Encrypted traffic data classification model training method and encrypted traffic data classification method

Abstract

The invention provides a training method of an encrypted traffic data classification model and a classification method of encrypted traffic data. According to the training method of the encrypted traffic data classification model, multiple disturbance processing is performed on an unlabeled first encrypted traffic data sample through a data augmenter, multiple augmented data samples are generated, and the difference degree between each augmented data sample and the first encrypted traffic data sample is smaller than a preset threshold value; determining a pseudo label data sample according to the plurality of augmented data samples through a pseudo label generator; taking the labeled second encrypted traffic data sample and the pseudo label data sample as training data, and inputting the training data into the initial encrypted traffic data classification model to obtain a prediction classification result output by the initial encrypted traffic data classification model; and according to an actual classification result and a predicted classification result corresponding to the training data, updating model parameters of the initial encrypted traffic data classification model to obtain a trained encrypted traffic data classification model. And the model generalization ability can be improved.

Description

Technical Field

[0001] The present application relates to the field of traffic detection technology, and in particular to a training method for an encrypted traffic data classification model and a classification method for encrypted traffic data. Background Art

[0002] At present, traditional abnormal traffic detection methods include the following two: one is a method based on deep packet inspection (DPI), which detects abnormal traffic data (such as attack traffic data) of the network based on a preset rule set, and can detect and defend against attack traffic data with known vulnerabilities and attack characteristics, and achieve high-precision traffic data identification. However, maintaining and updating the rule set is a tedious task. The DPI-based method is not accurate enough for detecting unknown attack traffic data, and it is difficult to process encrypted traffic data; the second is a method based on deep learning, which extracts the traffic characteristics of encrypted traffic data and then classifies the encrypted traffic data, solving the problem that the traffic data is encrypted and cannot be classified. The deep learning-based method mainly relies on a well-labeled data set for model training. However, in the actual network environment, normal traffic data is of various types and extremely common, while the number of abnormal traffic data with malicious attack intentions is small, and new attack traffic data samples are difficult to obtain. Creating a dataset with rich attack traffic data samples and accurate annotations requires a lot of manpower and time costs.

[0003] For the detection of encrypted traffic data, the above-mentioned deep learning-based method has a high cost for obtaining controllable and highly confident encrypted traffic data samples in an experimental environment. However, in the actual network environment, there are a large number of unlabeled encrypted traffic data samples, and among the labeled encrypted traffic data samples, the number of abnormal traffic data samples and normal traffic data samples is unbalanced. Summary of the invention

[0004] The embodiments of the present application provide a training method for an encrypted traffic data classification model and a classification method for encrypted traffic data, so as to solve the technical problems that the cost of obtaining controllable and highly confident encrypted traffic data samples in an experimental environment is high, while in an actual network environment, a large number of unlabeled encrypted traffic data samples exist, and among the labeled encrypted traffic data samples, the number of abnormal traffic data samples and normal traffic data samples is unbalanced.

[0005] In a first aspect, an embodiment of the present application provides a training method for an encrypted traffic data classification model, comprising the following steps.

[0006] The unlabeled first encrypted traffic data sample is subjected to multiple disturbance processing by a data augmenter to generate multiple augmented data samples, and the difference between each augmented data sample and the first encrypted traffic data sample is less than a preset threshold.

[0007] A pseudo-label data sample is determined by a pseudo-label generator according to the plurality of augmented data samples.

[0008] The labeled second encrypted traffic data samples and the pseudo-label data samples are used as training data and input into the initial encrypted traffic data classification model to obtain the predicted classification result output by the initial encrypted traffic data classification model.

[0009] According to the actual classification results corresponding to the training data and the predicted classification results, the model parameters of the initial encrypted traffic data classification model are updated to obtain a trained encrypted traffic data classification model.

[0010] In one embodiment, the data augmenter includes: an encoder, a sampling unit and a decoder, and the encoder and the decoder both include multiple long short-term memory network LSTM layers; the data augmenter performs multiple perturbation processing on the unlabeled first encrypted traffic data sample to generate multiple augmented data samples, including: S1, mapping the first encrypted traffic data sample to a latent space through the multiple LSTM layers in the encoder, and determining the mean and standard deviation of the distribution of latent variables in the latent space; S2, sampling latent variables from the latent space based on the mean and the standard deviation and a preset prior distribution through the sampling unit; S3, generating augmented data samples based on the latent variables through the multiple LSTM layers in the decoder; S4, repeating the above steps S1-S3 until a plurality of augmented data samples meeting a preset number are generated.

[0011] In one embodiment, the pseudo-label generator includes: a first feature extractor and a pseudo-label generating unit, the first feature extractor includes multiple long short-term memory network (LSTM) layers; the pseudo-label generator is used to determine the pseudo-label data sample according to the multiple augmented data samples, including: for each augmented data sample in the multiple augmented data samples, the first feature extractor is used to extract the feature of the augmented data sample to obtain a first traffic feature; the pseudo-label generating unit is used to generate a pseudo-label corresponding to the augmented data sample based on the first traffic feature; the pseudo-label generating unit is used to calculate multiple pseudo-labels to obtain target pseudo-labels corresponding to the multiple augmented data samples, the target pseudo-labels are soft labels in the form of logical Logits values; the pseudo-label generating unit is used to associate the multiple augmented data samples with the target pseudo-labels to obtain the pseudo-label data samples.

[0012] In one embodiment, the initial encrypted traffic data classification model includes: a second feature extractor and a classifier, the second feature extractor includes multiple long short-term memory network LSTM layers; the labeled second encrypted traffic data samples and the pseudo-label data samples are used as training data and input into the initial encrypted traffic data classification model to obtain the predicted classification result output by the initial encrypted traffic data classification model, including: extracting features from the training data through multiple LSTM layers in the second feature extractor to obtain second traffic features; and determining the predicted classification result based on the second traffic features through the classifier.

