A Classification Method for Encrypted Network Traffic Based on Integrated Prototype Network

Abstract

The present invention relates to an encrypted network traffic classification method based on an integrated prototype network, and belongs to the field of network security. The present invention adopts a machine learning model for encrypted network traffic classification based on an integrated prototype network, wherein the prototype network maps each traffic input sample to a point in an embedding space, and infers the category probability by calculating the distance between the sample and the category prototype, thereby reducing the need for labeled samples; according to the idea of ​​integrated learning, multiple prototype networks are combined into an integrated classification model with more powerful performance, and then the prediction results of multiple prototype networks are weighted and fused, thereby obtaining a more accurate and more robust classification prediction effect; the classification model can receive traffic statistical features and wavelet-based features as mixed inputs, and can learn advanced feature representations for traffic classification tasks, thereby solving the problem that traditional classification methods are overly dependent on collecting the entire connection statistics, and realizing rapid learning under limited data.

Description

Technical Field

[0001] The invention belongs to the field of network security, and in particular relates to an encrypted network traffic classification method based on an integrated prototype network. Background Art

[0002] With the rapid development of Internet technology, the public's awareness of network security is constantly improving, and the security and privacy protection of network communications are becoming more and more important. Network traffic encryption technology has become one of the key means to maintain communication security. However, traditional network encryption methods only focus on the encryption and decryption process of communication content, and do not classify and analyze encrypted traffic. While improving privacy protection, the encryption of malware has also increased accordingly. Network traffic encryption technology is also used to obfuscate commands, disguise the IP address of the server to destroy the signature detection function, and covertly transmit malicious code. Therefore, in order to better maintain the security of network communications, it is necessary to develop a technology that can identify and classify encrypted traffic so as to effectively manage and monitor different types of traffic.

[0003] Network traffic data usually has the characteristics of time series, diversity, large scale, high dimensionality, dynamics and noise anomalies. These characteristics are very challenging for the processing of high-dimensional network traffic data and are not conducive to the extraction and utilization of key features. Traffic classification has always relied mainly on port-based methods and deep packet inspection methods. However, the former may be unreliable and inaccurate, and the latter may involve privacy and legal rights issues. In order to address the above problems, machine learning has been introduced into the field of network security to achieve the classification of encrypted network traffic data. Through the application of machine learning, key information of network traffic can be captured based on traffic statistical features, and models can be built to achieve traffic classification and identification. Compared with traditional classification methods, machine learning algorithms can better adapt to changes in traffic characteristics and improve the accuracy and reliability of traffic classification.

[0004] The present invention proposes an encrypted network traffic classification method based on an integrated prototype network, which combines multiple prototype networks into a powerful classification model, aiming to use limited labeled data for rapid model training and provide integrated prediction results with higher accuracy and stronger robustness. Summary of the invention

[0005] 1. Technical issues to be resolved

[0006] The technical problem to be solved by the present invention is how to provide an encrypted network traffic classification method based on an integrated prototype network to solve the problem of encrypted network traffic classification.

[0007] (II) Technical solution

[0008] In order to solve the above technical problems, the present invention proposes an encrypted network traffic classification method based on an integrated prototype network, which comprises the following steps:

[0009] S1. Obtaining original traffic data

[0010] S2. Data preprocessing

[0011] The raw traffic data collected by S1 is stored in a Pacp format file, and the raw traffic data is processed using data preprocessing technology, including the following aspects: data packet parsing, data packet grouping to establish connections, time interval division, data packet number screening and data discretization processing to obtain a processed data set;

[0012] S3. Feature extraction

[0013] S31, each time interval T in the data set obtained by the above processing is regarded as a bidirectional flow, the flow statistical characteristics of each time interval are calculated, and the wavelet-based characteristics are generated by discrete wavelet transform, and then the flow statistical characteristics and the wavelet-based characteristics are mixed as the original flow characteristics;

[0014] S32. After completing the above feature processing, use the principal component analysis (PCA) method to extract the main features and reduce the dimension of the original traffic features to obtain the traffic feature vector after dimensionality reduction;

