Two-stage encrypted traffic classification method for programmable switches

Abstract

The present invention discloses a two-stage encrypted traffic classification method for programmable switches, which relates to the field of computer network technology and comprises the following steps: extracting semantic features and statistical feature sequences of input traffic on the switch data plane and performing preprocessing; inputting the semantic features into a matching-action pipeline and matching them with a convolutional neural network model classification table issued by a server, and obtaining a traffic category based on the semantic features if there is a match; if there is no match, inputting the statistical feature sequence into the matching-action pipeline and matching it with a long-short-term memory model classification table, obtaining a matching result for each statistical feature respectively, and performing a bitwise AND operation on them to obtain a traffic category based on the statistical features; executing a traffic decision action based on the traffic category; the encrypted traffic classification method aims to design and implement a network model for encrypted traffic classification and deploy it to a switch, thereby realizing a low-latency, low-load, high-precision and high-availability encrypted traffic classification scheme running on the switch.

Description

Technical Field

[0001] The present invention relates to the technical field of computer networks, and in particular to a two-stage encrypted traffic classification method for programmable switches. Background Art

[0002] With the widespread use of the internet and the rapid development of network technology, network traffic is experiencing explosive growth. To protect user privacy and data security, more and more network communications are adopting encrypted transmission. While encrypted transmission offers enhanced security, traditional network management tools are unable to decipher encrypted data packets, making encrypted traffic opaque to network administrators. This poses challenges to network management and network security. Many malware and network attacks can hide in encrypted traffic, making them difficult to detect by traditional security detection methods.

[0003] To address this issue, encrypted traffic classification is crucial. Encrypted traffic classification involves analyzing encrypted data and inferring basic information, such as application type, data type, and whether it represents a network attack. By using encrypted traffic classification, network administrators can better analyze, monitor, and troubleshoot networks, promptly identifying abnormal traffic and potential security threats.

[0004] Traditional traffic classification methods include port number classification, deep packet inspection, and the use of machine learning and deep learning to extract network flow characteristics such as flow duration, packet inter-arrival time, and packet size, and then build models for training. Common machine learning models include support vector machines, decision trees, and random forests, while deep learning models include convolutional neural networks, recurrent neural networks, and graph neural networks. While these methods can achieve good classification results, their application requires sending traffic from the data plane to the server where the classification system is deployed, resulting in high latency and significantly reduced throughput. Therefore, these solutions are difficult to implement efficiently and widely.

[0005] With the introduction of protocol-independent switching architectures (PISAs) and P4 switches, data plane programmability has revolutionized networking and brought numerous benefits. PISA aims to achieve high-performance, flexible, and scalable packet processing. PISA's design philosophy decouples packet processing from the protocols used, providing a universal switching platform capable of seamlessly translating and interacting across diverse network environments and protocols. This progress has led to a growing number of researchers considering integrating traffic classification systems with or deploying them directly in the data plane to achieve line-rate traffic classification and significantly improve the overall solution's usability.

[0006] However, the limitations of the data plane cannot be ignored. First, the data plane has limited memory resources, which restricts the scale and complexity of traffic classification models. Second, the data plane only supports simple operations, which means that the complexity and efficiency of operations must be considered when designing traffic classification schemes. These limitations make the design of accurate traffic classification models and their efficient deployment in the data plane a hot research topic.

[0007] Currently, data-plane-based encrypted traffic classification methods fall into two main categories. The first utilizes programmable switches in the data plane for feature extraction and processing, then sends the processed data to a model deployed in the control plane for classification. The classification results are then sent back to the data plane for traffic classification decisions. While this approach reduces the amount of communication between the control and data planes, it still cannot achieve line-speed processing. The second approach deploys the model or its classification results in the data plane. One approach involves deploying a binary neural network model in the data plane. The parameters of this model consist of 0s and 1s, and the forward pass of the model involves only addition and bitwise operations, making it suitable for direct deployment in the data plane. However, due to value limitations, this model currently has limited learning capabilities and is only capable of simple classification tasks. The second approach involves encoding the branches of a tree (decision tree or random forest) model into table entries and sending them to the data plane, thereby implementing a traffic classification solution running in the data plane. However, tree models still lag significantly behind deep learning models in processing complex data, representing highly abstract features, and handling large amounts of data. Summary of the Invention

[0008] Based on the technical problems existing in the background technology, the present invention proposes a two-stage encrypted traffic classification method for programmable switches, aiming to realize a network model for encrypted traffic classification and deploy it to the switch, so as to achieve a low-latency, low-load, high-precision and high-availability encrypted traffic classification scheme running on the switch.

[0009] The two-stage encrypted traffic classification method for programmable switches proposed in the present invention includes the following steps:

[0010] Step 1: The switch data plane extracts the semantic features and statistical feature sequences of the input traffic and performs preprocessing;

[0011] Step 2: Input the preprocessed semantic features into the matching-action pipeline and match them with the convolutional neural network model classification table sent by the server. If a match is found, a traffic category based on the semantic features is obtained. If a match is found, the statistical features stored in the register corresponding to the flow identifier of the semantic feature are obtained, and multiple statistical features are collected to obtain a statistical feature sequence of a set length.

