Method for classifying encrypted traffic in IPSec tunnel mode based on spatiotemporal information

Abstract

The application belongs to the technical field of encrypted network flow classification, and particularly relates to a graph attention IPsec tunnel mode encrypted flow classification method based on space-time information.The application comprises the following steps: extracting a data packet sequence containing direction, packet length and time information of a data packet from an original Pcap file encrypted under an IPsec tunnel mode in a fixed step length manner; a time domain information processing module composed of a one-dimensional convolution and a batch normalization is responsible for extracting time information and local dependence of the data packet; a spatial domain information processing module with a graph attention network introduced is used to extract a spatial structure and an interaction relationship of the data packet sequence; outputs of the spatial domain information processing modules are aggregated into an output vector in a hierarchical manner; and finally, encrypted flow is classified by a multilayer perceptron and a normalized exponential algorithm.The application realizes more accurate classification of encrypted flow under the IPsec tunnel mode.

Description

Technical Field

[0001] This invention belongs to the field of encrypted network traffic classification technology, specifically relating to an encrypted traffic classification method based on spatiotemporal information in the graph attention IPsec tunnel mode. Background Technology

[0002] With the rapid development of internet applications and continuous breakthroughs in communication technology, network traffic is growing exponentially. Accurate classification of network traffic is beneficial for managing network resources, maintaining service quality, and enabling service providers to offer differentiated services. Due to the widespread adoption of encryption protocols designed to protect user privacy, encrypted traffic now constitutes the vast majority of total network traffic. This includes internet security protocols. [1] (Internet Protocol Security, IPsec) and transport layer security [2] These methods, including Transport Layer Security (TLS), help improve security, but they also obfuscate traffic content and increase the complexity of traffic content analysis.

[0003] Existing network traffic classification technologies, to some extent, cannot adequately meet current task requirements. For example, traditional rule-based methods mainly include traffic detection algorithms based on port matching and deep packet inspection. These methods are fast and highly effective in simple network environments. However, with the development of encrypted networks, network applications no longer use fixed port numbers, making it difficult to effectively detect encrypted traffic data. Faced with complex and ever-changing network threats, machine learning and deep learning methods combine encrypted traffic detection and classification tasks with these methods. First, appropriate traffic features are designed based on the characteristics of traffic and protocols; these features aim to comprehensively capture the characteristic information of network traffic. Then, a classification model is built based on these features and trained using a training dataset. Finally, the model is tested using new traffic datasets or test datasets to quantify the classification effect. Although machine learning-based traffic classification methods have made some progress, further performance improvements depend on addressing the challenges of feature design and improving the ability to automatically extract features.

[0004] Previous research has primarily focused on classifying network traffic using encryption methods such as TLS. These studies typically did not address the analysis of IP header encapsulation. However, with the widespread adoption of Virtual Private Network (VPN) technology, IPsec-based encryption solutions have attracted significant attention from academia. Currently, research on the classification of encrypted traffic under this technology is scarce, especially regarding encrypted traffic classification in IPSec tunnel mode.

[0005] Based on the analysis of encrypted traffic in IPsec tunnel mode and the research of graph neural networks, this invention designs a neural network algorithm to extract packet sequence time information, spatial structure information, and interaction information, thereby realizing the classification of encrypted traffic in IPsec tunnel mode. Summary of the Invention

[0006] The purpose of this invention is to provide a graph attention method for classifying encrypted traffic in IPsec tunnel mode based on spatiotemporal information with high prediction accuracy and low computational workload, so as to achieve correct classification of encrypted traffic data in IPsec tunnel mode.

[0007] The invention provides a graph attention-based encrypted traffic classification method for IPsec tunnel mode based on spatiotemporal information, including the design of an encrypted traffic behavior classification model (denoted as EC-HIGAT); this model specifically includes four modules: a data preprocessing module, a temporal domain information processing module, a spatial domain information processing module, and an aggregation and output module; wherein:

[0008] Data preprocessing module: Extracts packet sequences from the original packet capture (Pcap) in a fixed step size manner, extracts the length, direction and time information of the packets, and performs normalization processing;

[0009] The time-domain information processing module consists of one-dimensional convolutional and batch normalization layers, which extracts time information and local dependencies from the preprocessed data packet sequence.

