Network traffic classification model training method, classification method and training device

Abstract

The present application provides a network traffic classification model training method, classification method, and training device. The training method comprises: selecting packet header feature vectors and load feature matrices from a target historical network traffic dataset; obtaining multiple load classification score vectors corresponding to each load feature matrix using a first neural network; and obtaining multiple packet header classification score vectors corresponding to each packet header feature vector using a second neural network; performing a weighted summation of the load classification score vectors and the packet header classification score vectors to obtain a fused feature vector; inputting the fused feature vector into a network traffic classifier to obtain the probabilities of each of the multiple corresponding traffic types; and during the training process, iteratively training the model by calculating the classification loss based on a preset classification loss function to obtain a target network traffic classification model. The present application can effectively ensure the integrity of network traffic data, thereby effectively improving the accuracy of network traffic data classification.

Description

Technical Field

[0001] The present application relates to the field of network traffic classification, and in particular to a network traffic classification model training method, a classification method, and a training device. Background Art

[0002] With the rapid development of the internet and the widespread use of global networks, the scale and complexity of network traffic continues to increase. In this digital age, various network applications and services (such as web browsing, video streaming, real-time communications, and cloud computing) generate massive amounts of data traffic. Simultaneously, users' daily online activities, such as research, audio and video, gaming, live streaming, and chatting, also generate increasing amounts of network traffic. This includes large-scale business traffic generated by large enterprises and organizations with thousands of devices, communication traffic generated by smaller departments within local area networks, and application traffic generated by users' daily lives and entertainment. Accurately classifying and identifying network traffic is crucial to providing efficient network services, optimizing network performance, and ensuring network security.

[0003] Existing network traffic classification methods easily cause the loss of network traffic header information, thereby affecting the accuracy of network traffic classification. Summary of the Invention

[0004] In view of this, the embodiments of the present application provide a network traffic classification model training method, a classification method and a training device to eliminate or improve one or more defects in the prior art.

[0005] A first aspect of the present application provides a network traffic classification model training method, the method comprising:

[0006] Selecting a packet header feature vector from packet header data in each target historical network traffic data set; and selecting a load feature from load data in each target historical network traffic data set to convert the load feature matrix; wherein the target historical network traffic data set is obtained by preprocessing the historical network traffic data set in advance;

[0007] Obtaining multiple load classification score vectors corresponding to each of the load feature matrices according to a first neural network; and obtaining multiple packet header classification score vectors corresponding to each of the packet header feature vectors according to a second neural network; wherein the first neural network and the second neural network have different network structures;

[0008] Performing weighted summation on each of the load classification score vectors and each of the packet header classification score vectors according to the sequentially connected target fully connected layer, fusion layer, and output layer to obtain a fusion feature vector corresponding to each of the target historical network traffic data;

[0009] Inputting each of the fused feature vectors into a network traffic classifier to obtain probabilities of multiple traffic types corresponding to each of the fused feature vectors;

[0010] A preset network traffic classification model is trained based on the target historical network traffic data set and the probability of each of the traffic types, and during the training process, the classification loss of the probability of each of the traffic types is obtained based on a preset classification loss function, and the network traffic classification model is iteratively trained based on the classification loss to obtain a target network traffic classification model for classifying network traffic; wherein, the network traffic classification model includes: the first neural network, the second neural network, the target fully connected layer, the fusion layer, the output layer and the network traffic classifier.

[0011] In some embodiments of the present application, before selecting the packet header feature vector in the packet header data and the load feature matrix in the load data in each target historical network traffic data set, the method further includes:

[0012] Filtering the historical network traffic data set based on a preset filtering condition to obtain a first network traffic data set;

[0013] Removing a link layer frame header and a frame trailer from each first network traffic data in the first network traffic data set, and masking a preset field in each first network traffic data set to obtain a second network traffic data set;

[0014] Each second network traffic data in the second network traffic data set is converted into a corresponding byte vector to obtain the target historical network traffic data set.

[0015] In some embodiments of the present application, the first network includes: a convolutional layer, a first residual block, a first pooling layer, a second residual block, a second pooling layer, a third residual block, a third pooling layer, a fourth residual block, a fourth pooling layer, a first flattening layer, a first fully connected layer, and a first activation function, connected in sequence;

[0016] The convolution layer is configured to obtain the first load feature matrix corresponding to each load feature matrix input therein according to the corresponding output;

[0017] The first residual block is configured to obtain corresponding second load feature matrices according to the corresponding outputs of the first load feature matrices input therein;

[0018] The first pooling layer is configured to obtain corresponding third load feature matrices according to the corresponding outputs of each of the second load feature matrices input therein;

[0019] The second residual block is configured to obtain respective corresponding fourth load feature matrices according to the corresponding outputs of the respective third load feature matrices input therein;

[0020] The second pooling layer is configured to obtain the corresponding fifth load feature matrix according to the corresponding output of each of the fourth load feature matrices input therein;

[0021] The third residual block is configured to obtain the sixth load feature matrix corresponding to each of the fifth load feature matrices input therein according to the corresponding output;

[0022] The third pooling layer is configured to obtain the corresponding seventh load feature matrix according to the corresponding output of each of the sixth load feature matrices input therein;

[0023] The fourth residual block is configured to obtain the corresponding eighth load feature matrix according to the corresponding output of each of the seventh load feature matrices input therein;

[0024] The fourth pooling layer is configured to obtain a ninth load feature matrix corresponding to each of the eighth load feature matrices input therein according to the corresponding output;

[0025] The first flattening layer is used to obtain the corresponding one-dimensional load feature vectors according to the corresponding outputs of each of the ninth load feature matrices input therein;

[0026] The first fully connected layer is configured to output a plurality of first categories according to the corresponding output of each of the one-dimensional load feature vectors input therein;

[0027] The first activation function is used to obtain the load classification score vectors corresponding to each of the one-dimensional load feature vectors according to each of the one-dimensional load feature vectors input therein and the output corresponding to each of the first categories.

