A method, device and electronic device for classifying encrypted traffic

Abstract

The present invention provides an encrypted traffic classification method, device and electronic device, wherein the encrypted traffic classification method comprises: obtaining traffic data; the traffic data comprises a plurality of data packets; constructing a target directed graph according to the information content of the data packets in the traffic data and the time relationship between the data packets; calling a pre-configured classification model, inputting the target directed graph into the classification model for classification, and obtaining the classification result of the traffic data; the classification model comprises a learner and a classifier connected in sequence. Through the present invention, the integrity of the traffic data can be maintained to the maximum extent, and the high-order graph structure at multiple scales is taken into account, the classification effect of the traffic data is improved, and the problems of poor accuracy and insufficient generalization ability of encrypted traffic classification existing in the existing related technologies are solved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an encrypted traffic classification method, device and electronic equipment. Background Art

[0002] Network traffic classification technology is mainly used in network behavior analysis, network transmission optimization, anomaly detection and other fields to meet the needs of differentiated quality of service (QoS) and ensure the safe operation of the network. It is one of the hot issues in the field of network traffic processing research. Encrypted traffic refers to the network traffic that uses cryptography technology to encrypt data during network transmission, making it difficult to eavesdrop or tamper with the data during transmission. Encrypted traffic can be used to protect user privacy and data security, and can also be used to prevent hackers and malicious attackers from stealing and tampering with network data. Encrypted traffic classification plays a fundamental role in both network security and network management. For example, in the field of network security, encrypted traffic can be divided into normal traffic and abnormal traffic to detect malicious attacks on the network and take defensive measures. In the field of network management, encrypted traffic can be divided into different service levels, and various traffic can be prioritized to achieve better service quality control.

[0003] In the early stage of network traffic classification research, port-based and deep packet inspection methods were widely recognized and used. In 2005, statistical-based traffic classification methods began to appear. With the surge in encrypted traffic and the limitations of information provided by port numbers, some researchers proposed behavior-based pattern classification methods. In the rapid development of the Internet, traditional traffic identification methods have become difficult to perform the identification and classification of data traffic, and a series of problems such as communication delay, resource consumption, and privacy protection have become increasingly prominent. In recent years, machine learning-based methods have achieved great success in the overall task of network traffic classification. However, machine learning methods rely heavily on predefined input features and require manual statistical extraction of features from raw data. Therefore, people have spent a lot of effort on feature statistics of flow-level network traffic rather than packet-level network traffic.

[0004] Some researchers have also used graph neural networks to complete classification tasks. Some work uses graph neural networks to classify traffic, taking into account the adjacency between the original bytes of the data packets and the data packets in the network traffic, but not the temporal relationship between the data packets. There are also some designs based on graph neural networks (GNNs) that are built with low-order GNNs. These methods use node locality for classification tasks, but do not fully utilize the high-order information that can retain the structural embedding required for graph classification, which affects the classification accuracy of encrypted traffic.

[0005] There is currently no good solution to the problems of poor encryption traffic classification accuracy and insufficient generalization ability in existing related technologies. Summary of the invention

[0006] The present invention provides an encrypted traffic classification method, device and electronic device, which are used to solve the defects of poor encrypted traffic classification accuracy and insufficient generalization ability in the prior art.

[0007] In a first aspect, the present invention provides an encrypted traffic classification method, comprising:

[0008] Acquire traffic data; the traffic data includes a number of data packets;

[0009] constructing a target directed graph according to information content of data packets in the traffic data and time relationships between data packets;

[0010] A pre-configured classification model is called, and the target directed graph is input into the classification model for classification to obtain a classification result of the traffic data; the classification model includes a learner and a classifier connected in sequence.

[0011] According to an encrypted traffic classification method provided by the present invention, obtaining traffic data includes:

[0012] Get the raw data of encrypted traffic;

[0013] The original data is divided into a plurality of sessions; the sessions include a plurality of data packets;

[0014] removing interference information in the conversation;

[0015] Byte adjustment is performed on the data packets in the session to obtain the traffic data.

[0016] According to an encrypted traffic classification method provided by the present invention, a target directed graph is constructed according to the information content of data packets in the traffic data and the time relationship between the data packets, including:

[0017] Selecting a preset number of data packets in the traffic data as graph nodes;

[0018] According to the time relationship between the data packets, the graph edges of the target directed graph are determined, and the graph edges are allocated to the target directed graph according to the timestamps of the data packets.