[0010] The spatial domain information processing module consists of a graph attention network and top-k pooling, and produces output subgraphs at different levels in a hierarchical manner to capture the structure and interaction information of data packets at different levels.

[0011] Aggregation and Output Module: Aggregates the output subgraphs of each level into vectors using maximum and mean pooling, and obtains the final classification result through a multilayer perceptron and a normalized exponential function (SoftMax).

[0012] Based on the above four modules, the encrypted traffic classification method for IPSec tunnel mode based on spatiotemporal information provided by this invention has the following specific steps:

[0013] Step 1: Extract the packet sequence from the original Pcap file, obtain the packet direction, length, and time information, perform normalization processing, and store the data; specifically:

[0014] Step 1-1: Extract the IP header, packet length sequence, and timestamp information from the Pcap packet.

[0015] Steps 1-2: Determine the direction of data packets based on the destination and source IP addresses encapsulated in IPsec, and construct a direction information sequence. Scale the data packet length sequence using a normalization method based on maximum and minimum values.

[0016]

[0017] Where, x raw It is the sequence of lengths of all packets in the original Pcap file, x min It is the minimum value in the data packet sequence, x max It is the maximum value in the data packet sequence, x norm It is the normalized sequence of data packet lengths.

[0018] Steps 1-3: In order to capture the time relationship between data packets more accurately, the timestamp is converted into the value of the data packet interval time, which is represented as the timestamp interval between the previous data packet and the next data packet, and then normalized.

[0019] Steps 1-4: Divide the normalized data packet direction, length, and time characteristics into fixed step sizes and store them.

[0020] Step 2: Using the fixed-step data packet direction, length, and time feature matrix from Step 1 as input to the time-domain information processing module, extract the time information and local dependencies of the data packet sequence. The specific process is as follows:

[0021] Step 2-1: Utilize convolution operations to preserve the translation invariance of sequence data, effectively identifying and processing temporal information in the input that is not fixed in position. A one-dimensional convolution operation can be represented as...

[0022]

[0023] Where, x i Let x represent the i-th element of the output vector. norm It is the preprocessed input vector, k is the convolution kernel, and K size is the kernel size, 'a' is the index within the kernel, and [·] represents a discrete value used to index the corresponding position in the data packet sequence and the kernel.

[0024] Step 2-2: Batch normalization layer is used to maintain data distribution consistency. After the time-domain information processing module consisting of two one-dimensional convolutions, a batch normalization layer is used to standardize the activation values ​​of each mini-batch, making their mean 0 and variance 1. For an input vector x = [x1, x2, ..., xn] of length n after one-dimensional convolution processing... n The batch normalization operation can be expressed as:

[0025]

[0026]

[0027] Where, x i The i-th element of the input vector, μ and σ 2 These are the mean and variance of the input vector x, respectively, where ∈ is a very small number to avoid division by zero, after normalization. It corresponds to the i-th element of the data feature. Output h i It is the i-th value after being corrected by the learnable scaling factor γ and offset β.

[0028] Step 3: Construct a graph structure for the encrypted traffic, where nodes represent data packet characteristics obtained by the time-domain information processing module, and edges represent the relationships between data packets. Specifically:

[0029] Step 3-1: Using the direction information of the data packets obtained in Step 1, during graph construction, first establish edges for the data packet nodes according to their chronological order. Simultaneously, define a communication pattern consisting of consecutive IP1 sending to IP2 and the next consecutive IP2 sending to IP1 as a ring. Within this ring, establish an additional edge between the first and last data packet nodes to strengthen the interactive communication relationship between data packets.

[0030] Step 4: Use a hierarchical graph attention network and Top-k pooling layers to learn important packet nodes, spatial structure, and interaction information from the graph in Step 3. The specific process is as follows:

[0031] Step 4-1: Affine transformation of features. This is achieved through the weight matrix W. (l) and the paranoia vector b (l) Each node v in the graph i (That is, the characteristics of encrypted traffic packets) are mapped to a new feature space. The formula for affine transformation is:

[0032]

[0033] in, It is the feature vector of node i after transformation at layer l. It is the original feature vector of data packet node i in the l-th layer of the graph attention network.

