A network traffic classification method and system

Abstract

The application relates to the technical field of flow data processing, and discloses a network flow classification method and system, the method comprising the following steps: acquiring network flow data, and extracting corresponding flows of the network flow data; dividing the flows into a plurality of sessions; aggregating sessions with the same communication direction into a grouping block; converting the grouping block into a two-dimensional gray grouping image; sequentially performing mode conversion and image recognition on the two-dimensional gray grouping image to obtain an image recognition text sequence; and using a classifier to classify the image recognition text sequence to obtain the application type of the network flow. The application can accurately detect and identify unknown network flow, and improves the classification effect and efficiency of the network flow.

Description

[0001] Technology Neighborhood

[0002] This invention relates to the field of traffic data processing technology, and more specifically, to a method and system for classifying network traffic. Background Technology

[0003] Network traffic classification has wide applications in today's internet, such as resource allocation, QoS provisioning, ISP billing, and anomaly detection. Accurate classification and identification of network traffic can greatly contribute to precise management of network resources, effective resource reuse, and the provision of personalized services.

[0004] Existing network traffic classification methods are based on traditional machine learning techniques and rely on packet-based or statistical feature-based designs. They require large labeled datasets for training. As unknown network traffic becomes more varied and complex, these traditional machine learning-based network traffic classification methods cannot accurately detect and identify unknown traffic, resulting in poor classification performance. Summary of the Invention

[0005] To overcome the shortcomings of existing technologies, such as the inability to accurately detect and identify unknown traffic and poor classification performance, the present invention proposes the following technical solution:

[0006] Firstly, this invention proposes a network traffic classification method, comprising:

[0007] Obtain network traffic data;

[0008] Extract the corresponding flow of the network traffic data; the flow is a group of communication packets that have the same source IP address, source port, destination IP address and destination port within a certain period of time;

[0009] According to preset rules, the stream is divided into several sessions;

[0010] Aggregate sessions with the same communication direction into a single packet block;

[0011] Convert the grouped blocks into two-dimensional grayscale grouped images;

[0012] An image recognizer using an integrated modality switching mechanism and a self-attention mechanism recognizes the two-dimensional grayscale grouped images to obtain an image-recognized text sequence;

[0013] The image-recognition text sequence is classified using a classifier to obtain the application type of the network traffic.

[0014] Secondly, this invention proposes a network traffic classification system, comprising:

[0015] The acquisition module is used to acquire network traffic data;

[0016] The extraction module is used to extract the corresponding stream of network traffic data; the stream is a group of communication packets that have the same source IP address, source port, destination IP address and destination port within a certain period of time;

[0017] The segmentation module is used to divide the stream into several sessions according to preset rules;

[0018] The aggregation module is used to aggregate sessions with the same communication direction into a single packet block.

[0019] A conversion module is used to convert the grouped blocks into two-dimensional grayscale grouped images;

[0020] The recognition module is used to recognize the two-dimensional grayscale grouped images using an image recognizer that integrates a modality conversion mechanism and a self-attention mechanism, thereby obtaining an image recognition text sequence;

[0021] The classification module is used to classify the image-recognized text sequence using a classifier to obtain the application type of the network traffic.

[0022] Compared with the prior art, the beneficial effects of the technical solution of the present invention include:

[0023] (1) By dividing flows with the same source IP address, source port, destination IP address and destination port into several sessions, and aggregating sessions with the same communication direction into a group block, traffic can be identified. This can better aggregate the deep information of the service flow, thereby improving the accuracy of traffic detection and identification and improving the classification effect.

[0024] (2) By converting the grouped blocks into two-dimensional grayscale grouped images and using an image recognizer with integrated modal conversion mechanism and self-attention mechanism to perform modal conversion and recognition of the two-dimensional grayscale grouped images, it is easier to capture the shift-invariant features of the two-dimensional grayscale grouped images, and it has higher parallelization and lower complexity, which can greatly improve the classification efficiency of network traffic. Attached Figure Description

[0025] Figure 1 This is a flowchart illustrating the network traffic classification method according to an embodiment of this application.