[0019] According to an encrypted traffic classification method provided by the present invention, a preset number of data packets in the traffic data are selected as graph nodes, including:

[0020] The first ten data packets in each of the sessions are selected as graph nodes of the target directed graph.

[0021] According to an encrypted traffic classification method provided by the present invention, after constructing a target directed graph based on the information content of data packets in the traffic data and the time relationship between data packets, the method includes:

[0022] The target directed graph is assigned a label according to a source of each of the sessions.

[0023] According to an encrypted traffic classification method provided by the present invention, the learner includes a plurality of sub-layers connected in sequence, and each of the sub-layers includes a convolutional layer, a normalization layer and a pooling layer.

[0024] According to an encrypted traffic classification method provided by the present invention, the classifier includes several groups of fully connected layers and discarding layers connected in sequence, and the classifier also includes a classification layer, and the classification layer is connected to the last discarding layer.

[0025] According to an encrypted traffic classification method provided by the present invention, the target directed graph is input into the classification model for classification to obtain the classification result of the traffic data, including:

[0026] Each of the sub-layers of the learner processes the target directed graph to generate a corresponding number of graph embeddings;

[0027] All the graph embeddings are connected in series and input into the classifier, the graph embeddings are mapped and discarded through the fully connected layer and the discard layer, and the type of the processing results is predicted through the classification layer to generate a classification result.

[0028] In a second aspect, the present invention further provides an encrypted traffic classification device, comprising:

[0029] An acquisition module, used to acquire flow data; the flow data includes a number of data packets;

[0030] A construction module, used to construct a target directed graph according to information content of data packets in the traffic data and time relationships between data packets;

[0031] The classification module is used to call a pre-configured classification model, input the target directed graph into the classification model for classification, and obtain the classification result of the traffic data; the classification model includes a learner and a classifier connected in sequence.

[0032] In a third aspect, the present invention further provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the encrypted traffic classification method as described in the first aspect above is implemented.

[0033] In a fourth aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the encrypted traffic classification method as described in the first aspect above.

[0034] In a fifth aspect, the present invention further provides a computer program product, comprising a computer program, which, when executed by a processor, implements the encrypted traffic classification method as described in the first aspect above.

[0035] Compared with the prior art, the present invention has the following beneficial effects:

[0036] The encrypted traffic classification method provided by the present invention constructs a target directed graph according to the information content of the data packets and the time relationship between the data packets, thereby maintaining the integrity of the traffic data to the maximum extent and improving the classification accuracy of the traffic data in the subsequent process. Finally, the constructed target directed graph is input into the classification model. In order to make more full use of the high-order information embedded in the structure required for graph classification, a high-order graph neural network model is used as the classification model in this method. Taking into account the high-order graph structure at multiple scales, the classification effect of the traffic data and the generalization ability of the classification model are further improved, solving the problems of poor accuracy and insufficient generalization ability of encrypted traffic classification in the existing related technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0038] Figure 1 is a flow chart of the encrypted traffic classification method proposed by the present invention;

[0039] Figure 2 is a schematic diagram of mapping flow data into a target directed graph in an embodiment of the present invention;

[0040] Figure 3 is a schematic diagram of edge connections of three data packets in an embodiment of the present invention;

[0041] Figure 4 is a schematic diagram of four data packet edge connections in an embodiment of the present invention;

[0042] Figure 5 is a schematic diagram of the structure of a classification model in an embodiment of the present invention;

[0043] Figure 6 It is a structural block diagram of the encrypted traffic classification device proposed by the present invention;

[0044] Figure 7 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] The present invention provides an encrypted traffic classification method. Figure 1 is a flow chart of the encrypted traffic classification method proposed by the present invention, such as Figure 1 As shown, the method comprises the following steps:

[0047] Step S101, acquiring traffic data; the traffic data includes a number of data packets.

[0048] Step S102: construct a target directed graph according to the information content of the data packets in the traffic data and the time relationship between the data packets.

[0049] Step S103, calling a pre-configured classification model, inputting the target directed graph into the classification model for classification, and obtaining the classification result of the traffic data; the classification model includes a learner and a classifier connected in sequence.