[0034] Step 4-2: Calculate the non-normalized attention value. Calculate the non-normalized attention value between node i and its neighbor node j. This step concatenates the transformation features of the two nodes, and then links them to the learnable weight vector a. (l) Perform a dot product and apply the ReLU activation function:

[0035]

[0036]

[0037] Where, || represents will and The vectors are concatenated to form a longer vector. The main function of the ReLU function is to set all negative values ​​to 0, while keeping all positive values ​​unchanged.

[0038] Step 4-3: Normalization of Attention Scores. Normalize the non-normalized attention values ​​to calculate the attention score of each node to its neighboring nodes.

[0039]

[0040] here, Let i represent the set of neighboring nodes of node i.

[0041] Step 4-4: Feature Aggregation and Node Feature Update. Finally, based on the calculated attention score, the feature vectors of neighboring nodes are aggregated to update the feature representation of node i.

[0042]

[0043] Where σ is the ReLU activation function, It is the feature vector of node i in the next layer (i.e., layer l+1).

[0044] Steps 4-5: Use a Top-k pooling strategy to select the k most critical node features from each subgraph. The scoring function is as follows:

[0045]

[0046]

[0047] in, p is the score of node i at level l. (l) It is the trainable parameter vector of the l-th layer. This represents the feature representation of node i at level l. The denominator of the SoftMax function represents the sum of all calculated results, ensuring that the score is positive and the sum is 1. m represents the index of the traversed node. Once the scores of all nodes are calculated, the top k nodes are selected based on their scores.

[0048] Step 5: Use an aggregation layer to aggregate the outputs of each subgraph from Step 4. Input the resulting aggregated vector into the subsequent prediction layer to obtain the predicted classification label and the trained model, which is used for encrypted traffic classification. The specific process is as follows:

[0049] Step 5-1: Combining mean pooling and max pooling operations, convert the output matrix H of each subgraph into a vector, calculated as follows:

[0050]

[0051] Here, r represents the feature vector after concatenating the two pooling operations, and q refers to the q-th column in matrix H.

[0052] Step 5-2: Based on Step 5-1, the model aggregates the output vectors of the pooled subgraphs to form the final aggregated vector. The calculation formula is as follows:

[0053] r′=r (1) +r (2) +…+r (N) #(13)

[0054] Where r′ is the final aggregate vector, r (l) The eigenvector represents the l-th subgraph.

[0055] Step 5-3: After obtaining the aggregated vectors of all hierarchical subgraphs from Step 5-2, the final predicted classification labels are obtained through a multilayer perceptron and Softmax.

[0056]

[0057] MLP(r′)=W2σ(W1r′+b1)+b2, #(15)

[0058] Among them, the output Let r′ represent the predicted label for traffic flow, W1 and W2 be the weight matrices of the first and second layers of the multilayer perceptron, b1 and b2 be the bias vectors of the first and second layers of the multilayer perceptron, and σ be the ReLU activation function.

[0059] Step 5-4: Optimize the model using the cross-entropy loss function L. The loss function L is defined as follows:

[0060]

[0061] Where N is the number of samples, C is the number of categories, and Y is the number of categories. i,c It is the actual label of the i-th sample in class c. Let be the predicted label of the i-th sample in class c.

[0062] Step 5-5: Apply the trained model to the corresponding test set.

[0063] The main technical features and performance advantages of this invention are as follows:

[0064] (1) To address the inability to accurately extract quintuple information in IPSec tunnel mode encryption scenarios, this invention extracts data packet sequences with a fixed step size, while simultaneously acquiring the length, direction, and time information of the data packets. It utilizes a spatiotemporal domain information processing module to mine the spatiotemporal characteristics of encrypted traffic and transforms the classification problem of encrypted traffic into a graph classification problem using graph neural network technology.

[0065] (2) A new encrypted traffic mapping method was designed, focusing on the complete communication between the client and server. This mapping method incorporates the length, direction, and time sequence information of data packets into each node. Each complete communication loop between the client and server not only includes burst information of data packets but also information on each complete communication interaction and the sequence information between complete communications. This incorporates more practical physical meaning.

