A VPN encrypted traffic service classification device and method

Abstract

This application discloses a VPN encrypted traffic service classification device and method. The deep learning classification model includes a preprocessing module, a feature extraction module, and a classification module. The preprocessing module converts each length scalar in a bidirectional flow message length sequence into a feature vector by embedding an operator lookup table to obtain an extended length sequence. The feature extraction module performs local feature extraction on the extended length sequence to obtain multiple length sequence features, and then performs global feature encoding and feature length transformation on the length sequence features to obtain a feature extraction sequence. The classification module classifies the feature extraction sequence to obtain a classification result that characterizes the probability distribution of the bidirectional flow message length sequence belonging to different services. By inputting the VPN encrypted flow message length sequence into the deep learning classification model and combining the design concept of "local-global feature extraction", the service to which the length sequence belongs is classified.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a VPN encrypted traffic service classification device and method. Background Art

[0002] A Virtual Private Network (VPN) is a technology that establishes a dedicated channel over a public network for end-to-end communication. In today's network environment, especially in enterprise networks, VPNs provide users with convenient remote access channels. With the current surge in demand for remote learning and working, VPNs are becoming increasingly widespread and frequent.

[0003] However, while VPN technology ensures that legitimate users can achieve remote access quickly and easily, it also provides convenience for criminals to carry out illegal activities. Due to the characteristic of VPN that hides the actual communication address during the communication process, some users with ulterior motives try to use it to evade network supervision and then engage in some illegal and criminal activities, which brings huge challenges to my country's network security.

[0004] Because mainstream commercial VPN tools such as Express VPN and Nord VPN are difficult to obtain and easily identified using abnormal node fingerprint libraries, many users have turned to subscribing to external virtual private servers (VPSs) and building private VPNs within them to evade network regulations. These self-built VPNs have more dispersed nodes and use more diverse protocols, placing even higher demands on already stringent VPN regulations. Current academic research on the classification of encrypted traffic services primarily focuses on non-VPN encrypted traffic scenarios and SSL / OpenVPN encrypted traffic scenarios. Furthermore, due to the more random byte distribution and more chaotic global sequence characteristics of private strongly obfuscated VPN encrypted traffic, currently established and efficient methods for classifying other types of encrypted traffic cannot be effectively applied to the task of classifying private strongly obfuscated VPN encrypted traffic, making refined classification research even more difficult. Therefore, how to address the problem of private strongly obfuscated VPN encrypted traffic having a more random byte distribution and chaotic global characteristics, which makes refined service classification difficult, has become a challenge for those skilled in the art. Summary of the Invention

[0005] The purpose of this application is to overcome the existing technical defects and provide a VPN encrypted traffic service classification device and method, which inputs the VPN encrypted flow message length sequence into a deep learning classification model and combines the design idea of ​​"local-global feature extraction" to classify the services to which the length sequence belongs.

[0006] The purpose of this application is achieved through the following technical solutions:

[0007] In a first aspect, the present application proposes a VPN encrypted traffic service classification device, which is applied to a deep learning classification model, wherein the deep learning classification model includes a preprocessing module, a feature extraction module, and a classification module;

[0008] The preprocessing module converts each length scalar in the bidirectional flow message length sequence into a feature vector by embedding an operator lookup table, obtains an extended length sequence and sends it to the feature extraction module;

[0009] The feature extraction module performs local feature extraction on the extended length sequence to obtain multiple length sequence features, performs global feature encoding and feature length transformation on the length sequence features to obtain a feature extraction sequence, and sends the sequence to the classification module;

[0010] The classification module performs classification processing on the feature extraction sequence to obtain a classification result, where the classification result represents the probability distribution of the bidirectional flow message length sequence belonging to different services.