[0012] Step 3: Input the preprocessed statistical feature sequence into the matching-action pipeline and match it with the long short-term memory model classification table sent by the server to obtain a statistical classification result set. Perform a bitwise AND operation on the classification results in the classification result set to obtain a matching result for each statistical feature. The matching results are then bitwise ANDed to obtain a traffic category based on the statistical feature sequence. The server does not directly participate in the real-time traffic classification of the switch, but instead trains the neural network model offline and sends the classification results of the trained neural network model to the switch table through the p4runtime interface. The switch classification program does not need to be suspended during the delivery.

[0013] Step 4: Execute traffic decision actions using the traffic categories based on semantic features and the traffic categories based on statistical feature sequences.

[0014] Furthermore, in step 1, the switch data plane extracts the semantic features and statistical feature sequences of the input traffic and performs preprocessing, specifically:

[0015] For each input data packet, the five-tuple of the data packet is first extracted and stored in metadata, which is used to mark the data packets of different session flows. The five-tuple includes the source IP address, destination IP address, source port, destination port, and transport layer protocol.

[0016] The P4 language hash function is used to calculate the five-tuple to obtain the flow identifier. The relevant characteristics and information of the data flow are stored in the corresponding register according to the flow identifier.

[0017] In the handshake phase, semantic features are extracted from the plaintext information in each data packet, and the semantic features are pre-processed and stored in a register marked with a five-tuple;

[0018] Downsampling the semantic features: segment the semantic features and calculate the average value of each segment. Reconstruct the semantic features based on the average value of each segment to obtain the preprocessed semantic features.

[0019] When the message type of the TLS record protocol is "Finished", the handshake phase ends. Next, the statistical features of the data packets in the secure data transmission phase are recorded and updated in real time. A preset timer is maintained. When the number of statistical packets reaches a preset number, the statistical features are stopped from being updated. The statistical features are pre-processed and stored in a register marked with a five-tuple.

[0020] Preprocess the statistical feature sequence: According to the random forest algorithm, the importance scores of the statistical feature sequence on the classification are obtained in advance and arranged in descending order. The m statistical features with the top m importance scores are taken to obtain a statistical feature sequence of length m. Each feature in the statistical feature sequence of length m is scaled to obtain the preprocessed statistical feature sequence.

[0021] Furthermore, in step 2, the convolutional neural network model classification table and the long short-term memory model classification table sent by the server are output by the neural network model after offline training and pre-inference. The neural network model includes a convolutional neural network model and a long short-term memory model. The convolutional neural network model is used to process semantic features, and the long short-term memory model is used to process statistical features. The training and inference process of the network model are as follows:

[0022] Constructing a training data set, wherein the training data set includes semantic features and statistical features, performing feature transformation and downsampling on the semantic features to obtain a semantic feature grayscale image, and performing feature screening and feature scaling on the statistical features to obtain a statistical feature sequence;

[0023] The semantic features and statistical feature sequences of the training data set are used to train the convolutional neural network model and the long short-term memory model respectively. After completing the training of the convolutional neural network model and the long short-term memory model, the semantic feature grayscale image of the training set is input into the convolutional neural network model, and the correspondence between the semantic feature grayscale image and the data stream category is output and encoded as a convolutional neural network model classification table; all values ​​in the statistical feature space are input into the long short-term memory model, and the correspondence between the statistical feature sequence and the data stream category is obtained, which is encoded as a long short-term memory model classification table.

[0024] Furthermore, the construction and preprocessing process of the training dataset on the server is as follows:

[0025] The encrypted traffic dataset is divided into data streams based on five-tuples. Data packets with the same five-tuple are merged into one data stream in chronological order. This stream serves as the basic unit for network model training. The five-tuple includes the source IP address, destination IP address, source port, destination port, and transport layer protocol.

[0026] In the handshake phase, the semantic features of each data stream are extracted, and the original payload of the semantic features is converted into a two-dimensional grayscale image. The two-dimensional grayscale image is downsampled to obtain a semantic feature grayscale image.

[0027] After the data packet in the handshake phase is completed, the statistical features of the first n data packets in the secure data transmission phase are extracted to obtain a statistical feature sequence of length n;

[0028] A random forest model is constructed based on the training data set. The classification results of each decision tree in the random forest model are used to perform feature screening on a statistical feature sequence of length n to obtain a statistical feature sequence of length m, where m≤n.

[0029] Based on a preset scaling factor r, each eigenvalue in a statistical feature sequence of length m is scaled to obtain a scaled statistical feature sequence.

[0030] Furthermore, the pre-inference, distribution and classification process after the convolutional neural network model is trained:

[0031] The semantic features in the training set are input into the trained convolutional neural network model. After inference, the convolutional neural network model outputs the traffic category corresponding to each semantic feature grayscale image.

[0032] The correspondence between the semantic feature grayscale image and the data stream category is encoded into a convolutional neural network model classification table and sent to the switch through the p4runtime interface;

[0033] During the real-time traffic classification process, the semantic features of some traffic will directly hit the result set of the convolutional neural network model to obtain the category of the data flow. The hit traffic will no longer enter the second stage matching process.

[0034] Furthermore, the pre-inference, distribution and classification process after the long short-term memory model is trained:

[0035] For the trained LSTM model, exhaustively enumerate the feature space value combinations of the statistical features. For each feature space value, use the LSTM model to infer the correspondence between the statistical feature sequence and the data stream category, and encode it into a temporary LSTM model classification table. The number of entries in the temporary LSTM model classification table is the product of the value ranges of each feature in the statistical feature sequence.

