Malicious encrypted traffic detection model based on pre-training

Abstract

The invention discloses a malicious encrypted traffic detection model based on pre-training, and belongs to the field of network security. According to the model, a pre-training thought is used, a general field coding model is learned by using a large amount of label-free traffic data, and the pre-training model is finely adjusted in a downstream task, so that the pre-training model is more suitable for a malicious encrypted traffic detection task. Besides, the model learns features from two kinds of modal data, including original flow data and side channel data, learns flow content features from the original flow data, and learns flow time sequence features from the side channel data, so that comprehensive description of the flow is realized, and the classification accuracy can be effectively improved. The malicious encrypted traffic is effectively detected, and the method can be used for overcoming the defects of an existing network intrusion detection system. The model does not need to carry out decryption operation on the encrypted traffic, and the malicious encrypted traffic is detected while the privacy of the user is ensured.

Description

Technical Field

[0001] The invention relates to a malicious encrypted traffic detection model based on pre-training, and belongs to the field of network security. Background Art

[0002] In recent years, Internet users have become more concerned about their privacy, which has led to the widespread use of encryption protocols. According to statistics, the proportion of encrypted traffic on the Internet has increased from about 50% in 2014 to about 95%. Unfortunately, this has facilitated the spread of malware and posed new challenges to the detection of malicious traffic. The characteristics of encrypted traffic are significantly different from those of unencrypted traffic. Existing detection technologies for unencrypted traffic cannot be directly transplanted to the detection of encrypted traffic. It is urgent to study new algorithms to solve the problem of malicious encrypted traffic detection.

[0003] At present, researchers mainly use detection methods based on machine learning and deep learning. This detection method does not require decryption of data packets, ensuring user privacy. However, how to make this method have excellent performance is a new problem that comes with it. The performance of this method is mainly determined by the feature set and algorithm. Regarding the research on feature sets, considering that the handshake packets of encrypted traffic and the headers of ciphertext packets are still transmitted in plain text, and the plain text contains effective information that can be used to classify malicious flows, researchers have extracted plain text features for malicious encrypted traffic detection and obtained relatively good detection results. However, the use of plain text features has certain limitations. On the one hand, extracting plain text features requires prior knowledge. On the other hand, plain text features are often not discrete, but related. For example, the Cipher Specs field of ClientHello and the Cipher Suite field of ServerHello in the TLS protocol are in a relationship between alternatives and selections. Moreover, this relationship is diverse and dynamic, and it is difficult to design suitable features to represent it. In recent years, representation learning has been widely used. The idea of ​​representation learning is to self-mine features through deep learning models. Its benefits are that it avoids the subjective problem caused by artificial selection of feature sets, and secondly, it can learn non-intuitive features that humans cannot find using deep learning models. However, how to design a reasonable deep learning model to learn effective encrypted traffic classification features still needs further research. In addition, traditional deep learning is highly dependent on the size of the training set and data distribution, resulting in poor model generalization and difficulty in adapting to unseen encrypted traffic.

[0004] In response to these two problems, conducting research on malicious encrypted traffic detection models based on pre-training is an issue that urgently needs to be addressed in this field. Summary of the invention

[0005] The purpose of the present invention is to propose a malicious encrypted traffic detection model based on pre-training, in view of the fact that the existing traffic detection models are highly dependent on the size of the training set and the data distribution problem and the shortcomings of the research on the extraction of encrypted traffic features using representation learning. A large amount of unlabeled encrypted traffic data is used to pre-train a model that can capture general inter-field correlations. Then, the model is fine-tuned according to the malicious encrypted traffic detection task to learn inter-field correlation features that are more suitable for the detection task. In addition, side channel features are also commonly used features for detecting malicious encrypted traffic, which have been proven to be used to obtain important information such as user network behavior. We also selected the three most commonly used side channel features as a supplement to the inter-field correlation features to achieve high accuracy in malicious encrypted traffic detection.

[0006] In order to achieve the above object, the technical solution adopted by the present invention is as follows:

[0007] A malicious encrypted traffic detection model based on pre-training, the model includes: a data pre-processing stage, a feature learning stage and a classification stage;

[0008] The data preprocessing stage includes traffic segmentation, extraction of original traffic data and traffic side channel data, traffic slicing and traffic visualization;

[0009] Traffic segmentation, first obtain the capture files of encrypted traffic using various protocols from the public data set. The file format is pcap or pcapng. Secondly, use the tshark tool to convert the pcapng format file into a pcap format file. Finally, use the splitcap tool to split the encrypted traffic into bidirectional streams according to the five-tuple (source IP address, source port number, destination IP address, destination port number, transport layer protocol), and save each bidirectional stream as a pcap file.

