A method and apparatus for classifying encrypted traffic based on path signature

Abstract

This application provides a method and apparatus for classifying encrypted traffic based on path signatures, relating to the field of artificial intelligence and also applicable to the financial field. The method includes: segmenting acquired encrypted traffic at the session granularity to obtain traffic paths; performing traffic path signatures on the traffic paths to obtain corresponding traffic path signature feature vectors; and inputting the traffic path signature feature vectors, after applying a Hilbert curve transform, into a pre-trained encrypted traffic classification model to obtain the encrypted traffic classification corresponding to the encrypted traffic. This application can generate signature information for encrypted traffic, thereby reflecting the geometric and statistical characteristics of encrypted traffic and exhibiting strong generalization ability.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence and can be used in the financial field. Specifically, it is a method and apparatus for classifying encrypted traffic based on path signature. Background Technology

[0002] With the development of internet technology, network scale is constantly expanding, and the types of services carried on the network are becoming increasingly diverse. Simultaneously, with rising user awareness of privacy, more and more traffic is being encrypted. To ensure the healthy development of the network, it is essential to analyze the characteristics of various service traffic in a timely manner and establish appropriate predictive models to understand traffic trends in real time, detect abnormal traffic, and manage various network services. For example, financial institutions or service providers need to understand network service status promptly and appropriately control some non-critical services (such as chat) to prevent them from consuming excessive network bandwidth resources, thereby affecting the normal operation of other critical services. Furthermore, it is also necessary to detect and identify malicious traffic hidden in the system, such as Trojans and worms, to ensure the security of the network environment and avoid negative impacts on normal network activities.

[0003] Therefore, by analyzing and identifying network traffic, network bandwidth can be rationally allocated, network performance improved, and anomalies detected in the network in a timely manner. This provides crucial assurance for the continuous high performance and secure operation of the network, ensuring proactive network management. Currently, the mainstream approach is to combine manually designed features with machine learning to classify encrypted traffic. This method requires manually designing and extracting statistical features based on the scenario. However, encrypted traffic is sensitive to environmental changes, and changes in scenarios or services often necessitate the design of new features. This approach relies on prior knowledge, is complex and inefficient, and suffers from poor generalization ability and high manpower costs. Summary of the Invention

[0004] To address the problems in the prior art, this application provides a method and apparatus for classifying encrypted traffic based on path signatures, which can generate signature information of encrypted traffic, thereby reflecting the geometric and statistical characteristics of encrypted traffic and having strong generalization ability.

[0005] To solve the above-mentioned technical problems, this application provides the following technical solution:

[0006] Firstly, this application provides a method for classifying encrypted traffic based on path signatures, including:

[0007] The acquired encrypted traffic is segmented at the session level to obtain the traffic path;

[0008] Perform a traffic path signature on the traffic path to obtain the corresponding traffic path signature feature vector;

[0009] After performing a Hilbert curve transformation on the traffic path signature feature vector, the input is given to a pre-trained encrypted traffic classification model to obtain the encrypted traffic classification corresponding to the encrypted traffic.

[0010] Furthermore, the step of segmenting the acquired encrypted traffic at the session granularity to obtain traffic paths includes:

[0011] The encrypted traffic is segmented at the session granularity based on the five-tuple information of the encrypted traffic to obtain the corresponding data packets;

[0012] For each session, the packet direction, packet length, and packet arrival interval of the data packets are extracted to generate a corresponding stream sequence;

[0013] By concatenating the various flow sequences, the corresponding flow paths can be obtained.

[0014] Further, the step of performing traffic path signature on the traffic path to obtain the corresponding traffic path signature feature vector includes:

[0015] The traffic path is divided into sub-paths of different lengths using a hierarchical binary window.

[0016] Higher-order multiple integrals are calculated for each sub-path to obtain the corresponding sub-path signature feature vector;

[0017] The signature feature vectors of each sub-path are stacked to form the traffic path signature feature vector.

[0018] Further, the step of performing a Hilbert curve transformation on the traffic path signature feature vector includes:

[0019] The traffic path signature feature vector is mapped to the pixel positions in a two-dimensional space using a Hilbert curve to obtain the initial image of the path signature.

[0020] The Hilbert curve transform image is obtained by cropping or padding the initial path signature image based on the length of the traffic path signature feature vector.