[0050] In this method, first, the traffic data of the encrypted traffic that needs to be classified is obtained. Then, in order to not only consider the adjacency relationship between the original bytes of the data packet and the data packets in the traffic data, but also to fully consider the time relationship between the data packets, in this method, a target directed graph is constructed according to the information content of the data packet and the time relationship between the data packets, so as to maximize the integrity of the traffic data and improve the classification accuracy of the traffic data in the subsequent process. Finally, the constructed target directed graph is input into the classification model. Among them, the classification model can adopt a traditional low-order graph neural network model. Preferably, in order to make more full use of the high-order information embedded in the structure required for graph classification, a high-order graph neural network model is used as the classification model in this method, taking into account the high-order graph structure at multiple scales, further improving the classification effect of the traffic data and the generalization ability of the classification model, and solving the problems of poor classification accuracy and insufficient generalization ability of encrypted traffic in the existing related technologies.

[0051] In order to improve the validity of traffic data and prevent other invalid information from interfering with the classification results, in some embodiments, step S101, obtaining traffic data includes: obtaining original data of encrypted traffic; dividing the original data into several sessions; the session includes several data packets; removing interference information in the session; and performing byte adjustment on the data packets in the session to obtain the traffic data.

[0052] Exemplarily, the open source tool SplitCap is used to split the raw data (raw pcap files) into sessions, and the packet capture files with a pcapng extension are converted to ".pcap" files before the splitting occurs.

[0053] In order to avoid the interference of irrelevant information and improve the effectiveness of extracting features from raw data, in this embodiment, other irrelevant information in the session is removed. Since the traffic data is collected at the data link layer, the data link layer carries information about its physical interface, and since the Ethernet header is only used for the second layer addressing of the local network, it does not play a role in the classification task. Therefore, in this embodiment, the Ethernet header containing the media access control (MAC) address is deleted. Then the source address IP and the destination address IP of the network layer are anonymized to improve the effectiveness of this method. Finally, because the port number may also affect the classification results, in this example, the port number is also deleted.

[0054] For each bidirectional flow, each bidirectional flow contains a series of data packets, each of which contains a byte stream, and the maximum transmission unit (MTU) is 1500 bytes. Related research shows that when the complete original data is used as network input, the performance of the model can be more accurate and reliable. Therefore, in order to maximize information, in this embodiment, all data packet information is extracted and converted into raw bytes, and insufficient MTU is filled. The value of each byte is normalized so that it falls into the interval [0,1].

[0055] In some of the embodiments, step S102, constructing a target directed graph based on the information content of the data packets in the traffic data and the time relationship between the data packets, includes: selecting a preset number of data packets in the traffic data as graph nodes; determining the graph edges of the target directed graph based on the time relationship between the data packets, and allocating graph edges to the target directed graph based on the timestamps of the data packets.

[0056] In this embodiment, if Figure 2 As shown, Figure 2It is a schematic diagram of mapping traffic data into a target directed graph in an embodiment of the present invention. Several data packets are selected as graph nodes of the target directed graph. In each graph node, the original bytes of the data packet are stored as node attributes, and each byte is normalized to [0,1]. The dimension of the node attribute is set to the size of the MTU, that is, 1500. Then, the edge set between the graph nodes is extracted based on the time relationship between the data packets. In a directed graph, the graph edge can show the relationship between the graph nodes. For this method, the graph edge is used to standardize the time relationship and time information between data packets. The time relationship between data packets is regarded as a directed edge, and the timestamp of the data packet is used to allocate the graph edge. Each graph node is connected to the graph node where its data packet arrives earlier through the arrival traversal edge, and is connected to the graph node where the data packet arrives later through the departure traversal edge. As Figure 3 and Figure 4 As shown, Figure 3 is a schematic diagram of edge connections of three data packets in an embodiment of the present invention, Figure 4 Schematic diagram of edge connection of four data packets in an embodiment of the present invention. Taking three data packets as an example, among the three data packets n1, n2 and n3, n1 is the source node of n2 and n3, and n2 is the source node of n3.

[0057] Further, a preset number of data packets in the traffic data are selected as graph nodes, including: selecting the first ten data packets in each of the sessions as graph nodes of the target directed graph. In this embodiment, in order to ensure that the encrypted application data is fully exchanged after the Transport Layer Security (TLS) handshake process is completed, which is usually 3 round trips containing 6 data packets, the first 10 data packets of each session are selected as graph nodes of the target directed graph. Specifically, when the number of data packets in a session exceeds 10, the remaining data packets will be pruned, and when the number of data packets in a session is less than 10 data packets, they will be filled with zeros. In addition, since the data packets belong to a specific session, in this embodiment, the mapping of data packets and sessions will be extracted.

