perform data augmentation, and obtain two different data augmentation samples;

[0023] The data augmentation samples are respectively subjected to feature extraction by an online network encoder and a target network encoder to obtain preliminary representations;

[0024] The preliminary representations are extracted and compressed by a projector to obtain online representations;

[0025] The online representations are subjected to prediction by a predictor to obtain output results;

[0026] The output results and target representations are used to calculate a contrastive learning loss function;

[0027] The contrastive learning loss function is represented as:

[0028]

[0029] Wherein, θ represents the online network encoder parameters; ε represents the target network encoder parameters; z θ represents the online representations of the projector; q θ represents the predictor; q θ (z θ ) represents the output results of the predictor; z′ ε represents the target representations of the data augmentation samples;

[0030] The sequence data of the training data is subjected to feature extraction by a sequence encoder to obtain sequence representations;

[0031] The sequence representations and the online representations are input into a final predictor to calculate a supervised learning loss function by using the prediction results and pseudo labels;

[0032] The supervised learning loss function is represented as:

[0033]

[0034] Wherein, pred is the prediction result of the final predictor, and label is the corresponding pseudo label;

[0035] Based on the contrastive learning loss function and the supervised learning loss function, a loss function is minimized;

[0036] Wherein, the loss function is represented as: L=L ss +L sup .

[0037] In the above implementation process, load feature extraction is performed based on contrastive learning, and on this basis, pseudo labels are designed in combination with time sequence features to perform self-supervised learning.

[0038] Further, the payload data and sequence feature data of the labeled encrypted traffic are input into a training model for training to obtain a detection model, including:

[0039] The training model is loaded with weight parameters after pre-training, and the training model includes a sequence encoder, a payload encoder, and a classifier.

[0040] The labeled encrypted traffic payload data and sequence feature data are input into the sequence encoder and the payload encoder for feature extraction to obtain sequence features and payload features.

[0041] The sequence features and payload features are combined and input into the classifier to obtain a probability that the labeled encrypted traffic is malicious encrypted traffic.

[0042] Based on the probability, a cross-entropy loss function is calculated, and the cross-entropy loss function is minimized to obtain an optimal training model as a detection model.

[0043] In the above implementation process, a training model is constructed based on pre-training, the model is fine-tuned using labeled data to obtain a detection model, and the detection model is obtained by combining pre-training and fine-tuning, thereby improving the accuracy of the detection model.

[0044] Embodiments of the present application also provide a malicious encrypted traffic identification device, and the device includes:

[0045] A traffic collection module is configured to collect encrypted traffic.

[0046] A preprocessing module is configured to preprocess the encrypted traffic to obtain preprocessed data.

[0047] A detection module is configured to input the preprocessed data into a detection model that is pre-trained and fine-tuned to obtain a detection result.

[0048] In the above implementation process, the detection model is obtained by combining pre-training and fine-tuning, a large amount of unlabeled encrypted traffic is used for pre-training to learn general features, and a small amount of labeled encrypted traffic is used for fine-tuning to learn malicious encrypted traffic characteristics, thereby achieving high recognition accuracy under the condition that the size of the malicious encrypted traffic annotation data set is small, realizing detection of malicious encrypted traffic, and solving the problem of low recognition rate of existing traffic recognition methods based on machine learning or deep learning.

[0049] Further, the preprocessing module includes:

[0050] A payload data acquisition module is configured to perform session segmentation on the encrypted traffic according to five-tuple to obtain payload data.

[0051] The sequence feature extraction module is configured to extract sequence features of the encrypted traffic, the sequence features including a packet length sequence, an inter-arrival time sequence, and a direction sequence.

[0052] In the implementation process, the encrypted traffic is subjected to feature extraction to obtain payload data and sequence feature data, which facilitates detection and identification by the detection model.