[0026] Figure 2 This is a schematic diagram illustrating the communication transmission of group blocks in an embodiment of this application.

[0027] Figure 3 This is a two-dimensional distribution matrix diagram of the grouped blocks in the embodiments of this application.

[0028] Figure 4 This is a diagram showing the overall architecture of the image recognizer in the embodiments of this application.

[0029] Figure 5 This is a framework diagram of the image recognizer classifying network traffic in the embodiments of this application.

[0030] Figure 6 This is an architecture diagram of the network traffic classification system according to an embodiment of this application. Detailed Implementation

[0031] The embodiments of the present invention will be described below with reference to the accompanying drawings and preferred technical solutions. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be understood that the preferred technical solutions are only for illustrating the present invention and are not intended to limit the scope of protection of the present invention.

[0032] It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. Therefore, the drawings only show the components related to the present invention and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0033] In the following description, numerous details are explored to provide a more thorough explanation of embodiments of the invention. However, it will be apparent to those skilled in the art that embodiments of the invention may be practiced without these specific details. In other embodiments, well-known structures and devices are shown in block diagram form rather than in detail to avoid obscuring embodiments of the invention.

[0034] Specifically, Figure 1 This is a flowchart illustrating the network traffic classification method provided in an embodiment of this application.

[0035] like Figure 1 As shown, the recommended method for this in-vehicle electronic instruction manual includes the following steps:

[0036] S10: Obtain network traffic data.

[0037] Optionally, in one embodiment of this application, the network traffic data includes at least one of voice call traffic, video call traffic, file transfer traffic, instant messaging traffic, and web browsing traffic.

[0038] In this implementation, the publicly available OpenVPN dataset was used. This dataset contains traffic for five different application types: VoIP (voice calls), video (video calls), FT (file transfer), chat (instant messaging), and browsing (web browsing). Each application type of traffic has both normal and encrypted forms, with the encrypted traffic protected using the TLS protocol.

[0039] S20: Extract the corresponding flow of the network traffic data; the flow is a group of communication packets that have the same source IP address, source port, destination IP address and destination port within a certain period of time.

[0040] As can be understood, a flow refers to a group of communication packets that share the same source IP address, source port, destination IP address, and destination port within a certain period of time. A flow can be viewed as a single communication process. This embodiment uses a quadruple (source IP address, source port, destination IP address, and destination port) to distinguish different flows and saves each flow as a separate file.

[0041] S30: Divide the stream into several sessions according to preset rules.

[0042] Optionally, in one embodiment of this application, for training and testing machine learning models, this method divides the extracted sessions into a training set and a test set. The training set is used to train the model, and the test set is used to evaluate the model's generalization ability on unknown data. This method randomly divides the training set and test set in a 7:3 ratio, that is, 70% of the traffic for each application type is used as the training set and 30% as the test set.

[0043] Optionally, in one embodiment of this application, step S20 specifically includes:

[0044] S31: Set the communication time threshold T.

[0045] S32: Group two streams whose communication time interval is less than or equal to the communication time threshold T into the same session.

[0046] As is understandable, session tracking is a technique used to track user actions within a web application. Each user corresponds to a session, and identifying the associated session maintains the continuity and traceability of user data. When using quadruples directly for session tracking, to avoid creating an unlimited number of new sessions, consecutive quadruples for the same user need to be grouped into the same session.

[0047] In the specific implementation process, a communication time threshold T is set to determine whether two streams belong to the same session. In this embodiment, T = 30 seconds, that is, if the communication time interval between two streams does not exceed 30 seconds, they can be classified as the same session.

[0048] S40: Aggregate sessions with the same communication direction into a single packet block.

[0049] Optionally, in one embodiment of this application, sessions with uplink communication direction are aggregated into a packet block, or sessions with downlink communication direction are aggregated into a packet block.

[0050] Optionally, in one embodiment of this application, the packet block is represented by a tuple [length, size], where the length is the number of communication packets in the packet block and the size is the average byte size of the communication packets.