[0011] In an optional embodiment, the feature extraction module includes a local feature extraction layer, the local feature extraction layer includes a plurality of local feature extraction units, each of the local feature extraction units includes a 1D convolution operator, an activation function layer, a layer normalization and a fully connected layer;

[0012] The 1D convolution operator is used to extract local features of the extended length sequence;

[0013] The activation function module is used to perform nonlinear transformation;

[0014] The layer normalization is used to normalize the result of summing the extended length sequence and the extended length sequence extracted by the 1D convolution operator;

[0015] The fully connected layer is used to increase the complexity of the deep learning classification model.

[0016] In an optional embodiment, the feature extraction module further includes a global feature extraction layer, the global feature extraction layer includes a Transformer unit, and the Transformer unit has an adaptive weight adjustment capability to classify the services corresponding to the multiple length sequence features.

[0017] In an optional embodiment, the Transformer unit includes an encoder and a decoder, the encoder is used to extract and encode global features of multiple input length sequence features, and the decoder is used to perform feature length transformation on the global features extracted by the encoder and the input signal of the decoder to obtain a feature extraction sequence.

[0018] In an optional embodiment, the convolution kernel used by the local feature extraction unit is larger than the value used by ResNet.

[0019] In an optional embodiment, the classification module includes a stacked fully connected layer and a softmax layer;

[0020] The stacked fully connected layer is used to convert the feature extraction sequence into a two-dimensional matrix, and the two-dimensional matrix is ​​processed by multiple groups of fully connected layers. A nonlinear activation function is placed between each two groups of fully connected layers for activation, and the number of categories to be classified is output;

[0021] The softmax layer uses a softmax function to obtain the probability that the number of categories to be classified belongs to each business.

[0022] In an optional implementation, the calculation process of the softmax function is:

[0023]

[0024] where X={x1,x2,…,x n} is the number of categories to be classified.

[0025] In a second aspect, the present application proposes a VPN encrypted traffic service classification method, including:

[0026] Each length scalar in the bidirectional flow message length sequence is converted into a feature vector by embedding the operator lookup table to obtain an extended length sequence;

[0027] Performing local feature extraction on the extended length sequence to obtain multiple length sequence features, and performing global feature encoding and feature length transformation on the length sequence features to obtain a feature extraction sequence;

[0028] Classification processing is performed on the feature extraction sequence to obtain a classification result, where the classification result represents the probability distribution of the bidirectional flow message length sequence belonging to different services.

[0029] In a third aspect, the present application further proposes a computer device comprising a processor and a memory, wherein the memory stores a computer program, and the computer program is loaded and executed by the processor to implement the VPN encrypted traffic service classification method as described in the second aspect.

[0030] In a fourth aspect, the present application further proposes a computer-readable storage medium, wherein the storage medium stores a computer program, and the computer program is loaded and executed by a processor to implement the VPN encrypted traffic service classification method as described in the second aspect.

[0031] The above-mentioned main scheme of this application and its further options can be freely combined to form multiple schemes, all of which are schemes that can be adopted and protected by this application; and in this application, (non-conflicting options) can also be freely combined with each other and with other options. After understanding the scheme of this application, those skilled in the art will understand that there are many combinations based on existing technology and common knowledge, all of which are technical solutions to be protected by this application, and they are not exhaustive here.

[0032] This application discloses a VPN encrypted traffic service classification device and method. The deep learning classification model includes a preprocessing module, a feature extraction module, and a classification module. The preprocessing module converts each length scalar in a bidirectional flow message length sequence into a feature vector by embedding an operator lookup table to obtain an extended length sequence. The feature extraction module performs local feature extraction on the extended length sequence to obtain multiple length sequence features, and then performs global feature encoding and feature length transformation on the length sequence features to obtain a feature extraction sequence. The classification module classifies the feature extraction sequence to obtain a classification result that characterizes the probability distribution of the bidirectional flow message length sequence belonging to different services. By inputting the VPN encrypted flow message length sequence into the deep learning classification model and combining the design concept of "local-global feature extraction", the service to which the length sequence belongs is classified. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 A structural diagram of the deep learning classification model proposed in an embodiment of the present application is shown.