[0053] Further, the device further comprises:

[0054] The training data processing module is configured to pre-process training data to obtain payload data, sequence feature data, and pseudo labels of unlabelled traffic, the pseudo labels being determined according to packet lengths and directions of the training data;

[0055] The pre-training module is configured to input the payload data, the sequence feature data, and the pseudo labels into a pre-training model for pre-training;

[0056] The training model construction module is configured to construct a training model based on the pre-training model;

[0057] The model training module is configured to input payload data and sequence feature data of labelled encrypted traffic into the training model for training to obtain a detection model.

[0058] In the implementation process, the detection model is obtained by using a combination of pre-training and fine-tuning, and a higher recognition accuracy is obtained in the case where a malicious encrypted traffic label data set is small in scale.

[0059] Embodiments of the present application also provide an electronic device, which comprises a memory and a processor, the memory being configured to store a computer program, and the processor being configured to run the computer program to enable the electronic device to perform the malicious encrypted traffic recognition method according to any one of the preceding embodiments.

[0060] Embodiments of the present application also provide a readable storage medium, which stores computer program instructions, and the computer program instructions are read and run by a processor to perform the malicious encrypted traffic recognition method according to any one of the preceding embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0061] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0062] Figure 1A flowchart of a malicious encrypted traffic identification method provided for an embodiment of the present application;

[0063] Figure 2 A specific flowchart of malicious encrypted traffic identification provided for an embodiment of the present application;

[0064] Figure 3 A preprocessing flowchart provided for an embodiment of the present application;

[0065] Figure 4 A specific preprocessing flowchart of training data provided for an embodiment of the present application;

[0066] Figure 5 A detection model generation flowchart provided for an embodiment of the present application;

[0067] Figure 6 A structural block diagram of a pre-trained feature extractor provided for an embodiment of the present application;

[0068] Figure 7 A pre-training flowchart provided for an embodiment of the present application;

[0069] Figure 8 A detection model training flowchart provided for an embodiment of the present application;

[0070] Figure 9 A structural block diagram of a malicious encrypted traffic identification device provided for an embodiment of the present application;

[0071] Figure 10 A composition schematic diagram of a malicious encrypted traffic identification device provided for an embodiment of the present application;

[0072] Figure 11 A structural block diagram of another malicious encrypted traffic identification device provided for an embodiment of the present application.

[0073] Icon:

[0074] 100 - traffic collection module; 200 - preprocessing module; 201 - payload data acquisition module; 202 - sequence feature extraction module; 300 - detection module; 410 - training data processing module; 420 - pre-training module; 430 - training model construction module; 440 - model training module. DETAILED DESCRIPTION

[0075] The technical solutions in the embodiments of the present application will be described below with reference to the accompanying drawings in the embodiments of the present application.

[0076] It should be noted that similar reference numerals and letters refer to like items in the accompanying drawings, and once an item is defined in one drawing, it need not be further defined and explained in subsequent drawings. Also, in the description of the present application, the terms "first", "second", and the like are used only to distinguish descriptions, and cannot be understood as indicating or implying relative importance.

[0077] Embodiment 1

[0078] Please refer to Figure 1 , Figure 1 A flowchart of a malicious encrypted traffic identification method provided by the embodiment of the present application. The method is based on self-supervised learning for feature extraction. Specifically, the payload feature is extracted based on contrastive learning, and on this basis, pseudo labels are designed in combination with time sequence features for self-supervised learning. A pre-training-fine-tuning method is used to construct a detection model, which can achieve a high recognition rate without a large amount of labeled data.

[0079] The method specifically includes the following steps:

[0080] Step S100: obtaining encrypted traffic;

[0081] Specifically, SSL / TLS protocol encrypted traffic is obtained and analyzed, including real-time collection of network traffic. The traffic obtained by this module is stored in the pcap file format.

[0082] Step S200: preprocessing the encrypted traffic to obtain preprocessed data;

[0083] The obtained traffic is session-splitting and recombined, and the corresponding payload data and time sequence data are obtained.

[0084] Step S300: inputting the preprocessed data into a detection model pre-trained and fine-tuned to obtain a detection result.

