A method for extracting spatiotemporal features, a method for identifying traffic flow and a device

Abstract

A method for extracting spatiotemporal features, a method for identifying traffic and a device thereof, which relate to the field of traffic analysis of optical fiber communication networks. The method comprises: for a pair of uplink and downlink real-time traffic data in a communication device, all packets obtained within each time interval T constitute a flow pulse, and according to the uplink and downlink cache packet information, the packet information of w dimensions is statistically analyzed using features of H dimensions, and the spatial features T within each time interval T are obtained. i , n spatial features T i Constructed into a timing sample ST n , Timing Sample ST n The dimension is W×H×n. The present invention only extracts spatial features for flow pulses and filters out the longer intervals between flow pulses, so it can quickly reduce the dimension of large-scale traffic data, especially encrypted traffic data; and can dynamically construct non-sparse discriminative traffic statistical spatial time series features, and the extracted traffic features have high discriminative and dimensional compression capabilities.

Description

Technical Field

[0001] The present application relates to the field of fiber optic communication network traffic analysis, and specifically to a spatiotemporal feature extraction method, a traffic identification method and a device. Background Art

[0002] In today's network environment, with the widespread use of encrypted communications, the demand for encrypted traffic identification is increasing.

[0003] However, it is difficult to implement the encrypted traffic identification function in the Operations and Maintenance Center (OMC) and the Optical Network Unit (ONU). As a centralized management system of the network, OMC is mainly responsible for high-level network monitoring and maintenance tasks, and it is difficult to cope with the high-intensity decryption and identification of large-scale encrypted traffic. As a device located at the user end, ONU usually focuses on the transmission of optical fiber signals and the connection of user terminals. Its resources are relatively limited, and it is also unable to achieve highly intelligent encrypted traffic identification tasks.

[0004] Existing encrypted traffic identification technology solutions include:

[0005] Traffic classification based on statistical features: A method that uses the statistical properties and features of network packets to classify or identify traffic. This classification method usually relies on various features and indicators of the packet, such as packet size, IP address, source and destination port numbers, transmission protocol type, etc. This type of method is highly dependent on the discriminability of the extracted features set by experts, and poor feature discriminability will lead to insufficient model performance.

[0006] Traffic classification based on deep feature extraction: Use deep learning models to learn and extract abstract high-level features (including time or space) from network packets, and then use these features to classify or identify traffic. This type of method is very time-consuming and computationally intensive to extract deep features from high-dimensional data, and cannot be used on the optical line terminal (OLT) side. At the same time, existing models cannot effectively combine spatial and temporal knowledge in traffic data to extract discriminative spatiotemporal features. Summary of the invention

[0007] The present application provides a spatiotemporal feature extraction method, a traffic identification method and a device, which can solve the technical problems existing in the prior art that features cannot be effectively identified and that extracting deep features is very time-consuming and computationally intensive.

[0008] In a first aspect, an embodiment of the present application provides a method for extracting spatiotemporal features, the method comprising:

[0009] Based on irregular flow pulse sampling, for the uplink and downlink flows in the real-time traffic data of the communication equipment, when the previous time interval ends, the next time interval is recorded from the arrival time of the first packet of one of the uplink or downlink of the flow, and all packets obtained in each time interval T constitute a flow pulse. According to the uplink and downlink cache packet information, the packet information of w dimensions is statistically analyzed using the features of H dimensions, and the spatial features Ti in each time interval T are obtained. The n spatial features Ti are constructed into a time series sample STn, and the dimension of the time series sample STn is W×H×n;

[0010] Wherein, W=2w, W represents the dimension of uplink and downlink together, w is the dimension of uplink packet information, H is the dimension of statistical characteristics, n is the number of Ti, and i is the sequence number.

[0011] In conjunction with the first aspect, in one implementation, the dimensions of the packet information include at least packet length, packet time interval, and packet quantity;

[0012] The dimensions of statistical features include at least mean, standard deviation, maximum, minimum, and median.

[0013] In combination with the first aspect, in one implementation, the spatial feature Ti is expressed as:

[0014]

[0015] Among them, u wH Indicates the statistics of the uplink cached packets, d wH Indicates the statistics of packets in the downstream buffer.

[0016] In combination with the first aspect, in one implementation, when the upstream and downstream have repeated dimensions, W=2w-x, where x represents the number of repeated dimensions.

[0017] In a second aspect, an embodiment of the present application provides a traffic identification method based on the above-mentioned spatiotemporal feature extraction method, the method comprising:

[0018] Timing Sample ST n The initial feature f is obtained by two bilinear interpolations interp , expand the sample dimension to W×H×N, and then extract the initialization spatiotemporal features f through grouped convolution init ; Initialize the spatiotemporal features f init Flattened conversion into first time series features The dimension is L×N, where N represents the number of channels after the dimension expansion, and L represents the one-dimensional data converted from the two-dimensional data W×H.

