Web traffic recognition method, device, electronic device and storage medium

Abstract

The present invention relates to the technical field of web traffic recognition, and particularly relates to a web traffic recognition method, device, electronic device, and storage medium, including: obtaining a target packet in a web traffic sequence, preprocessing the target packet, extracting the context local features of the target packet, calculating the correlation of the context local features through a preset self-attention mechanism, and based on the correlation, outputting the classification category of the target packet through a preset fully connected neural network to obtain the web category corresponding to the target packet, and further obtaining the web category sequence corresponding to the traffic sequence, and finally obtaining the corresponding web traffic recognition result. Thereby, the problem that it is impossible to distinguish the mixed traffic of multiple different web pages and accurately identify all web page categories contained in the mixed traffic is solved. By performing correlation calculations on the traffic characteristics of the same web page, the distinction of traffic characteristics of different web pages is realized, so as to realize the multi-label web traffic recognition of the entire traffic sequence.

Description

Technical Field

[0001] The present invention relates to the technical field of web traffic recognition, and particularly to a web traffic recognition method, device, electronic device, and storage medium. Background Art

[0002] Encrypted web traffic recognition is a key technology. By deeply analyzing and identifying the characteristics of web traffic, it realizes the accurate identification of the specific web pages that users are accessing from encrypted traffic, which plays a crucial role in network management and provides an effective means for network administrators to monitor, analyze, and optimize network traffic. With the popularization of encrypted communication and the continuous increase of Internet content, traditional traffic analysis and management methods are facing challenges. However, the emergence of encrypted web traffic recognition technology has filled this gap, enabling administrators to understand users' browsing behaviors and access preferences in detail.

[0003] In related technologies, through traditional machine learning classifiers, a set of features is selected through manual feature engineering to represent a website. The rise of deep learning has attracted many researchers to use deep learning models to improve the existing research work on website traffic recognition.

[0004] Currently, there are relatively few related research works on web traffic recognition. These works assume that users only browse one web page each time, and the generated traffic only contains information of that single web page. Related technical personnel have proposed to perform feature engineering on the entire traffic, and based on the statistical features or packet feature sequences of the entire traffic, use traditional machine learning models such as random forest or convolutional neural network to achieve accurate recognition of web traffic.

[0005] However, the assumptions of the current web traffic recognition research work do not conform to the actual situation. Since users may access multiple web pages simultaneously or browse multiple web pages successively in a real network environment, the generated traffic often contains the traffic of multiple web pages. Therefore, in this case, the research methods in related technologies cannot distinguish the traffic of different web pages in the feature engineering stage, and thus cannot accurately identify all the web pages contained in the traffic, which urgently needs to be solved. Summary of the Invention

[0006] The present invention provides a web traffic recognition method, device, electronic device, and storage medium to solve the problem that related technologies cannot distinguish the mixed traffic of multiple different web pages and cannot accurately identify all the web page categories contained in the mixed traffic.

[0007] The first aspect embodiment of the present invention provides a web traffic recognition method, including the following steps:

[0008] Obtain a target packet in the web traffic sequence;

[0009] Preprocess the target packet based on a preset convolutional neural network, and extract the context local features of the target packet;

[0010] Calculate the correlation of the context local features through a preset self-attention mechanism, and based on the correlation, output the classification category of the target packet through a preset fully connected neural network, and obtain the corresponding web page category sequence of the web traffic sequence according to the classification category of the target packet, so as to obtain the corresponding web traffic recognition result according to the web page category sequence.

[0011] According to an embodiment of the present invention, the preprocessing of the target packet based on a preset convolutional neural network and the extraction of the context local features of the target packet include:

[0012] Obtain the TCP (Transmission Control Protocol) load size and direction sequence of the target packet;

[0013] Based on the TCP load size and the direction sequence, perform a convolution operation on the target packet to extract the context local features of the target packet.

[0014] According to an embodiment of the present invention, the calculation of the correlation of the context local features through a preset self-attention mechanism includes:

[0015] Based on the preset self-attention mechanism, dynamically allocate the attention weights of the context local features;

[0016] Obtain the positional relationship and feature correlation degree between the target packet and other packets in the web traffic sequence according to the attention weights, and obtain the correlation of the context local features according to the positional relationship and the feature correlation degree.