[0015] S4. Traffic classification model

[0016] The prototype network framework and the idea of ​​ensemble learning are used to design the traffic classification model; the embedding function f is used in the prototype network. θ :R D →R M The traffic feature vector after dimensionality reduction is mapped to the embedding vector in the embedding space, where D represents the dimension of the feature space, M represents the dimension of the embedding space, and θ represents the weight parameter that the network needs to learn; through the mapping of the embedding function, each input sample is represented as a point in the embedding space; the prototype network calculates the distance between the input sample and each category prototype in the embedding space, and calculates the probability of belonging to the corresponding category based on these distances;

[0017] S5. Based on the above prototype network, the idea of ​​ensemble learning is used to design the entire classification model. Multiple prototype network models are combined into a more powerful ensemble learning model. The prediction results of multiple prototype networks are weighted and integrated to obtain a more accurate and robust classification prediction effect.

[0018] (III) Beneficial effects

[0019] The present invention proposes an encrypted network traffic classification method based on an integrated prototype network. The present invention proposes an encrypted network traffic classification method based on an integrated prototype network. The method adopts a machine learning model for encrypted network traffic classification based on an integrated prototype network. The model adopts an integrated learning architecture based on a prototype network. The prototype network maps each traffic input sample to a point in the embedding space, and infers the category probability by calculating the distance between the sample and the category prototype, thereby reducing the demand for labeled samples. According to the idea of ​​integrated learning, multiple prototype networks are combined into an integrated classification model with more powerful performance, and then the prediction results of multiple prototype networks are weighted and fused, thereby obtaining a more accurate and more robust classification prediction effect. The classification model can receive traffic statistical features and wavelet-based features as mixed inputs, and can learn advanced feature representations for traffic classification tasks, thereby solving the problem that traditional classification methods are overly dependent on collecting the entire connection statistics, and realizing rapid learning under limited data. The method of the present invention is based on a machine learning model of an integrated prototype network, can quickly train limited labeled data, can give integrated prediction results with better accuracy and robustness, and improves the reliability and interpretability of network traffic classification. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is the overall architecture diagram of the present invention;

[0021] Figure 2 This is a data preprocessing flow chart of the present invention;

[0022] Figure 3 This is a diagram of the integrated traffic classification model based on the prototype network of the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0024] The present invention adopts an encrypted network traffic classification method based on an integrated prototype network. The method adopts a machine learning model for encrypted network traffic classification based on an integrated prototype network. In the network encrypted traffic classification, the dependence on collecting the entire connection statistics is reduced through data preprocessing and feature extraction processes, and rapid learning is achieved under limited labeled data. By combining multiple prototype networks into a powerful integrated classification model, an integrated prediction result with better accuracy and robustness is given.

[0025] The present invention provides an encrypted network traffic classification method based on an integrated prototype network. The method adopts a machine learning model for encrypted network traffic classification based on an integrated prototype network. The overall architecture of the machine learning model is as follows: Figure 1 shown.

[0026] S1. Obtaining original traffic data

[0027] S11. Directly obtain encrypted traffic data through network traffic monitoring tools, secret keys and management certificates, and network device logs;

[0028] S12. Obtain open-source and highly recognized encrypted traffic datasets: such as the SCXVPN2016 dataset, the QUIC dataset, and the VNAT dataset.

[0029] S2. Data preprocessing

[0030] The raw traffic data collected by S1 is usually stored in a Pacp format file. There may be noise, abnormal data values, missing data, and other problems in the raw traffic data, and the data format and dimension are not exactly the same, so it cannot be directly transmitted to the neural network as input data. As an embodiment of the present invention, in order to achieve the classification of encrypted network traffic data, data preprocessing technology is used to process the raw traffic data, mainly including the following aspects: data packet parsing, data packet grouping to establish connections, time interval division, data packet number screening and data discretization processing to obtain a processed data set. The data preprocessing process is as follows: Figure 2 shown.