[0013] In one embodiment, the model parameters of the initial encrypted traffic data classification model are updated according to the actual classification results corresponding to the training data and the predicted classification results to obtain a trained encrypted traffic data classification model, including: determining the loss value between the predicted classification result and the actual classification result according to the target loss function; and updating the model parameters of the initial encrypted traffic data classification model according to the loss value to obtain a trained encrypted traffic data classification model.

[0014] In one embodiment, the method further includes: obtaining an unlabeled first initial encrypted traffic data sample; preprocessing the first initial encrypted traffic data sample to obtain the first encrypted traffic data sample; wherein the preprocessing includes: data cleaning processing, data packet length group alignment processing and conversion processing.

[0015] In a second aspect, an embodiment of the present application provides a method for classifying encrypted traffic data, comprising the following steps.

[0016] Get unlabeled encrypted traffic data.

[0017] The encrypted traffic data is input into an encrypted traffic data classification model to obtain a target classification result output by the encrypted traffic data classification model.

[0018] Among them, the encrypted traffic data classification model is trained based on any training method of the encrypted traffic data classification model in the first aspect.

[0019] In a third aspect, an embodiment of the present application provides a training device for an encrypted traffic data classification model, comprising the following modules.

[0020] The first acquisition module is used to perform multiple perturbations on the unlabeled first encrypted traffic data sample through a data augmenter to generate multiple augmented data samples, and the difference between each augmented data sample and the first encrypted traffic data sample is less than a preset threshold; and determine the pseudo-label data sample according to the multiple augmented data samples through a pseudo-label generator.

[0021] The model training module is used to input the labeled second encrypted traffic data samples and the pseudo-label data samples as training data into the initial encrypted traffic data classification model to obtain the predicted classification results output by the initial encrypted traffic data classification model; according to the actual classification results corresponding to the training data and the predicted classification results, the model parameters of the initial encrypted traffic data classification model are updated to obtain the trained encrypted traffic data classification model.

[0022] In a fourth aspect, an embodiment of the present application provides a classification device for encrypted traffic data, comprising the following modules.

[0023] The second acquisition module is used to acquire unlabeled encrypted traffic data.

[0024] The data classification module is used to input the encrypted traffic data into the encrypted traffic data classification model to obtain the target classification result output by the encrypted traffic data classification model.

[0025] Among them, the encrypted traffic data classification model is trained based on any training method of the encrypted traffic data classification model in the first aspect.

[0026] In a fifth aspect, an embodiment of the present application provides a terminal, including a memory, a transceiver, and a processor.

[0027] A memory for storing computer programs; a transceiver for sending and receiving data under the control of the processor; a processor for reading the computer program in the memory and executing the steps of the training method for the encrypted traffic data classification model of any one of the first aspects, or executing the steps of the classification method for encrypted traffic data of the second aspect.

[0028] In a fourth aspect, an embodiment of the present application provides an electronic device comprising a processor and a memory storing a computer program, wherein when the processor executes the computer program, the processor implements the steps of the training method of any one of the encrypted traffic data classification models described in the first aspect, or implements the steps of the classification method of the encrypted traffic data described in the second aspect.

[0029] In a fifth aspect, an embodiment of the present application further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the training method for the encrypted traffic data classification model described in any one of the first aspects, or implements the steps of the classification method for the encrypted traffic data described in the second aspect.

[0030] In a sixth aspect, an embodiment of the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the training method of any one of the encrypted traffic data classification models described in the first aspect, or implements the steps of the classification method of the encrypted traffic data described in the second aspect.

[0031] The training method of the encrypted traffic data classification model and the classification method of encrypted traffic data provided by the embodiment of the present application are as follows: the training method of the encrypted traffic data classification model performs multiple disturbance processing on the unlabeled first encrypted traffic data sample through a data augmenter to generate multiple augmented data samples, and the difference between each augmented data sample and the first encrypted traffic data sample is less than a preset threshold; the pseudo-label data sample is determined according to the multiple augmented data samples through a pseudo-label generator; the labeled second encrypted traffic data sample and the pseudo-label data sample are used as training data and input into the initial encrypted traffic data classification model to obtain the predicted classification result output by the initial encrypted traffic data classification model; according to the actual classification result and the predicted classification result corresponding to the training data, the model parameters of the initial encrypted traffic data classification model are updated to obtain the trained encrypted traffic data classification model. The training method of the encrypted traffic data classification model organically combines the data augmenter and the pseudo-label generator, makes full use of the unlabeled first encrypted traffic data sample, uses the pseudo-label data sample to expand the training data, increases the amount of data learned by the encrypted traffic data classification model, improves the generalization ability of the encrypted traffic data classification model, and thus improves the classification performance of the encrypted traffic data classification model. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the present application or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0033] Figure 1 It is a flow chart of the training method of the encrypted traffic data classification model provided in the embodiment of the present application.

[0034] Figure 2 It is a structural diagram of a data expander provided in an embodiment of the present application.

[0035] Figure 3 It is a schematic diagram of the structure of the pseudo-label generator provided in an embodiment of the present application.

[0036] Figure 4 It is a flow chart of the method for classifying encrypted traffic data provided in an embodiment of the present application.

[0037] Figure 5 It is a structural diagram of the training device of the encrypted traffic data classification model provided in an embodiment of the present application.

[0038] Figure 6 It is a structural diagram of the classification device for encrypted traffic data provided in an embodiment of the present application.

[0039] Figure 7 It is a schematic diagram of the structure of the terminal provided in the embodiment of the present application.

[0040] Figure 8 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0042] The following further describes the training method of the encrypted traffic data classification model involved in the embodiment of the present application.

[0043] Figure 1 Schematic diagram of the training method of the encrypted traffic data classification model provided in the embodiment of the present application. Figure 1 , an embodiment of the present application provides a training method for an encrypted traffic data classification model, including the following steps 101-104.