[0017] According to an embodiment of the present invention, the output of the classification category of the target packet through the preset fully connected neural network based on the correlation includes:

[0018] Based on the preset fully connected neural network, learn the context local features of the target packet;

[0019] Obtain the classification category of the target packet according to the learning result and the correlation.

[0020] According to the web traffic recognition method of an embodiment of the present invention, a target packet in a web traffic sequence is obtained, and the target packet is preprocessed to extract the context local features of the target packet. The relevance of the context local features is calculated through a preset self-attention mechanism, and based on the relevance, the classification category of the target packet is output through a preset fully connected neural network, obtaining the web category corresponding to the target packet, and then obtaining the web category sequence corresponding to the traffic sequence, and finally obtaining the corresponding web traffic recognition result. Thus, the problem that the related technology cannot distinguish the mixed traffic of multiple different web pages and cannot accurately identify all the web page categories included in the mixed traffic is solved. By performing relevant calculations on the traffic characteristics of the same web page, the distinction of the traffic characteristics of different web pages is realized, so as to realize the multi-label web traffic recognition of the entire traffic sequence.

[0021] An embodiment of the second aspect of the present invention provides a web traffic recognition device, including:

[0022] A first acquisition module, configured to acquire a target packet in a web traffic sequence;

[0023] An extraction module, configured to preprocess the target packet based on a preset convolutional neural network and extract the context local features of the target packet;

[0024] A second acquisition module, configured to calculate the relevance of the context local features through a preset self-attention mechanism, and based on the relevance, output the classification category of the target packet through a preset fully connected neural network, and obtain the web category sequence corresponding to the web traffic sequence according to the classification category of the target packet, so as to obtain the corresponding web traffic recognition result according to the web category sequence.

[0025] According to an embodiment of the present invention, the extraction module is specifically configured to:

[0026] Acquire the TCP payload size and direction sequence of the target packet;

[0027] Based on the TCP payload size and the direction sequence, perform a convolution operation on the target packet to extract the context local features of the target packet.

[0028] According to an embodiment of the present invention, the second acquisition module is specifically configured to:

[0029] Based on the preset self-attention mechanism, dynamically allocate the attention weights of the context local features;

[0030] Obtain the positional relationship and feature correlation degree between the target packet and other packets in the web traffic sequence according to the attention weights, and obtain the relevance of the context local features according to the positional relationship and the feature correlation degree.

[0031] According to an embodiment of the present invention, the second acquisition module is specifically configured to:

[0032] Learn the context local features of the target packet based on the preset fully connected neural network;

[0033] Obtain the classification category of the target packet according to the learning result and the relevance.

[0034] According to the web traffic recognition device of the embodiment of the present invention, a target packet in a web traffic sequence is obtained, preprocessed, the context local features of the target packet are extracted, the relevance of the context local features is calculated through a preset self-attention mechanism, and based on the relevance, the classification category of the target packet is output through a preset fully connected neural network to obtain the web category corresponding to the target packet, and then the web category sequence corresponding to the traffic sequence is obtained, and finally the corresponding web traffic recognition result is obtained. Thus, the problem that the related art cannot distinguish the mixed traffic of multiple different web pages and cannot accurately identify all the web page categories included in the mixed traffic is solved. By performing relevant calculations on the traffic characteristics of the same web page, the distinction of the traffic characteristics of different web pages is realized, so as to realize the multi-label web traffic recognition of the entire traffic sequence.

[0035] An embodiment of the third aspect of the present invention provides an electronic device, including: a memory, a processor, and a computer program stored on the memory and executable on the processor, and the processor executes the program to implement the web traffic recognition method as described in the above embodiment.

[0036] An embodiment of the fourth aspect of the present invention provides a computer-readable storage medium, on which a computer program is stored, and the program is executed by a processor to be used to implement the web traffic recognition method as described in the above embodiment.

[0037] An embodiment of the fifth aspect of the present invention provides a computer program product, including a computer program / instructions, characterized in that when the computer program / instructions are executed by a processor, the steps of the method as described in the above embodiment are implemented.

