Encrypted traffic classification method, device and medium based on unbalanced data

Abstract

The present invention provides an encrypted traffic classification method, device and medium based on unbalanced data, the method comprising: performing data packet composite feature extraction and data packet payload feature extraction after segmentation and filtering of the original traffic; setting a baseline after traffic data analysis, sending traffic below the baseline value into the WGAN‑GP network for training, and sending traffic above the baseline value into the OSS algorithm model for downsampling to obtain a balanced data set; dividing the data into a test set and a training set according to a preset ratio, and training the training set through a multi-level spatiotemporal feature extraction model; and then processing the training set through a preset feature fusion module and classification module to obtain a trained multi-level spatiotemporal feature extraction model. This application takes into account the tcp options field in the TCP packet header during data processing to achieve data balance through two sampling methods. The multi-level spatiotemporal feature extraction model adopted enables the model to pay more attention to feature information with discriminability, thereby promoting classification results.

Description

Technical Field

[0001] This document relates to the technical field of Internet encrypted traffic classification, and in particular to an encrypted traffic classification method, device and medium based on unbalanced data. Background Art

[0002] With the rapid development of the internet, information security has become a hot topic for countries, businesses, and individuals. Encrypted traffic has become an integral part of the internet environment. Since 2019, HTTPS encrypted traffic has surpassed HTTP traffic in terms of its share. As of April 2020, over 95% of pages in Google Chrome had encryption enabled. Traffic encryption and authentication technologies such as TLS and IPSec enhance the confidentiality and reliability of communication data. However, attackers can exploit traffic encryption to encrypt Trojans or malware, bypassing detection by firewalls and traditional IDS devices, posing a serious security risk. For example, adware, Trojans, and ransomware perform malicious activities through communication with command and control servers. Therefore, identifying malicious encrypted traffic or applications has become a challenging task that needs to be addressed.

[0003] Traffic identification tasks can be categorized into three main types: port-based traffic classification, deep packet identification, and statistical classification. Port-based traffic detection has a low granularity, identifying the protocol to which traffic belongs by detecting UDP or TCP source and destination ports. This approach is no longer suitable for the current internet environment. Deep Packet Inspection (DPI)-based classification focuses on the entire packet header and payload, using fingerprint matching to identify traffic and achieve classification. However, with the current use of traffic encryption technologies, packet payloads are encrypted or encapsulated, making fingerprint information extraction extremely difficult. Statistical classification methods focus on the diverse characteristics and behaviors of different applications. Statistical methods have two advantages: they are lightweight and can be applied to encrypted traffic. They do not match encrypted traffic based on payload content, but rely on manually extracted feature data for identification and classification. However, manual feature selection presents a series of challenges. Besides being time-consuming and labor-intensive, feature extraction and selection remain challenging, and are a popular research area. Summary of the Invention

[0004] The present invention provides an encrypted traffic classification method, device and medium based on unbalanced data, aiming to solve the above problems.

[0005] An embodiment of the present invention provides an encrypted traffic classification method based on unbalanced data, including:

[0006] S1. Split and filter the original traffic to obtain multiple session sub-files, and extract data packet composite features and data packet payload features from the multiple session sub-files;

[0007] S2. Analyze traffic data for multiple session subfiles and set a baseline. Send traffic below the baseline value to the WGAN-GP network for training. Send traffic above the baseline value to the OSS algorithm model for downsampling to obtain a balanced data set.

[0008] S3, dividing the balanced data set into a test set and a training set according to a preset ratio, and training the training set through a multi-level spatiotemporal feature extraction model;

[0009] S4, processing the trained data through a preset feature fusion module and classification module to obtain a trained multi-level spatiotemporal feature extraction model;

[0010] S5. The test set is passed through the trained multi-level spatiotemporal feature extraction model to obtain the encrypted traffic classification.

[0011] An embodiment of the present invention provides an electronic device, including:

[0012] processor; and,

[0013] A memory arranged to store computer-executable instructions, which, when executed, cause the processor to perform the steps of the above-mentioned method for classifying encrypted traffic based on unbalanced data.

[0014] An embodiment of the present invention provides a storage medium for storing computer-executable instructions, which, when executed, implement the steps of the above-mentioned method for classifying encrypted traffic based on unbalanced data.

