Traffic message identification method and device, computing device, and computer storage medium

Abstract

The application discloses a traffic message identification method and device, a computing device and a computer storage medium, wherein the traffic message identification method comprises the following steps: identifying a traffic message according to an application fingerprint network to obtain an application fingerprint network identification result, wherein the application fingerprint network is used for discovering explicit rules of traffic message fields; inputting the traffic message into a deep learning network to obtain a deep learning network identification result, wherein the deep learning network is used for mining implicit relationships and high-order features among traffic message features; and weighting and merging the application fingerprint network identification result and the deep learning network identification result to obtain a traffic message identification result. The application discovers explicit rules of message fields by using the application fingerprint network to enhance the memory capacity of a model, meanwhile, the deep learning network is used for mining implicit relationships and high-order features among features to enhance the generalization capacity of the model, so that the expression capacity of the model and the generalization performance of the system are improved.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence, and specifically to a method and apparatus for identifying traffic packets, a computing device, and a computer storage medium. Background Technology

[0002] In recent years, with the advent of the Internet era, from 2G and 3G to 4G and 5G, the number of mobile devices and applications has increased dramatically, and the amount of behavioral data generated by users on the Internet has increased exponentially. At the same time, with the development of transmission technology, the difficulty of identifying the data generated by various application products on the traffic end has gradually increased.

[0003] Current industry traffic identification solutions typically utilize DPI (Deep Packet Inspection) devices to detect and analyze traffic and packet content at key network points. Traffic is identified based on predefined strategies and rules, including traffic collection, traffic filtering, HTTP traffic learning and analysis, and feature extraction.

[0004] However, the existing traffic identification technologies mentioned above have the following drawbacks: First, they cannot effectively identify encrypted traffic, especially data traffic generated by audio and video applications. Furthermore, encrypted traffic accounts for a very high proportion of overall traffic, and using the traditional DPI method will result in low coverage and accuracy. Second, they do not consider the increasing number of new traffic types, and there are no corresponding traffic rules to match frequently updated traffic types, thus lacking generalization ability. Third, the feature rule base on which traffic matching and identification depends cannot be automatically generated, or the cost of generating the feature rule base is high and the level of intelligence is insufficient. Summary of the Invention

[0005] In view of the above problems, the present invention is proposed to provide a method and apparatus for identifying traffic packets, a computing device and a computer storage medium for overcoming the problem of poor generalization in traffic identification.

[0006] According to one aspect of the present invention, a method for identifying traffic packets is provided, comprising:

[0007] The application fingerprint network is used to identify traffic packets to obtain the application fingerprint network identification result, wherein the application fingerprint network is used to discover explicit rules for traffic packet fields.

[0008] Traffic packets are input into a deep learning network to obtain the deep learning network recognition results, wherein the deep learning network is used to mine the implicit relationships and higher-order features between traffic packet features;

[0009] The application fingerprint network identification result and the deep learning network identification result are weighted and merged to obtain the traffic packet identification result.

[0010] In one alternative approach, the traffic message field includes at least one of the following fields:

[0011] The SNI field in the encrypted message;

[0012] The UA field, Host field, and Refer_URI field in an unencrypted message.

[0013] In one alternative approach, the step of identifying traffic packets based on the application fingerprint network to obtain the application fingerprint network identification result further includes:

[0014] Determine whether the traffic packet is an encrypted packet; if yes, extract the SNI field of the traffic packet and identify it based on the SNI field; if no, extract the UA field of the traffic packet and identify it based on the UA field.

[0015] If the determination fails, the Host field and / or Refer_URI field of the traffic packet are extracted, and identification is performed based on the Host field and / or Refer_URI field.

[0016] In one alternative approach, the step of inputting the traffic packets into the deep learning network to obtain the deep learning network recognition result further includes:

[0017] Feature extraction is performed on traffic packets to obtain traffic packet features;

[0018] The traffic packet characteristics include one or more of the following characteristics: server IP and port, UA field, HOST field, URI field, Refer_URI field, SNI field, and field fields in the decompiled file.