[0021] Furthermore, the steps of pre-training the encrypted traffic classification model include:

[0022] Traffic path signatures are performed on historical traffic paths to obtain the corresponding historical signature feature vectors;

[0023] After performing a Hilbert curve transformation on the historical signature feature vector, it is input together with the corresponding traffic classification label into a convolutional neural network for training to obtain the encrypted traffic classification model.

[0024] Further, the Hilbert curve transform is applied to the traffic path signature feature vector, which is then input into a pre-trained encrypted traffic classification model to obtain the encrypted traffic classification corresponding to the encrypted traffic, including:

[0025] The Hilbert curve transform image is input into the encrypted traffic classification model to obtain a binary classification of encrypted traffic; wherein, the encrypted traffic classification includes normal traffic and malicious traffic;

[0026] The encrypted traffic is further subdivided into two categories to obtain the application type in the normal traffic or the malicious type in the malicious traffic.

[0027] Secondly, this application provides a path signature-based encrypted traffic classification device, comprising:

[0028] The traffic path generation unit is used to segment the acquired encrypted traffic at the session granularity to obtain traffic paths;

[0029] A signature vector generation unit is used to perform traffic path signature on the traffic path to obtain the corresponding traffic path signature feature vector.

[0030] The encrypted traffic classification unit is used to perform Hilbert curve transformation on the traffic path signature feature vector and input it into a pre-trained encrypted traffic classification model to obtain the encrypted traffic classification corresponding to the encrypted traffic.

[0031] Furthermore, the traffic path generation unit includes:

[0032] The traffic segmentation module is used to segment the encrypted traffic at the session granularity according to the five-tuple information of the encrypted traffic to obtain the corresponding data packets;

[0033] The sequence building module is used to extract the data packet direction, data packet length, and data packet arrival interval for each session, and generate a corresponding stream sequence.

[0034] The traffic path creation module is used to concatenate various flow sequences to obtain the corresponding traffic path.

[0035] Further, the signature vector generation unit includes:

[0036] The path partitioning module is used to divide the traffic path into sub-paths of different lengths using a hierarchical binary window;

[0037] The path signature module is used to perform high-order multiple integral calculations on each sub-path to obtain the corresponding sub-path signature feature vector.

[0038] The signature vector generation module is used to stack the signature feature vectors of each sub-path into the traffic path signature feature vector.

[0039] Furthermore, the encrypted traffic classification unit includes:

[0040] The initial image generation module is used to map the traffic path signature feature vector to the pixel positions in a two-dimensional space using a Hilbert curve to obtain the initial image of the path signature.

[0041] The transformed image generation module is used to crop or fill the initial path signature image according to the length of the traffic path signature feature vector to obtain the Hilbert curve transformed image.

[0042] Furthermore, the encrypted traffic classification unit includes:

[0043] The historical vector generation module is used to sign historical traffic paths and obtain the corresponding historical signature feature vectors.

[0044] The classification model training module is used to perform Hilbert curve transformation on the historical signature feature vector, and then input it together with the corresponding traffic classification label into a convolutional neural network for training to obtain the encrypted traffic classification model.

[0045] Furthermore, the encrypted traffic classification unit includes:

[0046] The binary classification module is used to input the Hilbert curve transform image into the encrypted traffic classification model to obtain encrypted traffic binary classification; wherein, the encrypted traffic classification includes normal traffic and malicious traffic;

[0047] The detailed classification module is used to further classify the encrypted traffic into two categories to obtain the application type in the normal traffic or the malicious type in the malicious traffic.

[0048] Thirdly, this application provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the path signature-based encrypted traffic classification method.

[0049] Fourthly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the path signature-based encrypted traffic classification method.

[0050] Fifthly, this application provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the path signature-based encrypted traffic classification method.

