A method and system for classifying encrypted network traffic for class imbalance

Abstract

The application provides a kind of method and system for the classification of class imbalance encrypted network traffic, relating to network traffic classification technical field. Including obtaining original class imbalance encrypted network traffic, preprocessing, generating real markov image representing network traffic features;Build a CWGAN-GP network including generator and discriminator, input the real markov image into the CWGAN-GP network, generate markov image using the generator, and use the discriminator to classify the generated markov image and the real markov image, realize the classification of original class imbalance encrypted network traffic. The application overcomes the optimization problem and sample reliability problem in WGAN, ensures the class balance of sample generation, and ensures more efficient calculation.

Description

Technical Field

[0001] This invention belongs to the field of network traffic classification technology, and in particular relates to a classification method and system for unbalanced encrypted network traffic. Background Technology

[0002] With the popularization of the internet and the continuous development of digital technologies, network traffic has experienced explosive growth. More and more human activities, such as online video, social media, and cloud computing, rely on network connections, leading to a continuous increase in network traffic. This massive amount of network traffic not only puts enormous operational pressure on network operators but also poses a significant challenge to regulatory authorities in effectively monitoring the network landscape. Against this backdrop, the effective classification of network application traffic has become crucial. Accurate and efficient network traffic classification can help network operators optimize network resource allocation, improve network performance, provide a better user experience, enhance user satisfaction, and thus increase customer loyalty and market competitiveness. Furthermore, it can help regulatory authorities better identify and respond to network threats, strengthen network security monitoring, protect user privacy, maintain order in cyberspace, and ensure national information security.

[0003] Deep learning technology has significant advantages in network traffic classification: it can autonomously identify key features from raw data without human intervention, giving it flexibility to adapt to various traffic types and effectively addressing the challenges posed by encrypted traffic, thus significantly improving classification accuracy. However, while deep learning typically provides high accuracy in encrypted traffic classification tasks, this is based on a relatively balanced class distribution in the dataset used for model training. In practical network traffic analysis, class imbalance is a common problem. Furthermore, most current traffic classification research tends to use overall accuracy to evaluate the performance of classification algorithms. This approach may not fully reflect the algorithm's performance across different classes, potentially overlooking its shortcomings when handling samples from a minority of classes. For example, in a corporate network, normal data transmission traffic might account for 99%, while malicious attack traffic such as phishing attempts or intrusion attempts might only account for 1%. In this case, if the classification algorithm only focuses on overall classification accuracy, it might receive a seemingly good score due to its high recognition rate of normal traffic, but in reality, it might completely ignore that 1% of malicious traffic, which is far from sufficient for network security.

[0004] Therefore, strengthening the classification of minority classes in traffic is crucial for network management. A common method for handling imbalanced traffic data classification is oversampling. Its basic idea is to increase the number of samples in the minority class to match or approach the number of samples in the majority class, thereby improving the model's ability to identify the minority class. Existing oversampling methods are mainly divided into traditional methods and methods based on generative adversarial networks (GANs). Most traditional oversampling methods are based on the SMOTE (Synthetic Minority Over-sampling Technique). However, SMOTE increases the dimensionality of the data when generating synthetic samples, leading to increased computational and memory consumption, and it is prone to generating too many samples near the decision boundary, causing model overfitting. Furthermore, since SMOTE generates synthetic samples based on neighboring samples, it may distort the distribution of the original data. Due to these drawbacks, generative adversarial networks (GANs) have emerged. A GAN is a generative model consisting of a generator and a discriminator network, which generates realistic data samples through adversarial training. Compared to the SMOTE method, GANs can generate more realistic data samples without causing increased data dimensionality or data distortion.

[0005] However, the traditional GAN ​​training process is complex and unstable, and may encounter the following problems:

[0006] ① Vanishing gradient: This is because GAN models use Jensen-Shannon divergence (JS divergence). When the balance between the generator and discriminator is broken, it may cause the gradient to vanish, affecting the training of the model.

[0007] ② Pattern collapse: The generator may tend to generate samples that are highly similar to real samples, which limits the diversity of generated samples, also known as pattern collapse.

[0008] ③ Training difficulties: The training process of GAN is very sensitive to the selection of hyperparameters. If not careful, the generated model may fluctuate greatly or fail to converge.

[0009] To address the aforementioned issues, Wasserstein GAN (WGAN) was developed. WGAN successfully improves the vanishing gradient problem by introducing Wasserstein distance instead of JS divergence and also offers some relief for mode collapse. However, it requires Lipschitz constraints, achieved through weight pruning, which can lead to extreme weight distribution, increasing optimization difficulty and affecting the reliability of generated samples. Furthermore, as an unsupervised model, WGAN generates random samples, making it unsuitable for multi-class imbalanced scenarios in current network environments.

[0010] Furthermore, traditional GANs still face limitations in reproducing global image structures and capturing long-range dependencies across image regions. They also suffer from limitations in computational cost and algorithmic efficiency. These issues highlight the inherent limitations of convolutional operations: while they can capture the spatial invariance of natural images, they struggle to effectively model complex geometries and long-range dependencies. To address these problems, self-attention mechanisms have been proposed and applied to GAN architectures. Self-attention is a technique capable of creating long-range dependencies in sequential data by dynamically reallocating attention weights, emphasizing important features while suppressing unimportant ones. This mechanism first achieved great success in natural language processing and is widely used in Transformer models. In image generation, by computing the pairing relationships among all elements in image features, self-attention mechanisms can help models understand and reconstruct more complex global structures and long-range dependencies.