[0044] Step 101: Perform multiple disturbance processing on the unlabeled first encrypted traffic data sample through a data augmenter to generate multiple augmented data samples, and the difference between each augmented data sample and the first encrypted traffic data sample is less than a preset threshold.

[0045] The augmented data sample is a sample that is similar to but slightly different from the first encrypted traffic data sample.

[0046] Optionally, the preset threshold value may be set by the data augmenter before leaving the factory, or may be user-defined, and is generally set to a smaller value.

[0047] The electronic device inputs the unlabeled first encrypted traffic data sample into the data augmenter, and performs multiple perturbation processes on the first encrypted traffic data sample through the data augmenter to generate multiple augmented data samples to provide data support for the subsequent determination of the pseudo-label data sample.

[0048] In one embodiment, a data augmenter may include: an encoder, a sampling unit and a decoder, wherein the encoder and the decoder each include a plurality of long short-term memory (LSTM) layers; the electronic device performs multiple perturbations on an unlabeled first encrypted traffic data sample through the data augmenter to generate a plurality of augmented data samples, which may include: S1, the electronic device maps the first encrypted traffic data sample to a latent space through a plurality of LSTM layers in the encoder, and determines a mean and a standard deviation of a distribution of latent variables in the latent space; S2, the electronic device samples latent variables from the latent space through a sampling unit based on the mean and the standard deviation and a preset prior distribution; S3, the electronic device generates augmented data samples based on latent variables through a plurality of LSTM layers in the decoder; S4, the electronic device repeats the above steps S1-S3 until a plurality of augmented data samples satisfying a preset number are generated.

[0049] Among them, the latent space encodes the intrinsic structure and features of the input data. These features and structures may not be easy to directly observe or extract in the original data space, but the input data can be mapped to the latent space through the encoder to form a low-dimensional, easy-to-process representation. The latent space can also be called the hidden space.

[0050] Mean available Indicates; standard deviation is available express.

[0051] The distribution of hidden variables satisfies the normal distribution (also called Gaussian distribution). Hidden variables can also be called potential vectors.

[0052] Exemplarily, the preset prior distribution may be a standard normal distribution.

[0053] Optionally, the preset number may be set before the electronic device leaves the factory, or may be user-defined, which is not specifically limited here.

[0054] For example, Figure 2 Schematic diagram of the structure of the data expander provided in the embodiment of the present application. Figure 2It can be seen that the data augmenter provided in the embodiment of the present application is a variational autoencoder (VAE) based on LSTM, which is used to augment the unlabeled first encrypted traffic data sample. The data augmenter is composed of an encoder, a sampling unit and a decoder. The encoder and the decoder both include multiple LSTM layers. Figure 2 The encoder and decoder in the example both have two LSTM layers. Assuming that the first encrypted traffic data sample is x, step S1, the electronic device inputs the first encrypted traffic data sample x into the encoder, and through the two LSTM layers in the encoder, the first encrypted traffic data sample x is mapped into a distribution in the latent space, and the data distribution information is obtained to determine the mean of the latent variable distribution in the latent space and standard deviation ; Step S2, the electronic device uses a sampling unit based on the mean and standard deviation , combined with the preset prior distribution (such as standard normal distribution), randomly sample from the latent space to obtain the latent variable z, which comes from the mean and standard deviation The normal distribution constituted satisfies the standard normal distribution; step S3, the electronic device inputs the hidden variable z into the decoder, and generates 1 augmented data sample x' based on the hidden variable z through multiple LSTM layers in the decoder; assuming that the preset number is K (K≥2), step S4, the electronic device repeats the above steps S1-S3 K times to generate K augmented data samples x', and the eigenvalues ​​corresponding to the K augmented data samples x' are not exactly the same, but all meet the distribution characteristics of the first encrypted traffic data sample x.

[0055] The data augmentation method involved in the above-mentioned data augmenter is not only a transformation of the input data, but also generates samples that are similar to but slightly different from the input data by learning the potential distribution of the input data. This can effectively avoid the problem that the image data augmentation methods in the existing technology (such as translation, rotation, flipping, scaling and cropping, etc.) are not suitable for traffic data.

[0056] Optionally, the data augmenter is trained based on the following steps: the electronic device inputs an unlabeled first encrypted traffic data sample and an augmented data sample corresponding to the first encrypted traffic data sample into an initial data augmenter to obtain predicted augmented data output by the initial data augmenter; the electronic device determines a loss value between the predicted augmented data and the augmented data sample based on a first loss function; the electronic device updates the model parameters of the initial data augmenter based on the loss value to obtain a trained data augmenter.

[0057] Exemplarily, the calculation formula of the first loss function is: ;in, represents the first loss function; represents the reconstruction loss function; represents the KL (Kullback-Leibler) divergence loss function; Represents the weight coefficient of the KL divergence loss function.

[0058] The purpose of the reconstruction loss function is to make the generated data (i.e., the augmented data sample x') and the input data (i.e., the first encrypted traffic data sample x) as close as possible. The calculation formula of the reconstruction loss function is: .

[0059] The KL divergence loss function measures the approximation between the distribution of latent variables and the preset prior distribution (such as the standard normal distribution). The KL divergence is used as a regular term to make the distribution of the latent variable z in the latent space close to the normal distribution. This is because the noise is sampled from the standard normal distribution. If there is no regular term, the data augmenter will continue to reduce the randomness in order to reduce the reconstruction loss. Without randomness, the data augmenter will not be able to generate various data. Therefore, the data augmenter needs to make the latent variable z satisfy the standard normal distribution. If the latent variable z does not obey the standard normal distribution, the encoder will be penalized in the KL divergence loss function. The calculation formula of the KL divergence loss function is: ;in, represents the standard normal distribution.

[0060] In one embodiment, before step 101, the method may further include: the electronic device obtains an unlabeled first initial encrypted traffic data sample; the electronic device preprocesses the first initial encrypted traffic data sample to obtain a first encrypted traffic data sample; wherein the preprocessing includes: data cleaning processing, data packet length grouping alignment processing and conversion processing.