[0038] The additional aspects and advantages of the present invention will be given in part in the following description, become apparent in part from the following description, or be understood through the practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The above and / or additional aspects and advantages of the present invention will become apparent and be readily understood from the following description of the embodiments in conjunction with the drawings, wherein:

[0040] Figure 1It is a flowchart of a web traffic recognition method provided according to an embodiment of the present invention;

[0041] Figure 2 It is a schematic structural diagram of a local context feature extractor according to an embodiment of the present invention;

[0042] Figure 3 It is a block diagram example of a web traffic recognition device according to an embodiment of the present invention;

[0043] Figure 4 It is a schematic structural diagram of an electronic device according to an embodiment of the present invention. Specific Embodiments

[0044] The embodiments of the present invention will be described in detail below. The examples of the embodiments are shown in the accompanying drawings, where the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to explain the present invention, and should not be construed as limiting the present invention.

[0045] The web traffic recognition method, device, electronic device, and storage medium according to an embodiment of the present invention will be described below with reference to the accompanying drawings. In view of the problem that the related art in the feature engineering stage cannot distinguish the traffic of different web pages, and thus cannot accurately identify all the web pages included in the traffic, the present invention provides a web traffic recognition method. In this method, a target packet in the web traffic sequence is obtained, and the target packet is preprocessed to extract the context local features of the target packet. The relevance of the context local features is calculated through a preset self-attention mechanism, and based on the relevance, the classification category of the target packet is output through a preset fully connected neural network to obtain the web page category corresponding to the target packet, and then the web page category sequence corresponding to the traffic sequence is obtained, and finally the corresponding web traffic recognition result is obtained. Thus, the problem that the related art cannot distinguish the mixed traffic of multiple different web pages and cannot accurately identify all the web page categories included in the mixed traffic is solved. By performing relevant calculations on the traffic features of the same web page, the distinction of the traffic features of different web pages is realized, so as to realize the multi-label web traffic recognition of the entire traffic sequence.

[0046] Specifically, Figure 1 It is a schematic flow diagram of a web traffic recognition method provided according to an embodiment of the present invention.

[0047] As Figure 1 shown, the web traffic recognition method includes the following steps:

[0048] In step S101, a target packet in the web traffic sequence is obtained.

[0049] Specifically, since each TCP flow generated during the simultaneous loading of multiple web pages may contain the traffic of multiple web pages, and each packet can only be associated with one web page, therefore, in the embodiments of the present invention, to solve the problem of web page recognition for the mixed traffic of multiple web pages, each packet is recognized, that is, the target packet in the web traffic sequence is obtained, so as to finally realize the recognition of web traffic based on the recognized target packet.

[0050] In step S102, the target packet is preprocessed based on a preset convolutional neural network, and the context local features of the target packet are extracted.

[0051] According to an embodiment of the present invention, preprocessing the target packet based on a preset convolutional neural network and extracting the context local features of the target packet includes: obtaining the TCP payload size and direction sequence of the target packet; based on the TCP payload size and direction sequence, performing a convolutional operation on the target packet to extract the context local features of the target packet.

[0052] Among them, the preset convolutional neural network can be selected by those skilled in the art according to actual usage requirements, and no specific limitation is made here.

[0053] Specifically, as Figure 2 shown, for web traffic, the corresponding target packets all have two features, namely the TCP payload size and direction sequence. Therefore, in the embodiments of the present invention, the TCP payload size and direction sequence of the target packets of the entire web traffic can be extracted through a preset convolutional neural network, such as a one-dimensional convolutional neural network, and the TCP payload size and direction sequence are used as feature inputs, so that a convolutional operation can be performed on the target packet based on the TCP payload size and direction sequence, thereby extracting the context local features of the target packet.

[0054] In step S103, the relevance of the context local features is calculated through a preset self-attention mechanism, and based on the relevance, the classification category of the target packet is output through a preset fully connected neural network, and the web page category sequence corresponding to the web traffic sequence is obtained according to the classification category of the target packet, so as to obtain the corresponding web traffic recognition result according to the web page category sequence.

[0055] According to an embodiment of the present invention, calculating the relevance of the context local features through a preset self-attention mechanism includes: dynamically allocating attention weights to the context local features based on the preset self-attention mechanism; obtaining the positional relationship and feature correlation degree between the target packet and other packets in the web traffic sequence according to the attention weights, and obtaining the relevance of the context local features according to the positional relationship and feature correlation degree.

