A network traffic classification method based on GPM and Vision Transformer

Abstract

The application relates to a network traffic classification method based on a GPM and a Vision Transformer, and belongs to the technical field of satellite network traffic classification. The application comprises the following steps: acquiring network traffic data for training, processing the network traffic data into a gray picture; obtaining feature data of local information and global information deep fusion of the gray picture; constructing a Vision Transformer neural network and training; collecting network traffic data to be classified, processing the network traffic data into a gray picture, extracting feature data of local information and global information deep fusion, inputting the feature data into the trained Vision Transformer neural network, and obtaining a classification result. The application adopts a network traffic classification scheme combining a global perception module and a Vision Transformer, has high traffic resolution capability, can realize strong network traffic classification capability, and has high traffic classification accuracy and stability.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of satellite network traffic classification, in particular to a network traffic classification method based on GPM and VisionTransformer. BACKGROUND

[0002] Satellite networks are an important supplement and extension of ground communication networks. With the popularization of satellite services, satellite network traffic is increasing and becoming more complex, which brings severe challenges to the management and service scheduling of satellite computing power networks. Therefore, an effective network traffic classification method needs to be designed to schedule appropriate computing power resources for different types of satellite traffic and relieve the pressure on satellite networks.

[0003] Currently, traditional network traffic classification methods mainly include two categories: port-based and deep packet inspection. These two methods have good classification performance for simple network traffic. However, current network traffic generally uses port camouflage or port randomization technology, which greatly limits the application of port-based network traffic classification methods. With the development of encrypted network traffic technology, network traffic undergoes various complex encryption processes, and the characteristics of network traffic packet payloads cannot be effectively analyzed, resulting in low accuracy of deep packet inspection-based network traffic classification methods. Therefore, the limitations of traditional network traffic classification methods are becoming more and more obvious. Researchers use the official IANA list to classify traffic based on ports, and the results show that the accuracy rate is less than 70%. Experimental results show that 30%-70% of network traffic in the experiment cannot be identified using the port-based traffic classification method. In order to avoid the influence of ports on network traffic classification, some researches use the method of detecting network traffic payloads to classify P2P network traffic, which improves the classification accuracy to a certain extent. However, many network traffics currently use encryption methods, which makes it impossible to effectively extract the characteristics of network traffic.

[0004] With the rapid development of artificial intelligence technology, machine learning is applied to the field of network traffic classification. The network traffic classification method based on machine learning has stronger robustness than the network traffic classification method based on deep packet detection. However, traditional machine learning relies largely on manual feature extraction, and with the advent of deep learning technology, the network traffic classification field has ushered in a turning point. For example, some researchers have proposed a network traffic classification method based on convolutional neural network, and compared the performance with support vector machine, logistic regression, naive Bayes and deep belief network under the Android network traffic dataset. Experiments have proved the effectiveness of the convolutional neural network model. With the popularization of large model technology, the Transformer model has been applied to natural language processing and achieved good results. Subsequently, various variants of the Transformer began to be applied in various fields, and the Vision Transformer played an important role in image classification due to its powerful self-attention mechanism. Some research has proposed a malicious traffic identification method combining neural network and Vision Transformer, and achieved good results, which has proved the effectiveness of Vision Transformer in the field of malicious traffic identification.

[0005] However, the prior art has relatively weak local information processing capability when extracting features, and the processing efficiency of large images is low. In addition, there is no scheme in the prior art that combines GPM and Vision Transformer for traffic classification. SUMMARY

[0006] Therefore, the present application proposes a network traffic classification method based on GPM and Vision Transformer. The method adopts a network traffic classification scheme combining global perception module and Vision Transformer, has high traffic resolution capability, can realize strong network traffic classification capability, and has high traffic classification accuracy and stability.