[0061] The first initial encrypted traffic data sample includes a plurality of sub-initial encrypted traffic data samples; the first encrypted traffic data sample includes a plurality of sub-encrypted traffic data samples, and the plurality of sub-initial encrypted traffic data samples correspond one to one to the plurality of sub-encrypted traffic data samples.

[0062] Optionally, the above data cleaning process may include: removing the Ethernet header, replacing the Internet Protocol (IP) address, aligning the transport layer protocol header, and deleting data packets mainly used to serve the transport layer protocol.

[0063] Among them, removing the Ethernet header: The Ethernet header contains data link layer information, which is necessary for forwarding frames in the network, but has no information value for the encrypted traffic data classification task and may cause overfitting of the data augmenter, so it is necessary to remove the Ethernet header in the first initial encrypted traffic data sample.

[0064] Replace IP address: In order to avoid overfitting of the data augmenter, all IP addresses in the first initial encrypted traffic data sample need to be replaced with 0.0.0.0.

[0065] Align the transport layer protocol headers: Since the minimum length of the Transmission Control Protocol (TCP) packet is 20 bytes, and the length of the User Datagram Protocol (UDP) packet is 8 bytes, the uniform packet header length makes it easier for LSTM to distinguish between the packet header and the traffic payload. The size of the TCP packet header in the first initial encrypted traffic data sample needs to be unified to 20 bytes, and the size of the UDP packet header in the first initial encrypted traffic data sample needs to be padded to 20 bytes.

[0066] Delete data packets mainly used to serve transport layer protocols (for example, SYN (Synchronize Sequence Numbers) packets, ACK (Acknowledge) packets, DNS (Domain Name System) packets, and FIN (Full Interconnection Network) packets, etc.): These data packets are required in the three-way handshake process of establishing or ending a connection, but these data packets do not carry any information about the application that generates them, so these irrelevant data packets need to be deleted.

[0067] The above-mentioned data packet length grouping alignment processing: When using a deep learning model, in order to align the entire data matrix, multiple sub-initial encrypted traffic data samples are usually truncated and padded according to a specific length L. In this case, if the length difference between multiple data packets (multiple sub-initial encrypted traffic data samples) is large, truncation will cause information loss, and padding will cause too many 0s to be padded to samples with smaller lengths, resulting in unnecessary information redundancy, which will cause the accuracy of the data expander to be less than expected. Since the data expander provided in the embodiment of the present application is a variational autoencoder based on LSTM, it can process variable-length inputs, but if only one sub-initial encrypted traffic data sample is trained in one batch, the training speed of the data expander will be too slow, so it is necessary to merge samples of similar length in the multiple sub-initial encrypted traffic data samples after data cleaning into the same batch for training. The electronic device can perform data packet length grouping alignment processing on the multiple sub-initial encrypted traffic data samples after data cleaning according to the byte length range (such as 1 bytes-50 bytes, 51 bytes-100 bytes, 101 bytes-150 bytes, and so on), that is, classification and merging.

[0068] The above conversion process: for each sub-initial encrypted traffic data sample in the multiple sub-initial encrypted traffic data samples after the data packet length group alignment process, the electronic device can use an embedding layer component to convert the sub-initial encrypted traffic data sample into a vector form that can be processed by the encoder in the data expander, that is, the sub-encrypted traffic data sample. The multiple sub-encrypted traffic data samples constitute the first encrypted traffic data sample, and the preprocessing of the first initial encrypted traffic data sample is completed at this time.

[0069] Step 102: Determine a pseudo-label data sample according to a plurality of augmented data samples by using a pseudo-label generator.

[0070] After generating multiple augmented data samples through the data augmenter, the electronic device processes the multiple augmented data samples through the pseudo label generator to obtain pseudo label data samples, which are convenient for subsequent combination with the labeled second encrypted traffic data samples to form training data and train the initial encrypted traffic data classification model.

[0071] In one embodiment, the pseudo-label generator may include: a first feature extractor and a pseudo-label generating unit, the first feature extractor may include multiple long short-term memory network (LSTM) layers; the electronic device determines the pseudo-label data sample according to multiple augmented data samples through the pseudo-label generator, which may include: for each augmented data sample in the multiple augmented data samples, the electronic device extracts features of the augmented data sample through the first feature extractor to obtain a first traffic feature; the electronic device generates a pseudo-label corresponding to the augmented data sample based on the first traffic feature through the pseudo-label generating unit; the electronic device calculates the multiple pseudo-labels through the pseudo-label generating unit to obtain target pseudo-labels corresponding to the multiple augmented data samples, the target pseudo-labels being soft labels in the form of logical Logits values; the electronic device associates the multiple augmented data samples with the target pseudo-labels through the pseudo-label generating unit to obtain pseudo-label data samples.

[0072] Among them, the role of the pseudo-label generator is to preliminarily determine the type (normal traffic / abnormal traffic) of each augmented data sample generated by the data augmenter.