[0056] Among them, the preset self-attention mechanism can be selected by those skilled in the art according to actual usage requirements, and no specific limitation is made here.

[0057] Specifically, after obtaining the context local features of the target packet, the embodiment of the present invention needs to further extract the correlation between the context local features of the target packet, so as to better understand the temporal correlation relationship between the target packets, and further improve the overall understanding ability of the target packet sequence.

[0058] Specifically, the embodiment of the present invention uses a preset self-attention mechanism to calculate the correlation between the features of packets. Among them, the preset self-attention mechanism allows the model to dynamically allocate the attention weights of the context local features when calculating the feature representation, so as to calculate the correlation between the features of different packets, that is, to obtain the positional relationship and feature correlation degree between the target packet and other packets in the web traffic sequence according to the attention weights. The higher the attention weight, the higher the feature correlation, and the correlation of the context local features is obtained according to the positional relationship and feature correlation degree. Thus, through the above method, the temporal correlation relationship between the target packets can be better understood, thereby improving the overall understanding ability of the packet sequence.

[0059] For example, first, the embodiment of the present invention can record the context local features of the obtained target packet as the local feature sequence X. The local feature sequence X is composed of a series of vectors, and its dimension can be expressed as (n, d), where n is the sequence length and d is the dimension of the vector; second, based on the local feature sequence X, the query Q, key K, and value V of the context local features need to be calculated. They are obtained through linear transformation and can be expressed as Q = XW q , K = XW k , V = XW v , where W q , W k and W v are all parameters to be learned; third, based on the query Q and the key K, calculate the correlation scores between the context local features. The correlation is calculated by taking the dot product of the query Q and the key K, and then divided by sqrt(d k ) for scaling. The formula can be expressed as scores = QK T / sqrt(d k); Again, based on the correlation between the context local features, further calculate the attention weights weights between the context local features, which can be obtained by applying the softmax function to the attention scores, thereby ensuring that the sum of all weights is 1, and its formula can be expressed as weights = softmax(scores); Finally, further calculate the relevant feature sequence between the context local features through the attention weights obtained above. This relevant feature sequence can be calculated by applying the attention weights to the value V and then summing the calculation results, and its formula can be expressed as output = weights * V.

[0060] Thus, through the self-attention mechanism described above, the model can be allowed to focus on different parts of the input sequence to better understand and represent the sequence.

[0061] According to an embodiment of the present invention, based on the correlation, output the classification category of the target message through a preset fully connected neural network, including: based on the preset fully connected neural network, learn the context local features of the target message; obtain the classification category of the target message according to the learning result and the correlation.

[0062] Among them, the preset fully connected neural network can be selected by those skilled in the art according to actual usage requirements, and no specific limitation is made here.

[0063] Specifically, after obtaining the correlation of the context local features of the target message in the embodiment of the present invention, it is necessary to classify the context local features of the target message based on the preset fully connected neural network. Since the preset fully connected neural network is a classic deep learning model with multiple fully connected layers, therefore, the relevant features of the context local features of the above target message are used as input features, and they are processed and transformed through multiple fully connected layers, that is, learn the complex relationship between the context local features of the target message, and obtain the classification category or regression task of the target message according to the learning result and the correlation in the last output layer. Among them, the specific processing and transformation are shown in the following formula:

[0064] Y = W * X + b;

[0065] Among them, Y is the output of the fully connected layer, which is an n * 1 vector, where n is the number of neurons in the fully connected layer and also the number of output categories; W is the weight matrix, which is an n * m matrix, where n is the number of neurons in the fully connected layer and m is the dimension of the input features; X is the input feature, which is an m * 1 vector, where m is the dimension of the input features and also the relevant features of the context local features of the target message; b is the bias vector, which is an n * 1 vector, where n is the number of neurons in the fully connected layer.

[0066] It should be noted that in the above formula, W*X is matrix multiplication, which means that the input feature X is linearly transformed through the weight matrix W, and b is the bias vector, which is the result of shifting the linearly transformed result, and can make the model better fit the data. Therefore, Y = W*X + b represents that the output of the fully connected layer is the result of the input feature after linear transformation and bias shifting.