[0031] Network traffic data is usually stored and transmitted in the form of data packets, the smallest unit of network communication. As an embodiment of the present invention, the dpkt module in Python is first used to parse the data packets to convert them from the original binary format into a readable data structure; then the five-tuple information in the data packets: source IP address, destination IP address, source port, destination port and protocol type are extracted, and the data packets with the same five-tuple information are classified into the same connection to establish a connection-level data structure; these connections are then divided into multiple time intervals of T (in a certain embodiment, T = 40.96 seconds), and time intervals containing less than 20 data packets are discarded to ensure that the amount of data in each time interval is large enough; finally, the timestamp, load size and transmission direction of the data packets in each time interval are discretized to obtain a processed data set.

[0032] The discretization of packet timestamps is to divide the time interval T into multiple small intervals according to the small time interval t. For each packet timestamp in the time interval T, subtract the start time of the time interval T, and divide the result by t and round it up;

[0033] Payload size discretization is to divide the payload size of the data packet at each time by t and round it up;

[0034] Discretization of the transmission direction means setting the packet input to 0 and the output to 1.

[0035] The processed dataset contains examples of various types of traffic, including command and control traffic, chat traffic, file transfer traffic, streaming traffic, and VoIP (Voice over IP) traffic.

[0036] S3. Feature extraction

[0037] S31. As an embodiment of the present invention, each time interval T in the data set obtained by the above processing can be regarded as a bidirectional flow. In order to better analyze and process the flow data, the flow statistical characteristics of each time interval are calculated, and the discrete wavelet transform is used to generate wavelet-based features, and then the flow statistical characteristics and the wavelet-based features are mixed as the original flow characteristics.

[0038] The traffic statistics characteristics of each time interval include: flow feature aggregation statistics and forward and backward statistics of the flow, such as the number of packets, bytes per second, traffic arrival time, traffic arrival time interval, etc.

[0039] As the simplest wavelet basis function, the Haar-based wavelet can decompose the input signal into a series of approximate coefficients and detail coefficients, and can obtain the maximum output energy and Shannon entropy ratio. Therefore, the Haar-based wavelet is selected as the mother wavelet in the embodiment of the present invention. First, the Python toolkit PyWavelets is used to perform a bidirectional discrete wavelet transform on the input flow data, and the detail coefficients of the frequency band 0-12 are extracted. The detail coefficients are the coefficients that represent the signal details in the wavelet transform process; then the wavelet-based features of the flow data are calculated according to the detail coefficients of each band. The wavelet-based features mainly include relative wavelet energy, Shannon entropy, and the absolute mean and standard deviation of the detail coefficients. Since these original feature distributions are severely right-skewed, the absolute mean and standard deviation of the detail coefficients need to be logarithmically transformed to introduce symmetry.

[0040] S32. Composition According to an embodiment of the present invention, after completing the above feature processing, it is necessary to further process it, use principal component analysis (PCA) to extract the main features and reduce the dimension of the original flow features, and obtain the flow feature vector after dimensionality reduction;

[0041] First, the collected raw traffic features are constructed into a matrix, where the rows of the matrix correspond to different time intervals and the columns correspond to different raw traffic features. If it is assumed that the raw traffic features within the time interval T (in a certain embodiment, T = 40.96 seconds) contain M raw traffic features and N time windows, then an (N, M) feature matrix will be obtained, in which each element represents the value of a raw traffic feature within a certain time window. Then the feature mean within each time window is calculated to form a mean matrix with a shape of (N, 1), and the raw traffic features are mean-centered by subtracting the corresponding mean matrix from each column of the feature matrix.