[0011] However, introducing self-attention mechanisms also brings some new challenges. First, self-attention is computationally inefficient because the memory and time complexity of a standard dense attention layer (the computational method of self-attention) is on the order of the square of the input size. Second, it also suffers from statistical inefficiency: self-attention layers require a large number of training samples to be effectively trained, a problem that becomes more pronounced when multiple attention heads or layers are introduced. Furthermore, a major problem with dense attention in image processing is that it doesn't effectively utilize a key characteristic of image data—locality. In images, most dependencies relate to the neighborhood of nearby pixels, meaning most pixels are strongly correlated with their immediate neighbors. However, dense attention layers consider the relationships between all pixels in the image equally during computation, leading to a lot of unnecessary computation. This is because the relationships between distant pixels are often less important than those between nearby pixels, and this computational waste reduces the statistical efficiency of the training process.

[0012] On the other hand, due to the diversity of raw network traffic data sizes, traditional techniques for standardizing image sizes often require truncation or padding of bytes to achieve size consistency. Each pixel in the image maps to local information of the data bytes. However, this direct mapping method may ignore the relevance of byte information in encrypted traffic identification. As a result, traditional image generation strategies may omit key information and include irrelevant redundant data, which in turn may affect the performance of encrypted traffic classification.

[0013] In summary, traditional Generative Adversarial Networks (GANs) face multiple challenges during training, including vanishing gradients, mode collapse, and training difficulties. These problems are partially alleviated by Wasserstein GAN (WGAN) through the introduction of Wasserstein distance, but WGAN's own Lipschitz constraints and weight pruning introduce new optimization challenges. Furthermore, traditional GANs have limitations in reproducing global image structures and capturing long-range dependencies, and also suffer from insufficient computational cost and algorithmic efficiency. To overcome these limitations, self-attention mechanisms have been introduced into GAN architectures, enhancing the ability to model complex global structures and long-range dependencies by dynamically adjusting the importance of features. However, self-attention mechanisms also introduce computational and statistical inefficiencies, as well as a high demand for training samples. In the image processing of network traffic data, traditional size unification techniques, such as byte truncation or padding, may lead to information loss and redundancy, affecting the classification performance of encrypted traffic. Summary of the Invention

[0014] To overcome the shortcomings of the existing technologies, this invention provides a classification method and system for class-imbalanced encrypted network traffic. It employs a novel grayscale image generation technique, utilizing Markov chains based on byte transition probabilities to create grayscale images, replacing the original byte truncation and padding methods. A CWGAN-GP network model is established, and gradient penalty (GP) replaces weight clipping, overcoming the optimization difficulties and sample reliability issues caused by Lipschitz constraints in WGAN. Secondly, a conditional generation mechanism is introduced to improve the randomness limitations of WGAN in multi-class imbalanced scenarios, ensuring class balance in sample generation. Furthermore, a novel locally sparse attention layer replaces the traditional dense attention layer, guaranteeing greater computational efficiency.

[0015] To achieve the above objectives, one or more embodiments of the present invention provide the following technical solutions:

[0016] The first aspect of this invention provides a classification method for classifying unbalanced encrypted network traffic.

[0017] A classification method for class-imbalanced encrypted network traffic includes the following steps:

[0018] The original class-imbalanced encrypted network traffic is obtained, preprocessed, and a realistic Markov image representing the characteristics of the network traffic is generated.

[0019] A CWGAN-GP network including a generator and a discriminator is constructed. Real Markov images are input into the CWGAN-GP network. The generator generates Markov images, and the discriminator distinguishes between the generated Markov images and real Markov images to achieve classification of the original class-imbalanced encrypted network traffic.

[0020] In this approach, a local sparse attention layer is introduced into both the generator and the discriminator to create a sparse pattern mask that selectively reflects the computation in the attention mechanism. The computation results of the query and key are modified based on the sparse pattern mask, and then the output feature matrix after the sparse pattern mask modification is obtained.

[0021] A second aspect of the present invention provides a classification system for class-imbalanced encrypted network traffic.

[0022] A classification system for class-imbalanced encrypted network traffic, comprising:

[0023] The preprocessing module is configured to: acquire the raw class-imbalanced encrypted network traffic, perform preprocessing, and generate a realistic Markov image characterizing the features of the network traffic;

[0024] The generation and discrimination module is configured to: build a CWGAN-GP network including a generator and a discriminator, input real Markov images into the CWGAN-GP network, use the generator to generate Markov images, and use the discriminator to classify the generated Markov images and real Markov images, thereby classifying the original class-imbalanced encrypted network traffic.

[0025] In this approach, a local sparse attention layer is introduced into both the generator and the discriminator to create a sparse pattern mask that selectively reflects the computation in the attention mechanism. The computation results of the query and key are modified based on the sparse pattern mask, and then the output feature matrix after the sparse pattern mask modification is obtained.

[0026] A third aspect of the invention provides a computer-readable storage medium having a program stored thereon that, when executed by a processor, implements the steps of the classification method for class-imbalanced encrypted network traffic as described in the first aspect of the invention.

[0027] A fourth aspect of the present invention provides an electronic device including a memory, a processor, and a program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the steps in the classification method for class-imbalanced encrypted network traffic as described in the first aspect of the present invention.

[0028] The above one or more technical solutions have the following beneficial effects:

[0029] ① Efficient image generation technology: This invention provides a classification method and system for classifying class-imbalanced encrypted network traffic. It adopts a novel grayscale image generation method based on Markov chains to generate Markov images that characterize network traffic features, effectively preserving key data information while reducing redundancy, and enhancing the accuracy of image classification and the generalization ability of the model.