[0036] For each value of each element in the statistical feature sequence, all possible classification results are counted in the temporary long short-term memory model classification table as the matching content of the statistical sub-table item corresponding to each element, and the matching contents of all elements corresponding to the statistical sub-table items are summarized to obtain the statistical total table item;

[0037] The total statistical table entries are used as a long-short-term memory model classification table and sent to the switch table entries.

[0038] The advantages of the two-stage encrypted traffic classification method for programmable switches provided by the present invention are: the two-stage encrypted traffic classification method for programmable switches provided in the structure of the present invention aims to design a network model for implementing encrypted traffic classification and deploy it to the switch, thereby realizing a low-latency, low-load, high-precision and high-availability encrypted traffic classification solution running on the switch. Its advantages are:

[0039] 1) Compared with the solution running on a combination of a server, a switch, and a server, the traffic classification process of this embodiment is completely performed on the switch, which has strong real-time performance and application value.

[0040] 2) This embodiment implements a network model for encrypted traffic classification and sends the corresponding switch table entries to the switch. Compared to traditional machine learning models and binary neural network models, this model has stronger learning capabilities and can theoretically achieve higher classification accuracy.

[0041] 3) This embodiment analyzes the transmission process of encrypted traffic, utilizing the semantic features of the handshake phase and the statistical features of the secure data transmission phase. Compared with the current switch-based encrypted traffic classification scheme, it has stronger explainability and comprehensiveness.

[0042] 4) This embodiment is implemented using the standard P4 language in the switch and is applicable to all switch devices that support P4, with high versatility. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 It is a schematic diagram of the process of the present invention;

[0044] Figure 2 This is the overall architecture diagram of the present invention;

[0045] Figure 3 This is an example diagram of the CNN model structure parameters of the present invention;

[0046] Figure 4 This is an example diagram of the LSTM model structure parameters of the present invention. DETAILED DESCRIPTION

[0047] The technical solutions of the present invention are described in detail below through specific embodiments. Numerous specific details are set forth in the following description to facilitate a full understanding of the present invention. However, the present invention can be implemented in many other ways than those described herein, and those skilled in the art may make similar modifications without departing from the scope of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0048] Currently, there are many solutions for switch-based traffic classification, but none of them consider or implement the deployment of deep learning models on switches. For deep learning models, their training and operation processes are relatively more complex, making them difficult to run directly on programmable switches. However, they have strong learning capabilities and potential, and can achieve better classification results than traditional machine learning. Therefore, the purpose of this invention is to design a solution for encrypted traffic classification using deep learning models and implement it on switches. The key is how to design a high classification accuracy and complete the delivery of the entire model result set with as little loss of accuracy as possible under the computing and memory limitations of the switch. The details are explained below.

[0049] like Figures 1 to 4 As shown, this embodiment proposes a two-stage encrypted traffic classification method for programmable switches, including the following steps:

[0050] Step 1: The switch data plane extracts the semantic features and statistical feature sequences of the input traffic and performs preprocessing;

[0051] Step 2: Input the semantic feature into the matching-action pipeline and match it with the convolutional neural network model classification table sent by the server. If a match is found, a traffic category based on the semantic feature is obtained. If a match is not found, the statistical features stored in the register corresponding to the flow identifier of the semantic feature are obtained, and multiple statistical features are collected to obtain a statistical feature sequence of a set length.

[0052] Step 3: Input the statistical feature sequence into the match-action pipeline and match it with the long-short-term memory model classification table sent by the server to obtain a set of statistical classification results. The classification results in the classification result set are bitwise ANDed together to obtain matching results for each statistical feature. These matching results are then bitwise ANDed together to obtain a traffic category based on the statistical feature sequence. The server does not directly participate in the switch's real-time traffic classification. Instead, it trains the neural network model offline and sends the classification results of the trained neural network model to the switch table via the p4runtime interface. Therefore, the switch classification process does not need to be suspended during the delivery.

[0053] Step 4: Execute traffic decision actions using the traffic categories based on semantic features and the traffic categories based on statistical feature sequences.

[0054] Through steps 1 to 4, a network model for encrypted traffic classification is implemented and deployed on the switch data plane, achieving a low-latency, low-load, high-precision, and high-availability encrypted traffic classification solution running on the switch data plane. Its advantages are: 1) Compared to existing solutions that run on a combination of servers and switches, the traffic classification process in this embodiment is performed entirely on the switch data plane, resulting in greater real-time performance and application value. 2) This embodiment implements a network model for encrypted traffic classification and distributes the corresponding data plane table entries (the convolutional neural network model classification table and the long-short-term memory model classification table) to the switch data plane. Compared to traditional machine learning models and binary neural network models, this embodiment has stronger learning capabilities and can theoretically achieve higher classification accuracy. 3) This embodiment analyzes the encrypted traffic transmission process, leveraging semantic features during the handshake phase and statistical features during the secure data transmission phase. Compared to existing data plane-based encrypted traffic classification solutions, it is more interpretable and comprehensive. 4) This embodiment utilizes the standard P4 language for implementation on the data plane, making it applicable to all P4-supported data plane devices, including switches and smart network cards, and highly versatile. The details are explained below.

[0055] The encrypted traffic classification method proposed in this embodiment is divided into network model training on the server side and matching classification of online traffic processing on the switch data plane.

[0056] (A) The server does not directly participate in real-time traffic classification. Instead, it trains the network model offline and sends the convolutional neural network model classification table and the long short-term memory model classification table to the switch. Therefore, the following description of the data in the server mainly focuses on how to construct a training dataset through data streams to train the network model located in the server.