[0007] To achieve the above purpose, the technical scheme adopted by the present application is:

[0008] A network traffic classification method based on GPM and Vision Transformer, comprising the following steps:

[0009] Step 1, obtaining network traffic data for training, processing the network traffic data into grayscale pictures;

[0010] Step 2, using a global perception module to extract local information and global information from each grayscale picture to obtain feature data of the local information and global information deep fusion of each grayscale picture, the data dimension of the feature data being consistent with the data dimension of the grayscale picture;

[0011] Step 3, constructing a Vision Transformer neural network;

[0012] Step 4, training the Vision Transformer neural network with the feature data obtained in Step 2 to obtain a trained Vision Transformer neural network;

[0013] Step 5, collecting network traffic data to be classified, processing it into a grayscale picture, using a global perception module to extract feature data of local information and global information deep fusion of the grayscale picture, inputting it into the trained Vision Transformer neural network to obtain a classification result.

[0014] Optionally, the specific manner of Step 1 is:

[0015] (101) using network traffic data set CRAWDAD, CRAWDAD containing 10 categories of network video traffic data samples, each data sample being a pcap format data packet, to ensure that the number of data samples of each category is basically the same, duplicating the entire category of some or all categories of data samples in CRAWDAD by two times;

[0016] (102) using SplitCap tool, according to (source IP address, source port number, destination IP address, destination port number, transmission layer protocol) five tuple, classifying the data samples according to whether they belong to the same session, obtaining all session data, wherein the data samples with source IP address and destination IP address interchanged also belong to the same session; all data in the session data are represented in hexadecimal;

[0017] (103) data screening, deleting session data with less than 10 data samples;

[0018] (104) data filling, extracting all hexadecimal data from each session data, converting each hexadecimal bit to corresponding 4-bit binary data, and using 1 byte to represent each two hexadecimal data; in addition, using zero padding or truncation to lengthen or shorten the length of the session data to 784 bytes, so as to unify all session data to the same length;

[0019] (105) for each session data, taking 1 byte as a whole, converting it to a decimal data value in the range of 0-255, representing a pixel point, so as to represent the session data in the form of a grayscale picture;

[0020] (106) converting the grayscale picture to IDX format, and storing the grayscale picture and its corresponding label separately in the disk.

[0021] Optionally, the global perception module includes a first sampling network, a first-stage multi-level feature map reorganization module, a second-stage multi-level feature map reorganization module, a third-stage multi-level feature map reorganization module, a merging network and a second sampling network, wherein the first sampling network is composed of a convolution module and the second sampling network is also composed of a convolution module; the merging network is used to merge the output features of the first-stage multi-level feature map reorganization module, the second-stage multi-level feature map reorganization module and the third-stage multi-level feature map reorganization module according to the first dimension; the first-stage multi-level feature map reorganization module, the second-stage multi-level feature map reorganization module and the third-stage multi-level feature map reorganization module have the same structure and are used to fully extract global and local information.

[0022] Optionally, the Vision Transformer neural network includes an image segmentation module, a vector stretching module, a patch embedding and position embedding module, an encoder module, and a feedforward network, wherein:

[0023] The image segmentation module is used to split the input image of shape C×H×W horizontally and vertically to obtain H / P patches of shape C×P×P, where H=W;

[0024] The vector stretching module is used to stretch the patch of shape C×P×P into one dimension to obtain a feature vector of length C*P*P;

[0025] The patch embedding and position embedding modules are used to map a feature vector of length C*P*P to a feature vector of length Dim; initialize a feature vector of length Dim to output a classification label; initialize a spatial position vector of length Dim for each feature vector to record and learn the relative position information between feature vectors; add the position feature to the feature vector, fuse the position feature and feature vector information, and finally input a feature vector of shape (H / P+1)×Dim into the encoder module;

[0026] The encoder module includes multiple encoders with the same structure connected in series. Each encoder is composed of a first normalized network, a multi-head attention mechanism module, a residual module, a second normalized network, a multi-layer perception network, and a residual network connected in sequence. The normalized network is used to normalize the neuron parameters to speed up the convergence of the model. Assume that the normalized network has d neurons and the input is Z = {z1, z2, z3, ..., z d}, then the normalization calculation process is:

[0027]

[0028] i=1,2,...,d

[0029] Wherein, u is the mean, a 2 is the variance, e is used to prevent the denominator from being 0, and parameters u and a 2 are respectively represented as:

[0030]