[0019] In an alternative approach, after obtaining the traffic packet characteristics, the method further includes:

[0020] The sequence representation vector corresponding to the traffic message features is masked according to a preset threshold.

[0021] In an alternative approach, the method further includes:

[0022] Collect historical traffic packets;

[0023] The application fingerprint network and deep learning network are trained based on historical traffic packets. Specifically, historical traffic packets are input into the application fingerprint network and deep learning network, and gradients are calculated using the loss function. The gradients are then backpropagated to the application fingerprint network and deep learning network to train their respective parameters. Training ends when the iteration conditions are met.

[0024] In an alternative approach, the outputs of the applied fingerprint network and the deep learning network are weighted and combined using the following formula:

[0025]

[0026] Where P represents the identification result of the traffic packet; w print To apply the weights of the fingerprint network; w deep The activation function of the last layer in a deep learning network The weights are denoted by x; x is the input to the applied fingerprint network; b is a constant.

[0027] According to another aspect of the present invention, a traffic packet identification device is provided, comprising:

[0028] An application fingerprint network module is used to identify traffic packets based on the application fingerprint network and obtain the application fingerprint network identification result, wherein the application fingerprint network is used to discover explicit rules for traffic packet fields.

[0029] A deep learning network module is used to input traffic packets into a deep learning network to obtain the deep learning network recognition results. The deep learning network is used to mine the implicit relationships and high-order features between traffic packet features.

[0030] The traffic packet identification module is used to weight and merge the application fingerprint network identification result and the deep learning network identification result to obtain the traffic packet identification result.

[0031] According to another aspect of the present invention, a computing device is provided, comprising: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus;

[0032] The memory is used to store at least one executable instruction, which causes the processor to perform the operation corresponding to the traffic packet identification method described above.

[0033] According to another aspect of the present invention, a computer storage medium is provided, the storage medium storing at least one executable instruction that causes a processor to perform an operation corresponding to the traffic packet identification method described above.

[0034] According to the solution provided by this invention, traffic packets are identified using an application fingerprint network to obtain an application fingerprint network identification result. The application fingerprint network is used to discover explicit rules in traffic packet fields. The traffic packets are then input into a deep learning network to obtain a deep learning network identification result. The deep learning network is used to mine implicit relationships and higher-order features between traffic packet features. The application fingerprint network identification result and the deep learning network identification result are weighted and merged to obtain the traffic packet identification result. This invention enhances the model's memory capacity by discovering explicit rules in packet fields using an application fingerprint network, and enhances the model's generalization ability by mining implicit relationships and higher-order features between features using a deep learning network, thereby improving the model's expressive power and the system's generalization performance.

[0035] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0036] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0037] Figure 1 A flowchart illustrating the traffic packet identification method according to an embodiment of the present invention is shown;

[0038] Figure 2 A flowchart illustrating a traffic packet identification method according to another embodiment of the present invention is shown;

[0039] Figure 3 A schematic diagram of the model structure of the traffic packet identification method according to an embodiment of the present invention is shown;

[0040] Figure 4 A schematic diagram of the structure of a traffic packet identification device according to an embodiment of the present invention is shown;

[0041] Figure 5 A schematic diagram of the structure of a computing device according to an embodiment of the present invention is shown. Detailed Implementation

[0042] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this invention will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

[0043] Before implementing the embodiments of the present invention, the technical terms used below are uniformly explained as follows:

[0044] DPI: Deep Packet Inspection (DPI) is a packet-based deep inspection technology that performs in-depth inspection of different network application layer payloads (such as HTTP, DNS, etc.), determining the legitimacy of packets by inspecting their payloads. The term "deep" refers to its depth compared to ordinary packet analysis. Ordinary packet inspection only analyzes the content below layer 4 of IP packets, including source address, destination address, source port, destination port, and protocol type; while DPI, in addition to the above layer analysis, adds application layer analysis, enabling it to identify various applications and their content.

[0045] UA: User Agent (UA) is a part of the HTTP protocol and is a component of the header field. UA is a special string header that enables the server to identify the client's operating system and version, CPU type, browser and version, browser rendering engine, browser language, browser plugins, etc.