[0066] (3) A time-domain information processing module consisting of a one-dimensional convolutional layer and a batch normalization layer was designed to extract the temporal features and local dependency information of data packet sequences. Furthermore, a graph attention network and a Top-k pooling layer were used to capture the spatial structure, interaction information, and key nodes of the data packets. Through a hierarchical approach, subgraphs at different levels were aggregated into vectors using maximum and mean pooling, thereby effectively extracting multi-level features to achieve more accurate traffic classification. Attached Figure Description

[0067] Figure 1 This is a schematic diagram of the EC-HIGAT model of the present invention.

[0068] Figure 2 This is a schematic diagram illustrating how the present invention converts a data packet sequence into graph-structured data.

[0069] Figure 3 This is a schematic diagram of the confusion matrix of EC-HIGAT classification results on the PC-IPsec encrypted traffic dataset. Detailed Implementation

[0070] The present invention will be further described below with reference to the embodiments and accompanying drawings.

[0071] An IPsec tunnel mode encrypted traffic dataset named PC-IPSec was selected. This dataset contains traffic of a single application behavior type transmitted through an IPSec VPN tunnel within the same time period. This dataset is divided into four main application categories, each further subdivided into four types of traffic behaviors. The structure of the EC-HIGAT model in this example is as follows: Figure 1 As shown.

[0072] Step 1: Extract packet sequences from the original Pcap file of the PC-IPsec dataset and obtain the packet direction, length, and time information, as follows:

[0073] Step 1-1: Use Python's Scapy tool to extract the IP header, packet length sequence, and timestamp information from the Pcap packet, and determine the packet direction based on the destination IP and source IP addresses encapsulated in IPSec. (Reference) [3-4] Although not specifically categorized for IPSec tunnel mode encrypted traffic, this work demonstrates the effectiveness of using fixed-step extraction of packet sequences for traffic classification. This example divides each data stream into a sequence of 255 packets, each encoded as a vector containing two core pieces of information: packet length and timestamp. To more accurately capture the temporal relationships between packets, this example converts the timestamps into the interval values ​​between adjacent packets. Finally, a 255×2 matrix is ​​constructed by combining the packet length vector and the time interval vector. Each vector in this matrix is ​​then normalized using a minimum-maximum-minimum method, and the results are stored in a CSV file. In this example, the normalization process adjusts the values ​​of packet length and time interval without distinguishing between positive and negative signs. This step preserves the directional information of the packets, where the packet orientation is preserved as an independent vector, which will be used to determine the node orientation and edges in the encrypted traffic graph when processing spatial domain information.

[0074] Step 2: Use the preprocessed PC-IPsec dataset as input to the time domain information processing module to extract the time information and local dependencies of the data packet sequences.

[0075] Step 2-1: Use a combination of two one-dimensional convolutions to extract temporal information and local dependencies of the data packet sequence. Set the kernel size of the one-dimensional convolution to K. size =7. To maintain the same dimensions for both input and output, this example uses appropriate padding to fill in the edges of the input data; that is, K is added to both ends of the input data matrix. size / 2 = 3 zero elements.

[0076] Step 2-2: Use a batch normalization layer to maintain the consistency of the data distribution and accelerate the model training process. The batch normalization parameters are set as follows: ∈ is set to 0.001 to avoid division by zero, momentum is set to 0.99 for moving average calculation, and offset and scaling adjustments are allowed. Figure 1 As shown, after two one-dimensional convolutional kernels and one batch normalization layer, this example repeats the above steps, using two one-dimensional convolutional layers and one batch normalization layer to obtain higher-level feature information.

[0077] Step 3: Construct the encrypted traffic graph structure.

[0078] After processing by the time-domain information module, it needs to be converted into graph-structured data before spatial domain information can be extracted. Specifically, the data packet sequence is formalized into a flow... i =P i1 ,P i2 ,…,P in , where P ij Let $j$ represent the $j$-th data packet in data packet sequence $i$. Based on this, a ring-interaction graph model $G = (V, E)$ is further constructed. Here, $V$ represents a node in the graph, each node corresponding to a data packet; $E$ represents an edge, describing the connection relationship between data packets. Node $V$ contains information about the processed data packet length and time-dependent characteristics. Furthermore, based on the difference in communication direction in each independent data packet direction sequence, the node values ​​are distinguished into positive and negative values, representing data packets from the source IP to the destination IP (client to server) and the reverse data packets, respectively.