[0010] Extraction of raw traffic data and traffic side channel data,First, use the scapy toolkit to obtain the raw traffic data from the pcap file and convert the raw data into hexadecimal representation, then use the flowcontainer toolkit to extract information such as IP packet length, packet direction, IP timestamp, etc.

[0011] Traffic slicing, because the data packet field contains biased data such as IP address, port number, MAC address, so first cut off the first 38 bytes of the data packet, these 38 bytes contain 14 bytes of Ethernet frame header, 20 bytes of IP data packet header and 4 bytes of source port number and destination port number, then retain the first 784 bytes of the bidirectional flow,

[0012] Traffic visualization: convert each 786-byte bidirectional flow into a 28*28*1 grayscale image for visualization, where each pixel in the image represents one byte.

[0013] The feature learning stage includes two modules, namely, an inter-field association feature learning module and a side channel feature learning module;

[0014] The field association feature learning module includes two stages: the pre-training stage and the fine-tuning stage.

[0015] During the pre-training phase, most of the data in encrypted traffic is encrypted random bytes with no real meaning. To effectively use pre-training techniques for malicious encrypted traffic classification, we use the following two components: (1) an embedding method from a CV perspective to convert the 2D grayscale image of the bidirectional flow into a pattern-preserving token. (2) A pre-training task, the bidirectional flow mask model, is used to learn contextualized network flow representations from transition contexts rather than semantic contexts.

[0016] Furthermore, the fields in the feature learning phase are associated with two components of the pre-training phase in the feature learning module.

[0017] The embedding method is used to embed the bidirectional flow graph into tokens. First, token embedding is performed, and then position embedding is performed. In the token embedding step, a network flow graph with a shape of h*w*c is divided into n shapes of p 2 *c. To comply with the permutation invariance principle, simple convolutional layers and flattening operations are used to implement token embeddings with a dimension of D. The n patches are converted into n token embeddings with a dimension of D. In the position embedding step, fixed sine-cosine position encoding is used to implement position embeddings to add relative position information. The n position embeddings are added to the n token embeddings and a [CLS] token is inserted at the front, which indicates the start of the token sequence.

[0018] The bidirectional stream mask model is used to learn contextualized bidirectional stream representations. The basic model of this model is the Transformer encoder, which is completely based on the self-attention mechanism model and has the advantages of parallel computing and shortest maximum path length. The task to be completed by the bidirectional stream mask model is to restore the masked tokens. Specifically, the tokens in the token sequence of the input model are randomly masked with a probability of 15%, and the masked tokens have an 80% probability of being replaced with [Mask] tokens, and a 10% probability of selecting a random token to replace or remain unchanged. Then, these masked tokens are used as supervision signals to allow the model to recover the masked tokens through contextual information. We use cross entropy to measure the training error. Assuming that k token embeddings are randomly masked, the loss function is defined as follows:

[0019]

[0020] Among them, θ represents all the parameters of the model, Represents the Token sequence with mask input to the model.

[0021] In the fine-tuning stage, in the pre-training stage, a general bidirectional flow feature representation is trained through the bidirectional flow mask model. This feature representation is independent of the traffic type, so the pre-trained model can be well adapted to various downstream tasks. The downstream task in the present invention is malicious encrypted traffic detection, so in the fine-tuning stage, the bidirectional flow of the malicious encrypted traffic detection task is pre-processed and embedded and then input into the model. After being processed by the model, the hidden vector corresponding to the output of the [CLS] token, raw_h_fea cls , as the bidirectional flow-level features learned from the original traffic, are fed into the model in the classification stage. Compared with pre-training, fine-tuning has a lower time cost and can train good results in less time.