[0046] SNI: Server Name Indication, is an extended TLS computer networking protocol that allows a client to tell the server it is connecting to the hostname at the start of the handshake process. This allows a server to use multiple different TLS certificates on the same IP address and TCP port number, and therefore allows multiple secure (HTTPS) websites (or any other TLS-based services) to be served on the same IP address without all of them needing to use the same TLS certificate.

[0047] Figure 1 A flowchart illustrating a traffic packet identification method according to an embodiment of the present invention is shown. This method identifies traffic packets based on an application fingerprint network and a deep learning network, enabling end-to-end joint identification of encrypted and unencrypted traffic packets. Specifically, the application fingerprint network discovers explicit rules in traffic packet fields to enhance the model's memory capacity, while the deep learning network mines implicit relationships and higher-order features between traffic packet features to enhance the model's generalization ability. Figure 1As shown, it includes the following steps:

[0048] Step S101: Identify traffic packets according to the application fingerprint network to obtain the application fingerprint network identification result, wherein the application fingerprint network is used to discover explicit rules of traffic packet fields.

[0049] Network user behavior data or data generated by various applications are transmitted in the form of traffic packets. Traffic devices can detect, analyze, and identify traffic packets at key network points (such as packet traffic category identification, anomaly detection and analysis, and risk identification and analysis). Traffic packets are encapsulated into packets, frames, and information segments during transmission. The information segment is a header that organizes information such as packet type, packet version, packet length, and packet entity in a certain format.

[0050] Traffic packets are generally divided into encrypted traffic packets and unencrypted traffic packets. In various applications such as audio, video, and file transfer, or in traffic packets generated using HTTPS (TLS), encrypted traffic packets account for a higher proportion, while unencrypted traffic packets are called unencrypted traffic packets.

[0051] The identification result of the traffic packets can be obtained by analyzing the display rules (such as field characteristics) of the fields in encrypted and unencrypted traffic packets. In this embodiment, for example... Figure 3 As shown, traffic packets are identified using an application fingerprint network to obtain the application fingerprint network identification result. Specifically, traffic packets are identified based on application fingerprint generation rules. The application fingerprint network can be a judgment, rule matching / reasoning system based on explicit rules and / or a knowledge base system. By discovering the rules displayed in the traffic packet fields through the application fingerprint network, the interpretability and accuracy of the system are enhanced. Here, application fingerprint refers to a traffic rule feature library of network applications summarized based on historical data analysis.

[0052] Step S102: Input the traffic packets into the deep learning network to obtain the deep learning network recognition results. The deep learning network is used to mine the implicit relationships and high-order features between traffic packet features.

[0053] As the types of traffic packets continue to increase or are frequently updated, the diversity of traffic packet features / feature combinations or implicit feature interactions are introduced, making it impossible for explicit rules based on traffic packet fields to completely and accurately identify traffic packets.

[0054] like Figure 3As shown, deep learning networks are used to mine implicit relationships and higher-order features among traffic packets. Since manual feature engineering is not required, this solves the problems of manual rule bases being unable to be automatically generated, being costly, and having low levels of intelligence. It also improves the system's coverage and generalization ability. Specifically, traffic packets are input into the deep learning network to obtain the network's recognition results.

[0055] In this implementation, by introducing a combined structure of application fingerprint network (which can also be understood as a shallow module) and deep learning network (which can also be understood as a deep module), the explicit high-order and implicit high-order interaction features of traffic packets are effectively combined, enabling end-to-end joint identification of encrypted and unencrypted traffic, and making the learning process have memory and generalization.

[0056] Step S103: The fingerprint network recognition result and the deep learning network recognition result are weighted and merged to obtain the traffic packet recognition result.

[0057] Because deep learning networks are non-linear, they obtain different weight vectors each time they are trained, resulting in different prediction results. They are often referred to as neural networks with high variance, and the prediction performance needs to be improved when using this model for prediction.