[0015] The implementation of the present invention, using WGAN-GP, avoids the shortcomings of GAN networks and generates required data more stably. The OSS algorithm can downsample data labeled for specific categories to meet requirements. The TCP options field in the TCP packet header was considered, and based on experimental results, two features, Kind type and TCP options field length, were selected as basic features for extraction. This method achieved good results for subsequent model classification tasks. The multi-level feature extraction model structure proposed in this study has shown promising results in traffic classification tasks, primarily due to its targeted focus on the composite header features and payload features of packets. For example, the 1D-CNN has excellent spatial feature extraction for packet payload content, i.e., long byte sequences, while the BiLSTM has excellent temporal feature extraction for inter-packet dependencies. Both work in conjunction with the transformer network to perform a weighted summation of inter-packet and inter-byte dependencies, allowing the model to prioritize discriminative feature information, thereby improving classification performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate one or more embodiments of this specification or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0017] Figure 1 This is a flow chart of a method for classifying encrypted traffic based on unbalanced data according to an embodiment of the present invention;

[0018] Figure 2 This is a schematic diagram of the overall architecture of the encrypted traffic classification model according to an embodiment of the present invention;

[0019] Figure 3 This is a flow chart of data packet composite feature extraction according to an embodiment of the present invention;

[0020] Figure 4 This is a schematic diagram of a data balancing module according to an embodiment of the present invention;

[0021] Figure 5 Schematic diagram of the BiLSTM network structure of an embodiment of the present invention

[0022] Figure 6 Schematic diagram of the Transformer encoder structure according to an embodiment of the present invention;

[0023] Figure 7 Schematic diagram of the 1D-CNN model architecture of an embodiment of the present invention. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the technical solutions in one or more embodiments of this specification will be clearly and completely described below in conjunction with the drawings in one or more embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on one or more embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this document.

[0025] The following introduces the existing traffic classification detection methods based on traditional machine learning:

[0026] Hu Bin et al. proposed a method for detecting encrypted malicious traffic that does not rely on five-tuple information. Five-tuple information generally refers to the source IP address, destination IP address, source port, destination port, and protocol of a data packet. The IP address and port in the five-tuple information vary across different session traffic, thus exhibiting uniqueness. This uniqueness is not a benign feature for distinguishing relationships between traffic flows. Therefore, the five-tuple information is discarded. The authors adopted a traditional method, manually analyzing the plaintext information during the TLS encrypted traffic handshake in the data packet, and combined it with the content of the payload message using machine learning methods to classify the encrypted traffic. However, this method requires manual extraction of plaintext information features, and the extracted features are not universal.

[0027] Liu et al. extracted basic features from three dimensions: traffic session behavior, TLS handshake plaintext information, and certificates. They then combined an online random forest model to distinguish malicious encrypted traffic in real time. This method significantly improved the performance compared to traditional port-based and DPI-based methods. Most of the methods mentioned above rely on expert knowledge and require time-consuming and labor-intensive manual work to select and extract features.

[0028] The following describes a mainstream deep learning-based traffic classification method. This method abandons traditional manual feature extraction and implements an end-to-end approach from feature extraction to classification, resulting in improved accuracy and efficiency compared to traditional methods. Zou et al. used a dataset of normal traffic from Tsinghua University's campus network and malicious traffic from a sandbox. They analyzed the transmission time interval, transmission direction, and packet length of the first 50 packets in a traffic session, then trained a long short-term memory (LSTM) network. Their method achieved superior accuracy and false positive rates compared to recognition models based on traditional machine learning algorithms such as decision trees and random forests.

[0029] WANG et al. converted session traffic bytes into grayscale images. They first used a two-dimensional CNN to extract the spatial features of the traffic, and then used a bidirectional long short-term memory network (BiLSTM) to extract the temporal features of the traffic. Finally, they obtained the spatiotemporal features of the session traffic for subsequent classification with high accuracy. The entire feature extraction and classification process is an end-to-end structure that does not require feature engineering, avoiding the time-consuming and labor-intensive manual feature extraction.

[0030] Cheng Hua et al. converted the payload content of encrypted traffic into sentence vectors using the Word2vec model (drawing on knowledge from the field of natural language processing (NLP)). They selected the first 1000 bytes of the traffic session payload content as the feature vector, first expanded the word embedding of each byte of the feature vector to a dimension of 300, and then used a one-dimensional convolutional neural network (CNN) on the new feature vector to identify malicious C&C traffic. The one-dimensional CNN borrowed the TextCNN method from the NLP field and used multiple convolution kernels of different sizes to extract spatial features at different levels. Finally, the multiple feature results were cascaded together and classified using the softmax function.