[0022] Side channel feature learning module, the present invention selects a triple (packet size, arrival interval time and packet direction) to learn side channel features. The reason for selecting packet size and packet direction is that the packet size distribution of malicious traffic is often different from the distribution of normal traffic and is related to the packet size distribution flow direction. For example, when browsing the web, the request packet from the client to the server is usually short, and the response packet from the server to the client is very long, but the malware is completely the opposite. The server only sends a small number of control commands to the client, and the client sends a large number of packets to the server because of data backhaul. Second, in order to adapt to the neural network, the feature of packet length is often lost. Because, during the data preprocessing process, the data packet will be padded or truncated to ensure the consistency of the length of the data packet. There is also a large difference in the distribution of the time interval between malicious traffic and normal traffic. According to statistics, about 80% of the time interval of malicious traffic is within 0.1s, while only about 25% of the time interval of benign traffic is within 0.1s. Therefore, we choose these three data packet metadata as a supplement to the original data.

[0023] Use BiLSTM to learn the temporal features of triples. Define m_vec i is the metadata vector of packet i. The vector elements are f1, f2, and f3, which respectively refer to the packet size, arrival interval time, and packet direction. {m_vec1, m_vec2, ..., m_vec n} is the input sequence of BiLSTM. The BiLSTM model is used to obtain the metadata hidden features {sup_h_fea1,sup_h_fea2,...,sup_h_fea n}, the formula is as follows:

[0024]

[0025] Among them, the symbol Indicates concatenation. The output of the last time of BiLSTM, sup_h_fea n ,As a supplementary network flow level feature, it is fed into the model in the subsequent classification stage.

[0026] In the classification stage, raw_h_fea cls and sup_h_fea n Concatenate them and then pass them through the fully connected layer and softmax layer for classification. cls and sup_h_fea n The motivation is to combine the best features learned from the two modalities. However, due to the black box characteristics of the neural network, it may learn two difference features, and then use this difference feature to continuously update the parameters of the fully connected layer in the fully connected layer. To ensure that the model can be optimized to the model parameters in the inter-field association feature learning module and the side channel feature learning module, we set the loss used to update the parameters to the arithmetic average of the inter-field association feature learning module loss, the side channel feature learning module loss and the overall model loss.

[0027] Specifically, the feature learning module and the side channel feature learning module are associated between fields to obtain raw_h_fea cls and sup_h_fea n After that, we first perform full connection + softmax operation on them to get the prediction results y1 and y2. Then we convert raw_h_fea cls and sup_h_fea n They are concatenated and classified again through full connection + softmax operation to obtain the final classification result y3. Correspondingly, in each of the above parts, the cross entropy function is used as their loss function, so the respective loss values ​​loss1, loss2 and loss3 are obtained respectively. The loss loss of the entire model is the arithmetic average of the above three losses, and its formula is as follows:

[0028]

[0029] y3=softmax(W3·Concat(raw_h_fea cls +sup_h_fea n )+b3)

[0030]

[0031] Among them, is the parameter of the corresponding fully connected layer, is the number of training samples, and L jis the label of the jth network flow. Note that the model only uses loss in the training phase to guide the neural network to learn the two best parts, while in the test phase, the model only uses loss3 because the model has been trained and its parameters are no longer updated. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0033] Figure 1 This is an architectural diagram of the pre-trained malicious encrypted traffic detection model described in the present invention.

[0034] Figure 2 This is a flowchart of the training of the pre-trained malicious encrypted traffic detection model described in the present invention. DETAILED DESCRIPTION

[0035] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0036] The present invention discloses a malicious encrypted traffic detection model based on pre-training. The model uses the idea of ​​pre-training, utilizes a large amount of unlabeled traffic data to learn a general field encoding model, and fine-tunes the pre-trained model in downstream tasks to make it more suitable for malicious encrypted traffic detection tasks. In addition, the model learns features from two modal data, namely original traffic data and side channel data, learns traffic content features from original traffic data, and learns traffic timing features from side channel data, which achieves a comprehensive characterization of traffic and can effectively improve classification accuracy. The present invention realizes effective detection of malicious encrypted traffic and can be used to make up for the deficiencies of existing network intrusion detection systems. The model does not need to perform decryption operations on encrypted traffic, and realizes detection of malicious encrypted traffic while ensuring user privacy.

[0037] Figure 1 What is shown is an architecture diagram of the pre-trained malicious encrypted traffic detection model described in the present invention.

[0038] Specifically, it includes the feature learning stage and the classification stage.