[0057] A1 Data Flow Division

[0058] In this embodiment, traffic classification is based on data flows. Therefore, the encrypted traffic dataset must first be segmented into data flows. This segmentation is based on a five-tuple: the source IP address, destination IP address, source port, destination port, and transport layer protocol. Packets with the same five-tuple are merged into a single data flow in chronological order, serving as the basic unit for classification and feature extraction.

[0059] A2 Extracting Semantic Features

[0060] The transmission of encrypted traffic occurs in two phases: the handshake phase and the secure data transmission phase. Because the handshake phase is plaintext, semantic features can be directly extracted for traffic classification. The original payload of the handshake phase, such as the cipher suite and protocol extension fields in the Client Hello packet, is extracted from the data packet as semantic features.

[0061] Feature transformation of A3 semantic features

[0062] For the extracted semantic features, each byte has a value range of 0 to 255, the same as the value range of grayscale image pixels. Therefore, we convert the original semantic feature payload into a two-dimensional grayscale image in bytes, so that the subsequent CNN model can process the extracted semantic features.

[0063] A4 Downsampling of Semantic Features

[0064] For the two-dimensional grayscale image obtained by feature transformation, each pixel contributes differently to the model, and the feature space relatively exceeds the expected value. Therefore, downsampling is required. Specifically, downsampling involves segmenting the semantic features and calculating the average value of each segment. The semantic features are reconstructed based on the average value of each segment to obtain the preprocessed semantic features. The averaging operation is implemented using addition and logical right shift in the p4 language, which requires that the number of bytes in each segment is an integer power of 2. This embodiment preprocesses the semantic features through downsampling to simplify the features and reduce their spatial size so that the classification result set can be fully stored in the table entries of the data plane programmable switch while preserving the data's translation invariance. This operation can be performed on the server side by directly adding an a*b maximum / average pooling layer before the first layer of the convolutional neural network model (CNN model). This reduces the feature space by a*b times, thereby obtaining the semantic feature grayscale image. The specific values ​​of a and b are determined based on the processing power of the switch and the expected accuracy. The value of a*b must be a power of 2. Because the p4 language does not support division operations, only bitwise operations can be used instead.

[0065] A5 convolutional neural network model training

[0066] Semantic features are transformed through A3 and A4 to obtain a grayscale image of the semantic features. A convolutional neural network model (CNN model) is then constructed for training. The convolutional neural network model consists of convolutional layers, pooling layers, and fully connected layers. The output of the convolutional layer is connected to the input of the pooling layer to form a layer unit. Multiple layer units are connected in sequence and then connected to the fully connected layer. The output of the current layer unit is connected to the input of the next layer unit, and the output of the last layer unit is connected to the input of the fully connected layer.

[0067] The forward operation of CNN model training is divided into the following steps:

[0068] A5.1: For semantic feature x se Through the feature transformation and downsampling operation of A3 and A4, the semantic feature grayscale image f1(x se ) as the input of the convolutional neural network model;

[0069] A5.2: The convolutional layer output feature Conv in the first layer unit 1 , the pooling layer output feature a in the first layer unit 2 ;

[0070] Conv 1 =ReLU(z l )=ReLU(f1(x se )*w 1 +b 1 )

[0071] a 2 =z 2 =pooling(Conv 1 )

[0072] Among them, w 1 represents the weight matrix of the lth layer, * represents the convolution operation, b 1 Represents the bias term of the first layer, ReLU represents the activation function, pooling represents the pooling operation, Conv 1 represents the output of the corresponding convolutional layer.

[0073] A5.3: Input the features output by the pooling layer of the last layer unit into the fully connected layer to output the first feature result F cu ;

[0074] Fc cu =σ(z u )=σ(W u a u-1 +b u )

[0075] Among them, σ represents the activation function, W u represents the weight matrix of the u-th layer, a u-1 represents the output of the u-1th pooling layer, b u Represents the bias term of the u-th layer, where the u-th layer is a fully connected layer.

[0076] It should be noted that CNN has n layers, where the convolution layer, activation layer and pooling layer (optional) are used as a convolution layer unit. After passing through several such units, the features output by the pooling layer of the last layer unit are input to the fully connected layer. The fully connected layer is also divided into several layers, which are connected end to end in sequence. The output of the last layer is the probability of the model inferring the data stream under each class label. The maximum probability is the category of this data stream. An example of a CNN model suitable for this embodiment is as follows: Figure 3 As shown in the figure, it contains three convolutional layers and two fully connected layers. The specific model parameters and structure depend on the classification task and training data.

[0077] A6 Model Inference: Traversing Training Set Features

[0078] For a trained CNN model, inference operations must be performed on the dataset beforehand. The switch then directly uses the inference results for matching, replacing the CNN model's forward computation. The semantic features used in this process represent the entire training dataset. After processing in steps A3 and A4, the feature space is significantly reduced. The two-dimensional grayscale images generated by the semantic features of data flows of the same category will have a high degree of overlap. Therefore, during the switch's real-time traffic classification, the processed semantic features of some data flows will directly match the result set, directly generating a correspondence between the semantic feature grayscale image and the data flow category. These matching semantic features will no longer enter the secure data transmission phase. For data flows that do not match, operations A8 through A14 are performed below.