[0031] The residual network is used to enhance the depth and performance of the model; the multi-layer perception network is composed of 2 linear layers and 1 activation function, and the number of input and output layer neurons of the multi-layer perception network is both Dim;

[0032] The multi-head attention mechanism module has multiple taps to form multiple subspaces, which respectively pay attention to different aspects of information. Each attention pays attention to different parts of the input information, and after completing the relevant operation, it is spliced and output. Let the input sequence be X = {x1, x2,..., x d}, x d is the dth feature vector, and the linear layer has d neurons; in the linear layer, the x d vector is subjected to three linear transformations to generate q d , k d , v d vectors, and finally all vectors are spliced into vector matrices W Q , W K , W V ;

[0033] Q, K, and V are respectively:

[0034] Q = W Q X

[0035] K = W K X

[0036] V = W V X

[0037] The specific way of calculating the attention value of the multi-head attention mechanism module is:

[0038]

[0039] Wherein, the superscript T represents matrix transposition;

[0040] Finally, the attention values of multiple subspaces are combined, mapped to a vector with a length of Dim through a linear layer, and output.

[0041] The feedforward network is composed of three linear layers and two activation functions, and is used to output classification labels.

[0042] Optionally, in step 5, the network traffic data to be classified is collected and processed into a grayscale picture in the following specific manner:

[0043] Open the wireshark tool, set the filter condition: source IP address, source port number, destination IP address, destination port number, transmission layer protocol, capture the application traffic data packet between the two hosts; by setting multiple filtering conditions, the traffic packets of multiple applications are obtained and stored in different folders, so as to obtain a network traffic data set;

[0044] The data in the network traffic data set is preprocessed, including session segmentation, data screening, data filling, picture conversion, format conversion and labeling, and finally a gray picture is obtained.

[0045] The beneficial effects achieved by the above technical scheme are:

[0046] 1. The network traffic classification scheme combining the global perception module (GPM) and the VisionTransformer is adopted, the network traffic is processed into a gray picture, the global and local information of the picture is fully extracted and fused through the feature extraction module, so that the feature information is deeply utilized, and the processed feature information is input into the Vision Transformer, and the multi-head attention mechanism is used to extract the data correlation information. The method has high traffic resolution capacity, and shows good convergence and stability in the training process.

[0047] 2. The network traffic classification method has strong network traffic classification ability, high traffic classification accuracy and stability. Through comparison with common network traffic classification algorithms under existing data sets, it is shown that the classification accuracy of the method reaches 97.82%, which is improved compared with existing models.

[0048] 3. The method has high implementation efficiency, can improve the service scheduling efficiency of the satellite network, and is helpful for optimizing the satellite network computing power. DETAILED DESCRIPTION

[0049] Figure 1 It is the overall structure diagram of the network traffic classification model based on GPM-Vison Transformer in the embodiment of the application.

[0050] Figure 2 It is the traffic visualization diagram of converting the network traffic data into a gray picture in the data preprocessing process of the embodiment of the application.

[0051] Figure 3 It is the structure block diagram of GPM in the embodiment of the application.

[0052] Figure 4 It is a partial structure working principle diagram of GPM in the embodiment of the application.

[0053] Figure 5A structural block diagram of a Vison Transformer classification network in an embodiment of the present application.

[0054] Figure 6 A working principle diagram of an Encoder, a core structure of the Vison Transformer classification network in an embodiment of the present application.

[0055] Figure 7 A working principle diagram of multi-head attention of the Encoder, a core structure of the Vison Transformer classification network in an embodiment of the present application.

[0056] Figure 8 A model training performance display diagram based on a CRAWDAD dataset for training in an embodiment of the present application.

[0057] Figure 9 A classification accuracy comparison diagram of the present application and several benchmark methods under the same dataset.

[0058] Figure 10 An accuracy confusion matrix display diagram based on a CRAWDAD dataset in an embodiment of the present application. DETAILED DESCRIPTION

[0059] The present application will be further described in detail below in combination with the drawings and specific embodiments.