[0085] The detection model is used to detect the preprocessed data, and outputs the probability of being normal or malicious. The class corresponding to the maximum probability is selected as the type of unknown encrypted traffic.

[0086] A feature extractor is learned from a large amount of unlabeled encrypted traffic to obtain a general feature representation. Then, a training model is constructed based on the pre-trained feature extractor, and fine-tuning learning is performed to obtain a final detection model. The trained detection model is used to detect unknown encrypted traffic to obtain an identification result. The maximum probability and the corresponding class can be used as the detection result, as shown in Figure 2 The specific flowchart of malicious encrypted traffic identification is shown in

[0087] As shown in Figure 3 The specific steps of the preprocessing flowchart are as follows:

[0088] Step S201: The encrypted traffic is divided into sessions according to the five-tuple, and the payload data is obtained.

[0089] The encrypted traffic is divided into sessions according to the five-tuple (i.e., source IP address, destination IP address, source port number, destination port number, and protocol). The first 784 bytes of the TCP layer payload are extracted, the excess is discarded, the insufficient part is filled with ASCII code 0, and the data is mapped to ASCII code numbers for normalization processing to obtain the payload data.

[0090] Step S202: Extracting sequence features of the encrypted traffic, the sequence features including packet length sequence, arrival time interval sequence, and direction sequence.

[0091] The packet length sequence, arrival time interval sequence, and direction sequence of the first 32 packets are extracted, and the direction is represented by +1 and -1, respectively, indicating that the packet is transmitted from the client to the server and from the server to the client, and the insufficient 32 packets are filled with 0.

[0092] It should be noted that the training data also needs to be preprocessed, and the difference is that the training data contains a large amount of unlabeled encrypted traffic and a small amount of labeled encrypted traffic. As shown in FIG. 4, the specific preprocessing flowchart of the training data is shown. For the training data, in the pre-training stage, the pseudo-label of the encrypted traffic needs to be obtained. Specifically, the statistical features of the packet length sequence corresponding to the encrypted traffic packet are extracted, including but not limited to the maximum value, the minimum value, the average value, and the variance; in the training stage, the traffic label is extracted according to the encrypted traffic labeling method. Figure 4 As shown in FIG. 5, the generation flowchart of the detection model is shown. Before the step of inputting the preprocessed data into the detection model pre-trained and fine-tuned, the method further includes:

[0093] Figure 5 As shown in FIG. 5, the generation flowchart of the detection model is shown. Before the step of inputting the preprocessed data into the detection model pre-trained and fine-tuned, the method further includes:

[0094] Step S410: Preprocessing the training data to obtain the payload data, sequence feature data, and pseudo-label of the unlabeled traffic, the pseudo-label being determined according to the packet length and direction of the training data;

[0095] Step S420: Inputting the payload data, sequence feature data, and pseudo-label into the pre-training model for pre-training;

[0096] The feature extractor is obtained by pre-training. Specifically, the payload data feature extractor is designed based on contrastive learning, and self-supervised learning is performed according to the pseudo-label in combination with the time series data. As shown in FIG. 6, the structural block diagram of the pre-trained feature extractor is shown. Figure 6

[0097] Step S430: Building a training model based on the pre-training model; ​​

[0098] The constructed training model includes a sequence encoder, a payload encoder, and a classifier, and each encoder loads pre-trained weight parameters.

[0099] Step S440: input the payload data and sequence feature data of the labeled encrypted traffic into the training model for training to obtain a detection model.