[0034] Figure 2 A schematic structural diagram of a local feature extraction unit proposed in an embodiment of the present application is shown.

[0035] Figure 3 A schematic diagram of the structure of the Transformer unit proposed in an embodiment of the present application is shown.

[0036] Figure 4 A structural diagram of the classification module proposed in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0037] The following describes the embodiments of the present application through specific examples. Those skilled in the art can easily understand the other advantages and effects of the present application from the content disclosed in this specification. The present application can also be implemented or applied through other different specific embodiments. The details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present application. It should be noted that the following embodiments and features in the embodiments can be combined with each other unless they conflict.

[0038] Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making any creative work shall fall within the scope of protection of this application.

[0039] In the existing technology, the byte distribution of VPN encrypted traffic is more random and the global sequence characteristics are more chaotic than those of non-VPN encrypted traffic. As a result, the mature and efficient methods for classifying other types of encrypted traffic services cannot be well applied to the task of classifying private strongly obfuscated VPN encrypted traffic services, making refined classification research more difficult.

[0040] As an example to solve the above problems, this application proposes a VPN encrypted traffic service classification device and method. By constructing a deep learning classification model to classify the services to which VPN encrypted traffic belongs, it can achieve an effect with high classification accuracy, which is described in detail below.

[0041] The embodiment of the present application proposes a VPN encrypted traffic service classification device, which is implemented through a deep learning classification model. Please refer to Figure 1 , Figure 1 A structural schematic diagram of the deep learning classification model proposed in an embodiment of the present application is shown. The deep learning classification model includes a preprocessing module, a feature extraction module and a classification module, and the preprocessing module, feature extraction module and classification module are connected in sequence.

[0042] The preprocessing module converts each length scalar in the bidirectional flow message length sequence into a feature vector by embedding an operator lookup table, obtains an extended length sequence and sends it to the feature extraction module.

[0043] The feature extraction module performs local feature extraction on the extended length sequence to obtain multiple length sequence features, performs global feature encoding and feature length transformation on the length sequence features to obtain a feature extraction sequence, and sends it to the classification module.

[0044] The classification module classifies the feature extraction sequence to obtain a classification result, which represents the probability distribution of the bidirectional flow message length sequence belonging to different services.

[0045] Bidirectional flow message length sequence I=[p1,p2,…,pn ] is n, the length of the upstream message is the original length of the bidirectional flow message, and the length of the downstream message is the sum of the maximum transmission unit MTU and the original length, to ensure that each length scalar in the bidirectional flow message length sequence is greater than or equal to zero (p i ≥0), which is convenient for specific implementation.

[0046] The preprocessing module embeds the operator and looks up the table to convert each length scalar p in the bidirectional flow message length sequence into i Expand into a feature vector To improve the expressive power of the input, and for a length scalar of length p, the corresponding vector is Finally, we get the matrix During each backpropagation, the matrix in the operator is also updated in real time, allowing the embedding operator to adapt to various inputs.

[0047] The feature extraction module includes multiple local feature extraction layers. The function of the local feature extraction layer is to obtain the local data interaction pattern in a small range and use more efficient convolution operations to extract the length sequence features within each smaller window.

[0048] The local feature extraction layer includes multiple local feature extraction units, combined with Figure 1 Please refer to Figure 2 , Figure 2 A structural schematic diagram of the local feature extraction unit proposed in an embodiment of the present application is shown. Each local feature extraction unit includes a 1D convolution operator, an activation function layer, a layer normalization, and a fully connected layer. The order of signal processing is: 1D convolution operator, activation function layer, layer normalization, fully connected layer, and activation function layer.

[0049] The 1D convolution operator is used to extract local features of the extended length sequence, the activation function module is used to perform nonlinear transformation, the layer normalization is used to normalize the result of summing the extended length sequence and the extended length sequence extracted by the 1D convolution operator, and the fully connected layer is used to increase the complexity of the deep learning classification model.