[0030] ② Optimized WGAN solution: Introducing Conditional Wasserstein Generative Adversarial Network (CWGAN-GP), which replaces traditional weight clipping with gradient penalty technique to penalize the gradient output of the discriminator, thereby avoiding the gradient vanishing or exploding problem. This solves the Lipschitz constraint problem in WGAN and improves the reliability of sample generation.

[0031] ③ Improved sample generation balance: Through a conditional generation mechanism, class labels are introduced as additional conditions in the generator and discriminator of the CWGAN-GP network. The corresponding class labels and the real Markov image or the generated Markov image are used as conditional constraints, which overcomes the limitations of WGAN in multi-class imbalance scenarios and ensures the class balance of sample generation.

[0032] ④ Computationally efficient self-attention mechanism: This invention uses a locally sparse attention layer instead of a traditional dense attention layer. By creating a binary sparse pattern mask, the sparse pattern mask is applied to the query matrix Q and the key matrix K to obtain the sparse query matrix and the sparse key matrix, respectively. The attention weights are calculated using the sparse query matrix and the sparse key matrix, and the obtained attention weights are used to perform a weighted summation on the value matrix V to obtain the final output feature matrix. This preserves the locality and geometric structure of the image while reducing the amount of computation and improving efficiency.

[0033] ⑤ Significant performance improvement: The structural improvements of this invention have resulted in significant improvements in FID, Inception score and visual effects, demonstrating its superior performance in the field of image generation.

[0034] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0035] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0036] Figure 1 This is a flowchart of the method in the first embodiment.

[0037] Figure 2This describes the process of generating Markov images.

[0038] Figure 3 This is a diagram of the CWGAN-GP network architecture in the first embodiment. Detailed Implementation

[0039] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0040] It should be noted that the terminology used herein is for the purpose of describing particular implementations only and is not intended to limit the exemplary implementations of the present invention.

[0041] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0042] Example 1

[0043] As mentioned above, this embodiment provides a high-performance and robust classification solution for classifying unbalanced encrypted network traffic, specifically addressing the following technical issues:

[0044] ① The Lipschitz constraint problem of Wasserstein GAN (WGAN): WGAN satisfies the Lipschitz constraint by pruning weights, which may lead to extreme weights in the network, increasing the difficulty of optimization and affecting the reliability of generated samples.

[0045] ② The randomness problem of unsupervised models: As an unsupervised model, WGAN generates samples with randomness, which limits its use in multi-class imbalance scenarios and cannot guarantee the class balance of the generated samples.

[0046] ③ The computational and statistical efficiency of self-attention mechanisms: Although self-attention mechanisms can create long-range dependencies, they have high computational complexity, require a large number of training samples, and have low statistical efficiency.

[0047] ④ Locality problem of dense attention layers: Since dense attention (the computational method of self-attention mechanism) is not conducive to benefiting from the locality of image pixels, it leads to reduced efficiency.

[0048] ⑤ The problem of missing key information in network traffic data: Traditional technologies achieve size consistency by truncating or supplementing bytes when processing network traffic data, which may ignore the correlation of byte information, resulting in the omission of key information and affecting classification performance.

[0049] ⑥ The problem of including irrelevant redundant data: Traditional image generation strategies may include irrelevant redundant data, which affects the performance of encrypted traffic classification.

[0050] The processing method for classifying unbalanced encrypted network traffic proposed in this embodiment includes:

[0051] First, this embodiment employs a novel grayscale image generation technique, utilizing Markov chains based on byte transition probabilities to create grayscale images, replacing the original byte truncation and padding methods. This improvement not only preserves key data information but also reduces redundancy, enhancing the accuracy of image classification and the generalization ability of the model.

[0052] Then, this embodiment proposes an improved scheme based on Conditional Wasserstein Generative Adversarial Network with Gradient Penalty (CWGAN-GP), which effectively solves two major problems faced by WGAN: First, by replacing weight pruning with Gradient Penalty (GP), the optimization difficulties and sample reliability problems caused by Lipschitz constraints in WGAN are overcome; Second, the introduction of a conditional generation mechanism improves the randomness limitation of WGAN in multi-class imbalanced scenarios and ensures class balance in sample generation.

[0053] Meanwhile, this embodiment uses a novel locally sparse attention layer to replace the traditional dense attention layer. This layer preserves the locality and geometric structure of the 2D image. Compared to the traditional dense attention layer (the computational method of the self-attention mechanism), this layer is computationally more efficient because it reduces the number of attention weights that need to be calculated. Replacing the dense attention layer of SAGAN with this structure yields significantly improved FID, Inception score, and visual effects.

[0054] To achieve the above objectives, the specific implementation process of this embodiment includes: generating a Markov image, constructing a CWGAN-GP network, and introducing a locally sparse attention layer. The overall architecture is as follows: Figure 1 As shown:

[0055] (1) Generate Markov image

[0056] Step 1: The initial step involves grouping the raw pcap file of network traffic into independent session files based on five key elements: source IP, destination IP, source port, destination port, and the transport layer protocol used.

[0057] Step 2: Next, use an analysis tool similar to Wireshark to filter the grouped network packets. The purpose is to remove unnecessary information, such as redundant packets like TCP retransmissions, in order to clean up the dataset.

[0058] Step 3: Treat the byte sequence in each session file as a Markov process and estimate the transition probability between them by analyzing the following relationships between bytes.