[0079] A7 CNN model inference result set delivery

[0080] The correspondence between the semantic feature grayscale image and the data stream category obtained in A6 is encoded into a convolutional neural network model classification table. The number of keys in each table is equal to the number of pixels in the semantic feature grayscale image. Specifically, the value of each pixel in the semantic feature grayscale image serves as a key, and the category serves as the table entry. When all the keys match, the corresponding category for this stream is matched.

[0081] A8 Extract statistical features

[0082] During the second phase of the data flow, the encrypted secure data transmission phase, the specific transmission content is unknown. However, statistical features of multiple data packets can be extracted, such as a sequence of packet lengths, for classification. Each data flow varies in length. The statistical features of the first n packets during the secure data transmission phase are taken to obtain a statistical feature sequence of length n. Data flow features exceeding n are truncated, while data flows less than n are padded with zeros to obtain a statistical feature sequence of length n.

[0083] Preprocessing of statistical features: feature screening and feature scaling.

[0084] A9 feature screening

[0085] The feature space of the statistical sequence features of length n obtained in A8 exceeds expectations, and the contribution of the length information at each position in the sequence to the long short-term memory (LSTM) model is different. Therefore, a method of ranking and screening features by importance is adopted. The principle is to construct a random forest model using the data from the training dataset, treating each length information as a separate feature. Each decision tree in the random forest randomly selects different features. The importance of the features is determined based on the classification accuracy of each tree and assigned an importance score. Based on the obtained scores, the m most important statistical features are selected to obtain a statistical feature sequence of length m, where m ≤ n. The specific value of m depends on the storage capacity of the switch and the expected classification accuracy. A larger m increases the feature space and requires more table storage space, but this also improves the model classification performance. Figure 2 In this example, the four most important length information are selected to reconstruct a statistical feature sequence with a length of m = 4 as the input for the next step.

[0086] A10 Feature Scaling

[0087] For the statistical feature sequence of length m obtained in A9, each feature in the statistical feature sequence is scaled by multiplying or dividing its value by a scaling factor r. This step further reduces the feature space, reducing the multiplication factor to rm. Note that because the switch does not support division, the scaling factor selected here must be an integer power of 2. This allows the switch to use shift operations instead of division to obtain the scaled statistical feature sequence as input to the LSTM model.

[0088] A11 LSTM model training

[0089] For the statistical feature x st The statistical feature sequence f2(x st ), build an LSTM model for training. The long short-term memory model includes several units consisting of input gates, forget gates, cell states and output gates. The number of units is equal to f2(x st ). The output gate of the last unit is connected to the fully connected layer. The fully connected layer is also divided into several layers, which are connected end to end in order. The output of the last layer is the probability of the model inferring each class label for the data stream. The highest probability is the class of this data stream. The forward propagation process of the LSTM at each time step t occurs in the following order:

[0090] A11.1: Based on the statistical characteristic data f2(x st ) Update the forget gate output f (t) :

[0091] f (t) =σ(Wf h (t-1) +U f x (t) +b f )

[0092] Among them, σ(·) represents the activation function, W f represents the weight matrix connecting the hidden state of the previous time step, h (t-1) Represents the value of the hidden state at the previous time step, h 0 =f2(x st ), U f Represents the weight matrix of the statistical features after the current time step input scaling, b f represents the bias vector, x (t) Represents the scaled statistical characteristics of the input at the current time step t;

[0093] A11.2: Update input gate i (t) and its controlled object a (t) :

[0094] i (t) =σ(W i h (t-1) +U i x (t) +b i )

[0095] Among them, W i represents the weight matrix connecting the hidden state of the previous time step, h (t-1) Represents the value of the hidden state at the previous time step, U i Represents the weight matrix of the statistical features after the current time step input scaling, b i represents the bias vector;

[0096] a (t) =tanh(W a h (t-1) +U a x (t) +b a )

[0097] Among them, W a represents the weight matrix connecting the hidden state of the previous time step, h (t-1) Represents the value of the hidden state at the previous time step, U a Represents the weight matrix of the statistical features after the current time step input scaling, b a represents the bias vector;

[0098] A11.3: Update cell state C (t) :

[0099] C (t) =C(t-1) ⊙f (t) +a (t) ⊙i (t)

[0100] Among them, C (t-1) represents the state of the memory unit at the previous time step, ⊙ represents the element-by-element product, f (t) represents the output of the forget gate, a (t) Represents the output of the control object of the input gate, i (t) represents the output of the input gate;

[0101] A11.4: Update output gate o (t) and its controlled object h (t) :

[0102] o (t) =σ(W o h (t-1) +U o x (t-1) +b o )

[0103] Among them, W o represents the weight matrix connecting the hidden state of the previous time step, h (t-1) Represents the value of the hidden state at the previous time step, U o represents the weight matrix connecting the input of the current time step, b o represents the bias vector, x (t-1) Represents the scaled statistical features of the input at the previous time step t-1;

[0104] h (t) =o (t) ⊙tanh(C (t) )

[0105] Among them, (t) represents the output of the output gate, ⊙ represents the element-wise product, C (t) Indicates the state of the memory unit;

[0106] A11.5: Set the output h of the control object of the output gate (t) As the input of the fully connected layer, the correspondence between the output statistical feature sequence and the data stream category is encoded as a long short-term memory model classification table.

[0107] Fc tr =σ(z r )=σ(W r a r-1 +b r )

[0108] Among them, r represents the rth layer of the LSTM model, σ represents the activation function, and W rrepresents the weight matrix of the rth layer, b r represents the bias term of the rth layer, a rr1 Represents the output of the r-1th layer. When r-1 is equal to t, a rr1 That is the output gate o of the last unit (t) , when r-1 is greater than t, a r-1 That is the output Fc of the previous fully connected layer tr-1 .