[0058] In this embodiment, to reduce the model variance of the deep learning network, the prediction results of the applied fingerprint network and the deep learning network are combined for a comprehensive judgment, which can reduce the prediction variance. Specifically, the identification results of the applied fingerprint network and the deep learning network are weighted and merged; or, the identification results of the applied fingerprint network and the deep learning network are weighted and averaged to obtain the identification result of the traffic packet.

[0059] Optionally, the network weights of the applied fingerprint network and the deep learning network can be averaged and fused (also known as model weight averaging) to produce a new single model that typically has better overall performance.

[0060] The solution provided by the above embodiments of the present invention discovers explicit rules in packet fields by applying fingerprint networks, and at the same time, mines implicit relationships and higher-order features between features by using deep learning networks. It effectively combines the explicit and implicit higher-order interaction features of traffic packets, and performs end-to-end joint identification of encrypted and unencrypted traffic, thereby improving the expressive power of the model and the generalization performance of the system.

[0061] Figure 2A flowchart illustrating a traffic packet identification method according to another embodiment of the present invention is shown. In this embodiment, the traffic packets are first identified based on an application fingerprint network to obtain the application fingerprint network identification result. The application fingerprint network is used to discover explicit rules for packet fields in encrypted and / or unencrypted packets. Further, the application fingerprint network identification specifically includes steps S201 to S204, detailed below:

[0062] In step S201, it is determined whether the traffic packet is an encrypted packet; if yes, step S202 is executed to extract the SNI field of the traffic packet and identify it based on the SNI field; if no, step S203 is executed to extract the UA field of the traffic packet and identify it based on the UA field; if the determination is unsuccessful, step S204 is executed to extract the Host field and / or Refer_URI field of the traffic packet and identify it based on the Host field and / or Refer_URI field.

[0063] For example, application traffic is identified by combining the UA, Host, and Refer_URI fields in unencrypted messages with the SNI field in encrypted messages. Corresponding fusion weights are set for the application fingerprint generation rules, and these rules are used to generate application fingerprints. Missing values ​​are filled using KNNImputer (a reliable missing value imputation method). For DPI traffic collected from mobile communication services (including HTTP and HTTPS protocol types), if the server IP port is "443", it is considered an encrypted flow (such as HTTPS); otherwise, it is considered an unencrypted flow. The application fingerprint generation rules and their corresponding network fusion weights are shown in Table 1.

[0064] Table 1

[0065]

[0066] Finally, the fusion weights of the applied fingerprint network can be expressed as W. print = [W1+W2+W3+W4+W5].

[0067] In step S205, the traffic packets are input into the deep learning network to obtain the deep learning network recognition result. The deep learning network is used to extract features from the traffic packets to obtain traffic packet features.

[0068] The displayed rule relationships obviously cannot completely and accurately identify network traffic packets. It is necessary to use a deep learning network to extract features from the traffic packets to obtain traffic packet features. These traffic packet features include at least one of the following features: server IP and port, UA field, HOST field, URI field, Refer_URI field, SNI field, and field fields in the decompiled file.

[0069] For example, deep learning models are used to supplement the implicit representations of the nine categories of string features. The specific feature extraction logic for the nine categories of strings is shown in Table 2:

[0070] Table 2

[0071]

[0072]

[0073] This embodiment uses the RoBERTa model as a deep learning network model and improves it. Specifically, the RoBERTa model is pre-trained and then the embedding is extracted. The output of the deep learning network is obtained after passing through several hidden layers. The parameter optimizer is AdaGrad.

[0074] Optionally, the pre-training part mainly includes the following three sub-tasks:

[0075] Task 1: Supervised task, directly using the model to fit the text training data.

[0076] Task 2: Unsupervised task, incorporating historical APP traffic data from the entire network (including labeled and unlabeled data) to perform a masked language model task.

[0077] Task 3: Combining Task 1 and Task 2, conduct Prompt (Learning) and / or Prompt (Tuning) fine-tuning.

[0078] In step S206, the sequence representation vector corresponding to the traffic packet features is masked according to a preset threshold.

