Method and device for encrypted traffic classification based on multi-modal learning, and storage medium

Abstract

The application relates to an encrypted traffic classification method and device based on multi-modal learning and a storage medium, and relates to the technical field of computer network management. The method comprises the following steps: collecting target encrypted traffic data, and obtaining effective sessions through traffic division and data cleaning; extracting heterogeneous information of the effective sessions, and constructing a multi-modal data set composed of a content matrix and a timing matrix; sequentially extracting content modal features from a packet level to a session level by using a hierarchical attention network; extracting timing modal features of different granularities by using a timing cycle network; fusing the content modal features and the timing modal features based on a multi-modal fusion network, and extracting high-level multi-modal features by using a high-speed network; and outputting traffic classification probabilities through an output layer based on the high-level multi-modal features, so that encrypted traffic classification is realized. Compared with the prior art, the application has the advantages of fully considering hierarchical structure and timing correlation characteristics, and improving the classification accuracy for encrypted traffic data.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer network management, and in particular to an encrypted traffic classification method and device based on multi-modal learning and a storage medium. BACKGROUND

[0002] In recent years, due to the wide popularity and vigorous development of the Internet, people generate a large amount of network traffic in daily life at all times. Although the Internet has greatly improved people's daily life in terms of clothing, food, shelter and transportation, the problem of privacy leakage has become a focus. For this reason, encryption technology has been gradually applied in Internet communication, which has solved the problem of network security to a certain extent. However, this inevitably leads to an increasing trend in the number of encrypted traffic in the Internet. Therefore, the classification method for encrypted traffic has gradually become a difficult problem to be solved in the academic and industrial circles. The accurate classification of encrypted traffic can not only assist network operators in reasonably allocating bandwidth resources according to the type of traffic to effectively guarantee the quality of service, but also help to detect malicious traffic disguised by encryption technology and strengthen the defense of network security.

[0003] In the early stage of the Internet, the mainstream method of traffic classification is port number matching and deep packet inspection technology. With the popularity of dynamic ports and encryption technology, these two classification methods are no longer applicable. Due to the rise of the field of machine learning, more and more researchers have begun to use statistical-based machine learning algorithms to solve the classification problem of encrypted traffic. Although statistical characteristics are not covered by encryption technology, and some studies have shown effectiveness, such methods rely too much on expert knowledge to design effective features, and have obvious shortcomings such as time-consuming, laborious and complex.

[0004] In view of this, in recent years, deep learning technology has been favored by researchers in the field of encrypted traffic classification due to its advantages of end-to-end and automatic learning. At present, many studies have applied deep learning to encrypted traffic classification, but the existing methods still have the following improvement space: (1) Incomplete use of encrypted traffic information: the payload information of encrypted traffic is confused by encryption technology, and the distribution characteristics are covered to a certain extent. Most of the existing methods only focus on stacking deep networks to extract payload features, and do not fully utilize distinctive statistical information, resulting in weak representation ability of encrypted traffic. (2) Ignoring the heterogeneity of encrypted traffic: encrypted traffic has hierarchical structure and time domain correlation characteristics in content and time sequence respectively. The current method does not use the above characteristics to design a suitable feature extraction network, making it difficult to achieve high-precision classification performance. SUMMARY

[0005] The application aims to provide a multi-modal learning-based encrypted traffic classification method, device and storage medium, which fully utilizes the heterogeneity of traffic by constructing payload modal and statistical information modal to achieve high-precision performance on different fine-grained classification tasks of encrypted traffic.

[0006] The application aims to provide a multi-modal learning-based encrypted traffic classification method, device and storage medium, which fully utilizes the heterogeneity of traffic by constructing payload modal and statistical information modal to achieve high-precision performance on different fine-grained classification tasks of encrypted traffic.