[0051] like Figure 2 As shown, this is a schematic diagram of communication transmission using packet blocks in an embodiment of this application. In the specific implementation process, for each packet in each session, two features are extracted based on its direction (positive for uplink traffic, negative for downlink traffic) and size (number of bytes). Then, sessions with the same communication direction are aggregated into a packet block, and the number of communication packets (length) and average byte size (size) in the packet block are calculated. Therefore, each packet block can be represented by a tuple [length, size]. For example, if there are two consecutive uplink communication packets in a session with sizes of 100B and 200B respectively, they can be aggregated into a packet block [2, 150]. In this way, each session can be converted into a sequence composed of multiple packet blocks.

[0052] It is understandable that by dividing flows with the same source IP address, source port, destination IP address, and destination port into several sessions, and aggregating sessions with the same communication direction into a block of packets to identify traffic, it is possible to better aggregate the deeper information of business flows, thereby improving the accuracy of traffic detection and identification and the classification effect.

[0053] S50: Convert the grouped blocks into two-dimensional grayscale grouped images.

[0054] In the specific implementation process, such as Figure 3As shown, this is a two-dimensional distribution matrix diagram of the grouped blocks in this embodiment of the application. The X-axis of the two-dimensional distribution matrix diagram represents the length of the grouped blocks, and its value ranges from 0 to L. If L is too large, the effective part will be compressed to the left side of the image; if L is too small, many grouped blocks will exceed the image range. Therefore, it is very important to choose a reasonable value of L. After observing grouped blocks with different traffic volumes, this embodiment sets the value of L between 10 and 150. The Y-axis of the two-dimensional distribution matrix represents the size of the block, with values ​​ranging from (-1500, 1500], totaling 3000 dimensions. Here, -1500 and 1500 correspond to the minimum and maximum MTU of Ethernet, respectively. To simplify calculations, this embodiment aggregates the Y-axis in units of K bytes, resulting in a Y-axis size M = 3000 / K. Therefore, the X-axis value set is {0, 1, ..., L}, and the Y-axis value set is {(-0.5MK, -(0.5M-1)K], ..., (-K, 0], (0, K], (K, 2K], ..., ((0.5M-1)K, 0.5Mk)]}. The grayscale value of each pixel in the two-dimensional grayscale block image represents the number of blocks of the corresponding length and size. For example, if the grayscale value at (4, 1200) is 7, it indicates that there are 7 blocks with a length of 4 and an average size of 1200 bytes.

[0055] Optionally, in one embodiment of this application, the two-dimensional grayscale grouped image is normalized to map each pixel value of the two-dimensional grayscale grouped image to the [0,1] interval.

[0056] Understandably, in order to keep the pixel values ​​of the grouped images within a reasonable range, this embodiment performs normalization processing on the grouped images. The normalized two-dimensional grayscale grouped images can be used as a two-dimensional grayscale image to represent the characteristics of each session in network traffic.

[0057] S60: An image recognizer using an integrated modality conversion mechanism and a self-attention mechanism recognizes the two-dimensional grayscale grouped images to obtain an image recognition text sequence.

[0058] Optionally, in one embodiment of this application, an image recognizer integrating a modality-transformation mechanism and a self-attention mechanism—MTED (Modality-Transform Block with integrated Encoder and Decoder)—is proposed, such as... Figure 4 and Figure 5 As shown, Figure 4 This is a diagram showing the overall architecture of the image recognizer in the embodiments of this application. Figure 5This is a framework diagram of the image recognizer performing network traffic classification in an embodiment of this application. The image recognizer includes a modality conversion module, an encoder, and a decoder connected in sequence; the modality conversion module is used to convert the input two-dimensional grayscale grouped image into an image sequence and transmit the image sequence to the encoder; the encoder is used to extract features from the input image sequence to obtain an image feature sequence; the decoder is used to recognize the input image feature sequence to obtain an image recognition text sequence.