[0031] Chen et al. introduced the Attention-CNN model, which uses 1D-CNN and an improved BiLSTM to classify encrypted application traffic. The BiLSTM primarily extracts traditional timing and length features from packet headers within traffic sessions. Furthermore, the BiLSTM output incorporates an Attention mechanism. This mechanism weights the BiLSTM's last hidden layer output and performs a weighted sum to highlight key traffic features. This allows the model to prioritize key features and achieve more accurate classification. The 1D-CNN primarily targets the payload portion of session traffic, using a max pooling layer to compress feature dimensions and a normalization layer to bring data closer to the origin without affecting its true distribution, thereby increasing the model's training rate.

[0032] Jiang et al. introduced the end-to-end model HST-MHSA. Based on a traffic hierarchy, this model combines a long short-term memory network (LSTM) and TextCNN to effectively integrate the multi-scale local features and two-layer global features of encrypted traffic. Finally, a multi-head attention mechanism is introduced to effectively enhance key features and improve feature discrimination. The model consists of two major components, considering both the packet and session levels. First, word embeddings are used to encode packets. These packets are then passed through BiLSTM and TextCNN to extract spatiotemporal features. Traffic packets belonging to the same session are then reassembled to form a session. The multi-head attention mechanism enhances the features of the traffic session. Furthermore, global average pooling is used instead of maximum pooling to avoid feature damage caused by the maximum pooling layer.

[0033] Wang et al. introduced a bit-level DPI (deep packet inspection) encrypted traffic detection method. They first explored the bit fingerprint information of the payload content in the encrypted traffic, used bits 0 and 1 to distinguish the payload content of encrypted traffic from the payload content of non-encrypted traffic, and encapsulated it into a state transition machine, which is mainly used to identify whether the traffic to be tested is encrypted traffic or non-encrypted traffic. Then, CNN was used to extract features from the plaintext handshake information, protocol, and remaining packet length in the traffic data packet to achieve encrypted traffic classification.

[0034] Lin et al. proposed the ET-BERT model, the core of which is the pre-trained model BERT. The BERT model is an emerging model in the field of natural language processing (NLP) and effectively extracts text context features. This application draws on this advantage and introduces traffic data into it to achieve good results.

[0035] Dai et al. proposed the GLADS model, a model framework that combines a "local + global" model with an "indicator" mechanism. The "indicator" is a multimodal input method processed with a sliding window, allowing the model to effectively extract features from multimodal input using a similar single-modal method. This "local + global" framework effectively solves the problems of variable length and speed performance of traffic data input.

[0036] Fu et al. proposed HyperVision, a malware detection system based on real-time unsupervised machine learning. The authors proposed attribute and temporal relationships between flows and used a graph neural network to record flow interactions, such as in-degree and out-degree. The unsupervised learning approach avoids the need for labeling. Furthermore, the model can identify unknown attacks based on flow characteristics and effectively distinguish between malicious and benign encrypted traffic. However, the model's drawback is that it does not extract information such as the plaintext handshake or certificates of encrypted traffic, making it unable to distinguish between encrypted and unencrypted traffic.

[0037] Xi et al. proposed a Tor traffic detection system based on data enhancement. Taking into account the imbalance of the data set, the traffic data was converted into grayscale images, and multi-scale fusion DCGAN was used to generate data to balance the data set. At the same time, the SDAE data encoder was used for feature learning to realize the identification and processing of Tor traffic.

[0038] Method Example

[0039] The embodiment of the present invention provides an encrypted traffic classification method based on unbalanced data. Figure 1 This is a flow chart of an encryption traffic classification method based on unbalanced data according to an embodiment of the present invention. Figure 1 As shown, the encryption traffic classification method based on unbalanced data in an embodiment of the present invention includes:

[0040] S1. Slice and filter the original traffic to obtain multiple session subfiles, and extract data packet composite features and data packet payload features from the multiple session subfiles;

[0041] S1 is to preprocess the original data. Figure 2 The overall architecture diagram of the encrypted traffic classification model shown in the figure shows the entire process from raw PCAP traffic processing to basic feature extraction. It is mainly divided into three steps: raw traffic segmentation and filtering, packet composite feature extraction, and packet payload feature extraction.

[0042] The specific process of original traffic segmentation and filtering is as follows:

[0043] Because the pcap raw traffic files in public datasets are large and contain accesses to multiple addresses or process ports, it is necessary to segment the pcap files based on the same five-tuple information. Using the open-source SplitCap tool, we segment the raw traffic according to the session mode. A single pcap file is split into multiple pcap session subfiles, and subsequent feature extraction is primarily based on these subfiles.