[0058] Based on the construction of the target directed graph, step S102, after the target directed graph is constructed according to the information content of the data packets in the traffic data and the time relationship between the data packets, includes: assigning a label to the target directed graph according to the source of each session. Specifically, different application types are assigned to the target directed graph as labels to facilitate subsequent learning by the learner.

[0059] In some embodiments, the learner includes several sequentially connected sublayers, each of which includes a convolutional layer, a normalization layer, and a pooling layer. The classifier includes several groups of fully connected layers and dropout layers connected in sequence, and the classifier also includes a classification layer, which is connected to the last dropout layer.

[0060] Based on the structure of the above-mentioned learner and classifier, in step S103, the target directed graph is input into the classification model for classification to obtain the classification result of the traffic data, including: each sublayer of the learner processes the target directed graph to generate a corresponding number of graph embeddings; all the graph embeddings are connected in series and input into the classifier, the graph embeddings are mapped and discarded through the fully connected layer and the discard layer, and the type of the processing result is predicted through the classification layer to generate a classification result.

[0061] Specifically, in this embodiment, Figure 5 is a schematic diagram of the structure of the classification model in an embodiment of the present invention, such as Figure 5 As shown in the figure, the classification model adopts the architecture of input-learner-classifier-output. Among them, the learner consists of 3 sub-layers, each of which has a dimension of 128. The input target directed graph will be processed by the convolution layer (GraphConv), the normalization layer (Batch Norm) and the pooling layer (Top-k Pooling). And each sub-layer will produce an output, which is the concatenation of its global average pooling value (global average pooling, referred to as GAP) and the global maximum pooling value (global max pooling, referred to as GMP). The outputs of the three sub-layers are connected in series and then passed to the classifier. The classifier includes a fully connected layer (Dense) and a dropout layer (Dropout). After processing by these layers, the last layer is the classification layer that assigns labels to the traffic data. The classification layer can be a Softmax classifier.

[0062] More specifically, for the learner in the classification model: Each convolutional layer contains 128 neurons to solve the problem of information loss in the learning stage. It is followed by a normalization layer, which reduces internal covariate transfer by standardizing the value of each feature, making the classification model easier to train and also reducing overfitting in the convolutional neural network. The last layer of the learner is the top-K pooling layer for dimensionality reduction. The pooling layer maintains the topological structure information of the target directed graph when performing graph node feature selection. This means that the selected node features usually correspond to the adjacency relationship of the target directed graph, thereby retaining the local structural information of the target directed graph, which helps the classification model better understand the topological structure of the target directed graph. Each sublayer produces an output, which is a concatenation of its global average pooling value and the global maximum pooling value. The three sublayers produce three graph embeddings, which are concatenated and provided to the classifier.

[0063] Each convolutional layer contains 128 neurons, and this number is kept constant in all sublayers of the learner. In the experiments, it was found that the reduction of feature length had a negative impact on the classification accuracy, and this phenomenon occurred in all experiments performed. This shows that continuously reducing the input and output channels during the learning phase will also affect the accuracy. Therefore, in order to solve this information loss problem, in this embodiment, the channel size is kept at 128, unchanged, and the pooling layer is used in the subsequent process to achieve dimensionality reduction. In this way, the node features that define the target directed graph are well represented before pooling.

[0064] The convolutional layer is followed by a normalization layer, which helps to speed up the convergence process of the classification model. This helps to overcome the gradient vanishing or gradient exploding problem, thereby speeding up the training of the classification model. When training a classification model, the input distribution of each layer may change as the classification model is trained, which can cause internal covariate shifts and make training difficult. The normalization layer reduces the internal covariate shifts by standardizing the value of each feature, making the classification model easier to train. In this embodiment, the use of a normalization layer can also reduce the overfitting problem in the convolutional neural network.