[0007] A multi-modal learning-based encrypted traffic classification method comprises the following steps:

[0008] S1, collecting target encrypted traffic data, and obtaining effective sessions through traffic division and data cleaning;

[0009] S2, extracting the heterogeneous information of the effective sessions, and constructing a multi-modal data set composed of a content matrix and a timing matrix;

[0010] S3, based on the multi-modal data set, using a hierarchical attention network to extract content modal features from the data packet level to the session level in turn;

[0011] S4, based on the multi-modal data set, using a timing recurrent network to extract timing modal features of different granularities;

[0012] S5, based on the multi-modal fusion network, fusing the content modal features and the timing modal features, and using a high-speed network to extract high-level multi-modal features;

[0013] S6, based on the high-level multi-modal features, outputting traffic classification probabilities through an output layer to realize encrypted traffic classification.

[0014] Further, the S1 comprises the following steps:

[0015] S11, using Wireshark to capture target encrypted traffic of a specified network interface to obtain a PCAP format original traffic file;

[0016] S12, using a hash data structure to divide each PCAP file into bidirectional sessions according to the five-tuple;

[0017] S13, considering that there are a certain number of plaintext domain name resolution sessions in network communication, performing data cleaning to filter out such sessions to avoid deviation of the classification result;

[0018] S14, deleting ACK data packets and retransmission data packets in the TCP session, and removing the data link layer protocol header of all data packets to obtain clean effective sessions.

[0019] Further, the structure of the five-tuple is represented as <source IP address, destination IP address, source port, destination port, transport layer protocol>, wherein the source and destination directions are interchangeable.

[0020] Further, the S2 comprises the following steps:

[0021] S21, sequentially selecting the first N data packets of each valid session to represent the data of the whole session;

[0022] S22, parsing the byte content of each data packet, extracting the payload byte sequence of the transmission layer, and processing it into a fixed length of Ethernet MTU size M, thereby obtaining a content matrix of size N rows and M columns corresponding to each valid session;

[0023] S23, parsing the protocol header of each data packet, extracting the statistical information sequence of each data packet, the statistical information sequence including the arrival time interval, the data packet direction, the length and the TCP window size, and dimensionally splicing the four statistical information sequences to obtain a time sequence matrix of size N rows and 4 columns corresponding to each valid session, wherein the arrival time interval is determined by sequentially subtracting the arrival times of adjacent data packets, the data packet direction is determined by analyzing the IP address to infer the server and client identity, and the data packet length is determined by the length of the transmission layer payload sequence;

[0024] S24, normalizing each element in the content matrix and the time sequence matrix, and dividing them into a training set and a test set according to a preconfigured ratio, for training and testing the hierarchical attention network, the time sequence recurrent network and the multi-modal fusion network.

[0025] Further, the hierarchical attention network comprises a distributed one-dimensional convolution module, a distributed attention mechanism module and a bidirectional GRU module for data packet sequence connected in sequence, and the content modal feature extraction based on the hierarchical attention network comprises the following steps:

[0026] S31, using the distributed one-dimensional convolution module to iteratively process each row of the content matrix, and extracting the content features of each data packet payload at the data packet level;

[0027] S32, using the distributed attention mechanism to assign attention weights to the content feature sequence output by S31 in sequence, and sequentially weighting and summing the sequence points on each content feature sequence to convert them into high-purity content feature vectors;

[0028] S33, stacking each content feature vector obtained by S32 into a content feature sequence at the session level, using the bidirectional GRU module to model the content features at the session level, and outputting the content modal features.

[0029] Further, the time sequence recurrent network comprises a time convolution network (TCN) module and a bidirectional GRU module connected in sequence, and the time sequence modal feature extraction based on the time sequence recurrent network comprises the following steps:

[0030] S41, input the time sequence matrix into a time convolution network module, perform short-term feature extraction through multi-layer dilated causal convolution, and construct an identity mapping;

[0031] S42, capture long-term features from the front and the back based on a bidirectional GRU module, and output time sequence mode features.