[0059] Optionally, in one embodiment of this application, the modality conversion module includes multiple convolutional layers. The stride of each layer is set to 2, and the number of channels increases progressively by a factor of 2. This design ensures that the product of the height and the number of channels in each layer remains a constant dmodel. For each layer, given the width and height (w0, h0) of the input image, the width, height, and number of channels (w, h, c) of the nth layer can be obtained. After the last layer, a concatenation operation is applied to reshape the features of different channels into an image sequence. Each element of this image sequence has a dmodel dimension. This design allows for a unified input dimension when processing different types of input (e.g., images and text), thereby simplifying model design and training. Positional encoding is used in the modality conversion module to represent each position in the image sequence. The role of positional encoding is to provide contextual information for each position in the sequence, which is crucial for processing sequential data. The positional encoding function generates a periodically changing code using sine and cosine functions, which can generate a unique code for each position in the sequence.

[0060] Each element in the image sequence output by the modality conversion module has a dmodel dimension. This image sequence can be viewed as an encoding of the input image, containing spatial structural information and suitable for processing by self-attention models.

[0061] Understandably, by converting images into sequences, powerful self-attention models can be used to process this data. Self-attention models can globally focus on elements in the input sequence, meaning they can consider all other elements in the sequence while understanding one. This ability allows the model to capture long-range dependencies, which is crucial in both image and text processing. Through positional encoding, self-attention models can understand the location information of each element in the input sequence. This is essential for understanding the order and structural information in sequential data, especially when processing data like images and text.

[0062] Optionally, in one embodiment of this application, the encoder includes N sequentially connected coding blocks; each coding block includes a multi-head self-attention module, a feedforward fully connected layer, and a normalization layer connected in sequence; the multi-head self-attention module is used to perform a scaling dot product attention operation on the input image sequence to obtain an attention matrix; the attention matrix is ​​sequentially transformed and normalized by the feedforward fully connected layer and the normalization layer to obtain a second image sequence; the image sequence and the second image sequence are added together to obtain an image feature sequence.

[0063] Understandably, the multi-head self-attention module allows the encoder to collectively attend to information from different representational subspaces at different locations in an image sequence, similar to a convolutional layer applying a set of filters to extract various features. The multi-head self-attention module first passes each scaled dot-product attention through three different linear projections to project the query matrix, key matrix, and value matrix from the image sequence into a more discriminative representation. Then, stacked b-fold scaled dot-product attentions are performed in parallel, and the output of the multi-head self-attention module is concatenated to linear layers to obtain the final output:

[0064] The scaling dot product attention operation is applied to the input image sequence to obtain the attention matrix H, as shown in the following expression:

[0065]

[0066] h i =f(W i (q) q, W i (k) k, W i (v) v)

[0067] Where w0 is a learnable linear transformation parameter, h i Let represent the output of the i-th attention head in the multi-head self-attention module, b be the number of attention heads in the multi-head self-attention module, f(·) be the attention convergence function, q be the query of the image sequence, k be the key of the image sequence, v be the value of the image sequence, and W be the output of the i-th attention head in the multi-head self-attention module. i (q) W i (k) and W i (v) These are the query weight matrix, key weight matrix, and value weight matrix of the i-th attention head in the multi-head self-attention module, respectively.

[0068] Given a query q∈R q and m key-value pairs (k1, v1), ..., (k m v m ), where k i∈R k v i ∈R v Attention convergence function f(W) i (q) q W i (k) k, W i (v) v) is then expressed as a weighted sum of values, and its expression is as follows:

[0069]

[0070] The query q and key k i The attention weights (scalars) are obtained by mapping two vectors into scalars through the attention scoring function 'a', and then performing a softmax operation:

[0071]

[0072] Where m is the number of self-attention heads in the multi-head self-attention module, and a(·) is the attention scoring function.

[0073] Optionally, in one embodiment of this application, the decoder generates an image recognition text sequence based on the image feature sequence output by the encoder and the original input labels. For each original input label, a learnable character-level embedding is applied, converting each character into a multidimensional vector. The resulting multidimensional vector is combined with positional encoding to form the decoder input.