[0051] To address the problems in existing technologies, this application provides a path signature-based encrypted traffic classification method and apparatus that can conveniently extract basic flow attributes from encrypted traffic and adjust the length of the flow sequence according to the scenario to achieve real-time traffic classification. Specifically, it utilizes a path signature algorithm to process the flow sequence, representing it as a signature feature vector based on multiple integral operations, thereby avoiding traces of manual design. The signature feature vector reflects the geometric and statistical characteristics of the traffic, thus effectively representing the traffic and is suitable for different network environments and classification tasks, exhibiting strong generalization ability. Furthermore, it applies Hilbert curves to capture the correlation between multi-scale signature feature vectors and combines them with a convolutional neural network to classify the traffic, improving the accuracy of traffic classification. Attached Figure Description

[0052] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0053] Figure 1 This is a flowchart of the encrypted traffic classification method based on path signature in the embodiments of this application;

[0054] Figure 2 This is a flowchart illustrating the traffic path obtained in the embodiments of this application;

[0055] Figure 3 This is a flowchart illustrating the process of obtaining the corresponding traffic path signature feature vector in this application embodiment;

[0056] Figure 4 This is a flowchart illustrating the Hilbert curve transformation in this application embodiment;

[0057] Figure 5 This is a flowchart illustrating the training of the encrypted traffic classification model in an embodiment of this application;

[0058] Figure 6 This is a flowchart illustrating the encrypted traffic classification process in the embodiments of this application;

[0059] Figure 7 This is a structural diagram of the encrypted traffic classification device based on path signature in the embodiments of this application;

[0060] Figure 8 This is a structural diagram of the traffic path generation unit in the embodiments of this application;

[0061] Figure 9 This is a structural diagram of the signature vector generation unit in an embodiment of this application;

[0062] Figure 10 This is one of the structural diagrams of the encrypted traffic classification unit in the embodiments of this application;

[0063] Figure 11 This is the second structural diagram of the encrypted traffic classification unit in the embodiments of this application;

[0064] Figure 12 This is the third structural diagram of the encrypted traffic classification unit in the embodiments of this application;

[0065] Figure 13 This is a schematic diagram of the structure of the electronic device in the embodiments of this application. Detailed Implementation

[0066] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0067] It should be noted that the encrypted traffic classification method and apparatus based on path signature provided in this application can be used in the financial field, or in any field other than the financial field. The application field of the encrypted traffic classification method and apparatus based on path signature provided in this application is not limited.

[0068] The acquisition, storage, use, and processing of data in this application comply with relevant laws and regulations.

[0069] In one embodiment, see Figure 1 In order to generate signature information for encrypted traffic, thereby reflecting the geometric and statistical characteristics of encrypted traffic and possessing strong generalization ability, this application provides an encrypted traffic classification method based on path signatures, including:

[0070] S101: The acquired encrypted traffic is segmented at the session level to obtain the traffic path;

[0071] S102: Perform traffic path signature on the traffic path to obtain the corresponding traffic path signature feature vector;

[0072] S103: After performing Hilbert curve transformation on the traffic path signature feature vector, input it into a pre-trained encrypted traffic classification model to obtain the encrypted traffic classification corresponding to the encrypted traffic.

[0073] It is understood that the embodiments of this application utilize a path signature algorithm to process the stream sequence corresponding to encrypted traffic, and then generate a signature feature vector of encrypted traffic based on multiple integral operations, avoiding the inefficiency and incompleteness caused by manually designing feature vectors. The signature feature vector can simultaneously reflect the geometric and statistical characteristics of encrypted traffic, thus effectively characterizing encrypted traffic and exhibiting strong generalization ability.

[0074] Specifically, firstly, encrypted traffic is acquired and segmented at the session level to obtain corresponding traffic paths; then, traffic path signatures are performed on the traffic paths to obtain corresponding traffic path signature feature vectors; next, Hilbert curve transformation is applied to the traffic path signature feature vectors, and finally, the data is input into a pre-trained encrypted traffic classification model to obtain the encrypted traffic classification corresponding to the encrypted traffic.

[0075] As described above, the encrypted traffic classification method based on path signature provided in this application can conveniently extract basic flow attributes from encrypted traffic, adjust the length of the flow sequence according to the scenario, and achieve real-time traffic classification. Specifically, it uses a path signature algorithm to process the flow sequence, and represents the flow sequence as a signature feature vector based on multiple integral operations, thereby avoiding traces of manual design. The signature feature vector can reflect the geometric and statistical characteristics of the traffic, thus effectively representing the traffic, applicable to different network environments and classification tasks, and exhibiting strong generalization ability. Furthermore, it applies Hilbert curves to capture the correlation between multi-scale signature feature vectors and combines them with a convolutional neural network to classify the traffic, improving the accuracy of traffic classification.