[0079] Distinguished from literature [5] The proposed graph construction method is TIG. TIG constructs its graph structure based on packet bursts, i.e., a large number of identical packets within the same time period. TIG connects the start and end points of different bursts to the start and end nodes of the next burst. Nodes in the graph represent packet size and direction; edges represent connections between packets. In this example, the graph construction first establishes edges between packet nodes according to chronological order. Simultaneously, a communication pattern consisting of consecutive packets from IP1 to IP2 and the next consecutive packets from IP2 to IP1 is defined as a ring; that is, a complete communication process between a client and a server is defined as a ring. Each ring represents an independent interaction process, and an edge is established between the first and last packet nodes of the ring to strengthen the interactive communication relationship between packets. Figure 2 The diagram shows the resulting graph, where green nodes represent packets sent from IP1 to IP2, and orange nodes represent reverse packets. Node P in the graph... i In this context, 'i' represents the order of data packets.

[0080] Step 4: Use a graph attention network and a Top-k pooling layer to learn important data packet nodes, spatial structure, and interaction information in the graph. Details are as follows:

[0081] Step 4-1: Map the feature information processed in the time domain to the new feature space. The transformed output feature vector is...

[0082] Step 4-2: Calculate the nonnormalized attention values ​​between nodes.

[0083] Step 4-3: Normalize the non-normalized attention values ​​from the above steps.

[0084] Step 4-4: Aggregate feature information based on attention values ​​and update the node's feature information. In this example, 'l' in the above formula represents the graph attention network at layer l. Furthermore, the graph attention network parameters are set as follows: each attention head has a dimension of 8, a total of 8 attention heads are used, the activation function is ReLU, and the dropout rate is set to 0.3 to reduce the risk of overfitting.

[0085] Steps 4-5: Use Top-k pooling to learn the K key nodes in the graph to obtain the score s. i The top k nodes are selected based on their scores. In this example, 60% of the nodes are retained after training. After completing the above steps, the output of the Top-k network is used as the input to the next layer, and the graph attention network and Top-k pooling are repeatedly used for training to learn deeper node feature information.

[0086] Step 5: As Figure 1 As shown, after each Top-k pooling output, this example will aggregate the outputs of each subgraph to form the input vector of the prediction output layer.

[0087] Step 5-1: Process the output of each subgraph using mean pooling and max pooling, and concatenate the results into a vector r.

[0088] Step 5-2: Concatenate the vector r obtained from each subgraph into a vector r′.

[0089] Step 5-3: Obtain the final predicted classification label through multilayer perceptron and Softmax.

[0090] Step 5-4: In this example, the model is optimized using the cross-entropy loss function L to converge to the optimal parameters on the training set. When training the EC-HIGAT model, the dataset and test set are split in an 8:2 ratio, with other parameters set to Batch_size = 200 and a learning rate of 5 × 10⁻⁶. -5 And use the Adam optimizer.

[0091] Step 5-5: Apply the trained model to the test set to verify its effectiveness.

[0092] like Figure 3As shown, the EC-HIGAT model in this example achieved good classification results on the PC-IPsec dataset, with the vast majority of encrypted traffic being successfully predicted and accurately classified into the corresponding behavior categories. Overall, the classification model exhibited an accuracy of up to 92.4%. Specifically, the behavior categories of Loginin & logout, Request file, and Play audio performed best, with 310, 275, and 318 correctly classified cases, respectively, achieving corresponding classification accuracies of 98.4%, 97.1%, and 96.7%.

[0093] References

[0094] [1]DHALL H,DHALL D,BATRA S,et al.Implementation of ipsec protocol[C] / / 2012Second International Conference on Advanced Computing&CommunicationTechnologies.IEEE,2012:176-181.

[0095] [2]DESHMUKH S,SONAVANE S.Security protocols for internet of things:Asurvey[C] / / 2017International Conference on Nextgen Electronic Technologies:Silicon to Software(ICNETS2).IEEE,2017:71-74.