[0042] Since the core idea of ​​PCA technology is to find the main variance direction in the data, that is, the direction containing the most information, this process can be achieved by calculating the covariance matrix of the feature matrix. The covariance matrix describes the correlation and variance between different features; based on the obtained covariance matrix, decomposition is performed to obtain eigenvalues ​​and corresponding eigenvectors, where the eigenvalues ​​represent the variance in the covariance matrix, and the eigenvectors represent the direction of each corresponding eigenvalue. Then the eigenvalues ​​and eigenvectors of the covariance matrix are arranged in descending order, and the eigenvectors corresponding to the first k eigenvalues ​​are selected as the principal components, and a principal component matrix is ​​constructed using k eigenvectors for data projection. Finally, the feature matrix is ​​multiplied by the principal component matrix to project the original traffic feature matrix into the low-dimensional feature space to obtain the reduced-dimensional traffic feature vector.

[0043] Through the above PCA technology, the relevant features in the data processing process can be screened and processed to reduce redundancy and extract more important features. Finally, the original traffic features can generate a certain amount of feature information in each time interval. Through further processing of traffic features, the feature dimension is effectively reduced, which improves the computational efficiency and the recognition accuracy and generalization ability of the model, and can better reveal the key feature information in the traffic data. The obtained feature vector can be used for further traffic classification and identification, and provide a better feature set for subsequent machine learning algorithms.

[0044] S4. Traffic classification model

[0045] As an embodiment of the present invention, a prototype network framework and the idea of ​​ensemble learning are used to design a traffic classification model. The embedding function f is used in the prototype network. θ :R D →R MThe traffic feature vector after dimensionality reduction is mapped to the embedding vector in the embedding space, where D represents the dimension of the feature space, M represents the dimension of the embedding space, and θ represents the weight parameter that the network needs to learn. Through the mapping of the embedding function, each input sample is represented as a point in the embedding space; unlike the traditional softmax activation function to calculate the category probability, the prototype network calculates the distance between the input sample and each category prototype in the embedding space, and calculates the probability of belonging to the corresponding category based on these distances.

[0046] As an embodiment of the present invention, the above embedding function will be implemented in the form of an embedding model, which is the basic neural network part of the prototype network, and is a neural network with 9 hidden layers, each hidden layer contains 64 neurons and uses the GeLU activation function; in order to avoid network overfitting, a 40% dropout layer is used after each hidden layer to provide a better regularization effect and increase the robustness of the model. Through back propagation, the weight parameters are continuously adjusted during the training process, and the embedding model can learn feature representations suitable for network encrypted traffic classification tasks. In the prototype network, the embedding model is used to calculate the embedding vector of the input sample. The embedding vector represents the position of the input sample in the embedding space. By calculating the distance between the input sample embedding vector and each category prototype, the prototype network can calculate the predicted probability of belonging to the corresponding category.

[0047] The encrypted network traffic data sample used in the present invention is denoted as X={x i}, whose category label is y i ∈{1, 2, ..., K}. As an embodiment of the present invention, 80% of the data in the traffic data set is divided into a training set X train , 20% of the data is divided into the test set X test , and divide the training set into the support set S train and the query set Q train , the support set is mainly used to calculate the category prototype, while the query set is mainly used for model training. After the feature extraction process, the input sample x i The reduced-dimensional traffic feature vector can be expressed as Z = {z i}, which is input into the prototype network for further calculation. The category prototype for category k can be defined as the embedding mean of several support samples in category k, that is:

[0048]

[0049] Among them, S k represents the number of support samples for category k, Represents the feature vector supporting sample s in category k, 1≤k≤K.

[0050] In the prototype network, for a given observation sample x i , the category probability P(y i =k|x i ). First, calculate the Euclidean distance in the embedding space:

[0051] d k (f θ (z i ), c k )=E(f θ (z i ), c k ) (2)

[0052] And calculate the sample x accordingly i Class probability of belonging to class k:

[0053]

[0054] Therefore, the loss function of the prototype network can be expressed as:

[0055] L = -log(P(y i =k|x i )) (4)

[0056] S5. As an embodiment of the present invention, based on the above-mentioned prototype network, the idea of ​​ensemble learning is used to design the entire classification model, and multiple prototype network models are combined into a more powerful ensemble learning model. The central idea is to weight the prediction results of multiple prototype networks to obtain a more accurate and robust classification prediction effect. In the present invention, in order to reduce the design complexity and the amount of calculation, the network structure, initialization parameters and input data of all prototype networks are consistent, but each prototype network will be trained as an independent branch, and each branch does not interfere with each other. Only the prediction results of multiple prototype networks will be fused at the end of the model to generate the final integrated prediction. While performing the above-mentioned prototype network design, the calculation formula of the loss and prediction result of a single prototype network is given. Therefore, for an ensemble learning model with n prototype networks, the calculation process of the loss function and the prediction result can refer to a single network, where n≥2.