[0076] In one embodiment, see Figure 2 The step of segmenting the acquired encrypted traffic at the session granularity to obtain traffic paths includes:

[0077] S201: Based on the five-tuple information of the encrypted traffic, the encrypted traffic is segmented at the session granularity to obtain the corresponding data packets;

[0078] S202: For each session, extract the data packet direction, data packet length, and data packet arrival interval of the data packet to generate a corresponding stream sequence;

[0079] S203: Concatenate the various flow sequences to obtain the corresponding flow paths.

[0080] It is understood that the encrypted traffic in the system collected in this application embodiment is segmented according to session granularity based on the 5-tuple (source IP address, source port, destination IP address, destination port, and transport layer protocol). A session contains multiple data packets in both sending and receiving directions. For each session, the packet direction, packet length, and packet arrival interval of the first n data packets are extracted. The direction of data packets received by the server is represented as -1, and the direction of data packets sent by the server is represented as 1. The interval time sequence is padded with 0s, resulting in three flow sequences of length n: packet direction, packet length, and packet arrival interval. Finally, the three flow sequences are concatenated into a three-dimensional traffic path.

[0081] As can be seen from the above description, the encrypted traffic classification method based on path signature provided in this application can segment the acquired encrypted traffic at the session granularity to obtain the traffic path.

[0082] In one embodiment, see Figure 3 The step of performing traffic path signature on the traffic path to obtain the corresponding traffic path signature feature vector includes:

[0083] S301: The traffic path is divided into sub-paths of different lengths using a hierarchical binary window;

[0084] S302: Perform higher-order multiple integrals on each sub-path to obtain the corresponding sub-path signature feature vector;

[0085] S303: Stack the signature feature vectors of each sub-path to form the traffic path signature feature vector.

[0086] Understandably, after concatenating the three flow sequences into a three-dimensional flow path, this embodiment utilizes a path signature algorithm to generate multi-scale signature features. Specifically, firstly, a hierarchical binary window of depth q is used to divide the flow path into sub-paths of different lengths. For example, an original path P of length n can be divided into one path of length n, and two paths of length n / 2, ..., 2 after being divided by the window. q-1 The length of the strip is n / 2 q-1 of 2 in total q -1 sub-path.

[0087] In this approach, a hierarchical binary window subdivides a path into smaller segments of varying lengths. The signature features of longer paths describe global information, while the signature features of shorter paths describe local details. Compared to directly calculating higher-order multiple integrals over the entire path, hierarchical paths require fewer orders of multiple integrals, resulting in fewer feature dimensions and thus greater efficiency.

[0088] Then, for each subpath, calculate the v-order truncated signature:

[0089]

[0090] and, Where l is the path length, j1, j2, ..., j k ∈{1,…,d} is the order of integration, and d is the path dimension.

[0091] As can be seen from the above description, the encrypted traffic classification method based on path signature provided in this application can perform traffic path signature on the traffic path to obtain the corresponding traffic path signature feature vector.

[0092] In one embodiment, see Figure 4 The step of performing a Hilbert curve transformation on the traffic path signature feature vector includes:

[0093] S401: Using Hilbert curves, the traffic path signature feature vector is mapped to the pixel positions in a two-dimensional space to obtain the initial image of the path signature;

[0094] S402: Trim or fill the initial path signature image according to the length of the traffic path signature feature vector to obtain the Hilbert curve transformation image.

[0095] It is understood that in this embodiment, the signatures of all sub-paths under a path are stacked into a multi-scale signature feature vector, and then a Hilbert curve is used for mapping transformation. The Hilbert curve can be used as a transfer function from one-dimensional data to two-dimensional data, preserving the spatial locality of the original one-dimensional data while reducing the distance between distant data. There is a certain correlation between the multi-scale signature features extracted based on the sub-path division, which can be captured using the Hilbert curve. The extracted multi-scale signature features are mapped to various pixel positions in two-dimensional space according to the Hilbert curve. Depending on the length of the signature features, they may need to be cropped or padded to map to all pixels in the image; redundant parts are directly removed, and the padded pixel values ​​can be 0.

[0096] As can be seen from the above description, the encrypted traffic classification method based on path signature provided in this application can perform Hilbert curve transformation on the traffic path signature feature vector.

