A classification method for edge device encrypted traffic based on weakly supervised continuous learning

Abstract

The present invention discloses an edge device encrypted traffic classification method based on weakly supervised continuous learning. First, existing real encrypted traffic data is obtained, including a small amount of labeled data and a large amount of unlabeled data; an encrypted traffic classification model is randomly initialized, and then the model is trained using the current encrypted traffic data and a small amount of core labeled data is stored; when a batch of new categories of encrypted traffic appears, computing resources are dynamically allocated based on the old model to respectively use a small amount of labeled data training model for the new category of traffic, sufficient unlabeled data training model and the stored core labeled encrypted traffic data training model for other old categories of traffic, and a small amount of core labeled data is stored. The present invention alleviates the demand pressure for labeled data and solves the difficulty that the new and old categories of encrypted traffic cannot be obtained at the same time. In addition, the resource requirements are low during implementation and limited resource quotas can be fully utilized, making it easy to deploy on edge devices.

Description

Technical Field

[0001] The present invention relates to an edge device encrypted traffic classification method based on weakly supervised continuous learning, relates to deep semi-supervised learning and continuous learning technologies, and particularly relates to a method for dynamically allocating resources when edge device resources are limited and classifying new categories of encrypted traffic that may continuously appear. Background Art

[0002] With the rapid development of communication networks, the volume and types of traffic data are increasing. Robust classification of this massive and complex network traffic data has become a pressing need in fields such as network resource scheduling. Traditional encrypted traffic classification methods typically require tedious feature engineering by experts and rely on statistical differences between different encryption algorithms. However, this traditional approach requires high levels of expert knowledge and consumes significant human resources.

[0003] In order to solve this problem, deep encrypted traffic classification technology has gradually become mainstream. Thanks to the development of deep semi-supervised learning and unsupervised learning, deep neural networks can obtain good feature extraction capabilities without additional feature engineering using only very little labeled data, and further realize end-to-end encrypted traffic classification, thereby reducing manpower and time costs. However, with the development of technologies such as the Internet of Things and the increasing attention to privacy protection, the types of encrypted traffic that individual edge devices need to handle are also increasing. At the same time, the computing and storage resources of edge devices are often limited in total and the available resource quotas change dynamically, making it impossible to store large amounts of data or support fixed high computing overhead. In the face of these practical challenges, the present invention is committed to providing a robust encrypted traffic classification method that has low model iteration computing resource requirements and is continuously available. Summary of the Invention

[0004] Purpose of the invention: In order to address the problems and shortcomings in the prior art, such as the high demand for labeled samples and the high labeling cost, the inability to simultaneously obtain encrypted traffic of new and old categories, which makes it difficult to achieve long-term and effective classification, and the high requirements for computing and storage resources but limited edge device resources, the present invention provides an edge device encrypted traffic classification method based on weakly supervised continuous learning. Specifically, the present invention first collects encrypted traffic data of existing categories of edge devices, obtains an encrypted traffic classification model based on this data through a weakly supervised learning paradigm, and saves a small amount of core labeled data. After a period of time, computing resources are dynamically allocated to perform weakly supervised model training based on the original model using the collected new category encrypted traffic and the saved old category encrypted traffic data, thereby obtaining an encrypted traffic classification model with low iterative computing resource requirements and continuous availability.

[0005] Technical solution: A method for classifying encrypted traffic for edge devices based on weakly supervised continuous learning. The method is suitable for scenarios where the encrypted traffic data flowing through and processed by edge devices changes with the scenario and over time. It includes data collection, weakly supervised continuous learning, and encrypted traffic classifier prediction.

[0006] The steps for data collection are:

[0007] Step 100, collecting encrypted traffic data flowing through the edge device;

[0008] Step 101: label a small portion of encrypted traffic data and perform data preprocessing to obtain a labeled data set S0 and an unlabeled data set U0;

[0009] Step 102 , collecting encrypted traffic data of a new category flowing through the edge device;

[0010] Step 103: label a small portion of the new category encrypted traffic data and perform data preprocessing to obtain a labeled data set S1 and an unlabeled data set U1;

[0011] The steps of weakly supervised continuous learning are:

[0012] Step 200: randomly initialize a training model M. The model M takes the pre-processed encrypted traffic data as input and can output a feature vector of the encrypted traffic. Based on the feature vector, a classification result of the encrypted traffic category or reconstructed encrypted traffic data is obtained.

