Malicious encrypted traffic classification method and system

Abstract

The invention provides a malicious encrypted traffic classification method and system, and relates to the technical field of network and information security, and the method comprises the steps: obtaining encrypted traffic information of a session between two devices; converting the encrypted traffic information into a heat map containing similar significant features, and extracting traffic features from the encrypted traffic information; fusing the heat map and the flow feature to obtain a fused feature; and performing classification according to the fusion features, and detecting the traffic category to which the encrypted traffic information belongs. According to the embodiment of the invention, the heat map containing the class significant features extracted by using the encrypted traffic information can be fused with the traffic features, and the fused features are adopted to perform traffic classification, so that the class significant features are added to perform traffic classification in addition to the traffic features, and the classification accuracy is improved.

Description

Technical Field

[0001] The present invention relates to the field of network and information security technology, and in particular to a malicious encrypted traffic classification method and system. Background Art

[0002] With the rapid development of the Internet, network security issues have become increasingly prominent. In network communications, encrypted traffic is widely used to protect user privacy and data security. However, malicious users and attackers also use encrypted communications to hide their malicious activities, such as data theft, botnet control, ransomware propagation, etc., which poses a serious challenge to network security.

[0003] The encrypted traffic detection method mainly relies on neural network to extract features and use the extracted features to classify traffic. Neural networks, such as convolutional neural networks, generally learn local features, and the purpose of feature extraction is to classify traffic. If only local features are focused on, the classification accuracy will be reduced. Summary of the invention

[0004] The present invention provides a malicious encrypted traffic classification method and system, which utilizes the heat map containing class significant features extracted from encrypted traffic information and traffic features for fusion, and uses the fused features for traffic classification. In this way, in addition to the traffic features, class significant features are also added for traffic classification, thereby improving the accuracy of classification.

[0005] In a first aspect, an embodiment of the present invention provides a method for classifying malicious encrypted traffic, including:

[0006] Get the encrypted traffic information of the conversation between two devices;

[0007] Converting the encrypted traffic information into a heat map containing class-significant features, and extracting traffic features from the encrypted traffic information;

[0008] Fusing the heat map and the traffic feature to obtain a fused feature;

[0009] Classification is performed according to the fusion feature to detect the traffic category to which the encrypted traffic information belongs.

[0010] The above method can obtain encrypted traffic information, use the encrypted traffic information to extract heat maps and traffic features containing class significant features, and fuse the heat maps and traffic features containing class significant features extracted from the encrypted traffic information, and use the fused features to classify traffic. In this way, in addition to traffic features, class significant features are also added for traffic classification, thereby improving the accuracy of classification.

[0011] In a possible implementation, converting the encrypted traffic information into a heat map containing class-significant features includes:

[0012] Converting the encrypted traffic information into a traffic image;

[0013] Using a target convolution layer to perform convolution processing on the flow image to obtain feature maps of multiple channels;

[0014] The feature maps of multiple channels are weighted by using the fully connected weights of each traffic category to obtain weighted feature maps of multiple channels corresponding to each traffic category.

[0015] Generate a single traffic category heat map corresponding to each traffic category according to the sum of the features of the weighted feature maps of multiple channels corresponding to each traffic category at the same position;

[0016] The single traffic category heat maps corresponding to each traffic category are fused to obtain a heat map containing the class's significant features.

[0017] The above method converts the encrypted traffic information into a traffic image, and uses the fully connected weight of each traffic category to weight the features processed by the target convolution layer, and generates a heat map based on the weighted features. In this way, the class-significant features are extracted from the traffic image to classify the encrypted traffic information, thereby improving the accuracy of classification.

[0018] In a possible implementation, the fully connected weight of each traffic category is the fully connected weight of the fully connected layer in the fine-tuned classification model;

[0019] The fine-tuned classification model is a new classification model pre-trained using a second training set; wherein the second training set includes a plurality of traffic images and annotation information of the traffic images; the annotation information includes the traffic category to which the encrypted traffic data information forming the traffic image belongs;

[0020] The new classification model is obtained by replacing the last convolutional layer and the structure after the last convolutional layer in the original classification model with a new pooling layer, a new fully connected layer, and a new output layer;

[0021] The original classification model is pre-trained based on a first training set; the first training set includes a plurality of object images and information for marking the object category in each object image; the original classification model is used to distinguish the category of the object in the object image;

[0022] The target convolutional layer is the convolutional layer in the fine-tuned classification model.