[0028] In some embodiments of the present application, the second neural network includes: an embedding layer, a second fully connected layer, a second activation function, a second flattening layer, a third fully connected layer, and a third activation function connected in sequence;

[0029] The embedding layer is configured to output a plurality of corresponding packet header byte feature vectors according to the corresponding output of each packet header feature vector input therein;

[0030] The second fully connected layer is configured to obtain a plurality of second categories according to the corresponding outputs of each of the packet header byte feature vectors input therein;

[0031] The second activation function is configured to output, based on each of the packet header byte feature vectors and each of the second categories input therein, respective packet header byte score vectors corresponding to each of the packet header feature vectors, and form a packet header byte feature matrix;

[0032] The second flattening layer is used to obtain the corresponding one-dimensional packet header feature vectors according to the corresponding output of each packet header byte feature matrix input therein;

[0033] The third fully connected layer is configured to output a plurality of third categories according to the corresponding one-dimensional vectors of the packet header features input therein;

[0034] The third activation function is used to obtain the packet header classification score vectors corresponding to each of the packet header feature one-dimensional vectors input therein and the corresponding outputs of each of the third categories.

[0035] In some embodiments of the present application, the target fully connected layer is used to map each of the load classification score vectors and the corresponding packet header classification score vectors input therein to a target feature space, so as to output a query vector, a key vector, a packet header value vector, and a load value vector corresponding to each of the load classification score vectors;

[0036] The fusion layer is used to calculate the inner product of each query vector and the corresponding key vector to obtain the attention score corresponding to each load classification score vector, and scale and normalize each attention score to obtain the attention weight matrix corresponding to each load classification score vector;

[0037] The output layer is used to perform weighted summation on the corresponding header value vectors and load value vectors based on each of the attention weight matrices to obtain the corresponding fused feature vectors.

[0038] In some embodiments of the present application, the network traffic classifier includes: a fourth fully connected layer and a fourth activation function;

[0039] The fourth fully connected layer is configured to obtain a plurality of fourth categories according to the corresponding outputs of the respective fused feature vectors input therein;

[0040] The fourth activation function is used to output the probabilities of the traffic types corresponding to the respective fused feature vectors according to the correspondence between the respective fused feature vectors input therein and the respective fourth categories.

[0041] A second aspect of the present application provides a network traffic classification method, the method comprising:

[0042] Obtaining a target network traffic data set; wherein the target network traffic data set is obtained by preprocessing the network traffic data set;

[0043] The target network traffic data set is input into the target network traffic classification model pre-trained based on the network traffic classification model training method described in the first aspect, so that the target network traffic classification model outputs the network traffic type result data corresponding to each target network traffic data in the target network traffic data set.

[0044] A third aspect of the present application provides a network traffic classification model training device, the device comprising:

[0045] a feature selection module for selecting a packet header feature vector from packet header data in each target historical network traffic data set; and selecting a load feature from load data in each target historical network traffic data set to convert the load feature matrix; wherein the target historical network traffic data set is obtained by preprocessing the historical network traffic data set;

[0046] a classification score calculation module, configured to obtain, based on a first neural network, a plurality of load classification score vectors corresponding to each of the load feature matrices; and to obtain, based on a second neural network, a plurality of packet header classification score vectors corresponding to each of the packet header feature vectors; wherein the first neural network and the second neural network have different network structures;

[0047] A feature fusion module is used to perform weighted summation on each of the load classification score vectors and each of the packet header classification score vectors according to the target fully connected layer, fusion layer, and output layer connected in sequence, to obtain a fused feature vector corresponding to each of the target historical network traffic data;

[0048] A category probability calculation module, configured to input each of the fused feature vectors into a network traffic classifier to obtain probabilities of multiple traffic types corresponding to each of the fused feature vectors;

[0049] A model training module is used to train a preset network traffic classification model based on the target historical network traffic data set and the probability of each of the traffic types, and during the training process, obtain the classification loss of the probability of each of the traffic types based on a preset classification loss function, and iteratively train the network traffic classification model based on the classification loss to obtain a target network traffic classification model for classifying network traffic; wherein, the network traffic classification model includes: the first neural network, the second neural network, the target fully connected layer, the fusion layer, the output layer and the network traffic classifier.

[0050] The fourth aspect of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the network traffic classification model training method described in the first aspect is implemented.

[0051] The fifth aspect of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the network traffic classification model training method described in the first aspect.

[0052] The present application provides a network traffic classification model training method, classification method, and training device. The training method comprises: selecting packet header feature vectors and load feature matrices from a target historical network traffic dataset; obtaining multiple load classification score vectors corresponding to each load feature matrix using a first neural network; and obtaining multiple packet header classification score vectors corresponding to each packet header feature vector using a second neural network; performing a weighted summation of the load classification score vectors and the packet header classification score vectors to obtain a fused feature vector; inputting the fused feature vector into a network traffic classifier to obtain the probabilities of each of the multiple corresponding traffic types; and during the training process, iteratively training the model by calculating the classification loss based on a preset classification loss function to obtain a target network traffic classification model. The present application can effectively ensure the integrity of network traffic data, thereby effectively improving the accuracy of network traffic data classification.