[0073] For example, Figure 3 Schematic diagram of the structure of the pseudo-label generator provided in the embodiment of the present application. Figure 3It can be seen that the pseudo-label generator is composed of a first feature extractor and a pseudo-label generation unit. The first feature extractor can adopt the encoder structure in the data augmenter mentioned above. Since the encoder has learned the potential distribution of the first encrypted traffic data sample, it is an ideal first feature extractor. For each augmented data sample, the electronic device extracts features from the augmented data sample through the first feature extractor to obtain a first traffic feature. Then, the electronic device generates a pseudo-label corresponding to the augmented data sample based on the first traffic feature through the pseudo-label generation unit. In this way, there are as many pseudo labels as there are augmented data samples, and multiple augmented data samples correspond to multiple pseudo labels one by one. The electronic device calculates multiple pseudo labels (for example, takes the average value) through the pseudo label generation unit to obtain an initial pseudo label. The initial pseudo label is a soft label in the form of Logits value, which can avoid the information loss caused by directly outputting the hard label and reduce the risk of potential unlabeled augmented data samples being labeled with incorrect pseudo labels. Next, the electronic device sharpens the initial pseudo label to obtain a target pseudo label. The sharpening process makes the target pseudo label as close as possible to the One-Hot Encoding distribution, so that the decision boundary passes through the low-density area as much as possible, reducing the possibility of misclassification; then, the electronic device associates each augmented data sample with the target pseudo label through the pseudo label generation unit to obtain a pseudo-label data sample, that is, a target pseudo label is labeled for each augmented data sample, and all augmented data samples labeled with the target pseudo label together constitute a pseudo-label data sample, providing clear and low-entropy prediction guidance for the subsequent encrypted traffic data classification model.

[0074] Among them, the calculation formula involved in the above sharpening process is: ;in, Represents the Logits value; T represents the temperature parameter, which can be used to adjust the classification entropy. When the temperature parameter T tends to 0, the target pseudo-label obtained after sharpening tends to be more One-Hot encoding. Reducing the temperature parameter T can obtain a target pseudo-label with lower entropy.

[0075] Optionally, for each augmented data sample, the electronic device generates a pseudo label corresponding to the augmented data sample based on the first traffic feature through a pseudo label generation unit, which may include: the electronic device determines whether the augmented data sample belongs to abnormal traffic based on the first traffic feature through the pseudo label generation unit to obtain a target probability; the electronic device generates a pseudo label corresponding to the augmented data sample according to the target probability through the pseudo label generation unit.

[0076] Among them, the target probability refers to the probability that the augmented data sample belongs to abnormal traffic. The calculation formula of the target probability is: ;in, represents the first flow characteristic; represents a fully connected layer; Represents an activation function.

[0077] Optionally, the pseudo-label generator is trained based on the following steps: the electronic device inputs the labeled second encrypted traffic data sample and the real label corresponding to the second encrypted traffic data sample into the initial pseudo-label generator to obtain a pseudo-label generated by the initial pseudo-label generator; the electronic device determines the loss value between the pseudo-label and the real label based on the second loss function; the electronic device updates the model parameters of the initial pseudo-label generator based on the loss value to obtain a trained pseudo-label generator.

[0078] Exemplarily, the second loss function can be a Focal Loss type loss function. The reason is that in actual situations, if a general loss function such as cross entropy is used, the pseudo-label generator will tend to classify all input data as normal traffic, and the use of methods such as resampling or undersampling will change the original distribution of the input data and may cause problems such as model overfitting.

[0079] The main function of the Focal Loss loss function is to readjust the loss contribution of simple samples (low prediction confidence) and difficult samples (high prediction confidence), and increase the pseudo-label generator's attention to the learning of difficult samples. The calculation formula of the FocalLoss loss function is: ;in, represents the prediction confidence of the second encrypted traffic data sample; Indicates the real label corresponding to the second encrypted traffic data sample; represents the balance factor; represents the modulation factor.

[0080] Balance Factor Mainly adjust the weights of positive and negative samples, modulation factor Dynamically adjust the loss contribution of samples. For samples with higher prediction confidence, the modulation factor A lower weight will be generated, and vice versa. At this time, if the samples are unbalanced, assuming that the negative samples are far more than the positive samples, the pseudo-label generator will inevitably overfit the negative samples in the early stage, and the prediction confidence calculated for all samples will be are very small. The negative sample loss is almost attenuated to 0, while the positive sample loss is almost not attenuated. Only a few positive samples are left to generate losses, and the sample imbalance is automatically resolved.

[0081] Optionally, the method may also include: the electronic device obtains a marked second initial encrypted traffic data sample; the electronic device preprocesses the second initial encrypted traffic data sample to obtain a second encrypted traffic data sample; wherein the preprocessing includes: data cleaning processing, data packet length group alignment processing and conversion processing.

[0082] The process of preprocessing the second initial encrypted traffic data sample by the above-mentioned electronic device is the same as the process of preprocessing the first initial encrypted traffic data sample by the electronic device mentioned above, and will not be described in detail here.

[0083] Step 103: Use the labeled second encrypted traffic data samples and pseudo-label data samples as training data and input them into the initial encrypted traffic data classification model to obtain the predicted classification results output by the initial encrypted traffic data classification model.

[0084] The electronic device uses the labeled second encrypted traffic data samples and the pseudo-label data samples as training data, processes the training data through the initial encrypted traffic data classification model, and obtains the predicted classification result (1 or 0, 1 represents normal traffic, and 0 represents abnormal traffic) output by the initial encrypted traffic data classification model.

[0085] In one embodiment, the initial encrypted traffic data classification model may include: a second feature extractor and a classifier, the second feature extractor may include multiple long short-term memory network LSTM layers; the electronic device inputs the labeled second encrypted traffic data samples and pseudo-label data samples as training data into the initial encrypted traffic data classification model to obtain the predicted classification results output by the initial encrypted traffic data classification model, which may include: the electronic device extracts features from the training data through multiple LSTM layers in the second feature extractor to obtain the second traffic feature; the electronic device determines the predicted classification result based on the second traffic feature through the classifier.

[0086] Among them, the second feature extractor has the same structure as the first feature extractor mentioned above, and will not be described in detail here.

[0087] The electronic device extracts features from the training data through multiple LSTM layers in the second feature extractor to obtain a second flow feature, and then determines a predicted classification result corresponding to the training data based on the second flow feature through a classifier.

[0088] Step 104: Update the model parameters of the initial encrypted traffic data classification model according to the actual classification results and the predicted classification results corresponding to the training data to obtain a trained encrypted traffic data classification model.