[0013] Step 201: Based on the current computing resource quota, resources are preferentially allocated to the labeled data set S0 until the resources reach a threshold T0, and the remaining resources that do not exceed a certain threshold T1 are allocated to the unlabeled data set U0, resulting in a batch of labeled data and a batch of unlabeled data;

[0014] Step 202: Based on the cross entropy loss and reconstruction loss, the model M is updated using the labeled data and unlabeled data of the current batch, and the average value of the loss function is calculated. After repeating step 201 and this step several times, if the average value of the loss function does not decrease, then step 203 is entered;

[0015] Step 203: Save the model M and use the model M to calculate the class center in the encrypted traffic feature space of each category on S1;

[0016] Step 204: Calculate the cosine similarity between each encrypted traffic data in the labeled data set S1 and the center of its corresponding class, and select T2 data with cosine similarity in the middle position and save them to the buffer set D;

[0017] Step 205, expanding the classifier of model M according to the number of new categories;

[0018] Step 206: Based on the current computing resource quota, resources are preferentially allocated to the labeled data set S1 and the buffer set D until the resources occupied by S1 and D reach the threshold T0 simultaneously. The remaining resources that do not exceed the threshold T1 are allocated to the unlabeled data set U1, resulting in a batch of new class labeled data, a batch of old class labeled data, and a batch of new class unlabeled data.

[0019] Step 207: Based on the cross entropy loss and reconstruction loss, update the model M using the current batch of new class labeled data, old class labeled data, and new class unlabeled data, and calculate the average value of the loss function. After repeating step 206 and this step several times, if the mean value of the loss function does not decrease, proceed to step 208.

[0020] Step 208: output the trained model M;

[0021] The steps for the encrypted traffic classifier prediction are:

[0022] Step 300 , collecting encrypted traffic test data containing new and old categories flowing through the edge device and pre-processing it;

[0023] In step 301 , the trained model M is used to make predictions and classify the new and old encrypted traffic data flowing through the edge device.

[0024] The encrypted traffic classification model M can generally be specified as a neural network, consisting of an encoder, a reconstructor, and a classifier. The specific encoder, reconstructor, and classifier types and structures can be specified by the user. The design of this model is irrelevant to this technique; that is, this technique can be applied to any neural network that includes the three functional components described above.

[0025] The calculation to obtain the class center in the encrypted traffic feature space refers to obtaining the Euclidean normalized feature vector of the labeled sample set through the model, and then calculating the arithmetic average of the feature vectors of samples of each category to obtain the class center of each category.

[0026] Beneficial Effects: Compared with existing technologies, the proposed method for classifying encrypted traffic on edge devices based on weakly supervised continuous learning can alleviate the pressure on labeled data and cope with the potential increase in the types of encrypted traffic flowing through and processed by edge devices. Furthermore, the proposed method can dynamically allocate hardware resources on edge devices, requiring fewer resources and fully utilizing limited resource quotas. It is easy to deploy on edge devices and has strong applicability. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1This is a flow chart of data collection in an embodiment of the present invention;

[0028] Figure 2 This is a flowchart of weakly supervised continuous learning in an embodiment of the present invention;

[0029] Figure 3 This is a flowchart of the encrypted traffic classifier prediction in an embodiment of the present invention. DETAILED DESCRIPTION

[0030] The present invention is further illustrated below with reference to specific examples. It should be understood that these examples are only used to illustrate the present invention and are not used to limit the scope of the present invention. After reading the present invention, modifications of various equivalent forms of the present invention made by those skilled in the art all fall within the scope defined by the claims attached to this application.

[0031] Data collection such as Figure 1 As shown in the figure, data collection begins (step 100). This includes collecting old encrypted traffic data that has historically flowed through edge devices (step 101) and labeling a small number of samples (step 102). It also includes collecting new encrypted traffic data (step 104) and labeling a small number of samples (step 105). All collected data undergoes data preprocessing, including normalization and zero extension (steps 103 and 105). Finally, data collection concludes, outputting the collected old and new encrypted traffic data from edge devices (step 107).

[0032] Weakly supervised continuous learning Figure 2As shown. First, weakly supervised continuous learning begins (step 200). Then, the collected old-class labeled encrypted traffic data S0, old-class unlabeled encrypted traffic data U0, new-class labeled encrypted traffic data S1, and new-class unlabeled encrypted traffic data U1 are prepared (step 201). Model M and buffer D are initialized (step 203). Then, based on current memory, video memory, processor resources, and other related resources, up to T0 resource quotas are allocated to data source S0, obtaining a batch of randomly sampled old-class labeled data (step 205). Next, based on remaining resources, up to T1 resource quotas are allocated to data source U0, obtaining a batch of randomly sampled old-class unlabeled data (step 205). T0 and T1 can be set based on actual conditions. Subsequently, using the current batch of data, the cross-entropy loss and reconstruction loss are calculated and the model is updated accordingly (step 206). This model update is repeated several times until the mean of the loss function substantially stops decreasing (step 207). After training on the old class data, model M is used to calculate the class centers of each class of data in data set S0 (step 208). Based on this, the cosine similarity of the samples to the corresponding class centers is calculated, and the centered samples are added to buffer D (step 209). Subsequently, the classifier of model M is expanded to meet the subsequent classification requirements of old and new class traffic data (step 210). Then, based on current resources, up to T0 resource quotas are allocated to data source S1 and buffer data D, resulting in a batch of randomly sampled labeled data from the old and new classes (step 211). Based on remaining resources, up to T1 resource quotas are allocated to data source U1, resulting in a batch of randomly sampled unlabeled data from the old class (step 212). Using the current batch of labeled data from the old and new classes, as well as the old class unlabeled data, the model is updated based on the cross-entropy loss and reconstruction loss (step 213). This model update is repeated several times until the mean loss function shows little sign of decreasing (step 214). Finally, weakly supervised continuous learning is concluded, and the encrypted traffic classification model M is output (step 215).