[0053] Additional advantages, purposes, and features of the present application will be described in part in the following description and will become apparent to those skilled in the art upon study of the following or may be learned from practice of the present application. The purposes and other advantages of the present application may be achieved and obtained by the structures specifically pointed out in the specification and drawings.

[0054] Those skilled in the art will understand that the purposes and advantages that can be achieved by the present application are not limited to the above specific description, and the above and other purposes that can be achieved by the present application will be more clearly understood based on the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] The drawings described herein are intended to provide a further understanding of the present application, constitute a part of the present application, and do not constitute a limitation of the present application. The components in the drawings are not drawn to scale, but are only for the purpose of illustrating the principles of the present application. In order to facilitate the illustration and description of some parts of the present application, the corresponding parts in the drawings may be enlarged, that is, they may become larger than other components in the exemplary device actually manufactured according to the present application. In the drawings:

[0056] Figure 1 Schematic diagram of the flow of a network traffic classification model training method in one embodiment of the present application.

[0057] Figure 2 This is a structural diagram of a network traffic classification model training device in another embodiment of the present application.

[0058] Figure 3 Schematic diagram of a flow chart of a network traffic classification method in one embodiment of the present application.

[0059] Figure 4 FIG. 1 is a schematic diagram of the architecture of a first neural network in one embodiment of the present application. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail in conjunction with the embodiments and drawings. Here, the illustrative embodiments of this application and their descriptions are used to explain this application, but are not intended to limit this application.

[0061] It should also be noted here that in order to avoid obscuring the present application due to unnecessary details, the accompanying drawings only show structures and / or processing steps that are closely related to the scheme according to the present application, while other details that are not closely related to the present application are omitted.

[0062] It should be emphasized that the term "include / comprises" when used herein refers to the existence of features, elements, steps or components, but does not exclude the existence or addition of one or more other features, elements, steps or components.

[0063] It should also be noted that, unless otherwise specified, the term "connection" herein may refer not only to a direct connection but also to an indirect connection involving an intermediate.

[0064] Hereinafter, embodiments of the present application will be described with reference to the accompanying drawings. In the accompanying drawings, the same reference numerals represent the same or similar components, or the same or similar steps.

[0065] The details are described in detail through the following examples.

[0066] The present invention provides a network traffic classification model training method that can be performed by a network traffic classification model training device or a client device. Figure 1 The network traffic classification model training method specifically includes the following contents:

[0067] Step 110: Select the header feature vector in the header data of each target historical network traffic data in the target historical network traffic data set; and select the load feature in the load data in each target historical network traffic data to convert it into a load feature matrix; wherein, the target historical network traffic data set is obtained by preprocessing the historical network traffic data set in advance.

[0068] Step 120: Obtain multiple load classification score vectors corresponding to each of the load feature matrices according to the first neural network; and obtain multiple packet header classification score vectors corresponding to each of the packet header feature vectors according to the second neural network; wherein the network structures of the first neural network and the second neural network are different.

[0069] Step 130: performing weighted summation on each of the load classification score vectors and each of the packet header classification score vectors according to the target fully connected layer, fusion layer, and output layer connected in sequence to obtain a fusion feature vector corresponding to each of the target historical network traffic data.

[0070] Step 140: Input each of the fused feature vectors into a network traffic classifier to obtain the probabilities of multiple traffic types corresponding to each of the fused feature vectors.

[0071] Step 150: Train a preset network traffic classification model based on the target historical network traffic data set and the probability of each of the traffic types, and during the training process, obtain the classification loss of the probability of each of the traffic types based on a preset classification loss function, and iteratively train the network traffic classification model based on the classification loss to obtain a target network traffic classification model for classifying network traffic; wherein, the network traffic classification model includes: the first neural network, the second neural network, the target fully connected layer, the fusion layer, the output layer and the network traffic classifier.

[0072] Specifically, the client device first selects header feature vectors from the packet header data of each target historical network traffic data set in the target historical network traffic dataset; and selects load features from the load data of each target historical network traffic data set to convert them into a load feature matrix. Next, a first neural network is used to obtain multiple load classification score vectors corresponding to each load feature matrix; and a second neural network is used to obtain multiple header classification score vectors corresponding to each header feature vector. Then, a weighted summation of each load classification score vector and each header classification score vector is performed using the target fully connected layer, fusion layer, and output layer connected in sequence to obtain a fused feature vector corresponding to each target network traffic data set. Each fused feature vector is then input into a network traffic classifier to obtain the probabilities of multiple traffic types corresponding to each fused feature vector. Finally, a preset network traffic classification model is trained based on the target historical network traffic dataset and the probabilities of each traffic type. During the training process, a classification loss for each traffic type probability is obtained based on a preset classification loss function. The network traffic classification model is then iteratively trained based on this classification loss to obtain a target network traffic classification model for classifying network traffic. This effectively ensures the integrity of the network traffic data and improves the accuracy of network traffic data classification.