[0044] Considering that the network layer IP address or data link layer MAC address of each packet in a session file may be different, this uniqueness, if not addressed, will affect the feature extraction of subsequent algorithm models, thereby affecting the model's subsequent classification performance. Therefore, traffic anonymization is required, that is, deleting the MAC address and setting all network layer IP addresses to "0.0.0.0" to eliminate uniqueness. Note that the specific method here uses the Python tool scapy. Using the raw function to read the traffic bytes from the pcap file directly skips the MAC address portion of the data link layer, effectively ignoring the MAC address information.

[0045] Considering that the dataset contains useless sessions such as TCP handshake failures, DNS domain name queries, and LLMNR protocols, these sessions will affect the subsequent model's feature extraction of traffic and need to be deleted to avoid affecting subsequent steps. The specific operation is to first detect whether the data packet is a TCP data packet, and then check whether the number of data packets in the file is less than 3. If it is less than 3, it means that the session has not met the basic handshake conditions and is deleted. The characteristic of the LLMNR protocol is that it is transmitted via UDP, with its destination IP fixed at "224.0.0.252" and its destination port fixed at "5355". According to these two filtering conditions, the session files are filtered and deleted.

[0046] The process of extracting composite features of data packets includes:

[0047] The data packet composite feature extraction is divided into two steps: traditional feature extraction and data packet header feature extraction. Figure 3 This is a detailed flowchart for extracting composite features from data packets. The traditional feature extraction process yields 2-dimensional feature data, while the packet header extracts 42-dimensional data features. The fusion of the two yields a total of 44-dimensional features. The following describes these two steps in detail.

[0048] (1) Traditional feature extraction.

[0049] This study analyzes the packet arrival time, packet length, and packet direction within each PCAP session, primarily using the Python tool Scapy. A traffic session file contains multiple packets. The time function provided by Scapy can be used to determine the arrival time of each packet, and the time interval can be calculated by calculating the difference between the arrival times. Packet length is determined by counting the number of bytes in the raw traffic flow, primarily using the raw function and the len function to determine the specific byte length. Finally, packet direction represents the direction of traffic flow. The direction from the source IP address to the destination IP address of the first packet in each session file is defined as positive. Subsequent packets with the same direction are considered positive, while those with the opposite direction are considered negative. The direction feature does not need to be extracted as a separate feature dimension; it can be directly multiplied by the packet length. For example, a packet length of -728 indicates that the packet is in a negative direction and is 728 bytes long. These are the features derived from considering these three perspectives.

[0050] In summary, assuming there are i sessions, we intercept n1 data packets in each session, and the features obtained after the above traditional feature extraction can be expressed as [i,n1,2], where 2 represents two dimensions, namely the packet arrival time feature and the directional length feature.

[0051] (2) Data packet header feature extraction.

[0052] Considering that the header feature dimensions extracted from each data packet need to maintain a consistent size to facilitate subsequent input into the algorithm model, data packets belonging to TCP or UDP should be considered separately, as described in detail below.

[0053] TCP packet feature extraction:

[0054] Figure 2For TCP packets, the first step is to extract the 20-byte network layer IP header features and the 20-byte TCP header basic features, totaling 40 bytes. In addition to these 40 bytes, this study also extracts features from the TCP options field. The TCP options field consists of Kind (1 byte), Length (1 byte), and Info (n bytes). Kind indicates the type of option, Length indicates the length of the option, and Info contains the specific information about the option. This study focuses on analyzing the Kind type portion of the packet. Table 3 shows all types of Kind fields. First, the TCP packet is analyzed to see if it contains the TCP options field. If not, it is padded with the integer 6. This padding is used because 6 does not belong to any Kind category, making it easier to distinguish. If the TCP packet contains the TCP options field, features are extracted from two dimensions: the category to which it belongs and the field length. The category is indicated by the Kind type label.

[0055] Table 3 TCP options field

[0056]

[0057]

[0058] To summarize, we first intercept the basic features of the network layer IP header and TCP header, totaling 40 bytes of data. We then check whether the header contains the TCP options field. If so, we extract two dimensional data from it. If not, we fill it with an integer 6. In practice, we use the Python scapy tool to intercept the raw traffic bytes. The frombuffer function in PyTorch then converts the traffic bytes into integer data, making it easier to concatenate the aforementioned features together to form a 42-dimensional data feature.