[0019] Establish a spatiotemporal self-attention module to initialize the spatiotemporal features finit Through the processing of multi-head spatial attention module and spatial feature extraction, the discriminative spatial feature f is obtained s At the same time, the first time series feature Through the processing of the multi-head time attention module, the second time series feature is obtained

[0020] The second time series feature is transformed by point convolution and discriminative spatial features f s Constructed into the f interp The spatiotemporal feature residual f st , and then input it into the new spatiotemporal self-attention module for learning. After multiple rounds of learning, the final feature f is output. mst , and output the final result through the fully connected layer.

[0021] In combination with the second aspect, in one implementation, the initialized spatiotemporal feature f init Through the processing of multi-head spatial attention module and spatial feature extraction, the discriminative spatial feature f is obtained s ,include:

[0022] The spatiotemporal features f initialized by three convolution kernels init Perform convolution to generate the first learnable weight matrix k c , the second weight matrix q c , the third weight matrix v c , calculate the first weight matrix k c and the second weight matrix q c The matrix dot product similarity of , and divided by and The expression of attention weight matrix Attn, attention weight matrix Attn and third weight matrix v c The matrices of the last two dimensions are multiplied and then transformed to obtain the initialized spatiotemporal features f init The residual characteristic f attnc , information compensation through multi-head spatial attention;

[0023] Initialize the spatiotemporal features f init and residual characteristics f attnc Through convolution, feature residual learning is performed to obtain discriminative spatial features f s .

[0024] In combination with the second aspect, in one implementation, the initialized spatiotemporal feature f init and residual characteristics f attnc Feature residual learning through convolution, including:

[0025] Initialize the spatiotemporal features finit and residual characteristics f attnc The sum is input to the spatial feature extraction layer composed of two convolutional blocks for feature residual learning. The first convolutional block includes a convolutional expansion layer, a BN layer, and a RELU activation function, which are used to expand the channel dimension; the second convolutional block includes a convolutional restoration layer, a BN layer, and a RELU activation function, which are used to restore the channel dimension to the original input.

[0026] In combination with the second aspect, in one implementation, the first timing feature Through the processing of the multi-head time attention module, the second time series feature is obtained include:

[0027] The first time series feature Position encoding is performed in N dimensions, and the encoded time series features Input multi-head temporal attention module, using three learnable matrix components, respectively with the encoded temporal features The matrix multiplication of the three corresponding matrices is obtained, and the learned output features are obtained by calculation.

[0028] Concatenate the attention of all heads and perform linear transformation to obtain the transformed features Then the feedforward network is fully connected and the transformed feature residual is output According to the formula

[0029]

[0030] Calculate the second time series feature

[0031] In combination with the second aspect, in one implementation, the encoded time series feature Use three learnable matrix components, respectively, and the encoded time series features The matrix multiplication of the three corresponding matrices is obtained, and the learned output features are obtained by calculation. include:

[0032] Using the first learnable matrix component W q , the second learnable matrix component W k , the third learnable matrix component W v Respectively with the encoded time series features The first corresponding matrix q is obtained by multiplying the matrix t , the second corresponding matrix k t , the third corresponding matrix v t , through the formula

[0033]

[0034] Calculate the output features where attn t is the attention weight, according to the first corresponding matrix q t , the second corresponding matrix k t Transpose and the second learnable matrix component w k The dimension of is calculated.

[0035] In combination with the second aspect, in one embodiment, the final feature f mst The final result is output through the fully connected layer, including:

[0036] The fully connected layer includes three linear layers and two activation functions, and the calculation formula is:

[0037] O class =linear(Relu(linear(Relu(linear(flatten(f mst ))))))).

[0038] In a third aspect, the embodiment of the present application provides a flow identification device based on the above-mentioned spatiotemporal feature extraction method, including:

[0039] The feature initialization module is used to convert the timing sample ST n The initial feature f is obtained by two bilinear interpolations interp , expand the sample dimension to W×H×N, and then extract the initialization spatiotemporal features f through grouped convolution init ; Initialize the spatiotemporal features f init Flattened conversion into first time series features The dimension is L×N;

[0040] There are multiple spatiotemporal self-attention modules, which include a spatial attention module and a temporal attention module. The spatial attention module is used to initialize the spatiotemporal features f init Through the processing of multi-head spatial attention module and spatial feature extraction, the discriminative spatial feature f is obtained s ; The temporal attention module is used to take the first temporal feature Through the processing of the multi-head time attention module, the second time series feature is obtained

[0041] Point convolution module, used to transform the second time series feature through point convolution and discriminative spatial features f s Constructed into the f interp The spatiotemporal feature residual f st, and then input it into the new spatiotemporal self-attention module for learning. After multiple rounds of learning, the final feature f is output. mst ;

[0042] The fully connected layer is used to calculate the final feature f mst Output the final result.