[0073] The target historical network traffic dataset is obtained by preprocessing the historical network traffic dataset. The network structures of the first neural network and the second neural network are different. The network traffic classification model includes: the first neural network, the second neural network, the target fully connected layer, the fusion layer, the output layer, and the network traffic classifier. The classification loss function is shown in formula (1):

[0074]

[0075] Where N is the number of traffic types in the dataset; y is the label. If the current traffic category is i, then y i =1, otherwise 0; p i is the output of the neural network, that is, the probability that the current data packet belongs to category i.

[0076] In addition, step 110 is described in detail as follows:

[0077] The first 20 bytes of the IP header and the first 20 bytes of the TCP / UDP header in the packet header data of each target historical network traffic data in the target historical network traffic dataset are selected as the packet header feature vector; and the first 100 bytes of the payload data in each target historical network traffic data are selected. Each byte corresponds to a grayscale pixel value of the image, 0 corresponds to black, and 255 corresponds to white. These 100 bytes are converted into a 10*10 traffic map as the payload feature matrix.

[0078] It should be noted that the IP header consists of a 20-byte fixed header and an option field of 0-40 bytes; the TCP header consists of a 20-byte fixed header and an option field of 0-40 bytes; and the UDP header consists of an 8-byte fixed header. Since not all target historical network traffic packets have the option fields in the IP header and the TCP header, and the information contained in the option fields is irrelevant to classification, for IP and TCP headers, the option fields are uniformly truncated when selecting the header feature vector, retaining only the first 20 bytes of the fixed header. For UDP headers, there is only an 8-byte fixed header, which is padded with zero bytes to 20 bytes. This results in a 40-byte header feature vector, which ensures the integrity of network traffic data.

[0079] In order to improve the effectiveness of the training data, the following steps are also included before step 110:

[0080] Filtering the historical network traffic data set based on a preset filtering condition to obtain a first network traffic data set;

[0081] Removing a link layer frame header and a frame trailer from each first network traffic data in the first network traffic data set, and masking a preset field in each first network traffic data set to obtain a second network traffic data set;

[0082] Each second network traffic data in the second network traffic data set is converted into a corresponding byte vector to obtain the target historical network traffic data set.

[0083] Specifically, the client device first filters the historical network traffic data set based on preset filtering conditions to obtain a first network traffic data set; then removes the link layer frame header and frame tail of each first network traffic data in the first network traffic data set, and masks the preset fields in each first network traffic data to obtain a second network traffic data set; finally, converts each second network traffic data in the two network traffic data sets into their respective corresponding byte vectors to obtain the target historical network traffic data set, thereby improving the effectiveness of the training data.

[0084] Among them, the preset filtering conditions are: removing historical network traffic data that lacks packet headers and has no load in the historical network traffic data set; the preset fields include: IP, checksum, identification and fragment offset fields in the IP header; port, sequence number, confirmation number, checksum field in the TCP header; port and checksum field in the UDP header.

[0085] It should be noted that the link layer contains information about the physical link, which is essential for forwarding frames in a local area network, but it does not provide information for the classification task of this application. The checksum, identification, and fragment offset fields are constants that are not related to classification. They are used by network devices for packet processing and error checking. The IP address and TCP / UDP port are related to the local network configuration and can only be used to judge local traffic, which will cause classification bias. Therefore, the above fields in the packet header are masked with zeros (that is, these data fields are ignored).

[0086] In order to effectively extract load features for traffic classification, the first network in step 120 includes: a convolutional layer, a first residual block, a first pooling layer, a second residual block, a second pooling layer, a third residual block, a third pooling layer, a fourth residual block, a fourth pooling layer, a first flattening layer, a first fully connected layer, and a first activation function connected in sequence;

[0087] The convolution layer is configured to obtain the first load feature matrix corresponding to each load feature matrix input therein according to the corresponding output;

[0088] The first residual block is configured to obtain corresponding second load feature matrices according to the corresponding outputs of the first load feature matrices input therein;

[0089] The first pooling layer is configured to obtain corresponding third load feature matrices according to the corresponding outputs of each of the second load feature matrices input therein;

[0090] The second residual block is configured to obtain respective corresponding fourth load feature matrices according to the corresponding outputs of the respective third load feature matrices input therein;

[0091] The second pooling layer is configured to obtain the corresponding fifth load feature matrix according to the corresponding output of each of the fourth load feature matrices input therein;

[0092] The third residual block is configured to obtain the sixth load feature matrix corresponding to each of the fifth load feature matrices input therein according to the corresponding output;

[0093] The third pooling layer is configured to obtain the corresponding seventh load feature matrix according to the corresponding output of each of the sixth load feature matrices input therein;

[0094] The fourth residual block is configured to obtain the corresponding eighth load feature matrix according to the corresponding output of each of the seventh load feature matrices input therein;

[0095] The fourth pooling layer is configured to obtain a ninth load feature matrix corresponding to each of the eighth load feature matrices input therein according to the corresponding output;

[0096] The first flattening layer is used to obtain the corresponding one-dimensional load feature vectors according to the corresponding outputs of each of the ninth load feature matrices input therein;

[0097] The first fully connected layer is configured to output a plurality of first categories according to the corresponding output of each of the one-dimensional load feature vectors input therein;

[0098] The first activation function is used to obtain the load classification score vectors corresponding to each of the one-dimensional load feature vectors according to each of the one-dimensional load feature vectors input therein and the output corresponding to each of the first categories.