[0039] The feature learning phase includes two modules, namely the inter-field association feature learning module and the side channel feature learning module. The field association feature learning module includes two stages, namely the pre-training stage and the fine-tuning stage. In the pre-training stage, the model is trained using unlabeled encrypted traffic. The shape of each patch input to the model is 2*2*1. After a simple convolution layer and flattening, the token embedding is obtained. The token embedding is added to the fixed sine and cosine position encoding to obtain the final token embedding, which is then input into the encoder of the basic model Transformer. Among them, the encoder hyperparameter configuration is 12 encoder layers, 12-head attention mechanism, 768-dimensional hidden vector, 3072-dimensional feedforward neural network output, and gelu activation function. The training task of the pre-trained model is to recover the masked token. The masking rule of the token is that the token in the token sequence of the input model is randomly masked with a probability of 15%, and the selected masked token has an 80% probability of being replaced with a [Mask] token, and a 10% probability of selecting a random token to replace or remain unchanged.

[0040] The fine-tuning phase does not modify the architecture of the pre-trained model, and reuses the model parameters that have been trained in the pre-training phase, but the data for training the model is replaced with labeled encrypted traffic data for a specific task. The shape of the patch input to the model remains unchanged, and the output matrix only takes the hidden vector corresponding to the output of the [CLS] token and feeds it into the subsequent classification phase model.

[0041] Side channel feature learning module, in which BiLSTM is used to learn the timing features of bidirectional flows. The packet size, window size, arrival time interval and packet direction form a vector of dimension 3 as the input of BiLSTM, and only the output of the last moment is taken and sent to the classification stage model.

[0042] The classification model consists of a fully connected layer and a softmax layer. The output of the field association feature module and the features of the side channel feature learning module are concatenated, and the concatenated vector is used as the input of the fully connected layer. After passing through a fully connected layer, it is input into the softmax for classification.

[0043] Figure 2 This is a flowchart of the training of the pre-trained malicious encrypted traffic detection model described in the present invention.

[0044] Step S201: Obtain capture files of encrypted traffic using various protocols from public datasets (dataCon, ISCX-VPN, USTCTFC2016, CIC-AndMal2017). The file format is pcap or pcapng. A total of about 30G of unlabeled encrypted traffic is obtained for pre-training model training. If you want to obtain labeled encrypted traffic for fine-tuning, you only need to manage the pcap files by dataset and use the label as the folder name.

[0045] Step S202: First, use the tshark tool to convert the pcapng format file into a pcap format file, and then use the splitcap tool to split the encrypted traffic into bidirectional streams according to the five-tuple (source IP address, source port number, destination IP address, destination port number, transport layer protocol), and save each bidirectional stream as a pcap file.

[0046] Step S203: Use the rdpcap method in the scapy toolkit to obtain the original traffic data from the pcap file and convert the original data into hexadecimal representation; if you want to obtain information such as the IP data packet length, data packet direction, IP timestamp, etc., use the extract method in the flowcontainer toolkit to extract the IP data packet length, data packet direction, IP timestamp, etc.

[0047] Step S204: Because the data packet field contains biased data such as IP address, port number, and MAC address, the first 38 bytes of the data packet are cut off, which include a 14-byte Ethernet frame header, a 20-byte IP packet header, and a 4-byte source port number and destination port number. Then we retain the first 784 bytes of the bidirectional flow and convert each 786-byte bidirectional flow into a 28*28*1 grayscale image for visualization. Each pixel in the image represents one byte.

[0048] Step S205: Convert these images into IDX format files, and persistently store visualized unlabeled encrypted traffic for subsequent training of pre-trained models.

[0049] Step S206: Use the pytorch framework to build a pre-trained model. The structure of the pre-trained model from bottom to top is a convolutional layer, a coding block in a 12-layer Transformer, a fully connected layer, and a softmax classifier. The function of the convolutional layer is to embed the bidirectional flow graph into the token. Specifically, this layer first divides a network flow graph of shape h*w*c into n shapes of p 2*c patch, and secondly, token embedding is achieved through a simple convolutional layer and flattening operation. Again, the token embedding is added with the fixed sine and cosine position encoding to inject position information into the token embedding. Finally, the [CLS] token is inserted at the front of the sequence. The [CLS] token indicates the beginning of the token sequence. After the model is built, the optimizer, data loader, model parameter initialization method and loss function are configured for the model, and then the model training is started. The training task of the pre-trained model designed by the present invention is to restore the masked tokens during input. The rule for masking tokens during input is that the tokens (except the [CLS] tokens) are randomly masked with a probability of 15%. The token selected to be masked has an 80% probability of being replaced by the [Mask] token, and a 10% probability of selecting a random token (except the [CLS] token) to replace or remain unchanged. For this training task, the loss function set is as follows:

[0050]

[0051] Among them, θ represents all the parameters of the model, Represents the token sequence with mask input to the model. The calculation process of the multi-head attention mechanism, the core part of the pre-trained model, is as follows:

[0052]

[0053] head i =Attention(QW i Q ,K i K ,VW i V ),1≤i≤h

[0054] MultiHead(Q,K,V)=Concat(head1,...,head h )W O

[0055] Among them, d k is the dimension of k, W Q ,W K ,W V and W O are different linear transformation matrices.

[0056] Step S207: Output the trained model and save it persistently for use in fine-tuning.

[0057] Step S208: At this point, the training of the pre-trained model has been completed, and next, the model is fine-tuned. First, it is necessary to repeat steps S201-S205 to obtain visualized labeled encrypted traffic, and then use pytorch to build a fine-tuning model. The structure of the fine-tuning model designed by the present invention is a convolutional layer, an encoder, and a decoder from bottom to top. Among them, the encoder is composed of two models in parallel, namely the encoding block and BiLSTM in the 12-layer Transformer, and the decoder is composed of a fully connected layer and a softmax classifier. The encoder and the decoder are connected in such a way that the vectors output by the two encoders are concatenated and input into the decoding. The design of the convolutional layer is the same as step S206. After the model is built, configure the optimizer, data loader, model parameter initialization method and set the loss function for the model. The model parameter initialization method is that the convolutional layer and the 12-layer Transformer reuse the parameters of the pre-trained model, and the other parts use normal distribution to initialize the parameters. It should be noted that after the convolution layer, only the encoding block in the 12-layer Transformer is connected, not the BiLSTM. The bidirectional flow graph is input into the convolution layer, and the vector consisting of the IP data packet length, data packet direction, and arrival time interval is input into the BiLSTM. In order to ensure that the model can be optimized to the two models in the encoder, the present invention sets the loss function as the arithmetic mean of the losses of the inter-field association feature learning module, the side channel feature learning module, and the overall fine-tuning model, and uses the cross entropy function as the loss function of the three to obtain their respective loss values ​​loss1, loss2, and loss3. The loss loss of the entire model is the arithmetic mean of the above three losses, and its formula is as follows:

[0058]

[0059] y3=softmax(W3·Concat(raw_h_fea cls +sup_h_fea n )+b3)

[0060]

[0061] Among them, is the parameter of the corresponding fully connected layer, is the number of training samples, and L j is the label of the jth network flow. Note that the model only uses loss in the training phase to guide the neural network to learn the two best parts, while in the test phase, the model only uses loss3 because the model has been trained and its parameters are no longer updated.

[0062] The above descriptions are merely embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention are included in the protection scope of the present invention.

Claims

1. A pre-trained malicious encrypted traffic detection model, Features: include: Data preprocessing stage, feature learning stage and classification stage; The data preprocessing stage is used to extract the original traffic data and IP packet length, IP data stamp, packet direction and other data from the pcap file and visualize them; In the feature learning stage, the pre-training idea is used to learn the correlation features between fields from a large amount of unlabeled original encrypted traffic data to describe the content information of the traffic. The BiLSTM model is used to learn the time series features of the side channel data to describe the user's network behavior information; The classification phase uses the encrypted traffic features learned in the feature learning phase to classify the encrypted traffic, in order to find malicious encrypted traffic in the network or classify malicious encrypted traffic.