[0043] The beneficial effects brought by the technical solution provided by the embodiments of the present application include:

[0044] The spatiotemporal feature extraction method (Irregular Impulse Sampling, IPS) is used. Since the traffic packets of each application present a pulse-like distribution in a short period of time, that is, there are a large number of traffic packets at a certain moment, but there are almost no traffic packets in most time periods, this application uses H dimensions of features to perform statistics on the w-dimensional packet information according to the uplink and downlink cache packet information for each flow pulse, and obtains the spatial features T in each time interval T. i , n spatial features T i Constructed into a time series sample ST with dimensions W×H×n n , only spatial features are extracted for flow pulses, and the longer intervals between flow pulses are filtered out. Therefore, large-scale traffic data can be quickly reduced in dimension, especially encrypted traffic data; and non-sparse discriminative traffic statistical spatial time series features can be dynamically constructed. The extracted traffic features have high discriminative and dimensional compression capabilities.

[0045] In the embodiment of the traffic identification method, the spatial attention module and the temporal attention module are used to effectively learn the temporal and spatial knowledge from the spatiotemporal features, so as to solve the problem that the convolutional attention algorithm in the prior art cannot effectively learn the long-distance dependencies in the temporal data knowledge, and solve the problem that the Transformer attention algorithm is not robust to the small sample spatial data features after dimensionality reduction. By residually connecting the multi-head attention information, the loss of spatiotemporal feature information in the deep network is effectively reduced, thereby obtaining discriminative traffic spatiotemporal features. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 This is a schematic diagram of an embodiment of the spatiotemporal feature extraction method of the present application;

[0047] Figure 2 This is a flow chart of the traffic identification method according to an embodiment of the present application;

[0048] Figure 3 This is a schematic diagram of the principle of the traffic identification method according to an embodiment of the present application. DETAILED DESCRIPTION

[0049] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0050] First, some technical terms in the present application are explained to facilitate those skilled in the art to understand the present application.

[0051] Encrypted traffic identification: It is an important technology in network management and network security, which aims to identify traffic categories from various applications or web services. First, it can help us better understand the nature and source of network traffic, which helps to optimize network performance and resource allocation. Secondly, the application of traffic identification can also help monitor and manage network traffic to improve service quality and better respond to network threats and security vulnerabilities. Finally, this capability can also be used to formulate more accurate pricing strategies to adjust service fees or discounts based on user usage of different applications, but a considerable portion of network traffic is encrypted traffic, which poses further challenges to traffic identification.

[0052] Irregular pulse characteristics of traffic: refers to the fact that the traffic packets of each application flow present a pulse-like distribution in a short period of time, that is, there are a large number of traffic packets at a certain moment, but almost no traffic packets in most time periods.

[0053] Transformer: is a deep learning model architecture for natural language processing (NLP) and Italian sequence-to-sequence tasks that introduces a self-attention mechanism that considers all positions in the input sequence at the same time, allowing the model to assign different attention weights to different parts of the input sequence.

[0054] Token: Token, the constituent unit of the time series samples used by the Transformer network.

[0055] Multi-head attention: The self-attention mechanism in Transformer is extended to multiple attention heads, each of which can learn different attention weights to better capture different types of relationships.

[0056] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below in conjunction with the accompanying drawings.

[0057] In the first aspect, the embodiments of the present application provide a spatiotemporal feature extraction method based on irregular flow pulse sampling. Specifically, the irregular pulse characteristic of traffic refers to the fact that the traffic packets of each application flow present a pulse-like distribution in a short period of time, that is, there are a large number of traffic packets at a certain moment, and almost no traffic packets in most time periods.

[0058] like Figure 1 As shown, p represents the traffic packet, T1, T2, T3...T n It represents the pulse time series samples of n tokens obtained in n time intervals T. The time interval T is a very small time interval, usually less than 0.2 seconds. The time intervals T can be the same or different. In this embodiment, the time intervals T are the same.

[0059] Figure 1 It can be seen that there are two uplink packets and four downlink packets in the time period [t0, t0+T1], while there are no packets in the time period [t0+T1, t1], and the time interval [t0+T1, t1] is relatively long. The irregularity of encrypted traffic is manifested in the irregular pattern of traffic packets of these pulses. In this application, encrypted traffic is taken as an example, and the above-mentioned spatiotemporal feature extraction method is also applicable to ordinary traffic. Each application has a different irregular pulse pattern. Due to the influence of the uncertainty of the application and human operation, [t0+T1, t1], [t1+T2, t2]…[t n-2 +T n-1 , t n-1 ] The time intervals are often irregular.

[0060] In this embodiment, a pair of uplink and downlink flows in real-time traffic data in a communication device is taken as an example to illustrate the above-mentioned spatiotemporal feature extraction method based on irregular flow pulse sampling. When the previous time interval ends, the next time interval starts from the arrival time (t0, t1, t2, ..., t n-1 ) starts recording, and all packets obtained in each time interval T constitute a flow pulse. That is, recording starts from the time when the first packet of the flow arrives. The first packet of the flow can be uplink or downlink. The packet information is cached according to uplink and downlink respectively, and then the dimension of these packets is reduced to statistics, that is, the packet information of w dimensions is counted using the features of H dimensions, and the spatial features T within each T are obtained. i (dimension is w×H), and use it as a token, and transform n spatial features T i Constructed into a timing sample ST n , Timing Sample ST nThe dimension is W×H×n; where W=2w, W represents the dimension of uplink and downlink together, w is the dimension of uplink packet information, H is the dimension of statistical features, and n is T i , i is the sequence number.