[0109] The output of the last fully connected layer is the probability of the LSTM model inferring the data stream under each class label, and the maximum probability is the category of this data stream. An example of an LSTM model suitable for this embodiment is as follows Figure 4 As shown, three fully connected layers are connected in sequence after the last time step of LSTM

[0110] A12 Model Inference: Exhaustive Statistical Feature Space

[0111] For the trained LSTM model, exhaustively search for combinations of statistical feature values ​​in the feature space. For each value, use the LSTM model to infer the corresponding category. Because the feature space was significantly reduced in steps a9 and a10 above, the number of exhaustive feature combinations and the overall exhaustive process time are within the expected acceptable range. This step yields a correspondence between the statistical feature sequence and the data stream category, which is encoded into a temporary long-short-term memory model classification table.

[0112] A13 inference result statistics

[0113] For the temporary long-short-term memory model classification table obtained in a12, the number of table entries is the product of the value range of each element in the statistical feature sequence. A single matching table of the switch cannot accommodate so many table entries, so a split table operation is required. For each value of each element in the statistical feature, all possible corresponding values ​​are counted in the temporary long-short-term memory model classification table as the matching content of the table entry. Figure 2 In the example above, statistics are completed to obtain four subtables. The number of entries in each table is equal to the value range of the corresponding element. The total number of entries is the sum of the number of entries in each subtable. The total number of entries is used as the long-short-term memory model classification table and is sent to the switch table. This operation significantly reduces the total number of entries, allowing them to be fully sent to the switch memory.

[0114] A14 LSTM model inference results are delivered

[0115] The table obtained in A13 is encoded into a long short-term memory model classification table. The key of each table is the value of each element in the statistical feature sequence, and the table content is the set of all possible categories of the data flow. It is important to note that the category here is represented by q bits of binary, where q represents the number of class labels. A value of 1 in the pth bit (0 <= p <= q) indicates that the possible category of this data flow is the pth category. Finally, it is sent to the switch data plane via the switch's P4 runtime interface and encoded into a long short-term memory model classification table.

[0116] It's also important to note that the delivery of the convolutional neural network model classification table and the long-short-term memory model classification table is invisible to the switch data plane. This means that each delivery of the latest table entries does not require pausing the switch data plane's classification process. After collecting traffic data for a period of time, it is sent to the server as a new training set for feature extraction, processing, and model training. The inference result set (i.e., the two table entries) is updated to ensure the solution can adapt to traffic changes and enhance usability. The specific model parameters and structure depend on the classification task and training data.

[0117] B such as Figure 2 As shown in the figure, the switch data plane is responsible for online classification of real-time traffic, including feature calculation and storage, table entry matching, and decision-making after classification. The main steps include:

[0118] B1 extracts quintuples

[0119] After receiving input traffic, the data plane needs to extract the five-tuple information of each data packet. Data packets with the same five-tuple belong to the same data flow. The data flow is also the basic unit for classifying traffic in this embodiment.

[0120] B2 hashing

[0121] For the extracted five-tuple, the hash function provided by the P4 language is used to perform operations to obtain the flow identifier of the data flow. Subsequently, all relevant features and information of the data flow are stored in the corresponding register based on the flow identifier. The five-tuple includes the source IP address, destination IP address, source port, destination port and transport layer protocol.

[0122] B3 Update Counter

[0123] For each packet arriving at the switch, the switch determines the packet's number in the data flow and whether to calculate its semantic and statistical features. Each time a new packet arrives in a data flow, the counter increments. When the value reaches the preset feature extraction limit, feature calculation stops and the switch directly matches the features of the previous packet to determine the encrypted flow category.

[0124] B4 Computing semantic features

[0125] The first few packets in the encrypted stream are part of the handshake phase, where the original payload is unencrypted. Therefore, the P4 language can be used to extract specific bytes from the data. Corresponding to the server-side downsampling operation, summation and right shift operations are used to obtain processed semantic features. Since the model's forward computation is not required on the switch data plane, there is no need to convert the semantic features into grayscale images (A3 and A4). Instead, the semantic features are directly stored in the corresponding registers for subsequent feature matching operations.

[0126] B5 Calculate statistical characteristics

[0127] After the handshake phase, the encrypted stream enters the secure data transmission phase. While the payload of the packet is encrypted, its length can still be calculated. By marking the last Finshed packet in the handshake phase as the signal to begin statistical feature extraction, the length of the packet with the specified sequence number (the sequence number obtained by the server-side A9 feature filtering) is extracted for subsequent feature matching operations.

[0128] B6 matching semantic features

[0129] After obtaining all semantic features in B4, the matching-action pipeline enters. The value of each semantic feature is used to determine whether it matches the convolutional neural network model classification table sent by the server. If it does, it indicates that the CNN model classification result has been obtained, and the flow decision operation B9 is directly carried out. If it does not, it means that the characteristics of the data flow are not in the result set of the training dataset on the server (the convolutional neural network model classification table), and the statistical feature matching operation B7 continues.