[0060] A network traffic classification method based on GPM and Vision Transformer, the overall process is shown in Figure 1 , including the following steps:

[0061] Step 1, obtaining network traffic data for training, processing the network traffic data into grayscale pictures; the specific way of step 1 is:

[0062] (101) using a network traffic dataset CRAWDAD, CRAWDAD contains 10 categories of network video traffic data samples, each data sample is a pcap format data packet, in order to ensure that the number of data samples of each category is basically the same, the data samples of some or all categories in CRAWDAD are duplicated for the whole category;

[0063] (102) using SplitCap tool, according to the five-tuple (source IP address, source port number, destination IP address, destination port number, transmission layer protocol), the data samples are classified according to whether they belong to the same session, and all session data are obtained, wherein the data samples with the source IP address and the destination IP address interchanged also belong to the same session; all data in the session data are represented in hexadecimal;

[0064] In network packet analysis, a session refers to a set of mutually associated packet exchanges between two network nodes in a communication process. For example, in the scenario of two people chatting using WeChat, the process of the two people sending messages to each other is actually the process of two computers sending packets to each other, and a packet can be considered as a pcap file. The pcap files generated in the chat process have the same characteristics (source IP address, source port number, destination IP address, destination port number, and transport layer protocol, referred to as five-tuple). Therefore, by collecting all packets from the beginning to the end of the chat process, all session information can be obtained.

[0065] In the CRAWDAD dataset, a category corresponds to a traffic file containing many packets (pcap files), and some of the pcap files belong to the same session. Therefore, by analyzing the pcap files one by one according to the specific identification of the five-tuple (source IP address, source port number, destination IP address, destination port number, and transport layer protocol), different session data can be obtained.

[0066] (103) Data screening is performed, and session data with less than 10 data samples are deleted;

[0067] (104) Data filling is performed, and all hexadecimal data are extracted from each session data. Each hexadecimal bit is converted to corresponding 4-bit binary data, and each two hexadecimal data is represented by 1 byte. In addition, the length of the session data is extended or shortened to 784 bytes using zero padding or truncation, so that all session data are unified to the same length;

[0068] (105) For each session data, 1 byte is taken as a whole, and converted to a decimal data value in the range of 0-255 to represent a pixel point, so that the session data is represented in the form of a grayscale image. The session data corresponding to each category is shown in Figure 2 Figure 2 The visualization features of the traffic data of each category are shown in the form of a grayscale image;

[0069] (106) The grayscale image is converted to IDX format, and the grayscale image and its corresponding label are stored separately on the disk.

[0070] Step 2, using a global perception module to extract local information and global information from each grayscale image, obtaining feature data of each grayscale image with local information and global information deep fusion, the data dimension of the feature data is consistent with the data dimension of the grayscale image.

[0071] As shown in Figure 3 ​As shown, the global perception module includes a first sampling network, a first stage multi-level feature map reorganization module, a second stage multi-level feature map reorganization module, a third stage multi-level feature map reorganization module, a merging network, and a second sampling network, wherein the first sampling network is composed of one convolution module, and the second sampling network is also composed of one convolution module; the merging network is used to merge the output features of the first stage multi-level feature map reorganization module, the second stage multi-level feature map reorganization module, and the third stage multi-level feature map reorganization module according to the first dimension; the first stage multi-level feature map reorganization module, the second stage multi-level feature map reorganization module, and the third stage multi-level feature map reorganization module have the same structure and are used to fully extract global and local information. As shown in Figure 4 .

[0072] Suppose the picture data has three dimensions, denoted as C, H, and W, and their corresponding values are 1, 28, and 28 respectively. After inputting the picture data into the GPM and extracting the features of the picture data by the GPM, the dimensions of the output data are still C, H, and W, and their values are also 1, 28, and 28 respectively. That is, the role of the GPM is to extract the features of the picture data, and the format of the final output data is consistent with the original picture data.

[0073] Step 3, construct a Vision Transformer neural network; the Vision Transformer neural network includes a picture segmentation module, a vector stretching module, a Patch embedding and position embedding module, an encoder module, and a feedforward network, and the structure of the Vision Transformer is as shown in Figure 5 .