[0065] The next layer is the pooling layer, and the goal of the pooling layer is to reduce the overall dimension of the graph. The nodes in the target directed graph may have a large number of features, and using all node features will cause the complexity of the classification model to increase and the amount of calculation to increase significantly. The pooling layer reduces the dimension of the node features by retaining only the most important node features, thereby reducing the complexity and amount of calculation of the classification model. The pooling layer is not just a simple feature selection, but selects the most important node features to retain the most critical information in the target directed graph, which helps to improve the generalization ability and performance of the classification model while reducing the risk of overfitting. When the pooling layer performs node feature selection, the topological structure information of the target directed graph is maintained. This means that the selected node features will correspond to the adjacency relationship of the target directed graph, thereby retaining the local structural information of the target directed graph, which helps the classification model to better understand the topological structure of the graph. Therefore, in this embodiment, the TOP-K pooling layer is applied to make the classification model more robust, and when faced with different input formats, better classification results can also be obtained.

[0066] For the classifier in the classification model: the classifier consists of a fully connected layer, a drop layer and a SoftMax classifier. The fully connected layer can be used for mapping and transforming the node features of the target directed graph, so as to map the node feature space to a higher dimensional or lower dimensional space, or to map the node feature space to another feature space. By randomly discarding the output of the neuron, the drop layer can effectively improve the classification model's understanding and representation capabilities for the target directed graph data, thereby improving the accuracy of the classification. Exemplarily, in the classifier, a fully connected layer with an input of 256 and an output of 128 is first used for mapping, and then a drop layer with a probability of 0.5 is used to deal with the overfitting problem, and then a fully connected layer with an input of 128 and an output of 64 is used for mapping, and then a drop layer with a probability of 0.5 is used, and finally a SoftMax classifier is used to predict the classification label of the traffic data.

[0067] In summary, in this method, a target directed graph is constructed based on the information content of the data packets and the time relationship between the data packets, which maximizes the integrity of the traffic data and improves the classification accuracy of the traffic data in the subsequent process. The constructed target directed graph is then input into the classification model. In order to make more full use of the high-order information embedded in the structure required for graph classification, a high-order graph neural network model is used as the classification model in this method. Taking into account the high-order graph structure at multiple scales, the classification effect of traffic data and the generalization ability of the classification model are further improved, solving the problems of poor classification accuracy and insufficient generalization ability of encrypted traffic in existing related technologies.

[0068] The present invention also provides an encrypted traffic classification device. The encrypted traffic classification device provided by the present invention is described below. The encrypted traffic classification device described below and the encrypted traffic classification method described above can be referenced to each other. Figure 6 is a structural block diagram of the encrypted traffic classification device proposed by the present invention, such as Figure 6 As shown, the device comprises:

[0069] The acquisition module 601 is used to acquire traffic data; the traffic data includes a number of data packets;

[0070] A construction module 602, configured to construct a target directed graph according to information contents of data packets in the traffic data and time relations between data packets;

[0071] The classification module 603 is used to call a pre-configured classification model, input the target directed graph into the classification model for classification, and obtain the classification result of the traffic data; the classification model includes a learner and a classifier connected in sequence.

[0072] When the device is in use, first, the acquisition module 601 acquires the traffic data of the encrypted traffic that needs to be classified. Then, in order to not only consider the adjacency relationship between the original bytes of the data packet and the data packets in the traffic data, but also to fully consider the time relationship between the data packets, in the device, the construction module 602 constructs a target directed graph according to the information content of the data packet and the time relationship between the data packets, thereby maintaining the integrity of the traffic data to the maximum extent and improving the classification accuracy of the traffic data in the subsequent process. Finally, the classification module 603 inputs the constructed target directed graph into the classification model. Among them, the classification model can adopt a traditional low-order graph neural network model. Preferably, in order to make more full use of the high-order information embedded in the structure required for graph classification, a high-order graph neural network model is used as the classification model in the device, taking into account the high-order graph structure at multiple scales, further improving the classification effect of the traffic data and the generalization ability of the classification model, and solving the problems of poor classification accuracy and insufficient generalization ability of encrypted traffic in the existing related technologies.

[0073] Figure 7 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 7 As shown, the electronic device may include: a processor 701, a communications interface 702, a memory 703 and a communication bus 704, wherein the processor 701, the communications interface 702 and the memory 703 communicate with each other through the communication bus 704. The processor 701 may call the logic instructions in the memory 703 to execute the encrypted traffic classification method, which includes:

[0074] Acquire traffic data; the traffic data includes a number of data packets;

[0075] constructing a target directed graph according to information content of data packets in the traffic data and time relationships between data packets;

[0076] A pre-configured classification model is called, and the target directed graph is input into the classification model for classification to obtain a classification result of the traffic data; the classification model includes a learner and a classifier connected in sequence.