[0023] The above method fine-tunes the original classification model after training to obtain a fine-tuned classification model, thereby reducing the amount of computational effort.

[0024] In one possible implementation, the fine-tuned classification model is obtained by:

[0025] The new classification model is trained multiple times using the second training set;

[0026] For each training, the traffic images of the training in the second training set are input into the new classification model, and the predicted classification corresponding to the traffic images of the training in the second training set is output; wherein each training corresponds to a batch of traffic images of the second training set;

[0027] adjusting the weights in the new classification model according to the predicted classification corresponding to the traffic image of the training in the second training set and the annotation information of the traffic image of the training in the second training set;

[0028] The trained new classification model is used as the fine-tuned classification model.

[0029] The above method can use traffic images to train the weights in the new classification model, thereby improving the accuracy of the fully connected weights of each traffic category.

[0030] In a possible implementation manner, converting the encrypted traffic information into a traffic image includes:

[0031] Converting the encrypted traffic information into the encrypted traffic information in binary representation;

[0032] Dividing the encrypted traffic information represented in binary into bytes to obtain multiple groups of information, and mapping each group of information into multiple traffic features represented by grayscale values;

[0033] The plurality of flow features are used as a plurality of pixel values, and a flow image is formed according to the plurality of pixel values.

[0034] The above method can utilize the byte mapping of the binary representation of the encrypted traffic information to become the traffic features represented by grayscale values, and compose a traffic image based on the traffic features, thus realizing the process of converting the encrypted traffic information into an image.

[0035] In a possible implementation, fusing the heat map and the traffic feature to obtain a fused feature includes:

[0036] Using the heat map as a weight, weighting the traffic feature to obtain a weighted traffic feature;

[0037] The weighted flow features are converted into gray values, and the gray values ​​are used as fusion features.

[0038] The above method can use the heat map as a weight to weight the traffic features, which can highlight the significant features of the class and improve the comprehensiveness of feature extraction.

[0039] In a possible implementation, the classifying according to the fusion feature to detect the traffic category to which the encrypted traffic information belongs includes:

[0040] Using a convolutional neural network to perform convolution processing on the fusion features to obtain convolution fusion features;

[0041] The convolution fusion features are classified by using a classifier to determine the traffic category to which the encrypted traffic information belongs.

[0042] The above method can extract the fused features through a convolutional neural network and classify the features using a classifier, so that the network extracted features can more accurately classify the encrypted traffic.

[0043] In a second aspect, an embodiment of the present invention provides a malicious encrypted traffic classification system, including:

[0044] An acquisition module, used to acquire encrypted traffic information of a session between two devices;

[0045] An extraction module, used to convert the encrypted traffic information into a heat map containing class significant features, and to extract traffic features from the encrypted traffic information;

[0046] A fusion module, used for fusing the heat map and the traffic feature to obtain a fusion feature;

[0047] A classification module is used to perform classification according to the fusion feature and detect the traffic category to which the encrypted traffic information belongs.

[0048] In a third aspect, an embodiment of the present invention provides an electronic device, including:

[0049] processor;

[0050] A processor is used to execute the computer program or instructions in the memory so that the malicious encrypted traffic classification method as described in any one of the first aspects is executed.

[0051] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium. When instructions in the storage medium are executed by a processor, the processor is enabled to execute any malicious encrypted traffic classification method as described in the first aspect.

[0052] In a fifth aspect, an embodiment of the present invention provides a computer program product, comprising: a computer program code, which, when executed on a computer, enables the computer to execute the malicious encrypted traffic classification method as described in any one of the first aspects.

[0053] In addition, the technical effects brought about by any implementation method in the second to fifth aspects can refer to the technical effects brought about by different implementation methods in the first aspect, and will not be repeated here.