[0059] UDP packet feature extraction:

[0060] The UDP packet features are divided into two parts: the 20-byte network layer IP header and the 8-byte UDP header features. To ensure the consistency of the feature length of the data packets in the session, the UDP packet needs to be padded with 0x00 to a size of 42 bytes, which is the feature dimension size of the TCP packet.

[0061] To summarize, assume there are i sessions in the dataset, and each session intercepts n1 packets. The feature dimension shape of each TCP / UDP packet header can be expressed as [i,n1,42], where the 42 dimensions include the 20-byte IP header information, the 20-byte TCP / UDP header information, and the TCP options field.

[0062] Packet payload feature extraction specifically includes:

[0063] Packet payload data is extracted in segments, not directly from the session file. Considering that each session file contains multiple packets, each with payload data of varying sizes, this study limits the extraction of n2 bytes of data from each session file. Experimental results indicate that 3500 is a suitable value for n2. The specific extraction method also imposes a limit: a maximum of 128 bytes of data is extracted from each packet until the interception length reaches n2 bytes. If n2 bytes are not intercepted, 0x00 is used as padding.

[0064] In summary, assuming there are i sessions, and each session captures n2 bytes of data, the characteristic shape of the packet payload can be represented by [i, n2]. The n2 bytes are derived from the payload content of multiple packets in the session, and each packet's payload information is accessed sequentially from top to bottom. Each packet is limited to a maximum of 128 bytes of data. If the number of bytes is less than n2, it is padded with 0x00.

[0065] S2. Analyze traffic data for multiple session subfiles and set a baseline. Send traffic below the baseline value to the WGAN-GP network for training. Send traffic above the baseline value to the OSS algorithm model for downsampling to obtain a balanced data set.

[0066] In this research, the imbalance of the dataset means that the number of traffic sessions corresponding to each label category is different. This situation may have a great impact on the final traffic classification results. For example, the subsequent algorithm model may give more weight to the category with more samples and ignore the category with fewer samples, thereby affecting the recognition accuracy and generalization ability of the model for minority categories. It may also cause overfitting or underfitting, resulting in poor performance of the model on the test set. Therefore, in Figure 2 In the data balancing module shown, this method uses the OSS undersampling algorithm to downsample the category data with more traffic sessions, and uses WGAN-GP (improved generative adversarial network GAN) to upsample the category data with fewer traffic sessions until the number of traffic sessions under each category label reaches a basic balance. Figure 4This is a flowchart of the data balancing module. The following introduces the basic principles and usage process of the OSS undersampling algorithm and WGAN-GP.

[0067] The OSS algorithm combines KNN and Tomek links to remove noise from most class data and perform sampling. Its basic principle is different from randomly removing samples. Instead, it evaluates each sample in advance and decides to remove the sample based on the amount of information contained in the sample. Tomek links refers to (x i ,x j ) sample pairs, there is the following relationship:

[0068] d(x i ,x j ) <d(x i ,x k )

[0069] d(x i ,x j ) <d(x j ,x k )

[0070] In the formula, d(x i ,x j ) represents x i and x j The Euclidean distance between them, and x j represents the majority class data, x i represents the minority class data, x k Represents other sample data. According to the definition of Tomek links, samples marked by Tomek links in the data sample are classified as noise samples or boundary samples. The OSS algorithm uses the nearest neighbor algorithm (KNN) to filter out misclassified samples from the sample data and find Tomek link sample pairs in these samples. It then achieves the purpose of data downsampling by removing majority class samples and retaining minority class samples.

[0071] WGAN-GP is an improved network of the traditional generative adversarial network (GAN). The traditional GAN ​​network has defects such as hyperparameter sensitivity and mode collapse. Hyperparameter sensitivity means that hyperparameters such as the network's learning rate, initialization state, and network structure settings have a significant impact on GAN network training, and fine-tuning the parameters will produce completely different training results. Mode collapse refers to the fact that the samples generated by the model are single. This is because the discriminator in the GAN network can only identify whether a single sample is sampled from the true distribution, and cannot explicitly constrain the diversity of the samples, resulting in the samples generated by the model tending to be a small number of high-quality samples in the true distribution range, and will not learn the entire true distribution. In response to the defects of the GAN network, the WGAN-GP network emerged. The WGAN-GP network removes the last layer of the Sigmoid function of the GAN network discriminator and proposes a gradient penalty term (Gradient Penalty) method to force the discriminator to use the difference between the Earth-Mover distance and the gradient penalty term GP as the loss. The loss function is defined as follows:

[0072]

[0073]

[0074] Among them, Loss(d) and Loss(g) represent the loss functions of the discriminator and generator in the network respectively, f d represents the discriminator, g θ represents the generator; x in the formula i represents the real data, z i Denotes randomly generated noise data; m represents the batch size; gp is the gradient penalty function for the discriminator in the WGAN-GP network, and λ determines the penalty strength. The WGAN-GP network performs data augmentation on the types of data with too few samples to achieve data balance.