2. The data preprocessing stage according to claim 1, Features: include: Traffic segmentation, extraction of raw traffic data and traffic side channel data, traffic slicing, and traffic visualization; Traffic segmentation,First, obtain the capture files of encrypted traffic using various protocols from public data sets (dataCon, ISCX-VPN, USTCTFC2016, CIC-AndMal2017), the file format is pcap or pcapng, then use the tshark tool to convert the pcapng format files into pcap format files, finally, use the splitcap tool to split the encrypted traffic into bidirectional flows according to the five-tuple (source IP address, source port number, destination IP address, destination port number, transport layer protocol), and save each bidirectional flow as a pcap file; Extraction of raw traffic data and traffic side channel data. First, use the rdpcap method in the scapy toolkit to obtain raw traffic data from the pcap file and convert the raw data into hexadecimal representation. Then, use the extract method in the flowcontainer toolkit to extract information such as IP packet length, packet direction, and IP timestamp. Traffic slicing,First, because the data packet field contains biased data such as IP address, port number, and MAC address, the first 38 bytes of the data packet are cut off. These 38 bytes include a 14-byte Ethernet frame header, a 20-byte IP packet header, and a 4-byte source port number and destination port number. Then, the first 784 bytes of the bidirectional flow are retained; Traffic visualization: Each 786-byte bidirectional flow is converted into a 28*28*1 grayscale image for visualization; each pixel in the image represents one byte.

3. The feature learning phase according to claim 1, Features: Contains: inter-field correlation feature learning module and side channel feature learning module; The inter-field correlation feature learning module is used to learn the inter-field correlation features using a large amount of unlabeled original encrypted traffic data using the pre-training idea; The side channel feature learning module is used to learn the timing characteristics of the side channel data. The triplet (packet size, inter-arrival time and packet direction) is selected to learn the side channel timing characteristics through BiLSTM.

4. The inter-field association feature learning module according to claim 3, Features: It consists of two components: (1) an embedding method from a CV perspective, which converts the 2D grayscale image of the bidirectional flow into a pattern-preserving token; (2) a pre-training task, the bidirectional flow mask model, which is used to learn contextualized network flow representations from transition contexts rather than semantic contexts; The embedding method is used to embed the bidirectional flow graph into tokens, first doing token embedding and then position embedding; In the token embedding step, a network flow graph with a shape of h*w*c is divided into n shapes of p 2 *c patch. To comply with the permutation invariance principle, simple convolutional layers and flattening operations are used to implement token embeddings with a dimension of D. n patches are converted into n token embeddings with a dimension of D. In the position embedding step, fixed sine-cosine position encoding is used to implement position embedding to add relative position information; n position embeddings are added to n token embeddings and a [CLS] token is inserted at the front, which indicates the beginning of the token sequence; The bidirectional flow mask model is used to learn contextualized bidirectional flow representations. The basic model of this model is the Transformer encoder, which is completely based on the self-attention mechanism model and has the advantages of parallel computing and shortest maximum path length. The task to be completed by the bidirectional flow mask model is to restore the masked tokens. Specifically, the tokens in the token sequence of the input model are randomly masked with a probability of 15%, and the masked tokens have an 80% probability of being replaced with [Mask] tokens, and a 10% probability of selecting a random token to replace or remain unchanged. Then, these masked tokens are used as supervision signals to allow the model to restore the masked tokens through contextual information. We use cross entropy to measure the training error. Assuming that k token embeddings are randomly masked, the loss function is defined as follows: Among them, θ represents all the parameters of the model, Represents the Token sequence with mask input to the model.

5. The classification stage according to claim 1, Features: Contains feature fusion and loss function settings; Feature fusion: concatenate the hidden vector corresponding to the output of the [CLS] token in the inter-field association feature learning module and the output vector of the last time of the side channel feature learning module BiLSTM as the feature used for the final classification; Loss function setting: To ensure that the model can be optimized to the two models in the encoder, the loss function is set to the arithmetic mean of the loss of the inter-field association feature learning module, the side channel feature learning module, and the overall fine-tuning model. The cross entropy function is used as the loss function of the three to obtain their respective loss values. 1 、loss 2 and loss 3 , the loss of the entire model is the arithmetic mean of the above three losses, and its formula is as follows: y 1 =softmax(W raw_h_feacls raw_h_fea cls +b raw_h_feacls ) y 2 =softmax(W sup_h_fean sup_h_fea n +b sup_h_fean ) y 3 =softmax(W 3 ·Concat(raw_h_fea cls +sup_h_fea n )+b 3 ) Where W,b is the parameter of the corresponding fully connected layer, T is the number of training samples, L j is the label of the jth network flow; note that the model only uses loss in the training phase to guide the neural network to learn the two best parts, while in the test phase, the model only uses loss 3 , because the model has been trained, its parameters are no longer updated.

Images