[0074] The picture segmentation module is used to divide the input picture with a shape of CxHxW into H / P Patches with a shape of CxPxP in the horizontal direction and the vertical direction respectively, and H=W;

[0075] The vector stretching module is used to stretch the Patch with a shape of CxPxP to one dimension to obtain a feature vector with a length of C*P*P;

[0076] The Patch embedding and position embedding module is used to map the feature vector with a length of C*P*P to a feature vector with a length of Dim; an initial feature vector with a length of Dim is used to output a classification label; a spatial position vector with a length of Dim is initialized for each feature vector to record and learn the relative position information between the feature vectors; the position feature and the feature vector are added to fuse the position feature and the feature vector information, and finally the feature vector with a shape of (H / P+1)xDim is input into the encoder module;

[0077] The encoder module comprises a plurality of serially connected encoders of the same structure, each of which is composed of a first normalization network, a multi-head attention mechanism module, a residual module, a second normalization network, a multi-layer perception network and a residual network connected in sequence, and the working principle of the encoder module is as shown in Figure 6 ; wherein the normalization network is used for normalizing neuron parameters to accelerate the convergence speed of the model; assuming that there are d neurons in the normalization network and the input is Z={z1, z2, z3,..., z d}, the normalization calculation process is as follows:

[0078]

[0079] i=1, 2,..., d

[0080] wherein u is the mean, a 2 is the variance, e is used to prevent the denominator from being 0, and the parameters u and a 2 are respectively represented as:

[0081]

[0082] The residual network is used to enhance the depth and performance of the model; the multi-layer perception network is composed of 2 linear layers and 1 activation function, and the number of neurons in the input and output layers of the multi-layer perception network is Dim.

[0083] The multi-head attention mechanism module has multiple taps to form multiple subspaces, which respectively pay attention to different aspects of information, each attention pays attention to different parts of the input information, and after completing the relevant operation, the output is spliced, and the working principle of the multi-head attention mechanism is as shown in Figure 7 ; assuming that the input sequence is X={x1, x2,..., x d}, x d is the dth feature vector, and the linear layer has d neurons; in the linear layer, the x d vector is subjected to three linear transformations to respectively generate q d , k d , v d vectors, and finally all vectors are spliced into vector matrices W Q , W K , W V .

[0084] Q, K and V are respectively:

[0085] Q=W Q X

[0086] K=W K X

[0087] V=W V X

[0088] The specific way in which the multi-head attention mechanism module calculates the attention value is as follows:

[0089]

[0090] wherein the superscript T represents matrix transposition;

[0091] Finally, the attention values of the plurality of subspaces are combined, mapped through a linear layer to a vector of length Dim, and outputted;

[0092] The feedforward network is composed of three linear layers and two activation functions, and is used to output a classification label.

[0093] Step 4: training the Vision Transformer neural network using the feature data obtained in step 2 to obtain a trained Vision Transformer neural network;

[0094] Suppose the picture data has three dimensions, denoted as C, H, and W, with corresponding values of 1, 28, and 28, respectively. The working process of the Vision Transformer neural network is as follows:

[0095] (1) The picture is evenly divided into 4 small blocks horizontally and 4 small blocks vertically, resulting in 16 small image blocks with dimensions of 1, 7, and 7.

[0096] (2) The small image blocks with dimensions of 1, 7, and 7 are linearly stretched to obtain 16 vector data with a length of 49.

[0097] (3) The 16 vector data with a length of 49 are linearly mapped to obtain 16 vectors with a length of 64, with the purpose of unifying the vector length for easy access to the subsequent network structure. A new vector with a length of 64 is added and initialized. Each of the 17 vectors is assigned a spatial position vector with a length of 64, and the vector data is added to the spatial position vector data, resulting in 17 vector data with a length of 64.

[0098] (4) The 17 vector data with a length of 64 are input into the Encoder network. In this process, first, the vector data is normalized through the normalization network to normalize the neuron parameters and speed up the model convergence. Second, through the multi-head attention network, in the operation of one attention head, three keys Q, K, and V are generated first, then the correlation between Q and K is calculated and multiplied by V to output the attention value. Since there are 8 taps, the outputs of all attention heads are concatenated and outputted, and the output data is 17 vectors with a length of 64.

[0099] (5) The 17 vectors of 64 long are input to a feedforward network, which outputs a classification label, a number from 0 to 9, after passing through the network.