[0097] In one embodiment, see Figure 5 The steps for pre-training an encrypted traffic classification model include:

[0098] S501: Sign the historical traffic paths to obtain the corresponding historical signature feature vectors;

[0099] S502: After performing a Hilbert curve transform on the historical signature feature vector, it is input together with the corresponding traffic classification label into a convolutional neural network for training, thereby obtaining the encrypted traffic classification model. See also... Figure 6 The Hilbert curve transform is applied to the traffic path signature feature vector, and then input into a pre-trained encrypted traffic classification model to obtain the encrypted traffic classification corresponding to the encrypted traffic. This includes: inputting the Hilbert curve transform image into the encrypted traffic classification model to obtain a binary classification of encrypted traffic (S601); wherein, the encrypted traffic classification includes normal traffic and malicious traffic; and refining the binary classification of encrypted traffic to obtain the application type in the normal traffic or the malicious type in the malicious traffic (S602).

[0100] Understandably, training an encrypted traffic classification model requires utilizing historical data (specifically, historical encrypted traffic). Therefore, the first step is to process historical encrypted traffic using the same method described above (for current encrypted traffic, not historical traffic) to obtain the corresponding historical signature feature vector. For details, please refer to the previous section. Then, after applying a Hilbert curve transform to the historical signature feature vector, it is input into a convolutional neural network along with the corresponding traffic classification labels for training. During training, a suitable loss function can be selected, and the initial learning rate can be adjusted. Finally, the encrypted traffic classification model is obtained after training. The traffic classification labels include at least normal traffic and malicious traffic, and may also include further subcategories such as chat traffic, video traffic, business traffic, worm traffic, and Trojan traffic. The encrypted traffic classification model can classify these types.

[0101] As can be seen from the above description, the encrypted traffic classification method based on path signature provided in this application can pre-train an encrypted traffic classification model.

[0102] Based on the same inventive concept, this application also provides a path signature-based encrypted traffic classification device, which can be used to implement the method described in the above embodiments, as described in the following embodiments. Since the principle of the path signature-based encrypted traffic classification device in solving the problem is similar to that of the path signature-based encrypted traffic classification method, the implementation of the path signature-based encrypted traffic classification device can refer to the implementation of the software performance benchmark determination method, and repeated details will not be elaborated further. As used below, the terms "unit" or "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the system described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0103] In one embodiment, see Figure 7In order to generate signature information for encrypted traffic, thereby reflecting the geometric and statistical characteristics of encrypted traffic and possessing strong generalization ability, this application provides an encrypted traffic classification device based on path signature, comprising:

[0104] Traffic path generation unit 701 is used to segment the acquired encrypted traffic according to session granularity to obtain traffic paths;

[0105] The signature vector generation unit 702 is used to perform traffic path signature on the traffic path to obtain the corresponding traffic path signature feature vector.

[0106] The encrypted traffic classification unit 703 is used to perform Hilbert curve transformation on the traffic path signature feature vector and input it into a pre-trained encrypted traffic classification model to obtain the encrypted traffic classification corresponding to the encrypted traffic.

[0107] In one embodiment, see Figure 8 The traffic path generation unit includes:

[0108] Traffic segmentation module 801 is used to segment the encrypted traffic according to the session granularity based on the five-tuple information of the encrypted traffic to obtain the corresponding data packets;

[0109] The sequence establishment module 802 is used to extract the data packet direction, data packet length and data packet arrival interval for each session, and generate a corresponding stream sequence.

[0110] The traffic path establishment module 803 is used to concatenate the various flow sequences to obtain the corresponding traffic path.

[0111] In one embodiment, see Figure 9 The signature vector generation unit includes:

[0112] The path partitioning module 901 is used to divide the traffic path into sub-paths of different lengths using a hierarchical binary window;

[0113] The path signature module 902 is used to perform high-order multiple integral calculations on each sub-path to obtain the corresponding sub-path signature feature vector.

[0114] The signature vector generation module 903 is used to stack the signature feature vectors of each sub-path into the traffic path signature feature vector.

[0115] In one embodiment, see Figure 10 The encrypted traffic classification unit includes:

[0116] The initial image generation module 1001 is used to map the traffic path signature feature vector to the pixel positions in a two-dimensional space using a Hilbert curve to obtain an initial image of the path signature.

[0117] The transformed image generation module 1002 is used to crop or fill the initial path signature image according to the length of the traffic path signature feature vector to obtain a Hilbert curve transformed image.

[0118] In one embodiment, see Figure 11 The encrypted traffic classification unit includes:

[0119] The historical vector generation module 1101 is used to sign the historical traffic path and obtain the corresponding historical signature feature vector.