[0079] To prevent overfitting of string-related information, the embedding sequence representation (i.e., the sequence representation vector corresponding to traffic packet features) output by the pre-trained model is processed with a mask (also known as a veil) with a threshold of τ (e.g., the default value is 0.9). That is, for extracted feature bits smaller than the threshold, they are directly set to 0 (or False), and for those larger than the threshold, they are directly set to 1 (or True). For example, the sequence representation vector (Seq_output) after masking is:

[0080] Seq_output=[0.98,-0.03,0.5,...]→[True,False,False,...]→[1,0,0,...]

[0081] In step S207, the fingerprint network recognition result and the deep learning network recognition result are weighted and merged to obtain the traffic packet recognition result.

[0082] In this embodiment, a weighted fusion method is adopted, which combines the recognition results of the applied fingerprint network and the deep learning network. The outputs of the two networks are combined using a weighted method, and the final output traffic packet recognition result is obtained through a softmax function with a temperature coefficient. Specifically, the outputs of the applied fingerprint network and the deep learning network are weighted and combined using the following formula:

[0083]

[0084] Where P represents the identification result of the traffic packet; w print To apply the weights of the fingerprint network; w deep The activation function a(l) in the last layer of the deep learning network f The weights of ) are: x is the input to the applied fingerprint network; b is a constant.

[0085] In one optional approach, historical traffic packets are collected; the application fingerprint network and the deep learning network are trained based on the historical traffic packets; wherein, the historical traffic packets are input into the application fingerprint network and the deep learning network, the gradient is calculated by combining the loss function, and backpropagation is performed on the application fingerprint network and the deep learning network to train their respective parameters, and the training ends when the iteration condition is met.

[0086] Specifically, during training, the gradient is calculated based on the final loss function and backpropagated to both the applied fingerprint network and the deep learning network, where their parameters are trained separately; that is, the two network parts are trained together. The training phase ends when the total number of iterations for the entire dataset reaches the upper limit set by `num_epoch`, or when the model has not received effective updates for a certain number of epochs, and the model is saved. This trained applied fingerprint-deep learning network model can be used to effectively predict the category of network traffic.

[0087] The solution provided by the above embodiments of the present invention enhances the model's memory ability by applying a fingerprint network to discover explicit rules of traffic packet fields, and enhances the model's generalization ability by mining implicit relationships and higher-order features between features through a deep learning network, thereby improving the model's expressive power and the system's generalization performance. The embedding sequence representation output by the pre-trained model is masked according to a preset threshold, reducing the overfitting problem that exists in the deep learning network model when extracting information. By training the fingerprint network and the deep learning network together, end-to-end joint identification of encrypted and unencrypted traffic packets is achieved, improving the level of intelligence. At the same time, rule matching also ensures the interpretability of the model.

[0088] Figure 4 A schematic diagram of the traffic packet identification device according to an embodiment of the present invention is shown. The traffic packet identification device 400 includes: an application fingerprint network module 410, a deep learning network module 420, and a traffic packet identification module 430.

[0089] The application fingerprint network module 410 is used to identify traffic packets according to the application fingerprint network and obtain the application fingerprint network identification result, wherein the application fingerprint network is used to discover explicit rules of traffic packet fields.

[0090] The deep learning network module 420 is used to input traffic packets into the deep learning network to obtain the deep learning network recognition result, wherein the deep learning network is used to mine the implicit relationship and high-order features between traffic packet features;

[0091] The traffic packet identification module 430 is used to weight and merge the application fingerprint network identification result and the deep learning network identification result to obtain the traffic packet identification result.

[0092] In one alternative approach, the traffic message field includes at least one of the following fields:

[0093] The SNI field in the encrypted message;

[0094] The UA field, Host field, and Refer_URI field in an unencrypted message.

[0095] In an alternative embodiment, the application fingerprint network module 410 is further configured to:

[0096] Determine whether the traffic packet is an encrypted packet; if yes, extract the SNI field of the traffic packet and identify it based on the SNI field; if no, extract the UA field of the traffic packet and identify it based on the UA field.