[0099] Specifically, see Figure 4 The client device inputs each load feature matrix into the convolution layer, so that the convolution layer calls the Conv2d structure for two-dimensional convolution, sets the number of convolution kernels out_channels = 64, the convolution window size parameter kernel_size = 7, the convolution step length stride = 1, and the activation function activation = "relu" (i.e. Figure 4 ) and then pass through a combination module of 4 residual blocks and pooling layers. Each residual block consists of two two-dimensional convolutional layers and a jump connection. For each convolutional layer, the Conv2d structure is called, and the number of convolution kernel parameters out_channels=64, the step parameter stride=1, and the convolution window size parameter kernel_size=5 are set. After each convolution operation, batch normalization is performed, the BatchNorm2d structure is called, and then nonlinear activation is performed through the ReLU function. After each residual block, the input feature map and the feature map after the convolution operation are jump-connected. Each pooling layer performs average pooling on the feature map output by the residual block. After that, the Flatten layer (i.e. the first flattening layer) is passed to expand the pooled load feature matrix into a one-dimensional vector; finally, the first fully connected layer (i.e. Figure 4 The first activation function, activation = "relu", maps the one-dimensional vector output by the first flattening layer to the final total number of categories N, and obtains a score vector for each category (i.e., the first category), thereby effectively extracting load features for traffic classification.

[0100] Among them, the first neural network is an improved ResNet network architecture. The specific architecture can be found in Figure 4 ; The window size parameter pool_size of the four pooling layers gradually decreases to (8,8), (6,6), (4,4) and (2,2), corresponding to Figure 4AdaptiveAvgPool2d(8,8), AdaptiveAvgPool2d(6,6), AdaptiveAvgPool2d(4,4) and AdaptiveAvgPool2d(2,2); Figure 4 Conv2d in the figure represents a two-dimensional convolutional layer, 7*7 represents the convolution window size, and BatchNorm2d represents two-dimensional batch normalization.

[0101] In order to effectively extract packet header features for traffic classification, the second neural network in step 120 includes: an embedding layer, a second fully connected layer, a second activation function, a second flattening layer, a third fully connected layer, and a third activation function connected in sequence;

[0102] The embedding layer is configured to output a plurality of corresponding packet header byte feature vectors according to the corresponding output of each packet header feature vector input therein;

[0103] The second fully connected layer is configured to obtain a plurality of second categories according to the corresponding outputs of each of the packet header byte feature vectors input therein;

[0104] The second activation function is configured to output, based on each of the packet header byte feature vectors and each of the second categories input therein, respective packet header byte score vectors corresponding to each of the packet header feature vectors, and form a packet header byte feature matrix;

[0105] The second flattening layer is used to obtain the corresponding one-dimensional packet header feature vectors according to the corresponding output of each packet header byte feature matrix input therein;

[0106] The third fully connected layer is configured to obtain a plurality of third categories according to the corresponding outputs of each of the packet header feature vectors input therein;

[0107] The third activation function is used to obtain the packet header classification score vectors corresponding to each of the packet header feature one-dimensional vectors input therein and the corresponding outputs of each of the third categories.

[0108] Specifically, the client device first inputs each header feature vector into the embedding layer, so that the embedding layer calls the Embedding structure, sets the vocabulary size parameter num_embeddings = 256, the embedding dimension parameter embedding_dim = 16, and encodes each header byte in each header feature vector into a feature vector of length 16;

[0109] Then, each header byte feature vector with a length of 16 is input into the second fully connected layer so that the second fully connected layer outputs the number of units units = N (N is the number of types of network traffic in the dataset). Then, the second activation function activation = "relu" is used to map each header byte feature vector with a length of 16 to the final total number of categories N, and obtain a score vector for each header byte feature vector with a length of 16 for each category (i.e., the second category). Multiple header byte score vectors corresponding to the same header feature vector are combined into a header feature matrix.

[0110] Then, through the flatten layer (i.e., the second flattening layer), each header feature matrix is ​​expanded into a one-dimensional vector.

[0111] Finally, after passing through the third fully connected layer, the output unit number units = N (N is the number of network traffic types in the dataset). Using the third activation function activation = "relu", the one-dimensional vector output by the second flattening layer is mapped to the final total number of categories N, resulting in a score vector for each category (i.e., the third category). This effectively extracts packet header features for traffic classification.

[0112] The second neural network can be an embedding layer network.

[0113] To further improve the accuracy of network traffic classification, in step 130:

[0114] The target fully connected layer is used to map each of the load classification score vectors and the corresponding packet header classification score vectors input therein to a target feature space, so as to output a query vector, a key vector, a packet header value vector, and a load value vector corresponding to each of the load classification score vectors;

[0115] The fusion layer is used to calculate the inner product of each query vector and the corresponding key vector to obtain the attention score corresponding to each load classification score vector, and scale and normalize each attention score to obtain the attention weight matrix corresponding to each load classification score vector;

[0116] The output layer is used to perform weighted summation on the corresponding header value vectors and load value vectors based on each of the attention weight matrices to obtain the corresponding fused feature vectors.

[0117] Specifically, each load classification score vector and its corresponding packet header classification score vector are input into the target fully connected layer, so that the target fully connected layer maps each load classification score vector x1 and its corresponding packet header classification score vector x2 to the same feature space (i.e., the target feature space) through linear transformation, so as to output the query vector q, key vector k, packet header value vector v1, and load value vector v2. Then, after passing through the fusion layer, the inner product between the query vector q and the key vector k is calculated to obtain the attention score scores. Subsequently, the attention weight matrix is ​​obtained by scaling and softmax normalization of the scores. Finally, after passing through the output layer, the packet header value vector v1 and the load value vector v2 are weighted and summed using the attention weight matrix to obtain a fused feature vector that integrates the packet header and packet load features, thereby further improving the accuracy of network traffic classification.