[0100] As shown in the pre-training flowchart, step S420 specifically includes the following steps: Figure 7

[0101] Step S421: duplicate the payload data of the training data for data augmentation to obtain two different data augmentation samples;

[0102] Step S422: perform feature extraction on the data augmentation samples through an online network encoder and a target network encoder respectively to obtain preliminary representations;

[0103] Step S423: use a projector to extract and compress the preliminary representations to obtain online representations;

[0104] Step S424: perform prediction on the online representations through a predictor to obtain output results;

[0105] Step S425: calculate a contrastive learning loss function using the output results and target representations;

[0106] The contrastive learning loss function is represented as:

[0107]

[0108] wherein θ represents the online network encoder parameters; ε represents the target network encoder parameters; z θ represents the online representations of the projector; q θ represents the predictor; q θ (z θ ) represents the output results of the predictor; z′ ε represents the target representations of the data augmentation samples;

[0109] Step S426: perform feature extraction on the sequence data of the training data through a sequence encoder to obtain sequence representations;

[0110] Step S427: input the sequence representations and the online representations into a final predictor to calculate a supervised learning loss function using the prediction results and pseudo labels;

[0111] The supervised learning loss function is represented as:

[0112] ​

[0113] wherein pred is the prediction result of the final predictor, and label is the corresponding pseudo label;

[0114] Step S428: minimizing the loss function based on the contrastive learning loss function and the supervised learning loss function;

[0115] wherein the loss function is represented as: L = L ss + L sup .

[0116] As shown in FIG. 4, it is a flow chart of the training process of the detection model, and step S440 specifically includes the following steps: Figure 8

[0117] Step S441: loading the weight parameters after pre-training into the training model, wherein the training model includes a sequence encoder, a payload encoder and a classifier;

[0118] Step S442: inputting the payload data and the sequence feature data of the labeled encrypted traffic into the sequence encoder and the payload encoder respectively for feature extraction to obtain sequence features and payload features;

[0119] Step S443: inputting the sequence features and the payload features into the classifier after merging to obtain the probability that the labeled encrypted traffic is malicious encrypted traffic;

[0120] Step S444: calculating a cross-entropy loss function based on the probability and minimizing the cross-entropy loss function to obtain an optimal training model as the detection model.

[0121] The method adopts a combination of pre-training and fine-tuning, learns general feature representation from a large amount of unlabeled encrypted traffic data, and learns malicious encrypted traffic characteristics using a small amount of labeled data. After a few iteration rounds, the pre-trained model is fine-tuned to learn, which can achieve high recognition accuracy in the case of small malicious encrypted traffic labeled data set size, and realize detection of malicious encrypted traffic.

[0122] Embodiment 2

[0123] The embodiment of the present application provides a malicious encrypted traffic recognition device, as shown in FIG. 5, which is a structural block diagram of a malicious encrypted traffic recognition device. The device includes but is not limited to: Figure 9

[0124] The traffic collection module 100 is configured to obtain encrypted traffic.

[0125] The preprocessing module 200 is configured to preprocess the encrypted traffic to obtain preprocessed data.

[0126] ​​The detection module 300 is configured to input the preprocessed data into a pre-trained and fine-tuned detection model to obtain a detection result.

[0127] Specifically, as shown in Figure 10 The encrypted traffic and the corresponding identification result can be stored, and the stored information can include encrypted traffic collection time, source IP address, destination IP address, source port number, destination port number, protocol, and the like.

[0128] As shown in Figure 11 As shown in FIG. 6, another structure block diagram of the malicious encrypted traffic identification device is shown, and the preprocessing module 200 includes but is not limited to:

[0129] The payload data acquisition module 201 is configured to perform session segmentation on the encrypted traffic according to a five-tuple to obtain payload data.

[0130] The sequence feature extraction module 202 is configured to extract sequence features of the encrypted traffic, and the sequence features include a packet length sequence, an arrival time interval sequence, and a direction sequence.

[0131] The device further includes:

[0132] The training data processing module 410 is configured to preprocess training data to obtain payload data, sequence feature data, and pseudo labels of unlabelled traffic, wherein the pseudo labels are determined according to packet lengths and directions of the training data.

[0133] The pre-training module 420 is configured to input the payload data, the sequence feature data, and the pseudo labels into a pre-training model for pre-training.

[0134] The specific implementation process of the pre-training module 420 has been specifically described in steps S421-S428 in Embodiment 1, and will not be repeated here.