[0059] Step 4: Based on the calculated transition probabilities, create a 256x256 matrix that represents the probability of transitions between bytes and is used to describe the characteristics of the Markov chain.

[0060] Step 5: Finally, use the above probability matrix to generate images that represent the Markov chain states of network traffic, which can be used as input data for network analysis.

[0061] (2) Building a CWGAN-GP network

[0062] ① Generator Network: A generator network takes a random noise vector and conditional input, and generates an image through a series of neural network layers (such as convolutional layers, activation layers, etc.). The goal of the generator is to generate an image that is as close as possible to the real data distribution.

[0063] ② Discriminator Network: The discriminator network receives real images and their conditional inputs, or images generated by a generator and their conditional inputs, and attempts to distinguish between them. The goal of the discriminator is to maximize its ability to distinguish between real and fake images.

[0064] ③Wasserstein distance: CWGAN-GP uses Wasserstein distance as the main loss function, which requires the discriminator network to output an unbounded truth score, rather than a probability.

[0065] ④ Gradient Penalty (GP): To stabilize the training process, CWGAN-GP introduces gradient penalty. This involves penalizing the gradient of the discriminator output to avoid the problems of gradient vanishing or exploding.

[0066] (3) Introduction of local sparse attention layer

[0067] Step 1: Design a sparse pattern, typically a binary mask, to determine which locations are active (i.e., can participate in the computation) and which are ignored (i.e., do not participate in the computation) during attention calculation. This mask is based on the principle of two-dimensional locality, selecting only neighboring pixels or features in the image.

[0068] Step 2: Utilize Information Flow Graphs (IFGs) to ensure that information flows efficiently through the network even after sparsification. IFGs are directed acyclic graphs used to simulate and optimize information flow in the attention layer.

[0069] Step 3: Similar to dense attention, local sparse attention layers also require computing the query (Q), key (K), and value (V) matrices. These matrices are obtained by multiplying the input feature matrix X by the corresponding weight matrix:

[0070] Q = X * W Q K = X * W K V = X * W V ;

[0071] Among them, W Q， W K， W V It is a learnable weight matrix.

[0072] Step 4: Apply a sparse pattern mask to the computation results of the query and key to reduce the number of pixels or feature logs that need to be considered. This is typically done through element-wise multiplication (Hadamard product):

[0073] Sparse Q =Q⊙M,Sparse K =K⊙M.

[0074] Where M is the sparse pattern mask.

[0075] Step 5: Calculate the attention weights using the modified query and key matrices. This typically involves calculating their dot product and then applying the softmax function to obtain normalized weights.

[0076] Attention Weights=softmax(Sparse Q *Sparse K T );

[0077] Step 6: Use the obtained attention weights to perform a weighted summation on the value matrix V to obtain the final output feature matrix:

[0078] Output=Attention Weights*V;

[0079] Step 7: Using the ESA(Enumerate, Shift, Apply) framework, adjust the one-dimensional sparse pattern to fit the two-dimensional image structure. This process includes:

[0080] ① Enumerate: Renumber pixels based on their Manhattan distance.

[0081] ② Shift: Adjust the sparsity pattern to match the Manhattan distance-based enumeration.

[0082] ③ Apply: Apply the adjusted sparse pattern to attention calculation.

[0083] Step 9: During training, update the weight matrix W using optimization algorithms such as backpropagation and gradient descent. Q， W K， W V And sparse pattern masks to minimize the loss function.

[0084] Furthermore, the specific implementation method of this embodiment is as follows:

[0085] Step 1: Preprocess the collected raw encrypted traffic to generate a Markov image;

[0086] Step 2: Build a CWGAN-GP network and introduce a local sparse attention layer into it. Then, input the generated Markov image into the CWGAN-GP network for image generation to balance the network traffic dataset, so that the number of minority classes can be increased.

[0087] First, let's elaborate on step 1:

[0088] Compared to traditional grayscale images, Markov images are generated by using the byte transition probabilities (the probability of one byte transitioning to another) from the session file as the pixels in the image, rather than individual bytes. Because the range of bytes is 0-255, Markov image generation does not require truncation or padding regardless of the session file size, ensuring a uniform 256x256 size. This effectively avoids information loss and reduces redundancy. Furthermore, the fixed 256x256 size of Markov images allows them to adapt to various datasets, thus improving generalization.

[0089] In network traffic analysis, the immediate state of traffic is typically only affected by the most recent state; this is known as the Markov property. This property allows traffic analysis to focus on the most recent data bytes, rather than the entire data sequence.

[0090] like Figure 2 As shown, the process of generating a Markov image is as follows:

[0091] ① First, the original network packets (pcap file) need to be grouped according to the session mode. A session refers to a set of packets with the same five-tuple characteristics (source IP, source port, destination IP, destination port, and protocol type).

[0092] ② Use specialized tools, such as Wireshark, to filter data packets and remove unnecessary information, such as TCP retransmission packets, to reduce data redundancy and generate a more concise session dataset.

[0093] ③ Further process the session dataset by removing unnecessary information from the packet header, such as noisy data, detailed information of the data link layer, and IP addresses. The aim is to reduce the model's learning of these irrelevant features, thereby improving the model's generalization ability.

[0094] ④ The binary file of a network session can be viewed as a sequentially arranged sequence of bytes that follows the Markov property, meaning that the occurrence of each byte depends only on its immediate predecessor. The probability formula for a Markov chain is as follows:

[0095] P(Byte i+1 |Byte0, ..., Byte i ) = P(Byte) i+1 |Byte i )

[0096] Among them, Byte i+1 |Byte0, ..., Byte i This represents the probability of the (i+1)th byte appearing, given that the first i bytes are known. i+1 |Byte i This indicates a characteristic of Markov chains: the probability of the (i+1)th byte appearing depends only on the i-th byte and is independent of earlier bytes in the sequence.