[0032] Further, the multi-modal fusion network in S5 considers that the content mode features and the time sequence mode features are both in sequence form, uses a point-to-point fusion method to perform dimension splicing at each sequence point, and uses a high-speed network to adaptively extract multi-modal representations to obtain high-level multi-modal features.

[0033] Further, S6 is specifically: reducing the dimension of the high-level multi-modal features through a flatten operation and inputting the full connection output layer, mapping the classification probability through a softmax function, obtaining the classification label of the encrypted traffic, and realizing encrypted traffic classification.

[0034] A kind of encrypted traffic classification device based on multi-modal learning, including memory, processor and program stored in the memory, the processor when implementing the program realizes the method as described above.

[0035] A storage medium, a program is stored on the storage medium, the program is implemented when realizing the method as described above.

[0036] Compared with the prior art, the present application has the following beneficial effects:

[0037] 1, the present application proposes a new encrypted traffic heterogeneous representation method, which uses the payload information and statistical information of the session to construct content matrix and time sequence matrix, and better enhances the input representation of encrypted traffic.

[0038] 2, the present application constructs a hierarchical attention network based on the hierarchical structure characteristics of traffic, fully extracts different fine-grained content features of packets and sessions, and fully mines the content differences of encrypted traffic.

[0039] 3, the present application constructs a time sequence cycle network based on the time sequence association characteristics of traffic, introduces two memory length models to optimize the extraction of time sequence features, and effectively realizes the modeling of the time sequence characteristics of encrypted traffic.

[0040] 4, the present application proposes a multi-modal model using parallel integration, adopts a feature extraction method combining content mode and time sequence mode, and improves the classification performance of encrypted traffic. BRIEF DESCRIPTION OF DRAWINGS

[0041] Figure 1 is the flowchart of the encrypted traffic classification method based on multi-modal learning of the present application;

[0042] Figure 2 Flowchart for obtaining and extracting heterogeneous information for effective sessions of encrypted traffic

[0043] Figure 3 Figure is an encrypted traffic classification model architecture diagram of the present application. DETAILED DESCRIPTION

[0044] The present application will be described in detail below with reference to the accompanying drawings and specific embodiments. The present embodiment is implemented on the basis of the technical solution of the present application, and gives a detailed implementation and specific operation process, but the protection scope of the present application is not limited to the following embodiments.

[0045] As shown in Figure 1 , the present embodiment discloses an encrypted traffic classification method based on multi-modal learning, comprising the following steps:

[0046] S1, collecting target encrypted traffic data, and obtaining effective sessions through traffic division and data cleaning;

[0047] S2, extracting the heterogeneous information of the effective sessions, and constructing a multi-modal data set composed of a content matrix and a timing matrix;

[0048] S3, based on the multi-modal data set, using a hierarchical attention network to extract content modal features from the data packet level to the session level in turn;

[0049] S4, based on the multi-modal data set, using a timing recurrent network to extract timing modal features of different granularities;

[0050] S5, based on the multi-modal fusion network, fusing the content modal features and the timing modal features, and using a high-speed network to extract high-level multi-modal features;

[0051] S6, based on the high-level multi-modal features, outputting traffic classification probability through the output layer to realize encrypted traffic classification.

[0052] The heterogeneous information representation method proposed in the present application enhances the input representation of encrypted traffic, and provides rich information to support reliable classification decision. Further, a multi-modal classification model is constructed by constructing a payload modal and a statistical information modal, which fully mines the effective features of encrypted traffic and improves the classification performance of the model. The steps of the present embodiment will be described in detail below:

[0053] In S1, the target encrypted traffic raw data is collected and converted into effective sessions, as shown in Figure 2 .