[0096] [3]MIRSKY Y, DOITSHMAN T, ELOVICI Y, et al.Kitsune: an ensemble of autoencoders for online network intrusion detection[C / OL] / / Network and distributed system security symposium(NDSS).2018.DOI:10.14722 / ndss.2018.23204.

[0097] [4]DIAO Z,XIE G,WANG X,et al.Ec-gcn:A encrypted trafficclassification framework based on multi-scale graph convolution networks[J].Computer Networks,2023,224:109614.

[0098] [5]SHEN M,ZHANG J,ZHU L,et al.Accurate decentralized applicationidentification via encrypted traffic analysis using graph neural networks[J].IEEE Transactions on Information Forensics and Security,2021,16:2367-2380。

Claims

1. A method for classifying encrypted traffic under IPsec tunnel mode based on spatiotemporal information, characterized in that, This includes designing an encrypted traffic behavior classification model; the model specifically comprises four modules: a data preprocessing module, a time-domain information processing module, a spatial-domain information processing module, and an aggregation and output module; wherein: Data preprocessing module: Extracts data packet sequences from the original Pcap packets in a fixed step size manner, extracts the length, direction and time information of the data packets, and performs normalization processing; The time-domain information processing module consists of one-dimensional convolutional and batch normalization layers, which extracts time information and local dependencies from the preprocessed data packet sequence. The spatial domain information processing module consists of a graph attention network and key node pooling, and obtains output subgraphs at different levels in a hierarchical manner to capture the structure and interaction information of data packets at different levels. Aggregation and Output Module: Aggregates the output subgraphs of each level into vectors using maximum and mean pooling, and obtains the final classification result through a multilayer perceptron and a normalized exponential function; The specific steps for classifying encrypted traffic in IPSec tunnel mode are as follows: Step 1: Extract the packet sequence from the original Pcap file, obtain the direction, length, and time information of the packets, perform normalization processing, and store the data; Step 2: Using the fixed-step data packet direction, length, and time feature matrix from Step 1 as input to the time domain information processing module, extract the time information and local dependencies of the data packet sequence; Step 3: Construct a graph structure for the encrypted traffic, where the nodes of the graph represent the characteristics of the data packets obtained by the time-domain information processing module, and the edges represent the relationships between the data packets; Step 4: Use a hierarchical graph attention network and Top-k pooling layers to learn important packet nodes, spatial structure, and interaction information in the packet sequence from the graph in Step 3; Step 5: Use an aggregation layer to aggregate the outputs of each subgraph from Step 4, input the resulting aggregated vector into the subsequent prediction layer to obtain the predicted classification label, and obtain the trained model for encrypted traffic classification.

2. The method according to claim 1, characterized in that, The specific process for step 1 is as follows: Step 1-1: Extract the IP header, packet length sequence, and timestamp information from the Pcap packet; Steps 1-2: Divide the data packets into directions based on the destination and source IP addresses encapsulated by IPsec, and construct a direction information sequence; scale the data packet length sequence according to the maximum and minimum value normalization method: Where, x raw It is the sequence of lengths of all packets in the original Pcap file, x min It is the minimum value in the data packet sequence, x max It is the maximum value in the data packet sequence, x norm It is the normalized sequence of data packet lengths; Steps 1-3: In order to more accurately capture the time relationship between data packets, the timestamps are converted into data packet interval values, which are represented as the timestamp interval between the previous data packet and the next data packet, and then normalized. Steps 1-4: Divide the normalized data packet direction, length, and time characteristics into fixed step sizes and store them.

3. The method according to claim 2, characterized in that, The specific process for step 2 is as follows: Step 2-1: Utilize convolution operations to preserve the translation invariance of sequence data, and identify and process temporal information in the input that is not fixed in position; the one-dimensional convolution operation is represented as: Where, x i Let x represent the i-th element of the output vector. norm It is the preprocessed input vector, k is the convolution kernel, and K size is the kernel size, 'a' is the index within the kernel, and [·] represents a discrete value used to index the corresponding position in the data packet sequence and the kernel. Step 2-2: The batch normalization layer is used to maintain the consistency of data distribution. After the time-domain information processing module consisting of two one-dimensional convolutions, the batch normalization layer is used to standardize the activation values ​​of each mini-batch, making their mean 0 and variance 1. For an input vector x = [x1, x2, ..., xn] of length n after one-dimensional convolution processing... n The batch normalization operation is represented as follows: Where, x i The i-th element of the input vector, μ and σ 2 These are the mean and variance of the input vector x, respectively, where ∈ is a very small number to avoid division by zero, after normalization. It corresponds to the i-th element of the data feature; output h i It is the i-th value after being corrected by the learnable scaling factor γ and offset β.