[0050] The local feature extraction layer first performs a local feature extraction on the extended length sequence through the 1D convolution operator, and then performs a nonlinear transformation through the activation function ReLU in the activation function module. The second local feature extraction is performed through the 1D convolution operator of the next layer. The value obtained by the second local feature extraction is summed with the input extended length sequence and sent to the layer normalization for normalization. After that, the complexity of the deep learning classification model is increased through the fully connected layer, and finally the output is transformed nonlinearly through the activation function ReLU in the activation function module.

[0051] Since the packet length pattern within a small range is relatively fixed in the traffic length sequence, it is very likely that the convolution kernel size cannot completely cover a request response, resulting in the extracted local features being meaningless. To solve this problem, the convolution kernel used by the local feature extraction unit is pre-set to be larger than the value used by ResNet. In this case, a relatively large receptive field can be obtained.

[0052] The feature extraction module also includes multiple global feature extraction layers, which are primarily used to integrate local feature information to obtain higher-dimensional information representations, thereby improving model classification accuracy. Each global feature extraction layer includes a Transformer unit, which has adaptive weight adjustment capabilities and can classify services corresponding to sequence features of multiple lengths. Furthermore, the Transformer unit also has Seq2Seq features, which can still preserve sequence characteristics and facilitate stacking.

[0053] Please refer to Figure 3 , Figure 3 A structural schematic diagram of the Transformer unit proposed in an embodiment of the present application is shown. The Transformer unit includes an encoder and a decoder. The encoder is used to extract and encode global features of multiple input length sequence features, and the decoder is used to perform feature length conversion on the global features extracted by the encoder and the input signal of the decoder to obtain a feature extraction sequence.

[0054] The encoder consists of a position information encoding layer and multiple attention structure layers. The position information encoding layer includes a position information encoding operator, and the attention structure layer includes a multi-head attention mechanism operator, layer normalization, and a fully connected layer. It can extract and encode the features of the input sequence. The decoder includes a multi-head attention mechanism operator, layer normalization, and a fully connected layer. It can fuse and transform the features extracted by the encoder with the decoder input to obtain the final decoded result.

[0055] Please refer to Figure 4 , Figure 4 The structural diagram of the classification module proposed in this application is shown. The classification module includes stacked fully connected layers and softmax layers. The stacked fully connected layers are used to convert the feature extraction sequence into a two-dimensional matrix. The two-dimensional matrix is ​​processed by multiple groups of fully connected layers. There is a layer of nonlinear activation function between each two groups of fully connected layers for activation, and the number of categories to be classified is output. The softmax layer uses the softmax function to obtain the probability that the number of categories to be classified belongs to each business.

[0056] The classification module first flattens the feature extraction sequence by stacking fully connected layers, converting the feature extraction sequence (three-dimensional tensor) into a two-dimensional matrix to adapt to the calculation of the fully connected layer. The fully connected layer is combined with the nonlinear activation function ReLU to process the data. The last fully connected layer outputs the number of categories to be classified to the softmax layer. The softmax function is used to obtain the probability P = {p1, p2, ..., p n}.

[0057] The calculation process of the softmax function is:

[0058]

[0059] where X={x1,x2,…,x n} is the number of categories to be classified.

[0060] In order to better illustrate the above-mentioned VPN encrypted traffic service classification device, in a possible embodiment, the experimental code is deployed on a physical machine. The CPU of the selected machine is AMD Ryzen 9 5950X (16C32T), the GPU is RTX3090 (24GB), the memory is 64GB, the operating system and version used are Ubuntu 20.04 focal, the kernel version is 5.4.0-96-generic, the cuda version is cuda11.1, the program code is mainly written in python and pytorch, the Python version used is python 3.8.5, and the Pytorch version is 1.8.1+cu111.