[0100] The disclosed CRAWDAD dataset is used in this embodiment. First, data preprocessing is performed, including session segmentation, data filtering, data padding, picture conversion, format conversion and labeling process, finally obtaining gray picture data, and a gray picture represents the data characteristics in a session process, and is divided into training set and test set according to the ratio of 9:1. After training the GPM-Vision Transformer model, the test data can be input into the model, and the model outputs a classification label.

[0101] In step 5, the network traffic data to be classified is collected and processed into a gray picture, and the global perception module is used to extract the feature data of the local information and global information of the gray picture, which is input into the trained Vision Transformer neural network to obtain the classification result.

[0102] In step 5, the network traffic data to be classified is collected and processed into a gray picture, and the specific method is:

[0103] Open the wireshark tool and set the filtering conditions: source IP address, source port number, destination IP address, destination port number, and transmission layer protocol, and capture the application traffic data packets between the two hosts; By setting multiple filtering conditions, the traffic packets of multiple applications are obtained and stored in different folders, thereby obtaining a network traffic dataset;

[0104] The data in the network traffic dataset is preprocessed, including session segmentation, data filtering, data padding, picture conversion, format conversion and labeling, finally obtaining a gray picture.

[0105] Figure 8 The training performance of the GPM-Vision Transformer model is shown, and the loss value of the model training process decreases sharply, showing strong ability to learn new data features. Figure 9 The average classification accuracy of each model is shown, and in the model training stage, the average classification accuracy of the GPM-Vision Transformer model increases sharply. Around the 20th training round, the average classification accuracy reaches 90%, which is greatly improved compared with the benchmark model. In the model convergence stage, the average classification accuracy of the GPM-Vision Transformer model reaches 97.82%, which is much higher than that of the benchmark model. Figure 10The classification accuracy of the Vision Transformer model for each type of sample is shown. Except for the classification accuracy of traffic such as Google Hangouts, which is around 93%, the classification accuracy of other categories reaches more than 96%, and the highest reaches 100%.

[0106] In summary, the network traffic classification scheme adopted by the present invention, which combines the global perception module and the Vision Transformer, has high traffic resolution capability, can achieve stronger network traffic classification capability, and has high traffic classification accuracy and stability.

Claims

1. A network traffic classification method based on GPM and Vision Transformer, characterized in that: The following steps are involved: Step 1: Obtain network traffic data for training and process the network traffic data into grayscale images; Step 2: Use the global perception module to extract local information and global information from each grayscale image to obtain feature data that is a deep fusion of local information and global information of each grayscale image. The data dimension of the feature data is consistent with the data dimension of the grayscale image. Step 3: Build the Vision Transformer neural network. Step 4: Use the feature data obtained in step 2 to train the Vision Transformer neural network to obtain a trained Vision Transformer neural network; In step 5, the network traffic data to be classified is collected and processed into a grayscale image. The global perception module is used to extract the feature data of the deep fusion of local information and global information of the grayscale image, and the feature data is input into the trained Vision Transformer neural network to obtain the classification result.

2. A network traffic classification method based on GPM and Vision Transformer according to claim 1, characterized in that: The specific method of step 1 is: (101) Using the network traffic dataset CRAWDAD, CRAWDAD contains 10 categories of network video traffic data samples. Each data sample is a data packet in pcap format. To ensure that the number of data samples in each category is basically the same, the data samples of some or all categories in CRAWDAD are copied and doubled. (102) Using the SplitCap tool, data samples are classified according to whether they belong to the same session based on the five-tuple (source IP address, source port number, destination IP address, destination port number, and transport layer protocol), and all session data are obtained. Among them, data samples with the source IP address and destination IP address swapped also belong to the same session; all data in the session data are expressed in hexadecimal; (103) Perform data screening and delete session data with less than 10 data samples; (104) Perform data padding, extract all hexadecimal data from each session data, convert each hexadecimal digit into corresponding 4-bit binary data, and represent every two hexadecimal data with 1 byte; in addition, use zero padding or truncation to extend or shorten the length of the session data to 784 bytes, so as to unify all session data to the same length; (105) For each session data, one byte is converted as a whole into a decimal data value in the range of 0 to 255, representing one pixel, thereby representing the session data in the form of a grayscale image; (106) Convert the grayscale image into IDX format, and store the grayscale image and its corresponding label separately on the disk.