[0075] The execution flow chart of the data balancing module is as follows: Figure 4 The flowchart can be divided into the following three steps.

[0076] (1) Quantitative analysis: The enhancement and downsampling of traffic data require a baseline to define. The baseline here is obtained by the following formula:

[0077]

[0078] Among them, C represents the total number of data label categories, c i represents the tag category; the Sum function calculates the number of sessions contained in each traffic data tag; avg represents the average number of sessions for each tag category. Simply put, the baseline is the average number of traffic sessions contained in each tag category.

[0079] Once we have a baseline number of sessions, we calculate the number of traffic sessions for each tag type and subtract it from the baseline. If the result is a positive number, it indicates that the number of sessions for that tag type is higher than the average, requiring OSS downsampling. If it is lower than the average, WGAN-GP is required for traffic data enhancement. Therefore, after the raw traffic data is input into the data balancing module, it is automatically divided into two traffic groups, which are then fed into subsequent modules.

[0080] (2) WGAN-GP data enhancement: The flow rate below the baseline value is sent to the WGAN-GP network for training.

[0081] The Adam optimizer was used with a learning rate of 0.0001. The generator consisted of a linear layer, an adaptive ReLU activation function, and a dropout layer, with the dropout parameter set to 0.4. The discriminator also consisted of a linear layer, an adaptive ReLU activation function, and a dropout layer, with the dropout parameter set to 0.5 to prevent overfitting.

[0082] (3) OSS downsampling: The traffic above the baseline value is sent to the OSS algorithm model for downsampling.

[0083] The algorithm module uses the OneSidedSelection function in the imblearn package in Python.

[0084] S3, dividing the balanced data set into a test set and a training set according to a preset ratio, and training the training set through a multi-level spatiotemporal feature extraction model;

[0085] like Figure 2 The algorithm model in the overall framework diagram is primarily divided into two parts: the temporal feature extraction module and the spatial feature extraction module. The composite features of the data packet are fed into the temporal feature extraction module, while the payload features are fed into the spatial feature extraction module. Finally, the output features of these two modules are fed into the final feature fusion and classification module. The following describes the specific implementation principles and processes of each module.

[0086] Time series feature extraction module:

[0087] This module mainly uses the bidirectional long short-term memory network BiLSTM and the encoder part of Transformer.

[0088] (1) Implementation of BiLSTM bidirectional long short-term memory network.

[0089] Figure 5The network structure is BiLSTM. The input layer sends the composite features of the data packet header to the forward network and the backward network respectively. Finally, the output structures of the two are spliced ​​(Output), which is the following form.

[0090]

[0091] in, and Represent the output of the reverse and forward networks respectively, h i It is the result of the cascade of the two.

[0092] (2) Transformer specific implementation:

[0093] When processing feature vectors between packets in session traffic, BiLSTM loses some information during long-distance transmission and is less sensitive to important feature information. Therefore, the multi-head attention mechanism in the Transformer is used to calculate weights and weighted sum the hidden layer outputs of the BiLSTM at the last moment. This allows the network model to focus on important packet features and improve classification results.

[0094] The original Transformer model structure mainly consists of two parts: decoder and encoder. However, the data set in this study, namely the traffic session data, has a fixed length feature, so only the encoder part of the Transformer is used. Figure 6 The encoder part of the Transformer is mainly composed of a multi-head attention layer and a feedforward neural network. The attention mechanism adopts dot product attention, which includes three inputs: value, key, and query. The query and key are used to calculate the weight score assigned to each value, and then the weight is calculated and summed with the value to obtain the output. The calculation formula is as follows:

[0095]

[0096] Q i =QW i Q

[0097]

[0098]

[0099] Among them, Q, K and V represent query, key and value matrices, respectively using different weight matrices and Parallel n linear transformations can obtain n different packet vector attentions d k is the dimension of Key. The value of i is 1, 2, ..., n (n is the number of attention heads), W O Represents a learnable matrix, which is used to perform linear transformation on the result of concatenating multiple attention heads.