[0074] The decoder consists of N identical decoder blocks connected in sequence. Similar to the encoder, each decoder block comprises a second multi-head self-attention module, a feedforward fully connected layer, and a normalization layer connected in sequence, but with two differences. First, leveraging autoregressive properties, a second multi-head self-attention module with a masking mechanism is added to each decoder block to ensure that position predictions depend only on previously known outputs. This is achieved by masking (set to -∞) all values ​​in the softmax input corresponding to illegal connections. Second, the second multi-head self-attention module takes the keys and values ​​from the encoder output and the queries from the previous decoder block outputs, transforming the outputs into probabilities of character classes through linear projection and a softmax function.

[0075] It is understandable that by converting the grouped blocks into two-dimensional grayscale grouped images and using an image recognizer with integrated modality conversion and self-attention mechanisms to process the two-dimensional grayscale grouped images, it is easier to capture the shift-invariant features of the two-dimensional grayscale grouped images, and it has higher parallelism and lower complexity, which can greatly improve the classification efficiency of network traffic.

[0076] S70: Use a classifier to classify the image recognition text sequence to obtain the application type of the network traffic.

[0077] In this embodiment, a trained softmax classifier is used to convert the image recognition text sequence output by the decoder into the probability of each category, and the application type of the network traffic is determined based on the category with the highest probability.

[0078] In addition, this embodiment uses accuracy (ACC) as a metric to evaluate the classification accuracy of the softmax classifier.

[0079] The expression for accuracy (ACC) is as follows:

[0080]

[0081] Where A = {VoIP, Video, FT, Chat, Browse}, TP i and FP i These represent the number of true positives and false positives for category i, respectively.

[0082] Understandably, true positives (TP) and false positives (FP) represent the number of positive samples that are correctly classified and the number of negative samples that are incorrectly classified as positive, respectively.

[0083] Besides ACC, a confusion matrix can be used to better observe multi-class classification problems. In a confusion matrix, each row represents the true label, and each column represents the predicted label. The diagonal represents the correct prediction probability for each class. Precision, recall, and F1 score are also used. They are defined as follows:

[0084]

[0085]

[0086]

[0087] Next, the network traffic classification system proposed according to the embodiments of this application is described with reference to the accompanying drawings.

[0088] Figure 6 This is an architecture diagram of the network traffic classification system according to an embodiment of this application.

[0089] like Figure 6 As shown, the classification system includes: an acquisition module 100, an extraction module 200, a segmentation module 300, an aggregation module 400, a conversion module 500, an identification module 600, and a classification module 700.

[0090] The acquisition module 100 is used to acquire network traffic data; the extraction module 200 is used to extract the corresponding flow of the network traffic data; the flow is a group of communication packets with the same source IP address, source port, destination IP address and destination port within a certain period of time; the segmentation module 300 is used to divide the flow into several sessions according to preset rules; the aggregation module 400 is used to aggregate sessions with the same communication direction into a packet block; the conversion module 500 is used to convert the packet block into a two-dimensional grayscale packet image; the recognition module 600 is used to recognize the two-dimensional grayscale packet image using an image recognizer with integrated modality conversion mechanism and self-attention mechanism to obtain an image recognition text sequence; the classification module 700 is used to classify the image recognition text sequence using a classifier to obtain the application type of the network traffic.

[0091] It should be noted that the foregoing explanation of the network traffic classification method embodiment also applies to the in-vehicle electronic instruction manual recommendation device of this embodiment, and will not be repeated here.

[0092] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0093] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0094] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more N executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order according to the functions involved, as should be understood by those skilled in the art to which the embodiments of this application pertain.

[0095] It should be understood that the various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, the N steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any of the following techniques known in the art, or a combination thereof: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (FPGAs), field-programmable gate arrays (FPGAs), etc.

[0096] Those skilled in the art will understand that all or part of the steps of the methods described in the above embodiments can be implemented by a program instructing related hardware, and the program can be stored in a computer-readable storage medium. When executed, the program includes one or a combination of the steps of the method embodiments.

[0097] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, and are not intended to limit the implementation of the present invention. Those skilled in the art can make other variations or modifications based on the above description. It is neither necessary nor possible to exhaustively describe all embodiments here. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the claims of the present invention.