[0054] S11, after confirming the communication interface of the target encrypted traffic, using Wireshark to capture the target encrypted traffic of the specified network interface to obtain a PCAP format raw traffic file;

[0055] S12, divide the collected PCAP file according to the source IP address, destination IP address, source port, destination port and transmission layer protocol by using the dictionary type of the hash data structure, and accurately classify the traffic to the session level;

[0056] S13, considering that there are a certain number of plaintext domain name resolution sessions in network communication, data cleaning is performed, the dpkt library is used to analyze the session protocol layer information, the highest layer protocol of the data packet is analyzed, the plaintext domain name resolution session is filtered out, and the deviation interference of the plaintext information on the classification result is eliminated;

[0057] S14, delete the ACK data packet and retransmission data packet in the TCP session, remove the data link layer protocol header of all data packets, eliminate the noise influence of non-classification information, and obtain clean effective sessions.

[0058] S2 extracts the heterogeneous information representation of the effective session, and constitutes a training set and a test set.

[0059] S21, cut the effective session in turn, and select the first 20 data packets of each effective session to represent the whole session;

[0060] S22, use the dpkt library to perform layer-by-layer protocol analysis, extract the transmission layer payload byte sequence, fill in the data packet less than the Ethernet MTU value 1500 bytes, and truncate the data packet greater than the Ethernet MTU value 1500 bytes, so as to obtain a content matrix with a size of 20x1500 corresponding to each effective session;

[0061] S23, use the dpkt library to perform network layer and transmission layer protocol header analysis, and extract the statistical information sequence of each data packet. In this embodiment, the statistical information sequence includes the arrival time interval, the data packet direction, the length and the TCP window size, wherein the arrival time interval is determined by subtracting the arrival times of adjacent data packets in turn, the data packet direction is determined by analyzing the IP address to infer the server and client identity, and the data packet length is determined by the length of the transmission layer payload sequence. The four statistical information sequences are dimensionally spliced by concat operation to obtain a time sequence matrix with a size of 20x4 corresponding to each effective session.

[0062] S24, normalize each element in the content matrix and the time sequence matrix to the [0, 1] interval by using z-score, and divide the training set and the test set in a ratio of 8:2 by using the train-test-split function, for training and testing the hierarchical attention network, the time sequence cycle network and the multi-modal fusion network.

[0063] The z-score normalization formula is:

[0064]

[0065] wherein μ,σ are mean and standard deviation respectively.

[0066] S3-S6 describe the process of encrypted classification of the pre-processed traffic data of S1-S2 using an encrypted traffic classification model, the overall structure of which is shown in Figure 3 .

[0067] The hierarchical attention network in S3 extracts content modal features from the packet level to the session level in turn, and the network architecture is shown in the hierarchical attention network module of Figure 3 .

[0068] S31, each row of the content matrix is iteratively extracted by using a distributed one-dimensional convolution module, and the content features of each packet payload are preliminarily extracted, wherein the distributed one-dimensional convolution is composed of two convolution layers and one max-pooling layer, and each distributed one-dimensional convolution module outputs a shape of 64x500;

[0069] S32, the content feature sequence output by S31 is sequentially given an attention weight by using a distributed attention mechanism, and each sequence point on the content feature sequence is sequentially weighted and summed to convert it into a high-purity content feature vector form, and the output shape is 1x64. The content feature sequence originally with a length of 500 is reduced to a vector with a length of 1 through the attention mechanism, effectively reducing the parameter operation amount. The calculation formula of the attention weight is:

[0070]

[0071] wherein u p is a trainable parameter, u i is a linear projection of the content feature sequence, and exp is an exponential operation with e as the base;

[0072] S33, each content feature vector obtained by S32 is stacked into a content feature sequence at the session level, and a bidirectional GRU module is used to model the content features at the session level to obtain the output content modal features, and the output shape is 20x100, wherein the dimensions correspond to the input sequence length and the number of neurons of the bidirectional GRU respectively.

[0073] S4, the time sequence cyclic network is constructed to extract the time sequence modal features, and the architecture is shown in the time sequence cyclic network module of Figure 3 , which includes a time convolution network module and a plurality of bidirectional GRU modules connected in turn.