[0097] If the determination fails, the Host field and / or Refer_URI field of the traffic packet are extracted, and identification is performed based on the Host field and / or Refer_URI field.

[0098] In an alternative embodiment, the deep learning network module 420 is further configured to:

[0099] Feature extraction is performed on traffic packets to obtain traffic packet features;

[0100] The traffic packet characteristics include one or more of the following characteristics: server IP and port, UA field, HOST field, URI field, Refer_URI field, SNI field, and field fields in the decompiled file.

[0101] In an alternative embodiment, the deep learning network module 420 is further configured to:

[0102] The sequence representation vector corresponding to the traffic message features is masked according to a preset threshold.

[0103] In an alternative embodiment, the traffic packet identification module 430 is further configured to:

[0104] Collect historical traffic packets;

[0105] The application fingerprint network and deep learning network are trained based on historical traffic packets. Specifically, historical traffic packets are input into the application fingerprint network and deep learning network, and gradients are calculated using the loss function. The gradients are then backpropagated to the application fingerprint network and deep learning network to train their respective parameters. Training ends when the iteration conditions are met.

[0106] In an alternative embodiment, the traffic packet identification module 430 is further configured to:

[0107] The outputs of the applied fingerprint network and the deep learning network are weighted and combined using the following formula:

[0108]

[0109] Where P represents the identification result of the traffic packet; w print To apply the weights of the fingerprint network; w deep The activation function of the last layer in a deep learning network The weights are denoted by x; x is the input to the applied fingerprint network; b is a constant.

[0110] The solution provided by the above embodiments of the present invention enhances the model's memory ability by applying a fingerprint network to discover explicit rules of traffic packet fields, and enhances the model's generalization ability by mining implicit relationships and higher-order features between features through a deep learning network, thereby improving the model's expressive power and the system's generalization performance. The embedding sequence representation output by the pre-trained model is masked according to a preset threshold, reducing the overfitting problem that exists in the deep learning network model when extracting information. By training the fingerprint network and the deep learning network together, end-to-end joint identification of encrypted and unencrypted traffic packets is achieved, improving the level of intelligence. At the same time, rule matching also ensures the interpretability of the model.

[0111] Figure 5 The diagram shows a structural schematic of an embodiment of the computing device of the present invention. The specific embodiments of the present invention do not limit the specific implementation of the computing device.

[0112] like Figure 5 As shown, the computing device may include: a processor 502, a communications interface 504, a memory 506, and a communications bus 508.

[0113] The processor 502, communication interface 504, and memory 506 communicate with each other via communication bus 508. Communication interface 504 is used to communicate with other network elements, such as clients or other servers. Processor 502 executes program 510, specifically performing the relevant steps described in the embodiment of the traffic packet identification method.

[0114] Specifically, program 510 may include program code that includes computer operation instructions.

[0115] Processor 502 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention. The computing device includes one or more processors, which may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0116] Memory 506 is used to store program 510. Memory 506 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0117] Specifically, program 510 can be used to cause processor 502 to perform the following operations:

[0118] The application fingerprint network is used to identify traffic packets to obtain the application fingerprint network identification result, wherein the application fingerprint network is used to discover explicit rules for traffic packet fields.

[0119] Traffic packets are input into a deep learning network to obtain the deep learning network recognition results, wherein the deep learning network is used to mine the implicit relationships and higher-order features between traffic packet features;

[0120] The application fingerprint network identification result and the deep learning network identification result are weighted and merged to obtain the traffic packet identification result.

[0121] In one alternative approach, the traffic message field includes at least one of the following fields:

[0122] The SNI field in the encrypted message;

[0123] The UA field, Host field, and Refer_URI field in an unencrypted message.

[0124] In an alternative manner, the program 510 causes the processor to perform the following operations:

[0125] Determine whether the traffic packet is an encrypted packet; if yes, extract the SNI field of the traffic packet and identify it based on the SNI field; if no, extract the UA field of the traffic packet and identify it based on the UA field.

[0126] If the determination fails, the Host field and / or Refer_URI field of the traffic packet are extracted, and identification is performed based on the Host field and / or Refer_URI field.