[0120] The classification model training module 1102 is used to perform Hilbert curve transformation on the historical signature feature vector, and then input it together with the corresponding traffic classification label into the convolutional neural network for training to obtain the encrypted traffic classification model.

[0121] In one embodiment, see Figure 12 The encrypted traffic classification unit includes:

[0122] The binary classification module 1201 is used to input the Hilbert curve transform image into the encrypted traffic classification model to obtain encrypted traffic binary classification; wherein, the encrypted traffic classification includes normal traffic and malicious traffic;

[0123] The detailed classification module 1202 is used to further classify the encrypted traffic into two categories to obtain the application type in the normal traffic or the malicious type in the malicious traffic.

[0124] From a hardware perspective, in order to generate signature information for encrypted traffic, thereby reflecting the geometric and statistical characteristics of encrypted traffic and possessing strong generalization ability, this application provides an embodiment of an electronic device for implementing all or part of the aforementioned path signature-based encrypted traffic classification method. The electronic device specifically includes the following components:

[0125] The system comprises a processor, a memory, a communications interface, and a bus; wherein the processor, memory, and communications interface communicate with each other via the bus; the communications interface is used to realize information transmission between the path signature-based encrypted traffic classification device and core business systems, user terminals, and related databases and other related devices; the logic controller can be a desktop computer, tablet computer, or mobile terminal, etc., and this embodiment is not limited to these. In this embodiment, the logic controller can be implemented with reference to the embodiments of the path signature-based encrypted traffic classification method and the embodiment of the path signature-based encrypted traffic classification device in the embodiments, the content of which is incorporated herein, and repeated details will not be described again.

[0126] It is understood that the user terminal may include smartphones, tablet computers, network set-top boxes, portable computers, desktop computers, personal digital assistants (PDAs), in-vehicle devices, smart wearable devices, etc. Among these, the smart wearable devices may include smart glasses, smartwatches, smart bracelets, etc.

[0127] In practical applications, the encrypted traffic classification method based on path signatures can be partially executed on the electronic device side as described above, or all operations can be completed in the client device. The choice can be made based on the processing power of the client device and the limitations of the user's usage scenario. This application does not impose any limitations on this. If all operations are completed in the client device, the client device may further include a processor.

[0128] The aforementioned client device may have a communication module (i.e., a communication unit) that can communicate with a remote server to achieve data transmission. The server may include a server on the task scheduling center side; in other implementation scenarios, it may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, a server cluster consisting of multiple servers, or a distributed server structure.

[0129] Figure 13 This is a schematic block diagram illustrating the system configuration of the electronic device 9600 according to an embodiment of this application. Figure 13 As shown, the electronic device 9600 may include a central processing unit 9100 and a memory 9140; the memory 9140 is coupled to the central processing unit 9100. It is worth noting that... Figure 13 This is an example; other types of structures can also be used to supplement or replace this structure to achieve telecommunications functions or other functions.

[0130] In one embodiment, the encrypted traffic classification method based on path signatures can be integrated into the central processing unit 9100. The central processing unit 9100 can be configured to perform the following control:

[0131] S101: The acquired encrypted traffic is segmented at the session level to obtain the traffic path;

[0132] S102: Perform traffic path signature on the traffic path to obtain the corresponding traffic path signature feature vector;

[0133] S103: After performing Hilbert curve transformation on the traffic path signature feature vector, input it into a pre-trained encrypted traffic classification model to obtain the encrypted traffic classification corresponding to the encrypted traffic.

[0134] As described above, the encrypted traffic classification method and apparatus based on path signature provided in this application can conveniently extract basic flow attributes from encrypted traffic, adjust the length of the flow sequence according to the scenario, and achieve real-time traffic classification. Specifically, the path signature algorithm is used to process the flow sequence, and the flow sequence is represented as a signature feature vector based on multiple integral operations, thereby avoiding traces of manual design. The signature feature vector can reflect the geometric and statistical characteristics of the traffic, thus effectively representing the traffic and is suitable for different network environments and classification tasks, exhibiting strong generalization ability. Furthermore, Hilbert curves are applied to capture the correlation between multi-scale signature feature vectors, and a convolutional neural network is combined to classify the traffic, improving the accuracy of traffic classification.