[0118] In order to effectively obtain the probability of traffic data for each type, in step 140:

[0119] The network traffic classifier includes: a fourth fully connected layer and a fourth activation function;

[0120] The fourth fully connected layer is configured to obtain a plurality of fourth categories according to the corresponding outputs of the respective fused feature vectors input therein;

[0121] The fourth activation function is used to output the probabilities of the traffic types corresponding to the respective fused feature vectors according to the correspondence between the respective fused feature vectors input therein and the respective fourth categories.

[0122] Specifically, each fused feature vector is input into the fourth fully connected layer so that the fourth fully connected layer outputs the number of units units = N (N is the type of network traffic in the dataset); then, the fourth activation function activation = "relu" is used to map each fused feature vector to the final total number of categories N, and the probability of each traffic type (i.e., the fourth category) corresponding to each fused feature vector is obtained, thereby effectively obtaining the probability of traffic data for each type.

[0123] It should be noted that the first category, the second category, the third category, the fourth category and the traffic type are the same; the first activation function, the second activation function, the third activation function and the fourth activation function can be the same activation function; the first flattening layer, the second flattening layer and the third flattening layer can also be the same flattening layer.

[0124] The present application also provides a method for classifying network traffic executed by a client device. Figure 3 , the method comprising:

[0125] Step 210: Acquire a target network traffic data set; wherein, the target network traffic data set is obtained by preprocessing the network traffic data set.

[0126] Step 220: Input the target network traffic data set into the target network traffic classification model pre-trained based on the network traffic classification model training method mentioned in the aforementioned embodiment, so that the target network traffic classification model outputs the network traffic type result data corresponding to each target network traffic data in the target network traffic data set.

[0127] Specifically, the client device first obtains the target network traffic data set; then inputs the target network traffic data set into the target network traffic classification model trained in advance based on the network traffic classification model training method mentioned in the aforementioned embodiment, so that the target network traffic classification model outputs the network traffic type result data corresponding to each target network traffic data in the target network traffic data set, thereby effectively ensuring the integrity of the network traffic data and effectively improving the accuracy of the network traffic data classification.

[0128] The target network traffic data set is obtained by preprocessing the network traffic data set; the network traffic type result data includes the probability of the target network traffic data for each network traffic type in the target network traffic data set.

[0129] From the software level, this application also provides a network traffic classification model training device for executing all or part of the network traffic classification model training method, see Figure 2 The network traffic classification model training device specifically includes the following contents:

[0130] The feature selection module 10 is used to select the header feature vectors in the packet header data of each target historical network traffic data in the target historical network traffic data set; and select the load features in the load data in each target historical network traffic data to convert them into a load feature matrix; wherein, the target historical network traffic data set is obtained by preprocessing the historical network traffic data set in advance.

[0131] The classification score calculation module 20 is used to obtain multiple load classification score vectors corresponding to each of the load feature matrices based on the first neural network; and to obtain multiple packet header classification score vectors corresponding to each of the packet header feature vectors based on the second neural network; wherein the network structures of the first neural network and the second neural network are different.

[0132] The feature fusion module 30 is used to perform weighted summation on each of the load classification score vectors and each of the packet header classification score vectors according to the target fully connected layer, fusion layer and output layer connected in sequence, to obtain the fused feature vector corresponding to each of the target historical network traffic data.

[0133] The category probability calculation module 40 is configured to input each of the fused feature vectors into a network traffic classifier to obtain the probabilities of multiple traffic types corresponding to each of the fused feature vectors.

[0134] The model training module 50 is used to train a preset network traffic classification model based on the target historical network traffic data set and the probability of each traffic type, and during the training process, obtain the classification loss of the probability of each traffic type based on a preset classification loss function, and iteratively train the network traffic classification model based on the classification loss to obtain a target network traffic classification model for classifying network traffic; wherein, the network traffic classification model includes: the first neural network, the second neural network, the target fully connected layer, the fusion layer, the output layer and the network traffic classifier.

[0135] The embodiment of the network traffic classification model training device provided in this application can be specifically used to execute the processing flow of the embodiment of the network traffic classification model training method in the above-mentioned embodiment. Its functions will not be repeated here, and reference can be made to the detailed description of the above-mentioned network traffic classification model training method embodiment.

[0136] This application provides a network traffic classification model training device. The device selects packet header feature vectors and load feature matrices from a target historical network traffic dataset; obtains multiple load classification score vectors corresponding to each load feature matrix using a first neural network; and obtains multiple packet header classification score vectors corresponding to each packet header feature vector using a second neural network; performs a weighted summation of the load classification score vectors and the packet header classification score vectors to obtain a fused feature vector; inputs the fused feature vector into a network traffic classifier to obtain the probabilities of multiple corresponding traffic types; and during the training process, it iteratively trains the model based on a preset classification loss function to obtain a target network traffic classification model. This application can effectively ensure the integrity of network traffic data, thereby effectively improving the accuracy of network traffic data classification.

[0137] The present application also provides an electronic device, such as a central server, which may include a processor, a memory, a receiver, and a transmitter. The processor is used to execute the network traffic classification model training method mentioned in the above embodiment, or the network traffic classification method mentioned in the above embodiment, wherein the processor and the memory may be connected via a bus or other means, with bus connection being used as an example. The receiver may be connected to the processor and the memory via a wired or wireless manner.