[0089] After determining the predicted classification result, the electronic device can update the model parameters of the initial encrypted traffic data classification model according to the actual classification result and the predicted classification result corresponding to the training data, and obtain a trained encrypted traffic data classification model. The training method of the encrypted traffic data classification model organically combines the data augmenter and the pseudo-label generator, makes full use of the unlabeled first encrypted traffic data samples, uses the pseudo-label data samples to expand the training data, increases the amount of data learned by the encrypted traffic data classification model, improves the generalization ability of the encrypted traffic data classification model, and thus improves the classification performance of the encrypted traffic data classification model.

[0090] It should be noted that the encrypted traffic data classification model provided in the embodiment of the present application is a classification model based on semi-supervised learning. The encrypted traffic data classification model can make full use of the information of the unlabeled first encrypted traffic data sample, and only use a small number of labeled second encrypted traffic data samples to make the prediction accuracy of semi-supervised learning close to that of supervised learning that requires a large number of labeled data samples.

[0091] In one embodiment, the electronic device updates the model parameters of the initial encrypted traffic data classification model according to the actual classification results and the predicted classification results corresponding to the training data to obtain a trained encrypted traffic data classification model, which may include: the electronic device determines the loss value between the predicted classification result and the actual classification result according to the target loss function; the electronic device updates the model parameters of the initial encrypted traffic data classification model according to the loss value to obtain a trained encrypted traffic data classification model.

[0092] Exemplarily, the calculation formula of the above objective loss function is: ;in, represents the cross entropy loss function; represents the self-consistent regularization loss function; Represents the weight coefficient of the self-consistent regularization loss function.

[0093] The idea of ​​self-consistent regularization is that similar samples have similar labels. Therefore, for the pseudo-labeled data samples composed of all augmented data samples with target pseudo-labels (referred to as target augmented data samples for short), for multiple target augmented data samples included in the pseudo-labeled data samples, after any target augmented data sample is input into the initial encrypted traffic data classification model, the predicted classification results output by the initial encrypted traffic data classification model should remain self-consistent, that is, the predicted classification results corresponding to multiple target augmented data samples should remain consistent.

[0094] The calculation formula of the self-consistent regularization loss function is: , which is an L2 loss term, where represents the target pseudo label; is a probability function; represents the predicted classification result; x represents the first encrypted traffic data sample; represents the augmented data sample, that is, the augmented data sample x' mentioned above; represents the model parameters of the encrypted traffic data classification model; Represents the squaring operation modulo 2.

[0095] The calculation formula of the cross entropy loss function is: ;in, represents a second encrypted traffic data sample; Indicates the real label corresponding to the second encrypted traffic data sample; Represents the predicted classification result.

[0096] In an embodiment of the present application, a data augmenter is used to perform multiple disturbance processing on an unlabeled first encrypted traffic data sample to generate multiple augmented data samples, and the difference between each augmented data sample and the first encrypted traffic data sample is less than a preset threshold; a pseudo-label data sample is determined based on multiple augmented data samples by a pseudo-label generator; the labeled second encrypted traffic data sample and the pseudo-label data sample are used as training data and input into an initial encrypted traffic data classification model to obtain a predicted classification result output by the initial encrypted traffic data classification model; the model parameters of the initial encrypted traffic data classification model are updated according to the actual classification result and the predicted classification result corresponding to the training data to obtain a trained encrypted traffic data classification model. The training method of the encrypted traffic data classification model organically combines the data augmenter and the pseudo-label generator, makes full use of the unlabeled first encrypted traffic data sample, uses the pseudo-label data sample to expand the training data, increases the amount of data learned by the encrypted traffic data classification model, improves the generalization ability of the encrypted traffic data classification model, and thus improves the classification performance of the encrypted traffic data classification model.

[0097] The following further describes the training method of the encrypted traffic data classification model involved in the embodiment of the present application.

[0098] Figure 4 Schematic diagram of the encrypted traffic data classification method provided in the embodiment of the present application. Figure 4 , an embodiment of the present application provides a classification method for encrypted traffic data, including the following steps 401 and 402.

[0099] Step 401: Obtain unlabeled encrypted traffic data.

[0100] Step 402: Input the encrypted traffic data into the encrypted traffic data classification model to obtain the target classification result output by the encrypted traffic data classification model; wherein the encrypted traffic data classification model is based on Figure 1The encrypted traffic data classification model is trained using the training method shown.

[0101] The target classification result is used to indicate whether the unlabeled encrypted traffic data is abnormal traffic. For example, the target classification result is 1 or 0, 1 indicates normal traffic, and 0 indicates abnormal traffic.

[0102] In the embodiment of the present application, unlabeled encrypted traffic data is obtained; the encrypted traffic data is input into the encrypted traffic data classification model to obtain the target classification result output by the encrypted traffic data classification model; wherein the encrypted traffic data classification model is based on Figure 1 The encrypted traffic data classification model is obtained by training using the training method; the encrypted traffic data classification method does not require human participation, and can automatically determine the target classification results corresponding to the unlabeled encrypted traffic data. While ensuring the classification efficiency, it effectively improves the accuracy of encrypted traffic data classification and helps to accurately identify abnormal traffic.

[0103] The following describes the training device for the encrypted traffic data classification model provided in an embodiment of the present application. The training device for the encrypted traffic data classification model described below and the training method for the encrypted traffic data classification model described above can be referenced to each other.

[0104] Figure 5 Schematic diagram of the structure of the training device of the encrypted traffic data classification model provided in the embodiment of the present application. Figure 5 , an embodiment of the present application provides a training device for an encrypted traffic data classification model, including the following first acquisition module 501 and model training module 502.

[0105] The first acquisition module 501 is used to perform multiple perturbations on the unlabeled first encrypted traffic data sample through a data augmenter to generate multiple augmented data samples, and the difference between each augmented data sample and the first encrypted traffic data sample is less than a preset threshold; and determine a pseudo-label data sample based on the multiple augmented data samples through a pseudo-label generator.