[0135] The training model construction module 430 is configured to construct a training model based on the pre-training model.

[0136] The model training module 440 is configured to input payload data and sequence feature data of labelled encrypted traffic into the training model for training to obtain a detection model.

[0137] The specific implementation process of the model training module 440 has been specifically described in steps S441-S444 in Embodiment 1, and will not be repeated here.

[0138] The method adopts a combination of pre-training and fine-tuning, learns general feature representation from a large amount of unlabeled encrypted traffic data, and learns malicious encrypted traffic characteristics by using a small amount of labeled data, and through a few iteration rounds, fine-tuning learning is performed on the basis of the pre-trained model, so that a higher recognition accuracy can be obtained under the condition that the malicious encrypted traffic labeled data set is small, and detection of the malicious encrypted traffic is realized.

[0139] The application further provides an electronic device, which comprises a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the malicious encrypted traffic identification method in the embodiment 1.

[0140] The application further provides a readable storage medium, which stores computer program instructions, and the computer program instructions are read and run by a processor to execute the malicious encrypted traffic identification method in the embodiment 1.

[0141] In several embodiments provided in the application, it should be understood that the disclosed apparatus and method can also be implemented by other manners. The apparatus embodiments described above are only schematic, for example, the flowcharts and block diagrams in the drawings show the possible implementation architectures, functions and operations of the apparatus, method and computer program product according to the embodiments of the application. In this regard, each block in the flowcharts or block diagrams can represent a module, a program segment or a part of code, which contains one or more executable instructions for implementing the specified logic function. It should also be noted that, in some alternative implementation manners, the functions noted in the blocks can also occur in different orders from those noted in the drawings. For example, two consecutive blocks can actually be executed substantially in parallel, and sometimes they can be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and the combination of blocks in the block diagrams and / or flowcharts, can be implemented by a dedicated hardware-based system for implementing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0142] In addition, the functional modules in each embodiment of the application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0143] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the parts of the prior art that make contributions or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0144] The above merely provides an example of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numbers and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0145] The above merely provides an example of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numbers and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0146] It should be noted that, in this document, the terms such as first and second are used merely to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the processes, methods, articles or devices including a series of elements not only include those elements, but also include other elements not explicitly listed or inherent to such processes, methods, articles or devices. Without more limitations, the element defined by the statement "including a" does not exclude the presence of another identical element in the process, method, article or device including the element.

Claims

1. A method for malicious encrypted traffic identification, characterized in that, The method comprises: obtaining encrypted traffic; preprocessing the encrypted traffic to obtain preprocessing data; inputting the preprocessing data into a detection model pre-trained and fine-tuned to obtain a detection result, before the step of inputting the preprocessing data into the detection model pre-trained and fine-tuned, the method further comprises: preprocessing training data to obtain payload data, sequence feature data and pseudo labels of unlabelled traffic, the pseudo labels being determined according to the packet length and direction of the training data; The load data, sequence feature data and pseudo label are input into a pre-training model for pre-training, specifically: duplicating the load data of the training data for data augmentation to obtain two different data augmentation samples; the data augmentation samples are respectively input into an online network encoder and a target network encoder for feature extraction to obtain preliminary representations; a projector is used to extract and compress the preliminary representations to obtain online representations; the online representations are input into a predictor for prediction to obtain output results; a contrastive learning loss function is calculated based on the output results and target representations; the contrastive learning loss function is represented as: wherein, θ represents online network encoder parameters; ε represents target network encoder parameters; z θ represents online representations of the projector; q θ represents the predictor; q θ (z θ ) represents output results of the predictor; z′ ε represents target representations of the data augmentation samples; sequence data of the training data is input into a sequence encoder for feature extraction to obtain sequence representations; the sequence representations and the online representations are input into a final predictor to calculate a supervised learning loss function based on prediction results and pseudo labels; the supervised learning loss function is represented as: wherein, pred represents prediction results of the final predictor, and label represents corresponding pseudo labels; a loss function is minimized based on the contrastive learning loss function and the supervised learning loss function; wherein, the loss function is represented as: L=L ss +L sup ; constructing a training model based on the pre-training model; inputting the payload data and sequence feature data of the labelled encrypted traffic into the training model for training to obtain a detection model.