[0057] The category prototype in the prototype network l can be obtained by referring to the formula:

[0058]

[0059] Where l = 1, ..., n. Referring to the formula, we can get the Euclidean distance in the embedding space of the prototype network l as:

[0060]

[0061] According to the formula, the sample x can be calculated by the prototype network l i The class probability of belonging to class k is:

[0062]

[0063] According to the formula, the loss function of the prototype network l can be obtained as:

[0064] loss l = -log(P l (y i =k|x i )) (8)

[0065] Therefore, the loss function of the entire ensemble learning model can be expressed as

[0066]

[0067] As an embodiment of the present invention, the prediction results of multiple prototype networks are integrated by soft voting. Since the initialization of each prototype network is consistent and there is no artificial preference for certain prototype networks during the training process, the weights of each prototype network are the same. Therefore, for sample x i The integrated class probability belonging to class k is:

[0068]

[0069] Select the maximum value of the integrated prediction probability to get the model for sample x i prediction results.

[0070] The integrated traffic classification model based on the prototype network is as follows Figure 3 As shown:

[0071] Among them, Model1, Model2, ..., Modeln represent n prototype networks respectively; output1, output2, ..., outputn represent the prediction results of n prototype networks respectively; loss1, loss2, ..., lossn represent the cross entropy loss function of n prototype networks respectively; L toatl Represents the total loss of the entire integrated classification model; weight represents the weight value of the n prototype network models in the integrated learning model. In the embodiment of the present invention, the weights of each prototype network model are the same; output represents the prediction result of the entire integrated classification model.

[0072] A large amount of encrypted network traffic data is put into the integrated traffic classification model for model training. The integrated learning model is optimized by minimizing the loss function, thereby continuously improving the category prediction probability.

[0073] The present invention proposes an encrypted network traffic classification method based on an integrated prototype network. The method adopts a machine learning model for encrypted network traffic classification based on an integrated prototype network. The model adopts an integrated learning architecture based on a prototype network. The prototype network maps each traffic input sample to a point in an embedding space, and infers the category probability by calculating the distance between the sample and the category prototype, thereby reducing the need for labeled samples. According to the idea of ​​integrated learning, multiple prototype networks are combined into an integrated classification model with more powerful performance, and then the prediction results of multiple prototype networks are weighted and fused to obtain a more accurate and more robust classification prediction effect. The classification model can receive traffic statistical features and wavelet-based features as mixed inputs, and can learn advanced feature representations for traffic classification tasks, thereby solving the problem that traditional classification methods are overly dependent on collecting the entire connection statistics, and realizing rapid learning under limited data. The method of the present invention is based on a machine learning model of an integrated prototype network, can quickly train limited labeled data, can give integrated prediction results with better accuracy and robustness, and improves the reliability and interpretability of network traffic classification.