[0067] Furthermore, after the classification category of the target packet is obtained based on the learning result and correlation in the embodiment of the present invention, since the target packet corresponds to a web page one by one, therefore, the web page category sequence corresponding to the web page traffic sequence can be determined according to the classification category, and then the web page categories included in the entire web page traffic can be obtained based on the web page category sequence, that is, the corresponding web page traffic recognition result, so as to achieve accurate recognition of web page traffic when multiple web page traffics exist simultaneously, and the recognition accuracy can reach 0.91. Furthermore, the web pages actually browsed by the user can be obtained according to the recognized web page traffic.

[0068] According to the web page traffic recognition method of the embodiment of the present invention, the target packet in the web page traffic sequence is obtained, and the target packet is preprocessed, the context local features of the target packet are extracted, the correlation of the context local features is calculated through a preset self-attention mechanism, and based on the correlation, the classification category of the target packet is output through a preset fully connected neural network, the web page category corresponding to the target packet is obtained, and then the web page category sequence corresponding to the traffic sequence is obtained, and finally the corresponding web page traffic recognition result is obtained. Thus, the problem that the related technology cannot distinguish the mixed traffic of multiple different web pages and cannot accurately identify all the web page categories included in the mixed traffic is solved. By performing correlation calculations on the traffic characteristics of the same web page, the distinction of the traffic characteristics of different web pages is realized, so as to realize the multi-label web page traffic recognition of the entire traffic sequence.

[0069] Next, a web page traffic recognition device according to an embodiment of the present invention will be described with reference to the accompanying drawings.

[0070] Figure 3 It is a block diagram of the web page traffic recognition device according to the embodiment of the present invention.

[0071] As Figure 3 shown, the web page traffic recognition device 10 based on this includes: a first acquisition module 100, an extraction module 200, and a second acquisition module 300.

[0072] Among them, the first acquisition module 100 is used to acquire the target packet in the web page traffic sequence;

[0073] The extraction module 200 is used to preprocess the target packet based on a preset convolutional neural network and extract the context local features of the target packet;

[0074] A second acquisition module 300 is configured to calculate the correlation of the context local features through a preset self-attention mechanism, and based on the correlation, output the classification category of the target packet through a preset fully connected neural network, and obtain the web page category sequence corresponding to the web traffic sequence according to the classification category of the target packet, so as to obtain the corresponding web traffic recognition result according to the web page category sequence.

[0075] According to an embodiment of the present invention, the extraction module 200 is specifically configured to:

[0076] Obtain the TCP payload size and direction sequence of the target packet;

[0077] Based on the TCP payload size and direction sequence, perform a convolution operation on the target packet to extract the context local features of the target packet.

[0078] According to an embodiment of the present invention, the second acquisition module 300 is specifically configured to:

[0079] Based on a preset self-attention mechanism, dynamically allocate the attention weights of the context local features;

[0080] Obtain the positional relationship and feature correlation degree between the target packet and other packets in the web traffic sequence according to the attention weights, and obtain the correlation of the context local features according to the positional relationship and feature correlation degree.

[0081] According to an embodiment of the present invention, the second acquisition module 300 is specifically configured to:

[0082] Based on a preset fully connected neural network, learn the context local features of the target packet;

[0083] Obtain the classification category of the target packet according to the learning result and the correlation.

[0084] According to the web traffic recognition device of the embodiment of the present invention, the target packet in the web traffic sequence is obtained, and the target packet is preprocessed to extract the context local features of the target packet. The correlation of the context local features is calculated through a preset self-attention mechanism, and based on the correlation, the classification category of the target packet is output through a preset fully connected neural network to obtain the web page category corresponding to the target packet, and then the web page category sequence corresponding to the traffic sequence is obtained, and finally the corresponding web traffic recognition result is obtained. Thus, the problem that the related technology cannot distinguish the mixed traffic of multiple different web pages and cannot accurately identify all the web page categories included in the mixed traffic is solved. By performing relevant calculations on the traffic features of the same web page, the distinction of the traffic features of different web pages is realized, so as to realize the multi-label web traffic recognition of the entire traffic sequence.

[0085] Figure 4The structural schematic diagram of the electronic device provided by the embodiment of the present invention. The electronic device may include:

[0086] A memory 401, a processor 402, and a computer program stored on the memory 401 and executable on the processor 402.

[0087] When the processor 402 executes the program, it implements the web traffic recognition method provided in the above embodiment.