[0054] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 A flowchart of a malicious encrypted traffic classification method provided by an embodiment of the present invention;

[0056] Figure 2 A flow chart of a method for generating a heat map provided by an embodiment of the present invention;

[0057] Figure 3 A schematic diagram of a process of generating a heat map from a flow image provided by an embodiment of the present invention;

[0058] Figure 4 A schematic diagram of a method for generating a traffic image provided by an embodiment of the present invention;

[0059] Figure 5 A flow chart of a method for fusing traffic features and heat maps provided in an embodiment of the present invention;

[0060] Figure 6 A flowchart of a method for classifying encrypted traffic information according to fusion features provided by an embodiment of the present invention;

[0061] Figure 7 A flowchart of another malicious encrypted traffic classification method provided by an embodiment of the present invention;

[0062] Figure 8 A schematic diagram of the structure of a malicious encrypted traffic classification device provided by an embodiment of the present invention;

[0063] Fig. 9 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0064] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0065] In the description of the embodiments of the present application, unless otherwise specified, in the description of the embodiments of the present application, "plurality" refers to two or more than two.

[0066] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features.

[0067] Glossary:

[0068] Heatmap: A visualization technique used to graphically represent information in data, especially to represent numerical data as changes in color. In the fields of computer vision and machine learning, heatmaps are often used to display specific types of output activities, such as the activation intensity of feature maps. In malicious encrypted traffic detection, heatmaps are used to represent the areas in the input data that have the greatest impact on the model classification decision, that is, to intuitively display the contribution of each part to the final classification result through the depth of color, thereby providing a visual explanation of the model decision-making process.

[0069] Class Activation Map (CAM): It is used to identify which areas in a convolutional neural network are activated and have an important influence on the final classification decision when performing image classification tasks. In application, CAM helps researchers and developers understand model behavior, especially in diagnosing the reasons for model misclassification or verifying whether the focus of the model is in line with expectations.

[0070] With the rapid development of the Internet, encrypted communication has become the main means of protecting user privacy and data security, but it also provides cover for network attacks. Traditional malicious traffic detection methods are not effective when facing encrypted traffic. Existing methods mainly rely on feature engineering and shallow machine learning models, lack the ability to explain the detection process, and cannot provide strong decision support for classification. Based on this, the present invention proposes a malicious encrypted traffic classification method and system, which solves the problem of being unable to provide strong decision support for classification.

[0071] The present invention is described in detail below with reference to the accompanying drawings:

[0072] Combination Figure 1 As shown, an embodiment of the present invention provides a malicious encrypted traffic classification method, including:

[0073] S100: Obtain encrypted traffic information of a session between two devices.

[0074] The encrypted traffic information of the conversation between the two devices includes the content of the conversation between the two devices.

[0075] S101: Convert the encrypted traffic information into a heat map containing class salient features, and extract traffic features from the encrypted traffic information.

[0076] S102: Fuse the heat map and the traffic feature to obtain a fused feature.

[0077] S103: Classify according to the fusion features and detect the traffic category to which the encrypted traffic information belongs.

[0078] The traffic category may be a malicious encrypted traffic category or a normal encrypted traffic category; or the malicious encrypted traffic category may be further divided into specific categories, such as data theft, botnet control, ransomware propagation, etc.

[0079] In this way, the present invention converts the encrypted traffic information into a heat map containing class-significant features, fuses the heat map with the traffic features extracted from the encrypted traffic information, and uses the fused features for classification. In this way, the class-significant features can provide strong support for classified traffic and improve the accuracy of classification.

[0080] In some embodiments, in combination Figure 2 As shown in Figure 1, the encrypted traffic information is converted into a heat map containing class salient features, including:

[0081] S200: Convert the encrypted traffic information into a traffic image.

[0082] Generally, encrypted traffic information is expressed in hexadecimal. In order to convert the encrypted traffic information into a traffic image, the specific implementation method is to convert the encrypted traffic information into encrypted traffic information expressed in binary; divide the encrypted traffic information expressed in binary according to bytes to obtain multiple groups of information, and map each group of information into multiple traffic features expressed in grayscale values; use multiple of the traffic features as multiple pixel values, and compose a traffic image based on the multiple pixel values.