[0074] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for classifying encrypted network traffic based on an integrated prototype network, characterized in that: The method comprises the following steps: S1. Obtaining original traffic data S2. Data preprocessing The raw traffic data is processed using data preprocessing technology, including the following aspects: data packet parsing, data packet grouping and connection establishment, time interval division, data packet number screening and data discretization processing to obtain the processed data set; S3. Feature extraction S31, each time interval T in the data set obtained by the above processing is regarded as a bidirectional flow, the flow statistical characteristics of each time interval are calculated, and the wavelet-based characteristics are generated by discrete wavelet transform, and then the flow statistical characteristics and the wavelet-based characteristics are mixed as the original flow characteristics; S32. After completing the above feature processing, use the principal component analysis (PCA) method to extract the main features and reduce the dimension of the original traffic features to obtain the traffic feature vector after dimensionality reduction; S4. Traffic classification model The prototype network framework and the idea of ​​ensemble learning are used to design the traffic classification model; the embedding function f is used in the prototype network. θ :R D →R M The traffic feature vector after dimensionality reduction is mapped to the embedding vector in the embedding space, where D represents the dimension of the feature space, M represents the dimension of the embedding space, and θ represents the weight parameter that the network needs to learn; through the mapping of the embedding function, each input sample is represented as a point in the embedding space; the prototype network calculates the distance between the input sample and each category prototype in the embedding space, and calculates the probability of belonging to the corresponding category based on these distances; S5. Based on the above prototype network, the idea of ​​ensemble learning is used to design the entire classification model. Multiple prototype network models are combined into a more powerful ensemble learning model. The prediction results of multiple prototype networks are weighted and integrated to obtain a more accurate and robust classification prediction effect.

2. The encrypted network traffic classification method based on the integrated prototype network as claimed in claim 1 is characterized in that: The S1 specifically includes: S11. Directly obtain encrypted traffic data through network traffic monitoring tools, secret keys and management certificates and network device log methods; S12. Obtain an open-source, highly recognized encrypted traffic dataset.

3. The encrypted network traffic classification method based on the integrated prototype network as claimed in claim 2 is characterized in that: The encrypted traffic data sets in S12 include: SCXVPN2016 data set, QUIC data set and VNAT data set.

4. The encrypted network traffic classification method based on the integrated prototype network as claimed in claim 1 is characterized in that: The S2 specifically includes: first, using the dpkt module in Python to parse the data packet and convert it from the original binary format into a readable data structure; then, extracting the five-tuple information in the data packet: source IP address, destination IP address, source port, destination port and protocol type, and classifying the data packets with the same five-tuple information into the same connection, and establishing a connection-level data structure; then dividing these connections into multiple time intervals of T, and discarding time intervals containing less than 20 data packets to ensure that the amount of data in each time interval is large enough; finally, discretizing the timestamp, load size and transmission direction of the data packet in each time interval to obtain a processed data set.

5. The encrypted network traffic classification method based on integrated prototype network as claimed in claim 4 is characterized in that: T = 40.96 seconds.

6. The encrypted network traffic classification method based on integrated prototype network as claimed in claim 4 is characterized in that: The discretization of packet timestamps is to divide the time interval T into multiple small intervals according to the small time interval t. For each packet timestamp in the time interval T, the start time of the time interval T is subtracted and the result is divided by t and rounded; Payload size discretization is to divide the payload size of the data packet at each time by t and round it up; Discretization of the transmission direction means setting the packet input to 0 and the output to 1; The processed dataset contains multiple types of traffic.

7. The encrypted network traffic classification method based on integrated prototype network as claimed in claim 4 is characterized in that: The S31 specifically includes: The traffic statistics characteristics of each time interval include: flow feature aggregation statistics and forward and backward statistics of the flow; The Haar basis is selected as the mother wavelet. The Python toolkit PyWavelets is first used to perform bidirectional discrete wavelet transform on the input traffic data, and the detail coefficients of the frequency bands 0-12 are extracted. The detail coefficients are the coefficients that represent the signal details in the wavelet transform process. Then, the wavelet-based features of the traffic data are calculated according to the detail coefficients of each band. The wavelet-based features include relative wavelet energy, Shannon entropy, and the absolute mean and standard deviation of the detail coefficients. Since the distribution of these original features is severely right-skewed, the absolute mean and standard deviation of the detail coefficients need to be logarithmically transformed to introduce symmetry.