[0074] S41, the time sequence matrix is preliminarily input into a time convolution network (TCN) module, short-term feature extraction is performed through multi-layer dilated causal convolution, and an identity mapping is constructed. Three layers are set with a power-increasing dilated coefficient of 2, and causal convolution is performed from a convolution kernel size of 2, 3 and 5 in sequence, so that the causality and dilatation are combined to ensure a short distance of the receptive field.

[0075] wherein the dilated causal convolution formula is:

[0076]

[0077] wherein l is an input time sequence matrix, d is a dilated coefficient, and f is a convolution kernel with a size of k.

[0078] S42, a bidirectional GRU module is used to capture long-term features of the time sequence matrix from the forward direction and the reverse direction, and output time sequence modal features are obtained, with a shape of 20x64.

[0079] In S5, a multi-modal fusion network is used to fuse the content modal features and the time sequence modal features, two equal-length modal feature sequences are spliced in the sequence dimension, point-to-point mode is used to complete more fine-grained modal fusion, and after fusion, the shape is 20x164. Then, a high-speed network is used to adaptively extract features in each modal, important features in each modal are further screened and filtered through a training gating mechanism, and high-level multi-modal features are obtained.

[0080] S6, based on the high-level multi-modal features obtained in S5, the features are reduced in dimension through a flatten operation and input into a fully connected output layer, are mapped into classification probabilities through a softmax function, and classification labels of the encrypted traffic are obtained.

[0081] The encrypted traffic classification method based on multi-modal learning in the embodiment collects encrypted traffic original data, generates rich heterogeneous information representation from effective sessions, extracts important features of the encrypted traffic from multiple aspects by constructing a payload modal and a statistical information modal, and effectively improves the classification performance of the encrypted traffic.

[0082] To verify the effectiveness of the encryption traffic method based on multi-modal learning proposed in the present application, the present embodiment selects the public encryption traffic dataset ISCXVPN2016 for verification, and selects other prior art methods for comparison. Based on the samples in the dataset, three groups of different fine-grained experimental scenarios are set: the first group of experiments is to distinguish the encryption type of traffic; the second group of experiments is to distinguish the application type generating encrypted traffic; and the third group of experiments is to distinguish the function type of traffic. The three experimental conditions all adopt ten-fold cross-validation method, mainly using two evaluation indexes: accuracy and F1 score, and the experimental results are shown in Table 1. The classification accuracy of the classification method of the present application in the three experimental scenarios is all above 99%, among which the accuracy and F1 score of the encryption type binary classification reach 99.86%. Compared with other technical methods in Table 1, the encryption traffic classification accuracy and F1 score of the present application are the highest.

[0083] Table 1: Classification of the method of the present application on the public encryption traffic dataset

[0084]

[0085] The above functions, if realized in the form of software function units and sold or used as independent products, can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application or the part of the technical solutions that essentially contribute to the prior art or the part of the technical solutions can be embodied in the form of a software product, which is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various program code storage media.

[0086] The above detailed the preferred embodiments of the present application. It should be understood that those skilled in the art can make many modifications and changes without creative labor according to the concept of the present application. Therefore, any technical solution obtained by logical analysis, reasoning, or limited experiments by those skilled in the art on the basis of the prior art according to the concept of the present application shall be within the protection scope determined by the claims.