[0061] Furthermore, in one embodiment, when there are repeated dimensions in the uplink and downlink, the statistics of the same dimension can be reduced once, that is, W=2w-x, where x represents the number of repeated dimensions. For example, for the same flow, the protocols of the uplink traffic and the downlink traffic are the same, which is equivalent to having repeated dimensions, then x is 1, and W=2w-1. By reducing the statistics of repeated dimensions, data redundancy can be reduced.

[0062] Specifically, the packet information includes: packet length, packet time interval, and packet quantity, and may also include: packet arrival time and packet protocol, etc., in this embodiment, there are a total of w dimensions. The statistical features include the mean, kurtosis, maximum, minimum, and median, and may also include the standard deviation, etc., in this embodiment, there are a total of H dimensions. The above time series sample ST n =(T1,T2,T3,...,T n ), where each token’s T i It can be expressed as:

[0063]

[0064] where u wH Indicates the statistics of the uplink cached packets, d wH It represents the statistics of packet information in the downlink buffer, and W represents the statistical timing characteristics of n upstream and downstream pulses in a flow n×T period in the encrypted traffic data.

[0065] The spatiotemporal feature extraction method in this embodiment can quickly reduce the dimension of large-scale encrypted traffic data and dynamically construct non-sparse discriminative traffic statistical spatial time series samples ST n , can extract single-stream samples with discriminative and non-sparse features in a short time, improve the discriminability of the extracted features, improve the performance of the recognition algorithm, and reduce time and computing power.

[0066] On the second aspect, the embodiment of the present application also provides a traffic identification method based on the above-mentioned spatiotemporal feature extraction method. The traffic identification method is based on ST-Former (Spatial & Temporal Transformer-based Model) spatiotemporal feature learning, which can meet the real-time requirements of implementing AI model reasoning on communication equipment, especially on the OLT side.

[0067] In one embodiment, if Figure 2 As shown, the above-mentioned traffic identification method includes the following steps:

[0068] S1, timing sample ST n The time series data can be expanded through the bilinear interpolation module. First, the sample data is bilinearly interpolated twice to obtain the initial feature f interp , expand the sample dimension to W×H×N, and then extract the features through grouped convolution to obtain the initialized spatiotemporal features f init Specifically, two convolution kernels are used to perform two convolutions. Each convolution is performed in W×H dimensions. N groups of independent convolutions are performed to preserve the temporal order between n tokens. The final output dimension is W×H×N, which is the initialization of the spatiotemporal feature f. init Then, the initialized spatiotemporal features f init The W and H dimensions in the tiling transformation become the first time series features Its dimension is L×N, where N represents the number of channels after the dimension expansion, and L represents the one-dimensional data transformed from the two-dimensional data W×H, and the dimension length remains unchanged.

[0069] S2. Establish a spatial and temporal self-attention module (Spatial & Temporal Attention Module, STA-Module) to initialize the spatiotemporal features f init Through the processing of multi-head spatial attention module and spatial feature extraction, the discriminative spatial feature f is obtained s At the same time, the first time series feature Through the processing of the multi-head time attention module, the second time series feature is obtained

[0070] S3, through point convolution, the second time series feature and discriminative spatial features f s Constructed into initial feature f interp The spatiotemporal feature residual f st , and then input it into the new spatiotemporal self-attention module for learning. After multiple rounds of learning, the final feature f is output. mst , and output the final result through the fully connected layer.

[0071] In this embodiment, the spatial attention module and the temporal attention module are used to effectively learn temporal and spatial knowledge from the spatiotemporal features, thereby solving the problem that the convolutional attention algorithm in the prior art cannot effectively learn the long-distance dependencies in the temporal data knowledge. By residually connecting the multi-head attention information, the loss of spatiotemporal feature information in the deep network is effectively reduced, thereby obtaining discriminative traffic spatiotemporal features.

[0072] like Figure 2 and Figure 3As shown, in one embodiment, the spatiotemporal self-attention module established in step S2 includes a spatial attention module (Spatial Attention Layers, SAL) and a temporal attention module (Temporal Attention Layers, TAL). Step S2 is used to initialize the spatiotemporal feature f init Through the processing of multi-head spatial attention module and spatial feature extraction, the discriminative spatial feature f is obtained s , including:

[0073] S211, the spatial attention module is a CNN-style multi-head self-attention mechanism layer. First, the initialization of the spatiotemporal features f is performed through three convolution kernels. init Perform convolution to generate the first learnable weight matrix k c , the second weight matrix q c , the third weight matrix v c , the matrix size is h×L×d, where h is the number of heads of multi-head attention, L is W×H, and d is equal to the number of channels divided by the number of heads h (i.e. N÷h). The first weight matrix k c , the second weight matrix q c , the third weight matrix v c It is a two-dimensional decomposition matrix obtained by convolution of two-dimensional data. c as the subscript represents convolution, q, k, and v represent query vector (query), key vector (key), and value vector (value), respectively.