[0100] The second part of the encoder, the feedforward neural network, contains a hidden layer of perceptrons with the same input and output dimensions. To balance mapping capability and computational complexity, the number of neurons in the hidden layer is set to twice that of the input layer. The GuLU function is used as the activation function, which adds randomness compared to the ReLU. The calculation formula for the GuLU function is as follows:

[0101]

[0102] like Figure 6 As shown in the figure, in order to prevent the gradient disappearance problem, the multi-head attention mechanism and the feedforward neural network adopt the residual connection method.

[0103] The specific implementation of this experiment is as follows:

[0104] The BiLSTM uses the nn.LSTM function in PyTorch with an input dimension of 44, a hidden layer size of 20, no stacking, and the number of directions set to 2. The number of multi-head attention heads in the Transformer is 4, the size of the attention heads is 11, and the dropout is set to 0.5. The feedforward neural network consists of two linear layers, the GuLU activation function, and a dropout layer with a dropout setting of 0.5.

[0105] Spatial feature extraction module:

[0106] This module mainly uses the one-dimensional convolutional neural network 1D-CNN and the encoder part of Transformer.

[0107] (1) Implementation of one-dimensional convolutional neural network (1D-CNN).

[0108] like Figure 7 As shown in the figure, the 1D-CNN model pipeline consists of four layers: convolution, pooling, dropout, and normalization. These layers form a loop that repeats twice. Within the loop, the convolution layer primarily extracts spatial features from the input packet payload, storing global feature information in multiple local feature matrices. The pooling layer uses max pooling to reduce the dimensionality of the data and compress features. The dropout layer prevents overfitting, primarily using the dropout method. The normalization layer aims to bring the data closer to the origin without affecting its true distribution, thereby speeding up model training.

[0109] (2) Transformer specific implementation.

[0110] The specific implementation of the Transformer module in this part is basically the same as the principle of the Transformer module in the temporal feature extraction module. The data packet payload content is processed through a convolutional neural network to extract spatial features. Using a one-dimensional convolutional neural network alone is not sensitive to the importance of bytes at the session level. Therefore, the multi-head attention mechanism in the Transformer is used to capture the dependencies between bytes and assign different weights. This helps the model focus on important byte content and better extract important feature information.

[0111] Here is the specific implementation:

[0112] In the 1D-CNN, the nn.Conv1d function in PyTorch was used. In the first round, the input channel size was 1, the output channel size was 32, the convolution kernel size was 25, and the padding was set to 12. In the second round, the input channel size was 32, the output channel size was 64, the convolution kernel size was 25, and the padding was set to 12. In the encoder structure, the number of multi-head attention heads was 4, and its dropout was set to 0.5. The feedforward neural network consisted of two linear layers, the GuLU activation function, and a dropout layer, and its dropout was set to 0.5.

[0113] S4, processing the trained data through a preset feature fusion module and classification module to obtain a trained multi-level spatiotemporal feature extraction model;

[0114] like Figure 2 In the feature fusion and classification section shown, the results of the temporal feature processing module and the spatial feature extraction module are first shaped to facilitate subsequent feature fusion. The shape of both features is [i, 256], where i represents the total number of sessions and 256 represents the feature data corresponding to each session. After fusion, the total feature shape is [i, 512].

[0115] The classification module mainly consists of a linear layer, a dropout layer, a ReLU activation function, and a normalization layer. The classification task can be achieved by reducing the session feature dimension from 512 to the number of dataset label categories.

[0116] The specific implementation is as follows:

[0117] The first linear layer has parameters (512, 256), the normalization layer has parameters 256, and the dropout parameter is 0.5. The second linear layer has parameters (256, 64), the normalization layer has parameters 256, and the dropout parameter is 0.5. The last linear layer has parameters (64, class), where class is the final number of classes.

[0118] S5. Obtain encrypted traffic classification from the test set through the trained multi-level spatiotemporal feature extraction model.

[0119] The following beneficial effects are achieved by adopting the embodiments of the present invention:

[0120] (1) From the perspective of dataset balance, compared with network structures such as GAN and DCGAN used in existing studies, WGAN-GP can avoid the defects of the GAN network and generate the required data more stably, while the OSS algorithm can downsample the label data of specific categories to meet the requirements.

[0121] (2) From the perspective of data preprocessing, this method takes into account the TCP options field in the TCP packet header, and based on the experimental results, attempts to select its Kind type and TCP options field length as the basic features for extraction. This method has achieved good results for the classification task of the subsequent model.