[0097] Since each byte can take an integer value from 0 to 255, there exists a 256x256 transition probability matrix.

[0098] ⑤ Specific calculation of transition probability: Transition probability P xy , representing the probability that byte x is immediately followed by byte y, can be calculated using the following formula:

[0099]

[0100] Here, f(x, y) is the number of times byte y appears immediately after byte x, and the denominator is the sum of f(x, y) for all possible subsequent bytes y.

[0101] ⑥ By analyzing the byte sequence in the session file, the transition probability of each byte pair is calculated, thereby generating a 256x256 transition probability matrix M, as shown below:

[0102]

[0103] ⑦ Using this probability matrix, a Markov chain image can be generated. In this process, each element in the matrix represents a pixel in the image, and these pixels can be used to construct a feature image of network traffic. The overall process described above is as follows: Figure 2 As shown.

[0104] exist Figure 2 In this process, the original class-asymmetric encrypted network traffic is grouped into independent session files. Each independent session file can be represented as... Figure 2 The leftmost frame;

[0105] Then, the byte sequence in each session file is treated as a Markov process. By analyzing the following relationships between bytes, the transition probabilities between bytes are estimated. The probability of transitioning from one byte to another byte (including the byte itself) is expressed as: Figure 2 The middle frame;

[0106] Finally, based on the calculated transition probabilities, a transition probability matrix is ​​generated, representing the likelihood of transitions between bytes. A Markov image is then generated based on this transition probability matrix, with each element in the matrix representing a pixel in the Markov image. The corresponding process can be represented as follows: Figure 2 The rightmost frame.

[0107] Next, step 2 will be explained in detail:

[0108] 1. Set up a CWGAN-GP network

[0109] Definition: CWGAN-GP is an improved model of WGAN that overcomes its limitations by employing a novel gradient penalty mechanism. This gradient penalty method replaces the original weight pruning technique, helping to avoid extreme distributions of weight values ​​and ensuring that the discriminator better adheres to the Lipschitz continuity condition. The overall architecture is as follows: Figure 3 As shown.

[0110] Specifically, the implementation of gradient penalty involves calculating the L2 norm between the gradient of the discriminator output and a predefined constant K. This process first randomly selects a value within the range of 0 to 1, and then mixes real data samples with generated data samples according to this random ratio. In this way, Lipschitz continuity can be satisfied in each batch of data.

[0111] During the sampling process, two distributions were used: the distribution of the real data P_r and the distribution of the generated data P_g. Sampling was performed using the following formula, where α represents the intermediate value obtained from the sampling, which is a mixture of the real sample x and the generated sample x' according to the weights of the random variable λ, which is uniformly distributed between 0 and 1:

[0112] α=λx+(1-λ)x′,λ~Uniform[0,1],x~P r ,x′~P g

[0113] In this formula, x is a sample obtained from the real data distribution, x' is a sample obtained from the generated data distribution, and λ is a random variable that controls the weights of x and x' in α.

[0114] By using this method, CWGAN-GP can effectively interpolate between real and generated data, thereby improving the model's performance and stability.

[0115] Meanwhile, to construct a supervised data generation process, the CWGAN-GP model introduces additional conditional information 'c' into both the discriminator and generator to adapt to the multi-class imbalance problem in modern network environments. In this invention, the class labels of traffic data are used as additional conditions, input into the model along with the feature image of the traffic data to form conditional constraints. The objective function of the CWGAN-GP model can be expressed as:

[0116]

[0117] In this formula, Let P represent the expected value of the sample, c represent additional conditional information, and P represent the expected value of the sample. r and P g λ and α represent the distributions of real and generated data, respectively. The discriminator D evaluates whether a sample x or α is real or generated based on condition c. λ is an adjustment term used to control the discriminator's sensitivity to generated samples, while the gradient penalty term λ... Ensure that the discriminator's output changes smoothly in the sample space.

[0118] The objective function minmaxV(D,G) reflects the competition between the generator G and the discriminator D. In this process, the generator G strives to produce samples that, under the evaluation of the discriminator D, approximate the true sample distribution P. r There is no difference. The discriminator D attempts to maximize its ability to distinguish between real and generated samples. This design leads to a dynamic balance between the two, where G continuously improves its generation quality, while D continuously improves its discriminative ability.

[0119] The loss functions for the discriminator and generator are defined as follows:

[0120] The loss function L(D) of the discriminator is defined as the difference between the expected discriminant probabilities of the real sample and the generated sample, plus a gradient penalty term. The specific formula is as follows:

[0121]

[0122] Here, the first term is the negative expected value of the probability that the discriminator D classifies a real sample x as real under given condition c. The second term is the expected value of the probability that a generated sample α is classified as real under the same conditions. The last term is the gradient penalty, used to smooth the decision boundary of the discriminator, where λ is a hyperparameter controlling the strength of the penalty.

[0123] The generator's loss function L(G) is the negative expected value of the probability that the generated sample is classified as real by the discriminator, as shown in the following formula:

[0124]

[0125] This means that the generator's goal is to maximize D(α|c), which is the probability that the generated sample α is considered real by the discriminator D.

[0126] These loss functions are core components of generative adversarial networks (GANs), guiding the training process of the generator and discriminator to produce high-quality, indistinguishable samples.