[0135] In another embodiment, the path signature-based encrypted traffic classification device can be configured separately from the central processing unit 9100. For example, the path signature-based encrypted traffic classification device of the data composite transmission device can be configured as a chip connected to the central processing unit 9100, and the function of the path signature-based encrypted traffic classification method can be realized through the control of the central processing unit.

[0136] like Figure 13 As shown, the electronic device 9600 may further include: a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, and a power supply 9170. It is worth noting that the electronic device 9600 does not necessarily need to include these components. Figure 13 All components shown; in addition, the electronic device 9600 may also include Figure 13 For components not shown, please refer to existing technologies.

[0137] like Figure 13As shown, the central processing unit 9100, sometimes also referred to as a controller or operating control, may include a microprocessor or other processor device and / or logic device, which receives inputs and controls the operation of various components of the electronic device 9600.

[0138] The memory 9140 may be, for example, one or more of a cache, flash memory, hard drive, removable media, volatile memory, non-volatile memory, or other suitable devices. It may store the aforementioned failure-related information, and also store a program for executing that information. The central processing unit 9100 may execute the program stored in the memory 9140 to perform information storage or processing, etc.

[0139] Input unit 9120 provides input to central processing unit 9100. Input unit 9120 may be, for example, a keypad or touch input device. Power supply 9170 provides power to electronic device 9600. Display 9160 displays images and text. Display may be, for example, an LCD display, but is not limited thereto.

[0140] The memory 9140 can be a solid-state memory, such as a read-only memory (ROM), random access memory (RAM), a SIM card, etc. It can also be a memory that retains information even when power is off, can be selectively erased, and contains more data; examples of this type of memory are sometimes referred to as EPROMs. The memory 9140 can also be some other type of device. The memory 9140 includes a buffer memory 9141 (sometimes referred to as a buffer). The memory 9140 may include an application / function storage unit 9142 for storing application programs and function programs or processes for executing the operation of the electronic device 9600 via the central processing unit 9100.

[0141] The memory 9140 may also include a data storage unit 9143 for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. The driver storage unit 9144 of the memory 9140 may include various drivers for the electronic device's communication functions and / or for performing other functions of the electronic device (such as messaging applications, address book applications, etc.).

[0142] The communication module 9110 is a transmitter / receiver 9110 that transmits and receives signals via the antenna 9111. The communication module (transmitter / receiver) 9110 is coupled to the central processing unit 9100 to provide input signals and receive output signals, which can be the same as in a conventional mobile communication terminal.

[0143] Based on different communication technologies, multiple communication modules 9110 can be configured in the same electronic device, such as cellular network modules, Bluetooth modules, and / or wireless LAN modules. The communication module (transmitter / receiver) 9110 is also coupled to a speaker 9131 and a microphone 9132 via an audio processor 9130 to provide audio output via the speaker 9131 and receive audio input from the microphone 9132, thereby realizing typical telecommunications functions. The audio processor 9130 may include any suitable buffer, decoder, amplifier, etc. Additionally, the audio processor 9130 is also coupled to a central processing unit 9100, enabling on-device recording via the microphone 9132 and on-device playback of stored sound via the speaker 9131.

[0144] Embodiments of this application also provide a computer-readable storage medium capable of implementing all steps of the path signature-based encrypted traffic classification method with a server or client as the execution subject in the above embodiments. The computer-readable storage medium stores a computer program that, when executed by a processor, implements all steps of the path signature-based encrypted traffic classification method with a server or client as the execution subject in the above embodiments. For example, when the processor executes the computer program, it implements the following steps:

[0145] S101: The acquired encrypted traffic is segmented at the session level to obtain the traffic path;

[0146] S102: Perform traffic path signature on the traffic path to obtain the corresponding traffic path signature feature vector;

[0147] S103: After performing Hilbert curve transformation on the traffic path signature feature vector, input it into a pre-trained encrypted traffic classification model to obtain the encrypted traffic classification corresponding to the encrypted traffic.

[0148] As described above, the encrypted traffic classification method and apparatus based on path signature provided in this application can conveniently extract basic flow attributes from encrypted traffic, adjust the length of the flow sequence according to the scenario, and achieve real-time traffic classification. Specifically, the path signature algorithm is used to process the flow sequence, and the flow sequence is represented as a signature feature vector based on multiple integral operations, thereby avoiding traces of manual design. The signature feature vector can reflect the geometric and statistical characteristics of the traffic, thus effectively representing the traffic and is suitable for different network environments and classification tasks, exhibiting strong generalization ability. Furthermore, Hilbert curves are applied to capture the correlation between multi-scale signature feature vectors, and a convolutional neural network is combined to classify the traffic, improving the accuracy of traffic classification.