[0088] Further, the electronic device further includes:

[0089] A communication interface 403 for communication between the memory 401 and the processor 402.

[0090] The memory 401 is used to store a computer program executable on the processor 402.

[0091] The memory 401 may include a high-speed RAM memory, and may also include a non-volatile memory, such as at least one disk memory.

[0092] If the memory 401, the processor 402, and the communication interface 403 are implemented independently, the communication interface 403, the memory 401, and the processor 402 may be interconnected through a bus and complete communication with each other. The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 only a thick line is shown in the figure, but it does not mean that there is only one bus or one type of bus.

[0093] Optionally, in a specific implementation, if the memory 401, the processor 402, and the communication interface 403 are integrated on a chip, the memory 401, the processor 402, and the communication interface 403 may complete communication with each other through an internal interface.

[0094] The processor 402 may be a Central Processing Unit (CPU), or an Application Specific Integrated Circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention.

[0095] The embodiments of the present invention also provide a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the above-described web traffic identification method is implemented.

[0096] In the description of this specification, the descriptions with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples", etc. mean that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any one or N embodiments or examples in a suitable manner. In addition, without contradiction, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples.

[0097] In addition, the terms "first" and "second" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, the features defined with "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "a plurality" is at least two, such as two, three, etc., unless otherwise specifically defined.

[0098] Although the embodiments of the present invention have been shown and described above, it can be understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those of ordinary skill in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present invention.

Claims

1. A webpage traffic identification method, characterized in that: The following steps are involved: Obtain target messages in the webpage traffic sequence; Preprocessing the target message based on a preset convolutional neural network, and extracting contextual local features of the target message; The correlation of the local features of the context is calculated through a preset self-attention mechanism, and based on the correlation, the classification category of the target message is output through a preset fully connected neural network, and a web page category sequence corresponding to the web page traffic sequence is obtained according to the classification category of the target message, so as to obtain a corresponding web page traffic identification result according to the web page category sequence; The method of preprocessing the target message based on a preset convolutional neural network and extracting the contextual local features of the target message includes: obtaining the transmission control protocol TCP load size and direction sequence of the target message; performing a convolution operation on the target message based on the TCP load size and the direction sequence to extract the contextual local features of the target message; The method of calculating the relevance of the local context features through a preset self-attention mechanism includes: dynamically allocating attention weights of the local context features based on the preset self-attention mechanism; obtaining the positional relationship and feature correlation between the target message and other messages in the web page traffic sequence according to the attention weights, and obtaining the relevance of the local context features according to the positional relationship and the feature correlation.

2. The method according to claim 1, characterized in that The outputting the classification category of the target message based on the correlation through the preset fully connected neural network includes: Based on the preset fully connected neural network, learning the local context features of the target message; The classification category of the target message is obtained according to the learning result and the correlation.

3. A webpage traffic identification device, characterized in that: include: A first acquisition module, used to acquire a target message in a webpage traffic sequence; An extraction module, used to pre-process the target message based on a preset convolutional neural network and extract contextual local features of the target message; The second acquisition module is used to calculate the correlation of the local context features through a preset self-attention mechanism, and based on the correlation, output the classification category of the target message through a preset fully connected neural network, and obtain the web page category sequence corresponding to the web page traffic sequence according to the classification category of the target message, so as to obtain the corresponding web page traffic identification result according to the web page category sequence; The extraction module is specifically used to: obtain the TCP load size and direction sequence of the target message; based on the TCP load size and the direction sequence, perform a convolution operation on the target message to extract the contextual local features of the target message; The second acquisition module is specifically used to: dynamically allocate the attention weight of the local context feature based on the preset self-attention mechanism; obtain the position relationship and feature correlation between the target message and other messages in the web page traffic sequence according to the attention weight, and obtain the correlation of the local context feature according to the position relationship and the feature correlation.

4. The device according to claim 3, characterized in that The second acquisition module is specifically used for: Based on the preset fully connected neural network, learning the local context features of the target message; The classification category of the target message is obtained according to the learning result and the correlation.

5. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the web page traffic identification method according to any one of claims 1 to 2.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the web page traffic identification method as described in any one of claims 1-2.

7. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to claims 1-2 are implemented.

Images