[0033] The encrypted traffic classifier predicts Figure 3 As shown in the figure, the encrypted traffic classifier prediction process begins (step 300). Next, encrypted traffic test data containing both new and old categories flowing through the edge device is collected (step 301) and preprocessed (step 302). The encrypted traffic classification model, acquired through weakly supervised continuous learning, is then used to make predictions on the collected encrypted traffic data (step 303). Finally, the model's classification results are output (step 304), and the encrypted traffic classification prediction process ends (step 305).

Claims

1. A method for classifying encrypted traffic on edge devices based on weakly supervised continuous learning, characterized by: First, we collect encrypted traffic data of both new and old categories flowing through edge devices and annotate a small amount of data. Then, we use a weakly supervised paradigm to complete continuous model learning. The specific process includes data collection, weakly supervised continuous learning, and encrypted traffic classifier prediction; The steps for data collection are: Step 100, collecting encrypted traffic data flowing through the edge device; Step 101: label a small portion of encrypted traffic data and perform data preprocessing to obtain a labeled data set S0 and an unlabeled data set U0; Step 102 , collecting encrypted traffic data of a new category flowing through the edge device; Step 103: label a small portion of the new category encrypted traffic data and perform data preprocessing to obtain a labeled data set S1 and an unlabeled data set U1; The steps of weakly supervised continuous learning are: Step 200: randomly initialize a training model M. The model M takes the pre-processed encrypted traffic data as input and can output a feature vector of the encrypted traffic. Based on the feature vector, a classification result of the encrypted traffic category or reconstructed encrypted traffic data is obtained. Step 201: Based on the current computing resource quota, resources are preferentially allocated to the labeled data set S0 until the resources reach a threshold T0, and the remaining resources that do not exceed a certain threshold T1 are allocated to the unlabeled data set U0; Step 202: Based on the cross entropy loss and reconstruction loss, the model M is updated using the labeled data and unlabeled data of the current batch, and the average value of the loss function is calculated. After repeating step 201 and this step several times, if the average value of the loss function does not decrease, then step 203 is entered; Step 203: Save the model M and use the model M to calculate the class center in the encrypted traffic feature space of each category on S1; Step 204: Calculate the cosine similarity between each encrypted traffic data in the labeled data set S1 and the center of its corresponding class, and select T2 data with cosine similarity in the middle position and save them to the buffer set D; Step 205, expanding the classifier of model M; Step 206 : Based on the current computing resource quota, resources are preferentially allocated to the labeled data set S1 and the buffer set D until the resources occupied by S1 and D reach the threshold T0 simultaneously, and the remaining resources that do not exceed the threshold T1 are allocated to the unlabeled data set U1 ; Step 207: Based on the cross entropy loss and reconstruction loss, update the model M using the current batch of new class labeled data, old class labeled data, and new class unlabeled data, and calculate the average value of the loss function. After repeating step 206 and this step several times, if the mean value of the loss function does not decrease, proceed to step 208. Step 208: output the trained model M; The steps for the encrypted traffic classifier prediction are: Step 300 , collecting encrypted traffic test data containing new and old categories flowing through the edge device and pre-processing it; In step 301 , the trained model M is used to make predictions and classify the new and old encrypted traffic data flowing through the edge device.

2. The edge device encrypted traffic classification method based on weakly supervised continuous learning according to claim 1 is characterized by: The encrypted traffic classification model M is a neural network, which needs to include an encoder, a reconstructor and a classifier.

3. The edge device encrypted traffic classification method based on weakly supervised continuous learning according to claim 1 is characterized by: The calculation to obtain the class center in the encrypted traffic feature space refers to obtaining the Euclidean normalized feature vector of the labeled sample set through the model, and then calculating the arithmetic average of the feature vectors of samples of each category to obtain the class center of each category.

4. The edge device encrypted traffic classification method based on weakly supervised continuous learning according to claim 1 is characterized by: The edge device encrypted traffic classification method based on weakly supervised continuous learning is suitable for scenarios where the encrypted traffic data flowing through and processed by edge devices changes with the scenario and over time.

Images