[0130] B7 matching statistical characteristics

[0131] For data flows that do not match in B6, statistical features are stored in the register area of ​​the corresponding flow identifier. After all elements of the statistical feature sequence are collected, the match-action pipeline enters, searching the LSTM model classification table sent by the server based on the value of each statistical feature. Because the server has already exhausted the feature space of all statistical features and encoded them into the LSTM model classification table and sent it to the switch data plane, misses are prevented. Each subtable entry in the LSTM model classification table represents a set of possible classification results for that element, and a bitwise AND operation (B8) is performed on these subtables to obtain the final classification result.

[0132] B8 bitwise AND

[0133] The statistical classification results obtained in B7 are sequentially subjected to bitwise AND operations. For the model, the final inference result for each feature input is also uniquely determined. Therefore, this step results in a k-bit binary number, where the k-1 bit is 0 and the 1 bit is 1. The sequence number corresponding to 1 is the category label for this data flow. After determining the data flow category, the data flow classification is complete, and the traffic flow decision operation in B9 is performed.

[0134] B9 Traffic Decision

[0135] For the traffic category labels obtained by B6 and B8, the corresponding decision-making operations are performed according to the preset program. For example, for the task of identifying encrypted attacks, the attack traffic is discarded or marked, and the normal data flow is forwarded. For the task of classifying encrypted traffic, different traffic category labels are counted and corresponding management operations are performed.

[0136] This embodiment aims to implement a network model for encrypted traffic classification and deploy it on the switch data plane, achieving a low-latency, low-load, high-precision, and high-availability encrypted traffic classification solution running on the data plane. The advantages are:

[0137] 1) Compared with the solution running on a combination of a server and a switch, the traffic classification process of this embodiment is completely performed on the switch data plane, which has strong real-time performance and application value.

[0138] 2) This embodiment implements a network model for encrypted traffic classification and distributes the corresponding data plane table entries (the convolutional neural network model classification table and the long short-term memory model classification table) to the switch data plane. Compared to traditional machine learning models and binary neural network models, this model has stronger learning capabilities and can theoretically achieve higher classification accuracy.

[0139] 3) This embodiment analyzes the transmission process of encrypted traffic, utilizing the semantic features of the handshake phase and the statistical features of the secure data transmission phase. Compared with the current data plane-based encrypted traffic classification scheme, it has stronger explainability and comprehensiveness.

[0140] 4) This embodiment uses the standard P4 language to implement the data plane and is applicable to all data plane devices that support P4, including switches and smart network cards, and has high versatility.

[0141] To test the performance and classification accuracy of the two-stage encrypted traffic classification method for programmable switches in this embodiment, an experimental platform was built to deploy the model and implement the solution. The setup was as follows:

[0142] Server side

[0143] The server's task is to train the model offline and distribute the classification results; it does not directly participate in the real-time traffic classification process. Experiments were conducted on a server running Linux Ubuntu 18.04. The hardware used an Intel(R) Xeon(R) Gold 6330 CPU @ 2.00GHz and an NVIDIA A100 GPU. On the software side, the system's primary programming language was Python 3, with Python being the deep learning framework. Traffic collection was performed using the QPA tool and the Scapy network library, and traffic analysis tools were Wireshark and Tshark. Network traffic was collected independently, and semantic features of the Client Hello packets during the handshake phase were extracted. These features were then transformed and downsampled before being fed into a CNN model for training. Statistical features from the secure data transmission phase were extracted, filtered, and scaled before being fed into an LSTM model for training. After training, the CNN model was pre-inferred using the training set features, and the LSTM was pre-inferred across the entire feature space of the statistical features. Traffic classification results from both models were obtained and encoded into the switch's data plane table entries and distributed to the data plane.

[0144] Switch data plane

[0145] The data plane is responsible for processing and classifying real-time traffic. Experiments were conducted in both a simulated environment and on real switches. The switch uses the Tofino architecture, with P4 as the primary programming language, adhering to the P4_16 standard. The environment is based on SDE 9.4.0. Testing was performed using a Tofino model to simulate the Tofino chip. After verification, the program was deployed to a physical programmable switch. Different types of encrypted traffic were input into the switch to test the accuracy of traffic classification, as well as the latency and storage overhead of the entire classification process.

[0146] Through experiments on the above platform, the feasibility and performance of the two-stage encrypted traffic classification method for programmable switches in this embodiment can be comprehensively tested.

[0147] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with the technical field, within the technical scope disclosed by the present invention, who makes equivalent replacements or changes based on the technical solution and inventive concept of the present invention, should be covered by the scope of protection of the present invention.

Claims

1. A two-stage encrypted traffic classification method for programmable switches includes the following steps: Step 1: The switch data plane extracts the semantic features and statistical feature sequences of the input traffic and performs preprocessing; Step 2: Input the preprocessed semantic features into the matching-action pipeline and match them with the convolutional neural network model classification table sent by the server. If a match is found, a traffic category based on the semantic features is obtained. If a match is found, the statistical features stored in the register corresponding to the flow identifier of the semantic feature are obtained, and multiple statistical features are collected to obtain a statistical feature sequence of a set length. Step 3: Input the preprocessed statistical feature sequence into the matching-action pipeline and match it with the long short-term memory model classification table sent by the server to obtain a statistical classification result set. Perform a bitwise AND operation on the classification results in the classification result set to obtain a matching result for each statistical feature. The matching results are then bitwise ANDed to obtain a traffic category based on the statistical feature sequence. The server does not directly participate in the real-time traffic classification of the switch, but instead trains the neural network model offline and sends the classification results of the trained neural network model to the switch table through the p4runtime interface. The switch classification program does not need to be suspended during the delivery. Step 4: Execute traffic decision actions using the traffic categories based on semantic features and the traffic categories based on statistical feature sequences.