[0106] The model training module 502 is used to input the labeled second encrypted traffic data sample and the pseudo-label data sample as training data into the initial encrypted traffic data classification model to obtain the predicted classification result output by the initial encrypted traffic data classification model; according to the actual classification result corresponding to the training data and the predicted classification result, the model parameters of the initial encrypted traffic data classification model are updated to obtain a trained encrypted traffic data classification model.

[0107] Optionally, the data augmenter includes: an encoder, a sampling unit and a decoder, the encoder and the decoder both include multiple long short-term memory network LSTM layers; a first acquisition module 501, specifically used for S1, mapping the first encrypted traffic data sample to a latent space through multiple LSTM layers in the encoder, and determining the mean and standard deviation of the distribution of latent variables in the latent space; S2, through the sampling unit, based on the mean and the standard deviation, combined with a preset prior distribution, sampling latent variables from the latent space; S3, through the multiple LSTM layers in the decoder, based on the latent variables, generating augmented data samples; S4, repeating the above steps S1-S3 until a plurality of augmented data samples that meet a preset number are generated.

[0108] Optionally, the pseudo-label generator includes: a first feature extractor and a pseudo-label generating unit, the first feature extractor including multiple long short-term memory network (LSTM) layers; a first acquisition module 501, specifically used to perform feature extraction on the augmented data sample for each of the multiple augmented data samples through the first feature extractor to obtain a first traffic feature; generate a pseudo-label corresponding to the augmented data sample based on the first traffic feature through the pseudo-label generating unit; calculate multiple pseudo-labels through the pseudo-label generating unit to obtain target pseudo-labels corresponding to the multiple augmented data samples, the target pseudo-labels being soft labels in the form of logical Logits values; and associate the multiple augmented data samples with the target pseudo-labels through the pseudo-label generating unit to obtain the pseudo-label data samples.

[0109] Optionally, the initial encrypted traffic data classification model includes: a second feature extractor and a classifier, the second feature extractor including multiple long short-term memory network LSTM layers; a model training module 502, specifically used to perform feature extraction on the training data through multiple LSTM layers in the second feature extractor to obtain a second traffic feature; and through the classifier, determine the predicted classification result based on the second traffic feature.

[0110] Optionally, the model training module 502 is specifically used to determine the loss value between the predicted classification result and the actual classification result according to the target loss function; according to the loss value, the model parameters of the initial encrypted traffic data classification model are updated to obtain a trained encrypted traffic data classification model.

[0111] Optionally, the first acquisition module 501 is also used to obtain an unlabeled first initial encrypted traffic data sample; preprocess the first initial encrypted traffic data sample to obtain the first encrypted traffic data sample; wherein the preprocessing includes: data cleaning processing, data packet length group alignment processing and conversion processing.

[0112] The following is a description of a classification device for encrypted traffic data provided in an embodiment of the present application. The classification device for encrypted traffic data described below and the classification method for encrypted traffic data described above can be referenced to each other.

[0113] Figure 6 Schematic diagram of the structure of the encrypted traffic data classification device provided in the embodiment of the present application. Figure 6 , an embodiment of the present application provides a classification device for encrypted traffic data, including the following second acquisition module 601 and data classification module 602.

[0114] The second acquisition module 601 is used to acquire unlabeled encrypted traffic data.

[0115] The data classification module 602 is used to input the encrypted traffic data into the encrypted traffic data classification model to obtain the target classification result output by the encrypted traffic data classification model; wherein the encrypted traffic data classification model is based on Figure 1 The encrypted traffic data classification model is trained using the training method shown.

[0116] The terminal involved in the embodiments of the present application may be a device that provides voice and / or data connectivity to a user, a handheld device with a wireless connection function, or other processing devices connected to a wireless modem, etc. In different systems, the name of the terminal device may also be different. For example, in a 5G system, the terminal device may be called a user equipment (UE).

[0117] Figure 7 is a schematic diagram of the structure of the terminal provided in the embodiment of the present application, referring to Figure 7 , an embodiment of the present application further provides a terminal, which may include: a memory 710, a transceiver 720 and a processor 730.

[0118] The memory 710 is used to store computer programs; the transceiver 720 is used to send and receive data under the control of the processor 730; the processor 730 is used to read the computer program in the memory 710 and execute the steps of the training method of the above-mentioned encrypted traffic data classification model, or execute the steps of the above-mentioned encrypted traffic data classification method.

[0119] exist Figure 7In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically one or more processors represented by processor 730 and various circuits of memory represented by memory 710 are linked together. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 720 may be a plurality of components, including a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium. For different user devices, the user interface 740 may also be an interface capable of externally connecting to the required internal devices.

[0120] The processor 730 is responsible for managing the bus architecture and general processing, and the memory 710 can store data used by the processor 730 when performing operations.

[0121] The processor 730 is used to execute any of the methods provided in the embodiments of the present application according to the obtained executable instructions by calling the computer program stored in the memory 710. The processor and the memory may also be arranged physically separately.

[0122] It should be noted here that the terminal provided in the embodiment of the present application can implement all the method steps implemented in the above method embodiment and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as those in the method embodiment will not be described in detail here.

[0123] Figure 8 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application, such as Figure 8 As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830 and a communication bus 840, wherein the processor 810, the communication interface 820 and the memory 830 communicate with each other through the communication bus 840. The processor 810 may call the computer program in the memory 830 to execute the steps of the above-mentioned training method of the encrypted traffic data classification model, or execute the steps of the above-mentioned classification method of the encrypted traffic data.

[0124] In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0125] On the other hand, an embodiment of the present application also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the steps of the training method of the above-mentioned encrypted traffic data classification model, or execute the steps of the above-mentioned encrypted traffic data classification method.

[0126] On the other hand, an embodiment of the present application also provides a processor-readable storage medium, which stores a computer program, and the computer program is used to enable the processor to execute the steps of the training method of the above-mentioned encrypted traffic data classification model, or to execute the steps of the above-mentioned encrypted traffic data classification method.