[0074] S212, calculate the first weight matrix k c and the second weight matrix q c The matrix dot product similarity of , and divided by and The expression ensures that the contribution of vectors of different dimensions to similarity will not be affected by the number of dimensions, and the attention weight matrix Attn is obtained as follows:

[0075]

[0076] Where × is the first weight matrix k c and the transposed second weight matrix q c The matrix multiplication of the last two dimensions, sum, represents d The dimensions (d-dimensional real space) are added, τ is minimized to prevent the denominator from being zero, and the dimension of the attention weight matrix Attn is h×L×L, and is used to c Weighted, attention weight matrix Attn and third weight matrix v c Multiply and transform to get the initialized spatiotemporal feature f init The residual characteristic f attnc , the formula is as follows:

[0077] f attnc =Rearrange(Attn×v c )

[0078] Where Rearrange is the matrix dimension combination transformation, × is the attention weight matrix Attn and the third weight matrix v c The matrix of the last two dimensions is multiplied, and the output residual characteristic f attnc The dimension is h×L×d, and information compensation is performed through multi-head spatial attention.

[0079] S213, initialize the spatiotemporal features f init and residual characteristics f attnc Through convolution (CNN) feature residual learning, the discriminative spatial feature f is obtained s , the dimension is W×H×N.

[0080] Specifically, the initialized spatiotemporal features f init and residual characteristics f attnc of and f com (f com =f attnc +f init ) is input to the spatial feature extraction layer composed of two convolutional blocks for feature residual learning. The first convolutional block includes a convolutional expansion layer, a BN layer (batch normalization layer) and a RELU (rectified linear activation function) activation function, which is used to expand the channel dimension; the second convolutional block includes a convolutional reduction layer, a BN layer and a RELU activation function, which is used to restore the channel dimension to the original input.

[0081] like Figure 2 and Figure 3 As shown, in one embodiment, the temporal attention module is a time series learning network with a Transformer structure, which extracts time series features from the time series data of traffic with reference to the structure of the Transformer encoder, in order to learn the long-distance dependencies in the time series data. Through the processing of the multi-head time attention module, the second time series feature is obtained Specifically include:

[0082] S221, the first time series feature As the input of the temporal attention module, its dimension is L×N. Position encoding is performed in N dimensions to obtain the encoded temporal features The calculation is as follows:

[0083]

[0084] Where pos represents the position number, and j represents the dimension index of the position encoding vector.

[0085] S222, encoded time series features It can be input into the multi-head temporal attention module, using three learnable matrix components, respectively with the encoded temporal features The matrix multiplication of the three corresponding matrices is obtained, and the learned output features are obtained by calculation.

[0086] Specifically, using the first learnable matrix component W q , the second learnable matrix component W k , the third learnable matrix component W v Respectively with the encoded time series features The first corresponding matrix q is obtained by multiplying the matrix t , the second corresponding matrix k t , the third corresponding matrix v t , and calculate the attention weight attn by the following formula t :

[0087]

[0088] where d k It is W k The dimension of the matrix, t as the subscript represents Transformer. This embodiment is a first time series feature The one-dimensional linear decomposition is transformed into a two-dimensional matrix, and the obtained attention is used to weight the word embedding matrix.

[0089] like Figure 3 As shown, the learned output features It can be expressed as the residual of q:

[0090]

[0091] S223, concatenate the attention of all heads (Concate), and then perform linear transformation through the linear output layer (Linear) to obtain the transformed features

[0092] S224, then fully connected through the feedforward network (FFN), and output the above transformed feature residual The feedforward network consists of two linear layers and an activation function. The transformed feature residual learned by the final temporal attention module is The dimension W×H×N can be obtained as follows:

[0093]

[0094] like Figure 2 and Figure 3 As shown, in one embodiment, in the above S3, the second time series feature is transformed into and discriminative spatial features f s Constructed into initial feature f interp The spatiotemporal feature residual f st , the specific formula is as follows:

[0095]

[0096] The spatial-temporal feature residual f st It will be input into the new spatiotemporal self-attention module (including SAL and TAL) for learning again. The process is the same as in the above embodiment. After multiple rounds of learning, the final feature f is output. mst , the final feature f mst It will pass through three linear layers and two fully connected layers consisting of activation functions to output the final result O class , which is the identified traffic application, the fully connected layer calculation is as follows:

[0097] O class =linear(Relu(linear(Relu(linear(flatten(f mst ))))))).

[0098] In a third aspect, the present application also provides a flow identification device based on the above-mentioned flow identification method. Figure 3 As shown, the traffic identification device in this embodiment includes a feature initialization module, a spatiotemporal self-attention module, a point convolution module and a fully connected layer.

[0099] The feature initialization module is used to convert the timing sample ST n The initial feature f is obtained by two bilinear interpolations interp , expand the sample dimension to W×H×N, and then extract the initialization spatiotemporal features f through grouped convolution init ; Initialize the spatiotemporal features f init Flattened conversion into first time series features The dimension is L×N.