[0127] Generator execution flow:

[0128] ① Input layer: First, the input layer receives a random noise vector z with a dimension of 100 and a set of class labels. These labels are combined with the noise vector to form the initial noise feature vector.

[0129] ②Dense layer: Next, the feature vector passes through a fully connected layer (Dense layer), which maps the input to a feature space with a higher dimension, and the output dimension is (b, 20480), where b represents the number of samples in the batch.

[0130] ③ Reshaping operation: The output of the Dense layer is then reshaping to convert it into a dimension suitable for subsequent convolutional operations, i.e. (b, 8, 8, 640).

[0131] ④ Transposed Convolutional Layer: Then, the feature map is upsampled through a series of transposed convolutional layers. The first transposed convolutional layer has a 3×3 kernel with a stride of 2, using 256 kernels, and the output dimension is (b, 16, 16, 256).

[0132] ⑤ Local Sparse Attention Layer: To enhance the model's ability to capture local features and introduce sparsity into the feature map, we introduce a local sparse attention layer after the second transposed convolution. This layer improves the quality of the generated image by strengthening important local features and suppressing unimportant features. The output dimension of this layer is (b, 32, 32, 256).

[0133] ⑥ Final transposed convolutional layer: The output of the local sparse attention layer then enters the final transposed convolutional layer, which uses a 2×2 convolutional kernel with a stride of 2 and only one kernel to upsample the feature map to (b, 256, 256, 1).

[0134] ⑦ Output layer: Finally, the feature map is non-linearly transformed by an activation function (e.g., ReLU or tanh) and the output layer generates the final 256×256×1 image sample.

[0135] With this structure, the generator can produce images with rich detail and high realism, while the introduction of local sparse attention layers further improves the model's sensitivity to local image features and the quality of generation.

[0136] Discriminator execution flow:

[0137] ① Input layer: The input layer receives image data with a size of (b, 256, 256, 1), where b represents the batch size and 256x256x1 represents the image resolution and number of color channels.

[0138] ② Convolutional Layers: The next two layers are convolutional layers. The first layer uses 3x3 convolutional kernels, with 16 kernels and a stride of 1 to keep the image size constant. The second layer uses 4x4 convolutional kernels, with 32 kernels and a stride of 2 to reduce the spatial dimension of the image. The dimensions of the output feature maps are (b, 256, 256, 16) and (b, 128, 128, 32), respectively.

[0139] ③ Local Sparse Attention Layer: After the second convolutional layer, we introduce a local sparse attention layer. This layer enhances the model's sensitivity to local image features by strengthening important local features and suppressing unimportant features. The output feature map size of this layer is (b, 64, 64, 32).

[0140] ④ Further convolutional layers: The output of the local sparse attention layer then passes through two more convolutional layers with kernel sizes of 3x3 and 2x2, and the number of kernels of 64 and 128, respectively, with a stride of 2, further reducing the image size and number of channels. The dimensions of the output feature maps are (b, 32, 32, 64) and (b, 16, 16, 128).

[0141] ⑤ Flatten layer: The output of the sixth layer is flattened into a one-dimensional vector through the Flatten layer, ready for dense connections.

[0142] ⑥ Dense Layer: Finally, the flattened vector is input into the Dense layer, which calculates the probability that a given image belongs to the true category and its distribution across the different categories.

[0143] 2. Introduce a locally sparse attention layer

[0144] ① Define the local neighborhood: Determine the extent of locality. For example, you can choose an n×n window (e.g., 3×3 or 5×5), which means focusing only on each pixel and its directly adjacent pixels.

[0145] ② Create a binary mask: For each pixel position (i,j) of the input feature map, create a binary mask M of the same size. Each element M in the mask... pq It is determined based on its positional relationship with the center pixel (i,j):

[0146]

[0147] Here, (i,j) is the position of the center pixel, (p,q) is the position of the surrounding pixels, and n is the locality range.

[0148] ③ Utilizing Information Flow Graphs (IFGs): IFGs are directed acyclic graphs used to simulate the flow of data in the attention layer. In the attention mechanism, each pixel or feature can be considered an information unit, and the nodes in the IFG represent the states of these information units at different processing stages. By designing IFGs, we ensure that information can flow effectively in the network even after sparsification. This involves ensuring that every node in the graph is connected to at least one path, thus guaranteeing that information can flow from the input layer to the output layer. A good IFG should have the property of "full information," meaning that for any two nodes, there exists at least one path connecting them in the graph, ensuring that information can flow to any location in the network.

[0149] ④ Calculate the query (Q), key (K), and value (V) matrices: In the attention mechanism, the input feature matrix X is used to generate the query (Q), key (K), and value (V) matrices, which are obtained by working with the learnable weight matrix W. Q， W K， W V The result is obtained by multiplication. The specific calculation is as follows:

[0150] The formula for calculating the query matrix Q is: Q = X * W Q ;

[0151] The formula for calculating the bond matrix K is: K = X * W K ;

[0152] The formula for calculating the value matrix V is: V = X * W V ;

[0153] Here, W Q， W K， W V These are the model's parameters, which are learned and updated during training using the backpropagation algorithm. The dimensions of the Q, K, and V matrices depend on the size of the input feature matrix X and the size of the weight matrix.

[0154] ⑤ Apply sparse pattern mask: Apply the sparse pattern mask M to the Q and K matrices to reduce the number of pixels or features involved in the calculation:

[0155] Sparse query matrix Q The calculation formula is: Sparse Q ==Q⊙M;

[0156] Sparse bond matrix K The calculation formula is: Sparse k =K⊙M;

[0157] Here, ⊙ represents the Hadamard product.