[0061] The services selected in this application are common web browsing, audio and video streaming, text chat, audio and video chat, and other five categories. To ensure the balance of the data set, the data volume of each service type is controlled to 800 streams, as shown in Table 1:

[0062] Table 1

[0063] serial number Business Type quantity 1 Text chat 800 2 Web browsing 800 3 Audio and video streaming 800 4 Audio and video chat 800 5 other 800

[0064] In addition, this application selected three classification methods with excellent classification performance for non-VPN encrypted traffic for comparative experiments with the classification method used by the classification device proposed in this application. These three classification methods are Pic-Net, FS-Net, and NGram-Net. In order to describe the overall classification of the model, the classification accuracy rate, which is independent of the category, is used to represent the proportion of samples correctly classified by the model. At the same time, the precision rate, recall rate, and F1-Score are used to describe the classification accuracy of the model for each category.

[0065] In addition, the average processing efficiency is used as an evaluation indicator of the model's processing speed for input data. The average processing efficiency is calculated by taking 100 input samples processed by a given model and deriving the average time it takes for them to belong to different categories. The unit is s / 10 6 samples.

[0066] Since the experiment cannot guarantee whether there will be other task loads that preempt the system computing resources during operation, it can ensure that the same processing efficiency comparison experiment runs in a roughly identical environment. Therefore, this indicator does not represent the absolute performance of the model, but only reflects the relative difference in the complexity of each model in each group of comparison experiments.

[0067] In order to minimize the impact of data set division on classification results, the experiment used a 5-fold cross-validation method to test classification performance. The final value of each indicator was the average of five experiments. The experimental results are shown in Table 2:

[0068] Table 2

[0069]

[0070] Through experimental comparison, it can be seen that the method proposed in this application has better classification accuracy in the classification task of VPN encrypted traffic business compared with the current mainstream excellent model applied to non-VPN encrypted traffic business classification.

[0071] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0072] First, using convolution operations to extract local features of the sequence can achieve better results under the premise of low complexity. Using Transformer to extract global features can adaptively fuse the results of different positions, thereby avoiding the impact of VPN global sequence feature confusion on the classification results, making the classification accuracy higher.

[0073] Second, by inputting the VPN encrypted flow message length sequence into the deep learning classification model and combining it with the design idea of ​​"local-global feature extraction", the services to which the length sequence belongs are classified.

[0074] In addition, this application also proposes a possible implementation of a VPN encrypted traffic service classification method, which is used to execute the various execution steps and corresponding technical effects of the VPN encrypted traffic service classification device shown in the above embodiments and possible implementations. Specifically, the VPN encrypted traffic service classification method is applied to the above-mentioned deep learning classification model and includes the following steps:

[0075] Each length scalar in the bidirectional flow message length sequence is converted into a feature vector by embedding an operator lookup table to obtain an extended length sequence.

[0076] Local feature extraction is performed on the extended length sequence to obtain multiple length sequence features, and global feature encoding and feature length transformation are performed on the length sequence features to obtain a feature extraction sequence.

[0077] The feature extraction sequence is classified to obtain a classification result, which represents the probability distribution of the bidirectional flow message length sequence belonging to different services.

[0078] This preferred embodiment provides a computer device that can implement the steps of any embodiment of the VPN encrypted traffic service classification method provided in the embodiments of the present application. Therefore, the beneficial effects of the VPN encrypted traffic service classification method provided in the embodiments of the present application can be achieved. Please refer to the previous embodiments for details and will not be repeated here.

[0079] Those skilled in the art will appreciate that all or part of the steps in the various methods of the above embodiments can be accomplished through instructions, or by controlling related hardware through instructions. The instructions can be stored in a computer-readable storage medium and loaded and executed by a processor. To this end, an embodiment of the present application provides a storage medium storing a plurality of instructions that can be loaded by a processor to execute the steps of any of the embodiments of the VPN encrypted traffic service classification method provided in the embodiments of the present application.

[0080] The storage medium may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0081] Since the instructions stored in the storage medium can execute the steps in the embodiment of the VPN encrypted traffic service classification method provided in the embodiment of the present application, the beneficial effects that can be achieved by the VPN encrypted traffic service classification method provided in the embodiment of the present application can be achieved. Please refer to the previous embodiment for details and will not be repeated here.