Claims

1. A method for classifying network traffic, characterized in that, include: Obtain network traffic data; Extract the corresponding flow from the network traffic data; The stream is a group of communication packets that have the same source IP address, source port, destination IP address, and destination port within a certain period of time; According to preset rules, the stream is divided into several sessions; Sessions with the same communication direction are aggregated into a block; the block is represented by a tuple [length, size], where the length is the number of communication packets in the block and the size is the average byte size of the communication packets; Convert the grouped blocks into two-dimensional grayscale grouped images; An image recognizer employing an integrated modality conversion mechanism and a self-attention mechanism recognizes the two-dimensional grayscale grouped images to obtain an image-recognized text sequence. The image recognizer comprises a modality conversion module, an encoder, and a decoder connected in sequence. The modality conversion module converts the input two-dimensional grayscale grouped images into an image sequence and transmits the image sequence to the encoder. The encoder extracts features from the input image sequence to obtain an image feature sequence. The decoder recognizes the input image feature sequence to obtain an image-recognized text sequence. The image-recognition text sequence is classified using a classifier to obtain the application type of the network traffic.

2. The network traffic classification method according to claim 1, characterized in that, According to preset rules, the stream is divided into several sessions, specifically including: Set a communication time threshold T; Two streams whose communication time interval is less than or equal to the communication time threshold T are grouped into the same session.

3. The network traffic classification method according to claim 1, characterized in that, The aggregation of sessions with the same communication direction into a single packet block specifically includes: Sessions with uplink communication can be aggregated into a single packet block, or sessions with downlink communication can be aggregated into a single packet block.

4. The network traffic classification method according to claim 1, characterized in that, After converting the grouped blocks into two-dimensional grayscale grouped images, the method further includes: The two-dimensional grayscale grouped image is normalized to map each pixel value of the two-dimensional grayscale grouped image to the [0,1] interval.

5. The network traffic classification method according to claim 1, characterized in that, The network traffic data includes at least one of voice call traffic, video call traffic, file transfer traffic, instant messaging traffic, and web browsing traffic.

6. The network traffic classification method according to claim 1, characterized in that, The encoder comprises N sequentially connected coding blocks; each coding block comprises a multi-head self-attention module, a feedforward fully connected layer, and a normalization layer sequentially connected. The multi-head self-attention module is used to perform a scaling dot product attention operation on the input image sequence to obtain an attention matrix; The attention matrix is ​​sequentially transformed and normalized through the feedforward fully connected layer and the normalization layer to obtain the second image sequence; The image sequence and the second image sequence are added together to obtain the image feature sequence.

7. The network traffic classification method according to claim 6, characterized in that, The input image sequence is subjected to a scaled dot product attention operation to obtain the attention matrix. H The expression is as follows: in, For learnable linear transformation parameters, Indicating the first in the multi-head self-attention module i The output of each attention head, b This refers to the number of attention heads in a multi-head self-attention module. Attention convergence function For image sequence queries, As the key of the image sequence, The values ​​of the image sequence, , and These are the first in the multi-head self-attention module. i The query weight matrix, key weight matrix, and value weight matrix for each attention head; Attention convergence function The expression is as follows: = in, This represents the number of self-attention heads in the multi-head self-attention module. This is the attention scoring function.

8. A network traffic classification system, applied to the network traffic classification method as described in any one of claims 1 to 7, characterized in that, include: The acquisition module is used to acquire network traffic data; The extraction module is used to extract the corresponding streams from network traffic data; The stream is a group of communication packets that have the same source IP address, source port, destination IP address, and destination port within a certain period of time; The segmentation module is used to divide the stream into several sessions according to preset rules; The aggregation module is used to aggregate sessions with the same communication direction into a single packet block. A conversion module is used to convert the grouped blocks into two-dimensional grayscale grouped images; The recognition module is used to recognize the two-dimensional grayscale grouped images using an image recognizer that integrates a modality conversion mechanism and a self-attention mechanism, thereby obtaining an image recognition text sequence; The classification module is used to classify the image-recognized text sequence using a classifier to obtain the application type of the network traffic.

Images