[0127] The processor-readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor storage (such as ROM, EPROM, EEPROM, non-volatile memory (NANDFLASH), solid-state drive (SSD)), etc.

[0128] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0129] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0130] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A training method for an encrypted traffic data classification model, characterized in that: include: Performing multiple perturbations on the unlabeled first encrypted traffic data sample by a data augmenter to generate multiple augmented data samples, wherein the difference between each augmented data sample and the first encrypted traffic data sample is less than a preset threshold; Determining, by a pseudo-label generator, a pseudo-label data sample based on the plurality of augmented data samples; Input the labeled second encrypted traffic data sample and the pseudo-label data sample as training data into the initial encrypted traffic data classification model to obtain a predicted classification result output by the initial encrypted traffic data classification model; According to the actual classification results corresponding to the training data and the predicted classification results, the model parameters of the initial encrypted traffic data classification model are updated to obtain a trained encrypted traffic data classification model.

2. The method for training an encrypted traffic data classification model according to claim 1, characterized in that: The data augmenter includes: an encoder, a sampling unit, and a decoder, wherein the encoder and the decoder each include a plurality of long short-term memory (LSTM) layers; the data augmenter performs multiple perturbations on the unlabeled first encrypted traffic data sample to generate a plurality of augmented data samples, including: S1. Mapping the first encrypted traffic data sample to a latent space through multiple LSTM layers in the encoder, and determining the mean and standard deviation of the latent variable distribution in the latent space; S2. Using the sampling unit, based on the mean and the standard deviation, combined with a preset prior distribution, sampling from the latent space to obtain latent variables; S3. Generate augmented data samples based on the latent variables through multiple LSTM layers in the decoder; S4. Repeat the above steps S1-S3 until a plurality of augmented data samples meeting a preset number are generated.

3. The training method of the encrypted traffic data classification model according to claim 1 is characterized in that: The pseudo-label generator includes: a first feature extractor and a pseudo-label generation unit, wherein the first feature extractor includes multiple long short-term memory network (LSTM) layers; and determining the pseudo-label data sample based on the multiple augmented data samples by the pseudo-label generator includes: For each augmented data sample among the plurality of augmented data samples, extract a feature of the augmented data sample by the first feature extractor to obtain a first traffic feature; and generate a pseudo label corresponding to the augmented data sample based on the first traffic feature by the pseudo label generating unit; The pseudo-label generation unit calculates multiple pseudo-labels to obtain target pseudo-labels corresponding to the multiple augmented data samples, where the target pseudo-labels are soft labels in the form of logical Logits values; The pseudo-label generating unit associates the plurality of augmented data samples with the target pseudo-labels respectively to obtain the pseudo-label data samples.

4. The training method of the encrypted traffic data classification model according to claim 1 is characterized in that: The initial encrypted traffic data classification model includes: a second feature extractor and a classifier, wherein the second feature extractor includes multiple long short-term memory network (LSTM) layers; the labeled second encrypted traffic data sample and the pseudo-label data sample are input as training data into the initial encrypted traffic data classification model to obtain a predicted classification result output by the initial encrypted traffic data classification model, including: Performing feature extraction on the training data through multiple LSTM layers in the second feature extractor to obtain a second traffic feature; The predicted classification result is determined by the classifier based on the second traffic feature.

5. The training method of the encrypted traffic data classification model according to claim 1 is characterized in that: The updating of the model parameters of the initial encrypted traffic data classification model according to the actual classification result corresponding to the training data and the predicted classification result to obtain a trained encrypted traffic data classification model includes: Determining a loss value between the predicted classification result and the actual classification result according to a target loss function; According to the loss value, the model parameters of the initial encrypted traffic data classification model are updated to obtain a trained encrypted traffic data classification model.

6. The method for training an encrypted traffic data classification model according to any one of claims 1 to 5, characterized in that: The method further comprises: Obtaining an unlabeled first initial encrypted traffic data sample; Preprocessing the first initial encrypted traffic data sample to obtain the first encrypted traffic data sample; The pre-processing includes: data cleaning processing, data packet length group alignment processing and conversion processing.

7. A classification method for encrypted traffic data, characterized in that: include: Obtain unlabeled encrypted traffic data; Inputting the encrypted traffic data into an encrypted traffic data classification model to obtain a target classification result output by the encrypted traffic data classification model; The encrypted traffic data classification model is obtained by training based on the training method of the encrypted traffic data classification model according to any one of claims 1 to 6.

8. A training device for an encrypted traffic data classification model, characterized in that: include: a first acquisition module, configured to perform multiple perturbations on the unlabeled first encrypted traffic data sample through a data augmenter to generate multiple augmented data samples, wherein the difference between each augmented data sample and the first encrypted traffic data sample is less than a preset threshold; Determining, by a pseudo-label generator, a pseudo-label data sample based on the plurality of augmented data samples; A model training module is used to input the labeled second encrypted traffic data sample and the pseudo-label data sample as training data into the initial encrypted traffic data classification model to obtain a predicted classification result output by the initial encrypted traffic data classification model; According to the actual classification results corresponding to the training data and the predicted classification results, the model parameters of the initial encrypted traffic data classification model are updated to obtain a trained encrypted traffic data classification model.

9. A classification device for encrypted traffic data, characterized in that: include: The second acquisition module is used to obtain unlabeled encrypted traffic data; A data classification module, configured to input the encrypted traffic data into an encrypted traffic data classification model to obtain a target classification result output by the encrypted traffic data classification model; The encrypted traffic data classification model is obtained by training based on the training method of the encrypted traffic data classification model according to any one of claims 1 to 6.

10. An electronic device comprising a processor and a memory storing a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the training method of the encrypted traffic data classification model described in any one of claims 1 to 6, or implements the steps of the classification method of encrypted traffic data described in claim 7.

Images