[0149] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0150] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (devices), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0151] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0152] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0153] Specific embodiments have been used to illustrate the principles and implementation methods of this invention. The descriptions of the embodiments above are only for the purpose of helping to understand the method and core ideas of this invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this invention. Therefore, the content of this specification should not be construed as a limitation of this invention.

Claims

1. A method for classifying encrypted traffic based on path signatures, characterized in that, include: The acquired encrypted traffic is segmented at the session level to obtain the traffic path; Perform a traffic path signature on the traffic path to obtain the corresponding traffic path signature feature vector; After performing a Hilbert curve transformation on the traffic path signature feature vector, the input is given to a pre-trained encrypted traffic classification model to obtain the encrypted traffic classification corresponding to the encrypted traffic. The step of performing traffic path signature on the traffic path to obtain the corresponding traffic path signature feature vector includes: The traffic path is divided into sub-paths of different lengths using a hierarchical binary window. Higher-order multiple integrals are calculated for each sub-path to obtain the corresponding sub-path signature feature vector; The signature feature vectors of each sub-path are stacked to form the traffic path signature feature vector.

2. The encrypted traffic classification method based on path signature according to claim 1, characterized in that, The step of segmenting the acquired encrypted traffic at the session granularity to obtain traffic paths includes: The encrypted traffic is segmented at the session granularity based on the five-tuple information of the encrypted traffic to obtain the corresponding data packets; For each session, the packet direction, packet length, and packet arrival interval of the data packets are extracted to generate a corresponding stream sequence; By concatenating the various flow sequences, the corresponding flow paths can be obtained.

3. The encrypted traffic classification method based on path signature according to claim 1, characterized in that, The step of performing a Hilbert curve transformation on the traffic path signature feature vector includes: The traffic path signature feature vector is mapped to the pixel positions in a two-dimensional space using a Hilbert curve to obtain the initial image of the path signature. The Hilbert curve transform image is obtained by cropping or padding the initial path signature image based on the length of the traffic path signature feature vector.

4. The encrypted traffic classification method based on path signature according to claim 1, characterized in that, The steps for pre-training an encrypted traffic classification model include: Traffic path signatures are performed on historical traffic paths to obtain the corresponding historical signature feature vectors; After performing a Hilbert curve transformation on the historical signature feature vector, it is input together with the corresponding traffic classification label into a convolutional neural network for training to obtain the encrypted traffic classification model.

5. The encrypted traffic classification method based on path signature according to claim 3, characterized in that, After performing a Hilbert curve transform on the traffic path signature feature vector, it is input into a pre-trained encrypted traffic classification model to obtain the encrypted traffic classification corresponding to the encrypted traffic, including: The Hilbert curve transform image is input into the encrypted traffic classification model to obtain a binary classification of encrypted traffic; wherein, the encrypted traffic classification includes normal traffic and malicious traffic; The encrypted traffic is further subdivided into two categories to obtain the application type in the normal traffic or the malicious type in the malicious traffic.

6. A path signature-based encrypted traffic classification device, characterized in that, include: The traffic path generation unit is used to segment the acquired encrypted traffic at the session granularity to obtain traffic paths; A signature vector generation unit is used to perform traffic path signature on the traffic path to obtain the corresponding traffic path signature feature vector. The encrypted traffic classification unit is used to perform Hilbert curve transformation on the traffic path signature feature vector and input it into a pre-trained encrypted traffic classification model to obtain the encrypted traffic classification corresponding to the encrypted traffic. The signature vector generation unit is specifically used to divide the traffic path into sub-paths of different lengths using a hierarchical binary window; to perform high-order multiple integral calculations on each sub-path to obtain the corresponding sub-path signature feature vector; and to stack the sub-path signature feature vectors to form the traffic path signature feature vector.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the encrypted traffic classification method based on path signature as described in any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the encrypted traffic classification method based on path signatures as described in any one of claims 1 to 5.

9. A computer program product, comprising a computer program / instructions, characterized in that, When executed by a processor, the computer program / instruction implements the steps of the path signature-based encrypted traffic classification method as described in any one of claims 1 to 5.

Images