[0138] The processor may be a central processing unit (CPU). The processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0139] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs, non-transient computer executable programs and modules, such as the network traffic classification model training method in the embodiment of the present application, or the program instructions / modules corresponding to the network traffic classification method mentioned in the aforementioned embodiment. The processor executes various functional applications and data processing of the processor by running the non-transient software programs, instructions and modules stored in the memory, that is, implementing the network traffic classification model training method in the above method embodiment, or the network traffic classification method mentioned in the aforementioned embodiment.

[0140] The memory may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created by the processor, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory may optionally include a memory remotely located relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0141] The one or more modules are stored in the memory, and when executed by the processor, perform the network traffic classification model training method in the embodiment, or the network traffic classification method mentioned in the above embodiment.

[0142] In some embodiments of the present application, the user equipment may include a processor, a memory and a transceiver unit, and the transceiver unit may include a receiver and a transmitter. The processor, memory, receiver and transmitter may be connected through a bus system. The memory is used to store computer instructions, and the processor is used to execute the computer instructions stored in the memory to control the transceiver unit to send and receive signals.

[0143] As an implementation method, the functions of the receiver and transmitter in this application can be considered to be implemented through a transceiver circuit or a dedicated transceiver chip, and the processor can be considered to be implemented through a dedicated processing chip, a processing circuit or a general-purpose chip.

[0144] As another implementation method, it is possible to use a general-purpose computer to implement the server provided in the embodiments of the present application. That is, the program code for implementing the functions of the processor, receiver, and transmitter is stored in a memory, and the general-purpose processor implements the functions of the processor, receiver, and transmitter by executing the code in the memory.

[0145] The present application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the aforementioned network traffic classification model training method, or the steps of the network traffic classification method mentioned in the aforementioned embodiment. The computer-readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the art.

[0146] It should be understood by those skilled in the art that the various exemplary components, systems and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software or a combination of the two. Whether it is specifically performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application. When implemented in hardware, it can be, for example, an electronic circuit, an application-specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of this application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link via a data signal carried in a carrier.

[0147] It should be understood that the present application is not limited to the specific configurations and processes described above and illustrated in the figures. For the sake of brevity, a detailed description of known methods is omitted here. In the above embodiments, several specific steps are described and illustrated as examples. However, the method process of the present application is not limited to the specific steps described and illustrated. Those skilled in the art can make various changes, modifications, and additions, or change the order of the steps after understanding the spirit of the present application.

[0148] In this application, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or replace features of other embodiments.

[0149] The above description is merely a preferred embodiment of the present application and is not intended to limit the present application. Those skilled in the art will appreciate that various modifications and variations of the present embodiment are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present application shall be included within the scope of protection of the present application.

Claims

1. A network traffic classification model training method, characterized in that: include: Selecting a packet header feature vector from packet header data of each target historical network traffic data set; and selecting load features from load data in each target historical network traffic data to convert into a load feature matrix; wherein the target historical network traffic data set is obtained by preprocessing the historical network traffic data set in advance; Obtaining multiple load classification score vectors corresponding to each of the load feature matrices according to a first neural network; and obtaining multiple packet header classification score vectors corresponding to each of the packet header feature vectors according to a second neural network; wherein the first neural network and the second neural network have different network structures; Performing weighted summation on each of the load classification score vectors and each of the packet header classification score vectors according to the sequentially connected target fully connected layer, fusion layer, and output layer to obtain a fusion feature vector corresponding to each of the target historical network traffic data; Inputting each of the fused feature vectors into a network traffic classifier to obtain probabilities of multiple traffic types corresponding to each of the fused feature vectors; A preset network traffic classification model is trained based on the target historical network traffic data set and the probability of each of the traffic types, and during the training process, the classification loss of the probability of each of the traffic types is obtained based on a preset classification loss function, and the network traffic classification model is iteratively trained based on the classification loss to obtain a target network traffic classification model for classifying network traffic; wherein, the network traffic classification model includes: the first neural network, the second neural network, the target fully connected layer, the fusion layer, the output layer and the network traffic classifier.

2. The network traffic classification model training method according to claim 1, characterized in that: Before selecting the packet header feature vectors in the packet header data and the load feature matrix in the load data in each target historical network traffic data set, the method further includes: Filtering the historical network traffic data set based on a preset filtering condition to obtain a first network traffic data set; Removing a link layer frame header and a frame trailer from each first network traffic data in the first network traffic data set, and masking a preset field in each first network traffic data set to obtain a second network traffic data set; Each second network traffic data in the second network traffic data set is converted into a corresponding byte vector to obtain the target historical network traffic data set.