3. A network traffic classification method based on GPM and Vision Transformer according to claim 1, characterized in that: The global perception module includes a first sampling network, a first-stage multi-level feature map reorganization module, a second-stage multi-level feature map reorganization module, a third-stage multi-level feature map reorganization module, a merging network, and a second sampling network, wherein the first sampling network is composed of a convolution module, and the second sampling network is also composed of a convolution module; the merging network is used to merge the output features of the first-stage multi-level feature map reorganization module, the second-stage multi-level feature map reorganization module, and the third-stage multi-level feature map reorganization module according to the first dimension; the first-stage multi-level feature map reorganization module, the second-stage multi-level feature map reorganization module, and the third-stage multi-level feature map reorganization module have the same structure and are used to fully extract global and local information.

4. A network traffic classification method based on GPM and Vision Transformer according to claim 1, characterized in that: The Vision Transformer neural network includes an image segmentation module, a vector stretching module, a patch embedding and position embedding module, an encoder module, and a feedforward network, wherein: The image segmentation module is used to split the input image of shape C×H×W horizontally and vertically to obtain H / P patches of shape C×P×P, where H=W; The vector stretching module is used to stretch the patch of shape C×P×P into one dimension to obtain a feature vector of length C*P*P; The patch embedding and position embedding modules are used to map a feature vector of length C*P*P to a feature vector of length Dim; initialize a feature vector of length Dim to output a classification label; initialize a spatial position vector of length Dim for each feature vector to record and learn the relative position information between feature vectors; add the position feature to the feature vector, fuse the position feature and feature vector information, and finally input a feature vector of shape (H / P+1)×Dim into the encoder module; The encoder module includes multiple encoders with the same structure connected in series. Each encoder is composed of a first normalized network, a multi-head attention mechanism module, a residual module, a second normalized network, a multi-layer perception network, and a residual network connected in sequence. The normalized network is used to normalize the neuron parameters to speed up the convergence of the model. Assume that the normalized network has d neurons and the input is Z = {z1, z2, z3, ..., z d }, then the normalization calculation process is: Among them, u is the mean, a 2 is the variance, e is used to prevent the denominator from being 0, and the parameters u and a 2 Respectively expressed as: The residual network is used to enhance the depth and performance of the model; the multi-layer perception network consists of two linear layers and one activation function, and the number of neurons in the input and output layers of the multi-layer perception network is Dim; The multi-head attention mechanism module has multiple taps, forming multiple subspaces, focusing on different aspects of information. Each attention focuses on a different part of the input information. After completing the relevant operations, the splicing output is performed. Suppose the input sequence is X = {x1, x2, ..., x d }, x d is the dth eigenvector, and there are d neurons in the linear layer; in the linear layer, x d The vector undergoes three linear transformations to generate q d 、k d 、v d Three vectors, finally all vectors are spliced ​​into vector matrix W Q 、W K 、W V ; Q, K, and V are: Q=W Q X K=W K X V=W V X The specific way in which the multi-head attention mechanism module calculates the attention value is: Where, the superscript T represents the matrix transpose; Finally, the attention values ​​of multiple subspaces are merged, mapped to a vector of length Dim through a linear layer and output; The feedforward network consists of three linear layers and two activation functions to output classification labels.

5. The network traffic classification method based on GPM and Vision Transformer according to claim 1 is characterized in that: In step 5, the network traffic data to be classified is collected and processed into grayscale images. The specific method is as follows: Open the Wireshark tool, set the filtering conditions: source IP address, source port number, destination IP address, destination port number, and transport layer protocol, and capture the application traffic data packets between the two hosts; By setting multiple filtering conditions, traffic packages of multiple applications are obtained and stored in different folders, thus obtaining a network traffic data set; The data in the network traffic dataset is preprocessed, including session segmentation, data filtering, data filling, image conversion, format conversion and labeling, and finally a grayscale image is obtained.

Images