[0122] (3) From the perspective of the algorithm model, the multi-level (packet level and session level) feature extraction model structure proposed in this study has a good effect on the traffic classification task, mainly because the model structure is targeted at the composite features of the packet header and the payload features. For example, 1D-CNN has a good spatial feature extraction effect on the packet payload content, that is, long byte sequence data, while BiLSTM has a good temporal feature extraction effect on the dependency between packets. Both of them cooperate with the transformer network to perform weighted summation on the dependency between packets and bytes, so that the model pays more attention to the discriminative feature information, thereby promoting the classification effect.

[0123] Device Example 1

[0124] An embodiment of the present invention provides an electronic device, including:

[0125] processor; and,

[0126] A memory is arranged to store computer executable instructions, which, when executed, cause the processor to perform the steps of the above method embodiments.

[0127] Device Example 2

[0128] A storage medium is used to store computer-executable instructions, which implement the steps of the above method embodiment when executed.

[0129] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for classifying encrypted traffic based on unbalanced data, characterized in that: include: S1. Slice and filter the original traffic to obtain multiple session subfiles, and extract data packet composite features and data packet payload features from the multiple session subfiles; S2. Analyze traffic data for multiple session subfiles and set a baseline. Send traffic below the baseline value to the WGAN-GP network for training. Send traffic above the baseline value to the OSS algorithm model for downsampling to obtain a balanced data set. S3, dividing the balanced data set into a test set and a training set according to a preset ratio, and training the training set through a multi-level spatiotemporal feature extraction model; S4, processing the trained data through a preset feature fusion module and classification module to obtain a trained multi-level spatiotemporal feature extraction model; S5. Obtain encrypted traffic classification from the test set through the trained multi-level spatiotemporal feature extraction model; The training of the training set through the multi-level spatiotemporal feature extraction model specifically includes: sending the composite features of the data packet to the temporal feature extraction module, and sending the payload features of the data packet to the spatial feature extraction module; The step of sending the composite features of the data packet to the time series feature extraction module specifically includes: Bidirectional long short-term memory network BiLSTM and the encoder part of Transformer, the input layer of the BiLSTM; The composite features of the data packet header are sent to the forward network and the backward network respectively, and finally the output structures of the two are spliced ​​together, which is the following form; in, and Represent the outputs of the reverse and forward networks, respectively. It is the result of the cascade of the two; The sending of the data packet payload features into the spatial feature extraction module specifically includes: a one-dimensional convolutional neural network 1D-CNN and an encoder part of a Transformer; The S4 specifically includes: The results of the temporal feature processing module and the results of the spatial feature extraction module are processed into shapes through the feature fusion module; The linear layer, discard layer, ReLU activation function and normalization layer of the classification processing module are used to reduce the data that has undergone shape processing by the feature fusion module to the number of dataset label categories, thereby achieving the classification task.

2. The method according to claim 1, characterized in that The composite feature extraction specifically includes: The traditional feature extraction method and the data packet header feature extraction method are combined to extract the composite features of the data packet; The traditional feature extraction method specifically includes: obtaining the arrival time interval, packet length and packet direction of the data packets in each session sub-file, The data packet header feature extraction method specifically includes: extracting TCP data packets and UDP data packets; when extracting the TCP data packet, first extracting 20 bytes of network layer IP packet header features and 20 bytes of TCP packet header basic features, and performing feature extraction on the TCP options field; when extracting UDP data packets, extracting 20 bytes of network layer IP packet header and 8 bytes of UDP packet header features, and additionally using preset characters to fill up to 42 bytes in size.

3. The method according to claim 1, characterized in that The data packet payload feature extraction specifically includes: The data of each session sub-file is intercepted until the intercepted length reaches the preset byte length. If the intercepted length does not reach the preset byte length, 0x00 is used for padding.

4. The method according to claim 1, wherein The setting of a baseline after analyzing the traffic data of the plurality of session sub-files specifically includes: The baseline is obtained by formula 1: Formula 1: Among them, C represents the total number of data label categories, Represents the label category; the Sum function obtains the data of sessions contained in each traffic data label; avg represents the average number of sessions for each type of label.

5. An electronic device comprising: processor; as well as, A memory arranged to store computer-executable instructions, wherein when the computer-executable instructions are executed, the processor is caused to perform the steps of the encryption traffic classification method based on unbalanced data according to any one of claims 1 to 4.

6. A storage medium for storing computer-executable instructions, wherein the computer-executable instructions, when executed, implement the steps of the encryption traffic classification method based on unbalanced data according to any one of claims 1 to 4.

Images