[0077] In addition, the logic instructions in the above-mentioned memory 703 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0078] On the other hand, the present invention further provides a computer program product, the computer program product includes a computer program, the computer program can be stored on a non-transitory computer-readable storage medium, when the computer program is executed by a processor, the computer can execute the encrypted traffic classification method provided by the above methods, the method includes:

[0079] Acquire traffic data; the traffic data includes a number of data packets;

[0080] constructing a target directed graph according to information content of data packets in the traffic data and time relationships between data packets;

[0081] A pre-configured classification model is called, and the target directed graph is input into the classification model for classification to obtain a classification result of the traffic data; the classification model includes a learner and a classifier connected in sequence.

[0082] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the computer program is executed by a processor to perform the encrypted traffic classification method provided by the above methods, the method comprising:

[0083] Acquire traffic data; the traffic data includes a number of data packets;

[0084] constructing a target directed graph according to information content of data packets in the traffic data and time relationships between data packets;

[0085] A pre-configured classification model is called, and the target directed graph is input into the classification model for classification to obtain a classification result of the traffic data; the classification model includes a learner and a classifier connected in sequence.

[0086] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0087] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0088] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for classifying encrypted traffic, characterized in that: include: Acquire traffic data; the traffic data includes a number of data packets; constructing a target directed graph according to information content of data packets in the traffic data and time relationships between data packets; Calling a pre-configured classification model, inputting the target directed graph into the classification model for classification, and obtaining a classification result of the traffic data; the classification model includes a learner and a classifier connected in sequence; The learner includes several sub-layers connected in sequence, each of which includes a convolution layer GraphConv, a normalization layer Batch Norm, and a pooling layer Top-k Pooling; the dimension of each sub-layer is 128, the input target will be processed by the convolution layer GraphConv, the normalization layer Batch Norm, and the pooling layer Top-k Pooling, and each sub-layer will generate an output, which is a concatenation of the global average pooling value and the global maximum pooling value; the outputs of the three sub-layers are concatenated and then passed to the classifier; The classifier includes a plurality of groups of fully connected layers and discard layers connected in sequence, and the classifier also includes a classification layer, and the classification layer is connected to the last discard layer.

2. The encrypted traffic classification method according to claim 1, characterized in that: Obtaining traffic data includes: Get the raw data of encrypted traffic; The original data is divided into a plurality of sessions; the sessions include a plurality of data packets; removing interference information in the conversation; Byte adjustment is performed on the data packets in the session to obtain the traffic data.

3. The encrypted traffic classification method according to claim 2, characterized in that: Constructing a target directed graph according to information content of data packets in the traffic data and time relationships between data packets, including: Selecting a preset number of data packets in the traffic data as graph nodes; According to the time relationship between the data packets, the graph edges of the target directed graph are determined, and the graph edges are allocated to the target directed graph according to the timestamps of the data packets.

4. The encrypted traffic classification method according to claim 3, characterized in that: Selecting a preset number of data packets in the traffic data as graph nodes includes: The first ten data packets in each of the sessions are selected as graph nodes of the target directed graph.

5. The encrypted traffic classification method according to claim 3, characterized in that: After constructing a target directed graph according to the information content of the data packets in the traffic data and the time relationship between the data packets, the method includes: The target directed graph is assigned a label according to a source of each of the sessions.

6. The encrypted traffic classification method according to claim 1, characterized in that: Inputting the target directed graph into the classification model for classification, and obtaining the classification result of the traffic data, including: Each of the sub-layers of the learner processes the target directed graph to generate a corresponding number of graph embeddings; All the graph embeddings are connected in series and input into the classifier, the graph embeddings are mapped and discarded through the fully connected layer and the discard layer, and the type of the processing results is predicted through the classification layer to generate a classification result.

7. An encrypted traffic classification device, used to implement the encrypted traffic classification method according to any one of claims 1 to 6, characterized in that: include: An acquisition module, used to acquire flow data; the flow data includes a number of data packets; A construction module, used to construct a target directed graph according to information content of data packets in the traffic data and time relationships between data packets; The classification module is used to call a pre-configured classification model, input the target directed graph into the classification model for classification, and obtain the classification result of the traffic data; the classification model includes a learner and a classifier connected in sequence.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the encrypted traffic classification method as described in any one of claims 1 to 6 is implemented.

Images