3. The network traffic classification model training method according to claim 1, characterized in that: The first neural network includes: a convolutional layer, a first residual block, a first pooling layer, a second residual block, a second pooling layer, a third residual block, a third pooling layer, a fourth residual block, a fourth pooling layer, a first flattening layer, a first fully connected layer and a first activation function connected in sequence; The convolution layer is configured to obtain the first load feature matrix corresponding to each load feature matrix input therein according to the corresponding output; The first residual block is configured to obtain corresponding second load feature matrices according to the corresponding outputs of the first load feature matrices input therein; The first pooling layer is configured to obtain corresponding third load feature matrices according to the corresponding outputs of each of the second load feature matrices input therein; The second residual block is configured to obtain respective corresponding fourth load feature matrices according to the corresponding outputs of the respective third load feature matrices input therein; The second pooling layer is configured to obtain the corresponding fifth load feature matrix according to the corresponding output of each of the fourth load feature matrices input therein; The third residual block is configured to obtain the sixth load feature matrix corresponding to each of the fifth load feature matrices input therein according to the corresponding output; The third pooling layer is configured to obtain the corresponding seventh load feature matrix according to the corresponding output of each of the sixth load feature matrices input therein; The fourth residual block is configured to obtain the corresponding eighth load feature matrix according to the corresponding output of each of the seventh load feature matrices input therein; The fourth pooling layer is configured to obtain a ninth load feature matrix corresponding to each of the eighth load feature matrices input therein according to the corresponding output; The first flattening layer is used to obtain the corresponding one-dimensional load feature vectors according to the corresponding outputs of each of the ninth load feature matrices input therein; The first fully connected layer is configured to output a plurality of first categories according to the corresponding output of each of the one-dimensional load feature vectors input therein; The first activation function is used to obtain the load classification score vectors corresponding to each of the one-dimensional load feature vectors according to each of the one-dimensional load feature vectors input therein and the output corresponding to each of the first categories.

4. The network traffic classification model training method according to claim 1, characterized in that: The second neural network includes: an embedding layer, a second fully connected layer, a second activation function, a second flattening layer, a third fully connected layer, and a third activation function connected in sequence; The embedding layer is configured to output a plurality of corresponding packet header byte feature vectors according to the corresponding output of each packet header feature vector input therein; The second fully connected layer is configured to obtain a plurality of second categories according to the corresponding outputs of each of the packet header byte feature vectors input therein; The second activation function is configured to output, based on each of the packet header byte feature vectors and each of the second categories input therein, respective packet header byte score vectors corresponding to each of the packet header feature vectors, and form a packet header byte feature matrix; The second flattening layer is used to obtain the corresponding one-dimensional packet header feature vectors according to the corresponding output of each packet header byte feature matrix input therein; The third fully connected layer is configured to output a plurality of third categories according to the corresponding one-dimensional vectors of the packet header features input therein; The third activation function is used to obtain the packet header classification score vectors corresponding to each of the packet header feature one-dimensional vectors input therein and the corresponding outputs of each of the third categories.

5. The network traffic classification model training method according to claim 1, characterized in that: The target fully connected layer is used to map each of the load classification score vectors and the corresponding packet header classification score vectors input therein to a target feature space, so as to output a query vector, a key vector, a packet header value vector, and a load value vector corresponding to each of the load classification score vectors; The fusion layer is used to calculate the inner product of each query vector and the corresponding key vector to obtain the attention score corresponding to each load classification score vector, and scale and normalize each attention score to obtain the attention weight matrix corresponding to each load classification score vector; The output layer is used to perform weighted summation on the corresponding header value vectors and load value vectors based on each of the attention weight matrices to obtain the corresponding fused feature vectors.

6. The network traffic classification model training method according to claim 1, characterized in that: The network traffic classifier includes: a fourth fully connected layer and a fourth activation function; The fourth fully connected layer is configured to obtain a plurality of fourth categories according to the corresponding outputs of the respective fused feature vectors input therein; The fourth activation function is used to output the probabilities of the traffic types corresponding to the respective fused feature vectors according to the correspondence between the respective fused feature vectors input therein and the respective fourth categories.

7. A network traffic classification method, characterized in that: include: Obtaining a target network traffic data set; wherein the target network traffic data set is obtained by preprocessing the network traffic data set; The target network traffic data set is input into the target network traffic classification model that has been trained in advance based on the network traffic classification model training method described in any one of claims 1-6, so that the target network traffic classification model outputs the network traffic type result data corresponding to each target network traffic data in the target network traffic data set.

8. A network traffic classification model training device, characterized in that: include: A feature selection module is used to select a packet header feature vector from the packet header data of each target historical network traffic data set; and selecting load features from load data in each target historical network traffic data to convert into a load feature matrix; wherein the target historical network traffic data set is obtained by preprocessing the historical network traffic data set in advance; a classification score calculation module, configured to obtain, based on a first neural network, a plurality of load classification score vectors corresponding to each of the load feature matrices; and to obtain, based on a second neural network, a plurality of packet header classification score vectors corresponding to each of the packet header feature vectors; wherein the first neural network and the second neural network have different network structures; A feature fusion module is used to perform weighted summation on each of the load classification score vectors and each of the packet header classification score vectors according to the target fully connected layer, fusion layer, and output layer connected in sequence, to obtain a fused feature vector corresponding to each of the target historical network traffic data; A category probability calculation module, configured to input each of the fused feature vectors into a network traffic classifier to obtain probabilities of multiple traffic types corresponding to each of the fused feature vectors; A model training module is used to train a preset network traffic classification model based on the target historical network traffic data set and the probability of each of the traffic types, and during the training process, obtain the classification loss of the probability of each of the traffic types based on a preset classification loss function, and iteratively train the network traffic classification model based on the classification loss to obtain a target network traffic classification model for classifying network traffic; wherein, the network traffic classification model includes: the first neural network, the second neural network, the target fully connected layer, the fusion layer, the output layer and the network traffic classifier.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, it implements the network traffic classification model training method according to any one of claims 1 to 7, or executes the network traffic classification method according to claim 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the network traffic classification model training method as described in any one of claims 1 to 7, or executes the network traffic classification method as described in claim 8.

Images