[0100] There are multiple spatiotemporal self-attention modules, which include a spatial attention module (SAL) and a temporal attention module (TAL). The spatial attention module is used to initialize the spatiotemporal features f init Through the processing of multi-head spatial attention module and spatial feature extraction, the discriminative spatial feature f is obtained s ; The temporal attention module is used to take the first temporal feature Through the processing of the multi-head time attention module, the second time series feature is obtained

[0101] The two modules SAL and TAL process the input data in parallel. SAL is performed on two-dimensional input and is used to process the spatial data of packet information and its statistics in the traffic data. The purpose is to learn the residual spatial information to supplement the time series data to make up for the missing spatial information extracted by TAL. TAL acts on one-dimensional data (original two-dimensional data stretch) and is used to process the time series information in the traffic data. The purpose is to learn the long-distance relationship between different spatiotemporal tokens to compensate for the time series order information in the data that SAL cannot learn.

[0102] Point convolution module, used to transform the second time series feature through point convolution and discriminative spatial features f s Constructed into the f interp The spatiotemporal feature residual f st , and then input it into the new spatiotemporal self-attention module for learning. After multiple rounds of learning, the final feature f is output. mst .

[0103] The fully connected layer is used to calculate the final feature f mst Output the final result. The fully connected layer includes three linear layers and two activation functions.

[0104] Next, an experimental example is used to verify the above-mentioned spatiotemporal feature extraction method and traffic identification method.

[0105] This embodiment conducts two rounds of experiments, and the experimental process includes two parts: network training and testing.

[0106] The training set of Experiment 1 selected the ISCXVPN2016 dataset, which was a network dataset released by a research team at Dalhousie University in Canada in 2016. It is used for network traffic classification and VPN traffic identification research. It includes 24 categories of applications, including web browsing (Firefox and Chrome), email (SMPTS, POP3S and IMAPS), chat software (ICQ, AIM, Skype, Facebook and Hangouts), streaming software (Vimeo and YouTube), file transfer, VoIP applications, P2P applications, etc., with a total of 16.4G network traffic data. We randomly selected 3 / 4 of each category as the training set and 1 / 4 as the test set.

[0107] In Experiment 2, the OLT computing power board dynamically captures the IPS statistical time series characteristics of network traffic, including 10 applications such as Blibli Video, Douyu, QQ, Tencent Video, and Honor of Kings, with 17,600 samples in the test set and 4,400 samples in the validation set.

[0108] First, if Figure 1 As shown, the statistical time series features are constructed by the spatiotemporal feature extraction method based on irregular flow pulse sampling. In this embodiment, the statistical features are selected as mean, standard deviation (std_dev), skewness, kurtosis, median, maximum value (max_val), minimum value (min_val), first quartile (q1), and third quartile (q3). The traffic information is divided into uplink and downlink and the packet length, number of packets, packet arrival time, packet time interval and protocol are selected respectively; the number of sample time series tokens is 10, and the time interval is 0.01 seconds. In this way, according to the above-mentioned spatiotemporal feature extraction method based on irregular flow pulse sampling, the training set 13.12G traffic data and the test set 3.28G traffic data are constructed into 487,805 training set samples and 121,952 test set samples respectively. In this embodiment, for each sample dimension W×H×n, W=10, since the protocols of the upstream traffic and the downstream traffic of the same flow are the same, after the protocol information of the upstream traffic and the downstream traffic is merged, the dimension of each sample is 9×9×10.

[0109] Then, if Figure 3 As shown in the figure, the feature initialization process of traffic data includes: first, after statistical time series feature extraction, it is transformed into 9×9×10-dimensional sample features, and then expanded into 9×9×30-dimensional statistical time series features through two sets of bilinear interpolation and grouped convolution blocks (including two-dimensional grouped convolution, batch normalization and RELU activation function), and finally the statistical time series features are input into the spatial attention module, and flattened into one dimension and input into the temporal attention module.

[0110] Specifically, we only use one spatiotemporal attention module, which consists of a spatial attention module (SAL) and a temporal attention module (TAL). The spatial attention module consists of a set of spatial multi-head attention layers and a set of 2D convolution blocks. The number of heads in the spatial multi-head attention layer is 4, the size of the spatial self-attention convolution kernel is 3×3, and the number of input and output channels is 30; the 2D convolution block consists of 2D convolution, batch normalization and RELU activation function, the size of the convolution kernel is 3×3, and the number of convolution input and output channels is 30. The temporal attention module is a standard Transformer encoder, which divides the input temporal 1D sequence (81×30) into 30 tokens for position encoding, and then performs multi-head temporal feature extraction and feed-forward neural network (FFN) linear connection. The number of multi-heads is 6, the number of encoding layers in the encoder is 1, the hidden layer dimension of the feed-forward neural network (FFN) is 512, and the output 1D features are normalized and reconstructed into the original 2D features (9×9×30). The spatial features extracted by the spatial attention module and the temporal features extracted by the temporal attention module are concatenated into a spatiotemporal feature (9×9×60), and the number of feature channels is adjusted to 30 (9×9×30) through a two-dimensional convolution with a convolution kernel size of 3×3.

[0111] Finally, the extracted spatiotemporal features are classified through a fully connected layer, which expands the spatiotemporal features and maps them to the output dimensional space through three linear layers. The output dimensions of the three linear layers are 512, 256, and 24, respectively.