8. The encrypted network traffic classification method based on the integrated prototype network as claimed in claim 7 is characterized in that: The S32 specifically includes: First, the collected original traffic features are constructed into a matrix, where the rows of the matrix correspond to different time intervals and the columns correspond to different original traffic features. If it is assumed that the original traffic features within the time interval T contain M original traffic features and N time windows, then an (N, M) feature matrix will be obtained, in which each element represents the value of a certain original traffic feature within a certain time window. Then, the feature mean within each time window is calculated to form a mean matrix with a shape of (N, 1). The mean centering of the original traffic features is achieved by subtracting the corresponding mean matrix from each column of the feature matrix. Calculate the covariance matrix of the feature matrix, which describes the correlation and variance between different features; decompose the obtained covariance matrix to obtain eigenvalues ​​and corresponding eigenvectors, where the eigenvalue represents the variance in the covariance matrix and the eigenvector represents the direction of each corresponding eigenvalue; then arrange the eigenvalues ​​and eigenvectors of the covariance matrix in descending order, select the eigenvectors corresponding to the first k eigenvalues ​​as the principal components, and use the k eigenvectors to construct a principal component matrix for data projection; finally, multiply the feature matrix by the principal component matrix to project the original traffic feature matrix into the low-dimensional feature space to obtain the reduced-dimensional traffic feature vector.

9. The encrypted network traffic classification method based on the integrated prototype network as claimed in claim 8, characterized in that: The S4 specifically includes: The embedding function will be implemented in the form of an embedding model, which is the basic neural network part of the prototype network. It is a neural network with 9 hidden layers, each hidden layer contains 64 neurons and uses the GeLU activation function. In order to avoid network overfitting, a 40% dropout layer is used after each hidden layer to provide a good regularization effect. Through back propagation, the weight parameters are continuously adjusted during the training process, and the embedding model can learn feature representations suitable for network encrypted traffic classification tasks. In the prototype network, the embedding model is used to calculate the embedding vector of the input sample. The embedding vector represents the position of the input sample in the embedding space. By calculating the distance between the embedding vector of the input sample and the prototype of each category, the prototype network calculates the prediction probability of belonging to the corresponding category. The encrypted network traffic data sample is recorded as X = {x i }, whose category label is y i ∈{1,2,...,K}; Divide 80% of the data in the traffic data set into the training set X train , 20% of the data is divided into the test set X test , and divide the training set into the support set S train and the query set Q train , the support set is used to calculate the category prototype, and the query set is used for model training; after the feature extraction process, the input sample x i The reduced-dimensional traffic feature vector is expressed as Z = {z i }, which is input into the prototype network for further calculation; the category prototype for category k is defined as the embedding mean of several support samples in category k, that is: Among them, S k represents the number of support samples for category k, Represents the feature vector supporting sample s in category k, 1≤k≤K; In the prototype network, for a given observation sample x i , the category probability P(y i =k|x i ); First, calculate the Euclidean distance in the embedding space: d k (f θ (z i ),c k )=E(f θ (z i ),c k ) (2) And calculate the sample x accordingly i Class probability of belonging to class k: Therefore, the loss function of the prototype network is expressed as: L=-log(P(y i =k|x i )) (4)。 10. The encrypted network traffic classification method based on integrated prototype network as claimed in claim 9, characterized in that: The S5 specifically includes: The network structure, initialization parameters and input data of all prototype networks are consistent, but each prototype network will be trained as an independent branch. The branches do not interfere with each other. The prediction results of multiple prototype networks will only be fused at the end of the model to generate the final integrated prediction. For an integrated learning model with n prototype networks, the category prototypes in the prototype network l are: Where l = 1,...,n; the Euclidean distance in the embedding space of the prototype network l is: Calculate sample x through prototype network l i The class probability of belonging to class k is: The loss function of the prototype network l is: loss l =-log(P l (y i =k|x i )) (8) Therefore, the loss function of the entire ensemble learning model is expressed as The prediction results of multiple prototype networks are integrated using soft voting. The weight of each prototype network is the same. i The integrated class probability belonging to class k is: Select the maximum value of the integrated prediction probability to get the model for sample x i prediction results.

Images