2. The two-stage encrypted traffic classification method for programmable switches according to claim 1 is characterized in that: In step 1, the switch data plane extracts the semantic features and statistical feature sequences of the input traffic and performs preprocessing, specifically: For each input data packet, the five-tuple of the data packet is first extracted and stored in metadata, which is used to mark the data packets of different session flows. The five-tuple includes the source IP address, destination IP address, source port, destination port, and transport layer protocol. The P4 language hash function is used to calculate the five-tuple to obtain the flow identifier. The relevant characteristics and information of the data flow are stored in the corresponding register according to the flow identifier. In the handshake phase, semantic features are extracted from the plaintext information in each data packet, and the semantic features are pre-processed and stored in a register marked with a five-tuple; Downsampling the semantic features: segment the semantic features and calculate the average value of each segment. Reconstruct the semantic features based on the average value of each segment to obtain the preprocessed semantic features. When the message type of the TLS record protocol is "Finished", the handshake phase ends. Next, the statistical features of the data packets in the secure data transmission phase are recorded and updated in real time. A preset timer is maintained. When the number of statistical packets reaches a preset number, the statistical features are stopped from being updated. The statistical features are pre-processed and stored in a register marked with a five-tuple. Preprocess the statistical feature sequence: According to the random forest algorithm, the importance scores of the statistical feature sequence on the classification are obtained in advance and arranged in descending order. The m statistical features with the top m importance scores are taken to obtain a statistical feature sequence of length m. Each feature in the statistical feature sequence of length m is scaled to obtain the preprocessed statistical feature sequence.

3. The two-stage encrypted traffic classification method for programmable switches according to claim 1 is characterized in that: In step 2, the convolutional neural network model classification table and the long short-term memory model classification table sent by the server are output by the neural network model after offline training and pre-inference. The neural network model includes a convolutional neural network model and a long short-term memory model. The convolutional neural network model is used to process semantic features, and the long short-term memory model is used to process statistical features. The training and inference process of the network model is as follows: Constructing a training data set, wherein the training data set includes semantic features and statistical features, performing feature transformation and downsampling on the semantic features to obtain a semantic feature grayscale image, and performing feature screening and feature scaling on the statistical features to obtain a statistical feature sequence; The semantic features and statistical feature sequences of the training data set are used to train the convolutional neural network model and the long short-term memory model respectively. After completing the training of the convolutional neural network model and the long short-term memory model, the semantic feature grayscale image of the training set is input into the convolutional neural network model, and the correspondence between the semantic feature grayscale image and the data stream category is output and encoded as a convolutional neural network model classification table; all values ​​in the statistical feature space are input into the long short-term memory model, and the correspondence between the statistical feature sequence and the data stream category is obtained, which is encoded as a long short-term memory model classification table.

4. The two-stage encrypted traffic classification method for programmable switches according to claim 3 is characterized in that: The construction and preprocessing process of the training dataset on the server is as follows: The encrypted traffic dataset is divided into data streams based on five-tuples. Data packets with the same five-tuple are merged into one data stream in chronological order. This stream serves as the basic unit for network model training. The five-tuple includes the source IP address, destination IP address, source port, destination port, and transport layer protocol. In the handshake phase, the semantic features of each data stream are extracted, and the original payload of the semantic features is converted into a two-dimensional grayscale image. The two-dimensional grayscale image is downsampled to obtain a semantic feature grayscale image. After the data packet in the handshake phase is completed, the statistical features of the first n data packets in the secure data transmission phase are extracted to obtain a statistical feature sequence of length n; A random forest model is constructed based on the training data set. The classification results of each decision tree in the random forest model are used to perform feature screening on a statistical feature sequence of length n to obtain a statistical feature sequence of length m, where m≤n. Based on a preset scaling factor r, each eigenvalue in a statistical feature sequence of length m is scaled to obtain a scaled statistical feature sequence.

5. The two-stage encrypted traffic classification method for programmable switches according to claim 3 is characterized in that: The pre-inference, distribution and classification process after the convolutional neural network model is trained: The semantic features in the training set are input into the trained convolutional neural network model. After inference, the convolutional neural network model outputs the traffic category corresponding to each semantic feature grayscale image. The correspondence between the semantic feature grayscale image and the data stream category is encoded into a convolutional neural network model classification table and sent to the switch through the p4runtime interface; During the real-time traffic classification process, the semantic features of some traffic will directly hit the result set of the convolutional neural network model to obtain the category of the data flow. The hit traffic will no longer enter the second stage matching process.

6. The two-stage encrypted traffic classification method for programmable switches according to claim 3 is characterized in that: The pre-inference, distribution and classification process after the long short-term memory model is trained: For the trained long-short-term memory model, exhaustively enumerate the feature space value combinations of the statistical features. For each feature space value, use the long-short-term memory model to infer the correspondence between the statistical feature sequence and the data stream category, and encode it into a temporary long-short-term memory model classification table. The number of entries in the temporary long-short-term memory model classification table is the product of the value range of each feature in the statistical feature sequence; For each value of each element in the statistical feature sequence, all possible classification results are counted in the temporary long short-term memory model classification table as the matching content of the statistical sub-table item corresponding to each element, and the matching contents of all elements corresponding to the statistical sub-table items are summarized to obtain the statistical total table item; The total statistical table entries are used as a long-short-term memory model classification table and sent to the switch table entries.

Images