[0112] During training, the learning rate was 2e-5, the Adam optimizer was used, the momentum was set to 0.5, the batch size was 64, and the experiment converged and ended training after 300 iterations.

[0113] The hardware of the OLT computing board is Intel(R) Xeon(R) D-2187NT, and the hardware of the GPU server is NVIDIA GeForce3090 24G graphics card. Experiment 1 is trained on the GPU server and tested and verified on the GPU server. Experiment 2 extracts IPS features (temporal and spatial features) on the OLT computing board, then trains on the GPU server, and deploys the trained model to the OLT computing board to test real-time traffic.

[0114] The test results of Experiment 1 are shown in Tables 1 and 2.

[0115] Table 1

[0116] method Accuracy Recall f1 score CNN 0.6277 0.5443 0.4642 LSTM 0.3971 0.4745 0.3801 Transformer 0.5366 0.5272 0.5272 CNN&IPS 0.8912 0.8688 0.8744 LSTM&IPS 0.8126 0.8093 0.8036 Transformer & IPS 0.8983 0.8897 0.8876

[0117] In Table 1, based on the ISCXVPN2016 dataset, the IPS method proposed in this application is verified on the three existing mainstream methods (CNN, LSTM, Transformer). The first three rows in Table 1 use the time series features extracted by the traditional statistical algorithm for a long time (sample extraction time 5s-100s) to test the three methods (the one-dimensional features extracted by the traditional statistical algorithm in a short time are completely invalid and the accuracy is 0). The last three rows in Table 1 use the statistical time series features extracted by the short-time (sample extraction time 0.1s-0.5s) IPS method proposed in this application. The experimental results prove the performance and real-time performance of the IPS method of this application.

[0118] Table 2

[0119] method Accuracy Recall f1 score CNN&IPS 0.8912 0.8688 0.8744 LSTM&IPS 0.8126 0.8093 0.8036 Transformer & IPS 0.8983 0.8897 0.8876 SDAE&IPS 0.8190 0.8170 0.8046 FS-NET&IPS 0.8950 0.8853 0.8871 Convformer&IPS 0.9089 0.9041 0.9036 ST-Former&IPS 0.9231 0.9212 0.9206

[0120] In Table 2, ST-Former is compared with the advanced time series classification algorithm based on IPS features. Compared with the SOTA of the existing algorithms, the ST-Former algorithm of this community has significantly higher classification accuracy. In Experiment 2, the traffic identification method of this application can achieve a single sample average reasoning time of 0.009s and a sample reasoning accuracy of 91.2% on the OLT computing power board while occupying only 10% of the CPU resources.

[0121] It should be noted that the serial numbers of the above-mentioned embodiments of the present application are only for description and do not represent the advantages or disadvantages of the embodiments.

[0122] The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices. The terms "first", "second" and "third" are used to distinguish different objects, etc., and do not represent a sequence, nor do they limit "first", "second" and "third" to different types.

[0123] In the description of the embodiments of the present application, "exemplary", "for example" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary", "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary", "for example" or "for example" is intended to present related concepts in a specific way.

[0124] In the description of the embodiments of the present application, unless otherwise specified, “ / ” means or, for example, A / B can mean A or B; the “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.

[0125] In some processes described in the embodiments of the present application, multiple operations or steps that appear in a specific order are included, but it should be understood that these operations or steps may not be executed in the order in which they appear in the embodiments of the present application or in parallel, and the sequence number of the operation is only used to distinguish the different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed in sequence or in parallel, and these operations or steps may be combined.

[0126] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD) as described above, and includes a number of instructions for a terminal device to execute the methods described in each embodiment of the present application.

[0127] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A spatiotemporal feature extraction method, characterized in that: The method comprises: Based on irregular flow pulse sampling, for the uplink and downlink flows in the real-time traffic data of the communication equipment, when the previous time interval ends, the next time interval starts recording from the arrival time of the first packet of one of the uplink or downlink of the flow. All packets obtained in each time interval T constitute a flow pulse. According to the uplink and downlink cache packet information, the packet information in w dimensions is statistically analyzed using the features of H dimensions to obtain the spatial features T in each time interval T. i , n spatial features T i Constructed into a timing sample ST n , Timing Sample ST n The dimension is W×H×n; Where W = 2w, W represents the dimension of uplink and downlink together, w is the dimension of uplink packet information, H is the dimension of statistical features, and n is T i The number of , i is the serial number; The dimensions of the packet information include at least packet length, packet time interval, and packet quantity; The dimensions of statistical features include at least mean, standard deviation, maximum, minimum, and median.

2. The spatiotemporal feature extraction method according to claim 1, characterized in that: The spatial feature Ti is expressed as: Among them, u wH Indicates the statistics of the uplink cached packets, d wH Indicates the statistics of packets in the downstream buffer.

3. The spatiotemporal feature extraction method according to claim 1, characterized in that: When the upper and lower rows have repeated dimensions, W=2w-x, where x represents the number of repeated dimensions.