[0158] ⑥ Calculate attention weights: Use the modified sparse query and key matrix to calculate attention weights. First, calculate their dot product, then apply the softmax function to obtain normalized weights. This process can be represented as:

[0159] Attention Weights=softmax(Sparse Q *Sparse K T )

[0160] Each element w of the attention weight matrix ij This represents the attention intensity of the j-th position to the i-th position in the input feature matrix. The softmax function ensures that for each position i, its corresponding weight vector w... i The sum of the elements is 1, which helps in the weighted summation in the next step.

[0161] ⑦ Weighted summation to obtain the output feature matrix: The value matrix V is weighted and summed using the obtained attention weights to obtain the final output feature matrix. This step can be expressed as:

[0162] Output=Attention Weights*V;

[0163] ⑧ Applying the ESA (Enumerate, Shift, Apply) framework: The main purpose of the ESA framework is to adapt the one-dimensional sparse pattern to fit the two-dimensional image structure, thereby preserving the spatial relationship between pixels, especially in attention calculation.

[0164] Manhattan distance is a method for measuring the distance between two points on a grid. It is equal to the sum of the absolute differences between the two points on each coordinate axis. In two-dimensional space, if the coordinates of two points are (x1, y1) and (x2, y2), then the Manhattan distance d between them is:

[0165] d = |x2 - x1| + |y2 - y1|

[0166] The steps of the ESA framework are as follows:

[0167] First, the pixels in the image are renumbered according to their Manhattan distances. This helps us determine the local neighborhood of each pixel, as the Manhattan distance reflects its positional relationship in two-dimensional space.

[0168] Next, we adjust the sparsity pattern based on the enumeration results of the Manhattan distance. This means that we map the index of the one-dimensional sparsity pattern to a two-dimensional space, ensuring that the sparsity pattern correctly represents the local connectivity of pixels in the image.

[0169] Finally, we apply a modified sparse pattern to the attention computation. This involves using a binary mask M to selectively activate or disable certain computations in the attention mechanism, thereby reducing computational cost and preserving locality.

[0170] Using the ESA framework, we can effectively implement a sparse attention mechanism while preserving the structure of 2D image data. This approach not only improves computational efficiency but also enhances the model's ability to capture local features by considering the spatial relationships between pixels. Combined with the use of IFGs, we can further ensure the effective flow of information within the network, thereby optimizing the performance of the attention layer.

[0171] ⑨ Optimization process: During training, the weight matrix W is updated using optimization algorithms such as backpropagation and gradient descent. Q W K W V And a sparse pattern mask M to minimize the loss function.

[0172] Through these steps, we designed a locally sparse attention layer that leverages the principle of 2D locality and information flow graphs to optimize information flow and adapts to 2D image structures. This design not only improves computational efficiency but also maintains the model's sensitivity to local features, thereby enhancing the performance of the generative model.

[0173] Example 2

[0174] This embodiment discloses a classification system for class-imbalanced encrypted network traffic.

[0175] A classification system for class-imbalanced encrypted network traffic, comprising:

[0176] The preprocessing module is configured to: acquire the raw class-imbalanced encrypted network traffic, perform preprocessing, and generate a realistic Markov image characterizing the features of the network traffic;

[0177] The generation and discrimination module is configured to: build a CWGAN-GP network including a generator and a discriminator, input real Markov images into the CWGAN-GP network, use the generator to generate Markov images, and use the discriminator to classify the generated Markov images and real Markov images, thereby classifying the original class-imbalanced encrypted network traffic.

[0178] In this approach, a local sparse attention layer is introduced into both the generator and the discriminator to create a sparse pattern mask that selectively reflects the computation in the attention mechanism. The computation results of the query and key are modified based on the sparse pattern mask, and then the output feature matrix after the sparse pattern mask modification is obtained.

[0179] Example 3

[0180] The purpose of this embodiment is to provide a computer-readable storage medium.

[0181] A computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the steps in the classification method for class-imbalanced encrypted network traffic as described in Embodiment 1 of this disclosure.

[0182] Example 4

[0183] The purpose of this embodiment is to provide an electronic device.

[0184] An electronic device includes a memory, a processor, and a program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the steps in the classification method for class-imbalanced encrypted network traffic as described in Embodiment 1 of this disclosure.

[0185] The steps and methods involved in the apparatuses of Embodiments 2, 3, and 4 above correspond to those in Embodiment 1. For specific implementation details, please refer to the relevant description section of Embodiment 1. The term "computer-readable storage medium" should be understood as a single medium or multiple media including one or more instruction sets; it should also be understood as including any medium capable of storing, encoding, or carrying an instruction set for execution by a processor and enabling the processor to perform any of the methods in this invention.

[0186] Those skilled in the art will understand that the modules or steps of the present invention described above can be implemented using general-purpose computer devices. Optionally, they can be implemented using computer-executable program code, thereby allowing them to be stored in a storage device for execution by a computer device, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. The present invention is not limited to any particular combination of hardware and software.