4. The method according to claim 3, characterized in that, The specific process for step 3 is as follows: Step 3-1: Using the direction information of the data packets obtained in Step 1, when constructing the graph, first establish the connection edges for the data packet nodes according to the time sequence. At the same time, define the communication mode consisting of data packets sent from IP1 to IP2 and the next consecutive data packets sent from IP2 to IP1 as a ring. In this ring, establish an additional connection edge between the first and last data packet nodes to strengthen the interactive communication relationship between data packets.

5. The method according to claim 4, characterized in that, The specific process for step 4 is as follows: Step 4-1: Affine transformation of features, specifically through the weight matrix W (l) and the paranoia vector b (l) Each node v in the graph i That is, mapping the characteristics of encrypted traffic data packets to a new feature space, the formula for the affine transformation is: in, It is the feature vector of node i after transformation at layer l. It is the original feature vector of data packet node i in the l-th layer of the graph attention network; Step 4-2: Calculation of nonnormalized attention value: Calculate the nonnormalized attention value between node i and its neighbor node j. This step concatenates the transformation features of the two nodes, and then links them to the learnable weight vector a. (l) Perform a dot product and apply the ReLU activation function: Where, || represents will and The vectors are concatenated to form a longer vector; the ReLU function sets all negative values ​​to 0 while keeping all positive values ​​unchanged. Step 4-3: Normalization of attention scores, i.e., normalizing the non-normalized attention values, to calculate the attention score of each node to its neighboring nodes. here, Represents the set of neighboring nodes of node i; Step 4-4: Feature Aggregation and Node Feature Update; that is, based on the calculated attention score, aggregate the feature vectors of neighboring nodes to update the feature representation of node i: Where σ is the ReLU activation function, It is the feature vector of node i in the next layer, i.e., layer l+1; Steps 4-5: Use the Top-k pooling strategy to select the k most critical node features from each subgraph. The scoring function is as follows: in, p is the score of node i at level l. (l) It is the trainable parameter vector of the l-th layer. is the feature representation of node i at level l; the denominator of the SoftMax function represents the sum of all calculated results, and ensures that the score is positive and the sum is 1, m represents the index of the traversed node; after calculating the score of all nodes, select the first k nodes according to the score.

6. The method according to claim 5, characterized in that, The specific process for step 5 is as follows: Step 5-1: Combining mean pooling and max pooling operations, convert the output matrix H of each subgraph into a vector, calculated as follows: Here, r represents the feature vector after concatenating the two pooling operations, and q refers to the q-th column in matrix H; Step 5-2: Based on Step 5-1, aggregate the output vectors of the pooled subgraphs to form the final aggregated vector; the calculation formula is as follows: r ′ ＝r (1) +r (2) +…+r (N) ,#(13) Where, r ′ For the final aggregate vector, r (l) The feature vector representing the l-th subgraph; Step 5-3: After obtaining the aggregated vectors of all hierarchical subgraphs from Step 5-2, the final predicted classification labels are obtained through a multilayer perceptron and Softmax. MLP(r ′ )=W2σ(W1r ′ +b1)+b2,#(15) Among them, the output The label representing the predicted traffic, r ′ The input vector is W1 and W2, which are the weight matrices of the first and second layers of the multilayer perceptron, b1 and b2 are the bias vectors of the first and second layers of the multilayer perceptron, and σ is the ReLU activation function. Step 5-4: Optimize the model using the cross-entropy loss function L. The loss function L is defined as follows: Where N is the number of samples, C is the number of categories, and Y is the number of categories. i,c It is the actual label of the i-th sample in class c. Let be the predicted label of the i-th sample in class c; Step 5-5: Apply the trained model to the corresponding test set.

Images