[0082] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A VPN encrypted traffic service classification device, characterized in that: The device is applied to a deep learning classification model, which includes a preprocessing module, a feature extraction module, and a classification module; The preprocessing module converts each length scalar in the bidirectional flow message length sequence into a feature vector by embedding an operator lookup table, obtains an extended length sequence and sends it to the feature extraction module; The feature extraction module performs local feature extraction on the extended length sequence to obtain multiple length sequence features, performs global feature encoding and feature length transformation on the length sequence features to obtain a feature extraction sequence, and sends it to the classification module; the feature extraction module includes a local feature extraction layer, the local feature extraction layer includes multiple local feature extraction units, each of the local feature extraction units includes a 1D convolution operator, an activation function layer, a layer normalization and a fully connected layer; The 1D convolution operator is used to extract local features of the extended length sequence; The activation function module is used to perform nonlinear transformation; The layer normalization is used to normalize the result of summing the extended length sequence and the extended length sequence extracted by the 1D convolution operator; The fully connected layer is used to increase the complexity of the deep learning classification model; The feature extraction module also includes a global feature extraction layer, which includes a Transformer unit. The Transformer unit has an adaptive weight adjustment capability and classifies the services corresponding to the multiple length sequence features. The Transformer unit includes an encoder and a decoder. The encoder is used to extract and encode global features of the input multiple length sequence features, and the decoder is used to perform feature length conversion on the global features extracted by the encoder and the input signal of the decoder to obtain a feature extraction sequence. The local feature extraction layer first extracts local features from the extended length sequence using a 1D convolution operator, then performs a nonlinear transformation using the activation function ReLU in the activation function module. A second local feature extraction is performed using the 1D convolution operator of the next layer. The value obtained from the second local feature extraction is summed with the input extended length sequence and sent to the layer normalization for normalization. The complexity of the deep learning classification model is then increased through a fully connected layer, and finally the output is transformed nonlinearly using the activation function ReLU in the activation function module. The classification module performs classification processing on the feature extraction sequence to obtain a classification result, where the classification result represents the probability distribution of the bidirectional flow message length sequence belonging to different services.

2. The VPN encrypted traffic service classification device according to claim 1, wherein: The convolution kernel used by the local feature extraction unit is larger than the value used by ResNet.

3. The VPN encrypted traffic service classification device according to claim 1, wherein: The classification module includes a stacked fully connected layer and a softmax layer; The stacked fully connected layer is used to convert the feature extraction sequence into a two-dimensional matrix, and the two-dimensional matrix is ​​processed by multiple groups of fully connected layers. A nonlinear activation function is placed between each two groups of fully connected layers for activation, and the number of categories to be classified is output; The softmax layer uses a softmax function to obtain the probability that the number of categories to be classified belongs to each business.

4. The VPN encrypted traffic service classification device according to claim 3, wherein: The calculation process of the softmax function is: where X={x1,x2,…,x n } is the number of categories to be classified.

5. A VPN encrypted traffic service classification method, characterized in that: The method is applied to the VPN encrypted traffic service classification device according to any one of claims 1 to 4, and the method comprises: Each length scalar in the bidirectional flow message length sequence is converted into a feature vector by embedding the operator lookup table to obtain an extended length sequence; Performing local feature extraction on the extended length sequence to obtain multiple length sequence features, and performing global feature encoding and feature length transformation on the length sequence features to obtain a feature extraction sequence; Classification processing is performed on the feature extraction sequence to obtain a classification result, where the classification result represents the probability distribution of the bidirectional flow message length sequence belonging to different services.

6. A computer device, characterized in that: The computer device includes a processor and a memory, wherein a computer program is stored in the memory, and the computer program is loaded and executed by the processor to implement the VPN encrypted traffic service classification method according to claim 5.

7. A computer-readable storage medium, characterized in that The storage medium stores a computer program, which is loaded and executed by a processor to implement the VPN encrypted traffic service classification method according to claim 5.

Images