[0187] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. A classification method for class-imbalanced encrypted network traffic, characterized in that, Includes the following steps: The original class-imbalanced encrypted network traffic is obtained, preprocessed, and a realistic Markov image representing the characteristics of the network traffic is generated. A CWGAN-GP network including a generator and a discriminator is constructed. Real Markov images are input into the CWGAN-GP network. The generator generates Markov images, and the discriminator distinguishes between the generated Markov images and real Markov images to achieve classification of the original class-imbalanced encrypted network traffic. In this process, a local sparse attention layer is introduced in both the generator and the discriminator to create a sparse pattern mask that selectively reflects the computation in the attention mechanism. The computation results of the query and key are modified based on the sparse pattern mask, and then the output feature matrix after the sparse pattern mask modification is obtained. A local sparse attention layer is introduced in both the generator and the discriminator. The specific process is as follows: Define a local neighborhood based on each pixel and its immediate neighbors; Based on the local neighborhood, a binary sparse pattern mask is created, and each element in the mask is determined according to its positional relationship with the center pixel of the local neighborhood. Design an information flow diagram to ensure that information can flow effectively within the CWGAN-GP network; Based on the input feature matrix, generate the query matrix Q, the key matrix K, and the value matrix V; Based on the Hadamard product calculation, the sparse pattern mask is applied to the query matrix Q and the key matrix K to obtain the sparse query matrix and the sparse key matrix, respectively. Calculate attention weights using the sparse query matrix and the sparse key matrix; The value matrix V is weighted and summed using the obtained attention weights to obtain the final output feature matrix.

2. The classification method for class-imbalanced encrypted network traffic as described in claim 1, characterized in that, Generating realistic Markov images that characterize network traffic features, specifically including: The original unbalanced encrypted network traffic is grouped based on five key elements to form independent session files; the five key elements include source IP, destination IP, source port, destination port, and the transport layer protocol used. Filter the grouped network data packets; Treat the byte sequence in each session file as a Markov process, and estimate the transition probability between bytes by analyzing the following relationships between bytes; Based on the calculated transition probabilities, a transition probability matrix representing the possibility of transitions between bytes is generated; Markov images are generated based on the transition probability matrix, where each element in the transition probability matrix represents a pixel in the Markov image.

3. The classification method for class-imbalanced encrypted network traffic as described in claim 2, characterized in that, The formula for calculating the transition probability is: ； Where f(x,y) is the number of times byte x is immediately followed by byte y. It is the summation of f(x,y) over all possible subsequent bytes y; It is the probability that byte x is immediately followed by byte y.

4. The classification method for class-imbalanced encrypted network traffic as described in claim 1, characterized in that, In the generator and discriminator of the CWGAN-GP network, class labels are introduced as additional conditions, and the corresponding class labels are used as conditional constraints along with real Markov images or generated Markov images.

5. The classification method for class-imbalanced encrypted network traffic as described in claim 4, characterized in that, During the training of the CWGAN-GP network, a gradient penalty method is used to penalize the gradient of the discriminator output: The loss function of the discriminator Defined as: ； Among them, the first item It is the negative expected value of the probability that the discriminator D classifies a real sample x as real under given condition c; the second term It is the expected value of the probability that the generated sample α will be judged as true under the same conditions; the last term λ is the gradient penalty, used to smooth the decision boundary of the discriminator, where λ is a hyperparameter that controls the intensity of the penalty. This represents the mathematical expectation of the sample. This indicates additional condition information. and These represent the distributions of real data and generated data, respectively. The generator's loss function Defined as: 。 6. The classification method for class-imbalanced encrypted network traffic as described in claim 1, characterized in that, Also includes: The ESA framework is used to adjust the one-dimensional sparse pattern to fit the two-dimensional image structure, specifically as follows: The pixels are renumbered based on the Manhattan distance of the Markov image pixels; Adjust the sparse pattern mask to match the Manhattan distance-based enumeration; The adjusted sparse pattern mask is applied to attention calculation; Also includes: During training, the weight matrix and sparse pattern mask are updated to minimize the loss function.

7. A classification system for class-imbalanced encrypted network traffic, characterized in that, include: The preprocessing module is configured to: acquire the raw class-imbalanced encrypted network traffic, perform preprocessing, and generate a realistic Markov image characterizing the network traffic features; The generation and discrimination module is configured to: build a CWGAN-GP network including a generator and a discriminator, input real Markov images into the CWGAN-GP network, use the generator to generate Markov images, and use the discriminator to classify the generated Markov images and real Markov images, thereby classifying the original class-imbalanced encrypted network traffic. In this process, a local sparse attention layer is introduced in both the generator and the discriminator to create a sparse pattern mask that selectively reflects the computation in the attention mechanism. The computation results of the query and key are modified based on the sparse pattern mask, and then the output feature matrix after the sparse pattern mask modification is obtained. A local sparse attention layer is introduced in both the generator and the discriminator. The specific process is as follows: Define a local neighborhood based on each pixel and its immediate neighbors; Based on the local neighborhood, a binary sparse pattern mask is created, and each element in the mask is determined according to its positional relationship with the center pixel of the local neighborhood. Design an information flow diagram to ensure that information can flow effectively within the CWGAN-GP network; Based on the input feature matrix, generate the query matrix Q, the key matrix K, and the value matrix V; Based on the Hadamard product calculation, the sparse pattern mask is applied to the query matrix Q and the key matrix K to obtain the sparse query matrix and the sparse key matrix, respectively. Calculate attention weights using the sparse query matrix and the sparse key matrix; The value matrix V is weighted and summed using the obtained attention weights to obtain the final output feature matrix.

8. A computer-readable storage medium having a program stored thereon, characterized in that, When executed by a processor, the program implements the steps in the classification method for class-imbalanced encrypted network traffic as described in any one of claims 1-6.

9. An electronic device, comprising a memory, a processor, and a program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the classification method for class-imbalanced encrypted network traffic as described in any one of claims 1-6.

Images