[0127] In an alternative manner, the program 510 causes the processor to perform the following operations:

[0128] Feature extraction is performed on traffic packets to obtain traffic packet features;

[0129] The traffic packet characteristics include one or more of the following characteristics: server IP and port, UA field, HOST field, URI field, Refer_URI field, SNI field, and field fields in the decompiled file.

[0130] In an alternative manner, the program 510 causes the processor to perform the following operations:

[0131] The sequence representation vector corresponding to the traffic message features is masked according to a preset threshold.

[0132] In an alternative manner, the program 510 causes the processor to perform the following operations:

[0133] Collect historical traffic packets;

[0134] The application fingerprint network and deep learning network are trained based on historical traffic packets. Specifically, historical traffic packets are input into the application fingerprint network and deep learning network, and gradients are calculated using the loss function. The gradients are then backpropagated to the application fingerprint network and deep learning network to train their respective parameters. Training ends when the iteration conditions are met.

[0135] In an alternative manner, the program 510 causes the processor to perform the following operations:

[0136] The outputs of the applied fingerprint network and the deep learning network are weighted and combined using the following formula:

[0137]

[0138] Where P represents the identification result of the traffic packet; w print To apply the weights of the fingerprint network; w deep The activation function a(l) in the last layer of the deep learning network f The weights of ) are: x is the input to the applied fingerprint network; b is a constant.

[0139] The solution provided by the above embodiments of the present invention enhances the model's memory ability by applying a fingerprint network to discover explicit rules of traffic packet fields, and enhances the model's generalization ability by mining implicit relationships and higher-order features between features through a deep learning network, thereby improving the model's expressive power and the system's generalization performance. The embedding sequence representation output by the pre-trained model is masked according to a preset threshold, reducing the overfitting problem that exists in the deep learning network model when extracting information. By training the fingerprint network and the deep learning network together, end-to-end joint identification of encrypted and unencrypted traffic packets is achieved, improving the level of intelligence. At the same time, rule matching also ensures the interpretability of the model.

[0140] This invention provides a non-volatile computer storage medium storing at least one executable instruction that can execute the traffic packet identification method in any of the above method embodiments.

[0141] The algorithms or displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used in conjunction with the teachings herein. The required structure for constructing such systems is apparent from the above description. Furthermore, the embodiments of the present invention are not directed to any particular programming language. It should be understood that the content of the invention described herein can be implemented using various programming languages, and the above description of specific languages ​​is for the purpose of disclosing the best mode of implementation of the invention.

[0142] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0143] Similarly, it should be understood that, in order to simplify the invention and aid in understanding one or more of the various inventive aspects, features of the embodiments of the invention are sometimes grouped together in a single embodiment, figure, or description thereof in the above description of exemplary embodiments of the invention. However, this disclosure should not be construed as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as reflected in the following claims, inventive aspects lie in fewer than all features of a single foregoing disclosed embodiment. Therefore, the claims following the detailed description are hereby expressly incorporated into this detailed description, wherein each claim itself is a separate embodiment of the invention.

[0144] Those skilled in the art will understand that modules in the device of the embodiments can be adaptively changed and placed in one or more devices different from that embodiment. Modules, units, or components in the embodiments can be combined into a single module, unit, or component, and further, they can be divided into multiple sub-modules, sub-units, or sub-components. Except where at least some of such features and / or processes or units are mutually exclusive, any combination can be used to combine all features disclosed in this specification (including the accompanying claims, abstract, and drawings) and all processes or units of any method or device so disclosed. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstract, and drawings) may be replaced by an alternative feature that serves the same, equivalent, or similar purpose.

[0145] Furthermore, those skilled in the art will understand that although some embodiments herein include certain features included in other embodiments but not others, combinations of features from different embodiments are intended to be within the scope of the invention and form different embodiments. For example, in the following claims, any of the claimed embodiments can be used in any combination.