4. A traffic identification method based on the spatiotemporal feature extraction method according to any one of claims 1 to 3, characterized in that: The method comprises: Timing Sample ST n The initial feature f is obtained by two bilinear interpolations interp , expand the sample dimension to W×H×N, and then extract the initialization spatiotemporal features f through grouped convolution init ; Initialize the spatiotemporal features f init Flattened conversion into first time series features The dimension is L×N, where N represents the number of channels after the dimension expansion, and L represents the one-dimensional data converted from the two-dimensional data W×H. Establish a spatiotemporal self-attention module to initialize the spatiotemporal features f init Through the processing of multi-head spatial attention module and spatial feature extraction, the discriminative spatial feature f is obtained s At the same time, the first time series feature Through the processing of the multi-head time attention module, the second time series feature is obtained The second time series feature is transformed by point convolution and discriminative spatial features f s Constructed into the f interp The spatiotemporal feature residual f st , and then input it into the new spatiotemporal self-attention module for learning. After multiple rounds of learning, the final feature f is output. mst , and output the final result through the fully connected layer.

5. The flow identification method according to claim 4, characterized in that: The initialization of the spatiotemporal features f init Through the processing of multi-head spatial attention module and spatial feature extraction, the discriminative spatial feature f is obtained s ,include: The spatiotemporal features f initialized by three convolution kernels init Perform convolution to generate the first learnable weight matrix k c , the second weight matrix q c , the third weight matrix v c , calculate the first weight matrix k c and the second weight matrix q c The matrix dot product similarity of , and divided by and The expression of attention weight matrix Attn, attention weight matrix Attn and third weight matrix v c The matrices of the last two dimensions are multiplied and then transformed to obtain the initialized spatiotemporal features f init The residual characteristic f attnc , information compensation through multi-head spatial attention; Initialize the spatiotemporal features f init and residual characteristics f attnc Through convolution, feature residual learning is performed to obtain discriminative spatial features f s .

6. The flow identification method according to claim 5, characterized in that: Initialize the spatiotemporal features f init and residual characteristics f attnc Feature residual learning through convolution, including: Initialize the spatiotemporal features f init and residual characteristics f attnc The sum is input to the spatial feature extraction layer composed of two convolution blocks for feature residual learning. The first convolution block includes a convolution expansion layer, a batch normalization BN layer, and a linear rectification RELU activation function, which are used to expand the channel dimension; the second convolution block includes a convolution reduction layer, a BN layer, and a RELU activation function, which are used to restore the channel dimension to the original input.

7. The flow identification method according to claim 4, characterized in that: The first timing characteristic Through the processing of the multi-head time attention module, the second time series feature is obtained include: The first time series feature Position encoding is performed in N dimensions, and the encoded time series features Input multi-head temporal attention module, using three learnable matrix components, respectively with the encoded temporal features The matrix multiplication of the three corresponding matrices is obtained, and the learned output features are obtained by calculation. Concatenate the attention of all heads and perform linear transformation to obtain the transformed features Then fully connect through the feedforward network and output the transformed feature residual According to the formula Calculate the second time series feature 8. The flow identification method according to claim 7, characterized in that: The encoded time series features Use three learnable matrix components, respectively, and the encoded time series features The matrix multiplication of the three corresponding matrices is obtained, and the learned output features are obtained by calculation. include: Using the first learnable matrix component W q , the second learnable matrix component W k , the third learnable matrix component W v Respectively with the encoded time series features The first corresponding matrix q is obtained by multiplying the matrix t , the second corresponding matrix k t , the third corresponding matrix v t , through the formula Calculate the output features where attn t is the attention weight, according to the first corresponding matrix q t , the second corresponding matrix k t Transpose and the second learnable matrix component W k The dimension of is calculated.

9. The flow identification method according to claim 4, characterized in that: The final feature f mst The final result is output through the fully connected layer, including: The fully connected layer includes three linear layers and two activation functions, and the calculation formula is: A class =linear(Relu(linear(Relu(linear(flatten(f mst ))))))。 10. A flow identification device based on the flow identification method according to claim 4, characterized in that: include: The feature initialization module is used to convert the timing sample ST n The initial feature f is obtained by two bilinear interpolations intero , expand the sample dimension to W×H×N, and then extract the initialization spatiotemporal features f through grouped convolution init ; Initialize the spatiotemporal features f init Flattened conversion into first time series features The dimension is L×N; There are multiple spatiotemporal self-attention modules, which include a spatial attention module and a temporal attention module. The spatial attention module is used to initialize the spatiotemporal features f init Through the processing of multi-head spatial attention module and spatial feature extraction, the discriminative spatial feature f is obtained s ; The temporal attention module is used to take the first temporal feature Through the processing of the multi-head time attention module, the second time series feature is obtained Point convolution module, used to transform the second time series feature through point convolution and discriminative spatial features f s Constructed into the f interp The spatiotemporal feature residual f st , and then input it into the new spatiotemporal self-attention module for learning. After multiple rounds of learning, the final feature f is output. mst ; The fully connected layer is used to calculate the final feature f mst Output the final result.

Images