Claims

1. A method for encrypted traffic classification based on multi-modal learning, characterized in that, The method comprises the following steps: S1, collecting target encrypted traffic data, and obtaining effective sessions through traffic division and data cleaning; S2, extracting heterogeneous information of the effective sessions, and constructing a multi-modal data set composed of a content matrix and a timing matrix; The S2 comprises the following steps: S21, selecting the first N data packets of each effective session in turn to represent the data of the whole session; S22, analyzing the byte content of each data packet, extracting the payload byte sequence of the transmission layer, and processing it into a fixed length of Ethernet MTU size M, thereby obtaining a content matrix of size N rows and M columns corresponding to each effective session; S23, analyzing the protocol header of each data packet, extracting the statistical information sequence of each data packet, the statistical information sequence including the arrival time interval, the data packet direction, the length and the TCP window size, and dimensionally splicing the four statistical information sequences to obtain a timing matrix of size N rows and 4 columns corresponding to each effective session, wherein the arrival time interval is determined by sequentially subtracting the arrival times of adjacent data packets, the data packet direction is determined by analyzing the IP address to infer the server and client identity, and the data packet length is determined by the length of the transmission layer payload sequence; S24, normalizing each element in the content matrix and the timing matrix, and dividing them into a training set and a test set according to a preconfigured proportion, for training and testing the hierarchical attention network, the timing recurrent network and the multi-modal fusion network; S3, based on the multi-modal data set, using the hierarchical attention network to extract content modal features from the data packet level to the session level in turn; The hierarchical attention network comprises a distributed one-dimensional convolution module, a distributed attention mechanism module and a bidirectional GRU module connected in turn, and the extraction of the content modal features based on the hierarchical attention network comprises the following steps: S31, using the distributed one-dimensional convolution module to iteratively process each row of the content matrix to extract the content features of the payload of each data packet at the data packet level; S32, using the distributed attention mechanism to assign attention weights to the content feature sequence output by S31 in turn, and sequentially weighting and summing the sequence points on each content feature sequence to convert them into high-purity content feature vectors; S33, stacking each content feature vector obtained by S32 into a content feature sequence at the session level, modeling the content features at the session level using the bidirectional GRU module, and outputting the content modal features; S4, based on the multi-modal data set, using the timing recurrent network to extract timing modal features of different granularities; S5, fusing the content modal features and the timing modal features based on the multi-modal fusion network, and extracting high-level multi-modal features using a high-speed network; S6, based on the high-level multi-modal features, outputting traffic classification probabilities through an output layer to realize encrypted traffic classification.

2. The method of claim 1, wherein, The S1 comprises the following steps: S11, using Wireshark to capture target encrypted traffic of a specified network interface to obtain a PCAP format raw traffic file; S12, using a hash data structure to divide each PCAP file into bidirectional sessions according to the five-tuple; S13, performing traffic data cleaning to filter out plaintext domain name resolution sessions; S14, delete ACK data packets in the TCP session, retransmit data packets, and remove the data link layer protocol header of all data packets to obtain a clean effective session.

3. The method of claim 2, wherein, The structure of the five-tuple is represented as <source IP address, destination IP address, source port, destination port, transport layer protocol>, wherein the source and destination directions are interchangeable.

4. The method of claim 1, wherein, The time sequence cycle network comprises sequentially connected time convolution network modules and bidirectional GRU modules, and the time sequence cycle network-based extraction of time sequence mode features specifically comprises the following steps: S41, inputting the time sequence matrix into the time convolution network module, performing short-term feature extraction through multi-layer dilated causal convolution, and constructing an identity mapping; S42, capturing long-term features from the forward and reverse directions based on the bidirectional GRU module, and outputting time sequence mode features.

5. The method of claim 1, wherein, The multi-modal fusion network in S5 considers that the content mode features and the time sequence mode features are both in sequence form, uses a point-to-point fusion mode to perform dimension splicing at each sequence point, and uses a high-speed network to adaptively extract multi-modal representations to obtain high-level multi-modal features.

6. The method of claim 1, wherein, S6 is specifically: reducing the dimension of the high-level multi-modal features through a flatten operation and inputting the high-level multi-modal features into a fully connected output layer, mapping the high-level multi-modal features into classification probabilities through a softmax function, obtaining classification labels of the encrypted traffic, and realizing encrypted traffic classification.

7. An encrypted traffic classification apparatus based on multi-modal learning, comprising a memory, a processor, and a program stored in the memory, characterized in that, The processor implements the method of any one of claims 1-6 when executing the program.

8. A storage medium having stored thereon a program, characterized by The program is executed to implement the method of any one of claims 1-6.

Images