2. The method of claim 1, wherein, The preprocessing of the encrypted traffic to obtain preprocessing data comprises: performing session segmentation on the encrypted traffic according to the five-tuple to obtain payload data; extracting sequence features of the encrypted traffic, the sequence features including packet length sequence, arrival time interval sequence and direction sequence.

3. The method of claim 1, wherein, The inputting of the payload data and sequence feature data of the labelled encrypted traffic into the training model for training to obtain a detection model comprises: loading the weight parameters after pre-training into the training model, the training model including a sequence encoder, a payload encoder and a classifier; inputting the payload data and sequence feature data of the labelled encrypted traffic into the sequence encoder and the payload encoder respectively for feature extraction to obtain sequence features and payload features; inputting the combined sequence features and payload features into the classifier to obtain the probability that the labelled encrypted traffic is malicious encrypted traffic; calculating a cross-entropy loss function based on the probability and minimizing the cross-entropy loss function to obtain an optimal training model as the detection model.

4. A malicious encrypted traffic identification apparatus characterized by comprising: The device comprises: a traffic collection module for obtaining encrypted traffic; a preprocessing module for preprocessing the encrypted traffic to obtain preprocessing data; a detection module for inputting the preprocessing data into a detection model pre-trained and fine-tuned to obtain a detection result, the device further comprising: a training data processing module for preprocessing training data to obtain payload data, sequence feature data and pseudo labels of unlabelled traffic, the pseudo labels being determined according to the packet length and direction of the training data; The pre-training module is configured to input the load data, the sequence feature data and the pseudo label into a pre-training model for pre-training. Specifically, load data of training data is copied for data augmentation to obtain two different data augmentation samples; the data augmentation samples are respectively subjected to feature extraction by an online network encoder and a target network encoder to obtain preliminary representations; the preliminary representations are subjected to extraction and compression by a projector to obtain online representations; the online representations are subjected to prediction by a predictor to obtain an output result; a contrastive learning loss function is calculated by using the output result and a target representation; and the contrastive learning loss function is represented as: wherein θ represents online network encoder parameters; ε represents target network encoder parameters; z θ represents online representations of the projector; q θ represents the predictor; q θ (z θ ) represents an output result of the predictor; z′ ε represents a target representation of the data augmentation sample; sequence data of the training data is subjected to feature extraction by a sequence encoder to obtain a sequence representation; the sequence representation and the online representation are input into a final predictor to calculate a supervised learning loss function by using a prediction result and a pseudo label; the supervised learning loss function is represented as: wherein pred represents a prediction result of the final predictor, and label represents a corresponding pseudo label; a loss function is minimized based on the contrastive learning loss function and the supervised learning loss function; wherein the loss function is represented as: L = L ss + L sup ; a training model construction module for constructing a training model based on the pre-training model; a model training module for inputting the payload data and sequence feature data of the labelled encrypted traffic into the training model for training to obtain a detection model.

5. The apparatus for malicious encrypted traffic identification of claim 4, wherein, The preprocessing module comprises: a payload data acquisition module for performing session segmentation on the encrypted traffic according to the five-tuple to obtain payload data; a sequence feature extraction module for extracting sequence features of the encrypted traffic, the sequence features including packet length sequence, arrival time interval sequence and direction sequence.

6. An electronic device, comprising: The electronic device comprises a memory for storing a computer program and a processor for running the computer program to enable the electronic device to perform the malicious encrypted traffic identification method according to any one of claims 1 to 3.

7. A readable storage medium, characterized by, The readable storage medium stores computer program instructions, and the computer program instructions are read and run by a processor to execute the malicious encrypted traffic identification method in any one of claims 1 to 3.

Images