[0146] The various component embodiments of the present invention can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some or all of the components according to the embodiments of the present invention. The present invention can also be implemented as a device or apparatus program (e.g., a computer program and computer program product) for performing part or all of the methods described herein. Such programs implementing the present invention can be stored on a computer-readable medium, or can be in the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

[0147] It should be noted that the above embodiments are illustrative of the invention and not restrictive, and that those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names. The steps in the above embodiments, unless otherwise specified, should not be construed as limiting the order of execution.

Claims

1. A method for identifying traffic packets, characterized in that, The method includes: The application fingerprint network identifies traffic packets and obtains the application fingerprint network identification result. Specifically, it determines whether the traffic packet is encrypted; if so, the SNI field of the traffic packet is extracted and identification is performed based on the SNI field; if not, the UA field of the traffic packet is extracted and identification is performed based on the UA field; if the determination fails, the Host field and / or Refer_URI field of the traffic packet are extracted and identification is performed based on the Host field and / or Refer_URI field. The application fingerprint network is used to discover explicit rules for traffic packet fields. The traffic packet fields include the SNI field in encrypted packets, the UA field in unencrypted packets, the Host field, and the Refer_URI field. Traffic packets are input into a deep learning network to obtain the deep learning network recognition results, wherein the deep learning network is used to mine the implicit relationships and higher-order features between traffic packet features; The application fingerprint network identification result and the deep learning network identification result are weighted and merged to obtain the traffic packet identification result.

2. The method according to claim 1, characterized in that, The step of inputting traffic packets into a deep learning network to obtain the deep learning network's recognition result further includes: Feature extraction is performed on traffic packets to obtain traffic packet features; The traffic packet characteristics include one or more of the following characteristics: server IP and port, UA field, HOST field, URI field, Refer_URI field, SNI field, and field fields in the decompiled file.

3. The method according to claim 2, characterized in that, After obtaining the traffic packet characteristics, the method further includes: The sequence representation vector corresponding to the traffic message features is masked according to a preset threshold.

4. The method according to claim 1, characterized in that, The method further includes: Collect historical traffic packets; The application fingerprint network and deep learning network are trained based on historical traffic packets. Specifically, historical traffic packets are input into the application fingerprint network and deep learning network, and gradients are calculated using the loss function. The gradients are then backpropagated to the application fingerprint network and deep learning network to train their respective parameters. Training ends when the iteration conditions are met.

5. The method according to claim 1, characterized in that, The outputs of the applied fingerprint network and the deep learning network are weighted and combined using the following formula: in, The identification results for traffic packets; To apply the weights of the fingerprint network; The activation function of the last layer in a deep learning network The weights; For use with fingerprint networks as input; It is a constant.

6. A device for identifying traffic packets, characterized in that, include: An application fingerprint network module is used to identify traffic packets based on the application fingerprint network to obtain the application fingerprint network identification result. Specifically, it determines whether the traffic packet is an encrypted packet; if so, it extracts the SNI field of the traffic packet and identifies it based on the SNI field; if not, it extracts the UA field of the traffic packet and identifies it based on the UA field; if the determination fails, it extracts the Host field and / or Refer_URI field of the traffic packet and identifies it based on the Host field and / or Refer_URI field. The application fingerprint network is used to discover explicit rules for traffic packet fields; the traffic packet fields include the SNI field in encrypted packets, the UA field in unencrypted packets, the Host field, and the Refer_URI field. A deep learning network module is used to input traffic packets into a deep learning network to obtain the deep learning network recognition results. The deep learning network is used to mine the implicit relationships and high-order features between traffic packet features. The traffic packet identification module is used to weight and merge the application fingerprint network identification result and the deep learning network identification result to obtain the traffic packet identification result.

7. A computing device, comprising: The processor, memory, communication interface, and communication bus are provided, wherein the processor, memory, and communication interface communicate with each other via the communication bus. The memory is used to store at least one executable instruction, which causes the processor to perform the operation corresponding to the traffic packet identification method as described in any one of claims 1-5.

8. A computer storage medium storing at least one executable instruction that causes a processor to perform an operation corresponding to the traffic packet identification method as described in any one of claims 1-5.

Images