[0083] The mapping process converts each set of information into a decimal representation, and the decimal representation is the flow characteristics represented by grayscale values, that is, the flow characteristics are all between [0, 255].

[0084] Exemplarily, the encrypted traffic information represented in binary is 010001000100011001000111; taking the preset number of binary bits represented by a byte as 8 as an example, the first eight bits of the encrypted traffic information represented in binary are: 01000100, converted to decimal number, 68; the second eight bits are 01000110, converted to decimal number, 70; the third eight bits are 01000111, converted to decimal number, 71; then the multiple traffic features obtained by mapping are 68, 70, and 71.

[0085] After obtaining multiple flow features, the multiple flow features are used as multiple pixel values, the multiple pixel values ​​form a one-dimensional vector, and then the one-dimensional vector is rearranged to form a new vector, and the new vector is used to form a two-dimensional grayscale image, which is a flow image.

[0086] For example, a one-dimensional vector with 9 elements is used as an example, and the mapped pixel values ​​are [a1 a2 a3 a4 a5 a6a7 a8a9]. They are rearranged to form a new vector with 3 rows and 3 columns. The new vector is Use this new vector to construct a two-dimensional grayscale image.

[0087] S201: Use the target convolution layer to perform convolution processing on the flow image to obtain feature maps of multiple channels.

[0088] There may be multiple convolutional layers, each convolutional layer may include multiple convolution kernels, and one convolution kernel corresponds to one channel; and the feature map of each channel includes multiple features.

[0089] S202: Using the fully connected weight of each traffic category, weighted processing is performed on the feature maps of multiple channels to obtain weighted feature maps of multiple channels corresponding to each traffic category.

[0090] The weighted feature map includes multiple weighted features.

[0091] S203: Generate a single traffic category heat map corresponding to each traffic category according to the sum of features of the weighted feature maps of multiple channels corresponding to each traffic category at the same position.

[0092] S204: Fusing the single traffic category heat maps corresponding to each traffic category to obtain a heat map containing class salient features.

[0093] The embodiment of the present invention introduces heat map technology to intuitively display the significant characteristics of the class in the encrypted traffic classification task, and can clearly identify the key areas that affect the traffic classification decision. This innovation not only improves the detection accuracy, but also helps network administrators and security experts to deeply understand the characteristics and behavior patterns of malicious encrypted traffic.

[0094] Among them, the fully connected weight of each traffic category is the fully connected weight of the fully connected layer in the fine-tuned classification model;

[0095] The fine-tuned classification model is a new classification model pre-trained using the second training set; wherein the second training set includes a plurality of traffic images and annotation information of the traffic images; the annotation information includes the traffic category to which the encrypted traffic data information forming the traffic image belongs;

[0096] The new classification model is obtained by replacing the last convolutional layer and the structure after the last convolutional layer in the original classification model with a new pooling layer, a new fully connected layer, and a new output layer;

[0097] The original classification model is pre-trained based on the first training set; the first training set includes multiple object images and information for marking the object category in each object image; the original classification model is used to distinguish the category of the object in the object image;

[0098] The target convolutional layer is the convolutional layer in the fine-tuned classification model.

[0099] Exemplarily, the original classification model includes multiple convolutional layers and fully connected layers;

[0100] The original classification model is trained using the first training set. For each training, the object image of the training in the first training set is input into the original classification model to obtain the predicted classification corresponding to the object image of the training in the first training set; the parameters of the original classification model are adjusted according to the predicted classification corresponding to the object image of the training in the first training set and the annotation information of the object image of the training in the first training set;

[0101] Then the original classification model is modified by removing the last convolutional layer and the fully connected layer, and adding a new pooling layer, a new fully connected layer and a new output layer after the second to last convolutional layer to obtain a new classification model.

[0102] The new classification model is trained multiple times using the second training set;

[0103] For each training, the traffic image of the training in the second training set is input into the new classification model, and the predicted classification corresponding to the traffic image of the training in the second training set is output; wherein each training corresponds to a traffic image of the second training set;

[0104] Adjust the weights in the new classification model according to the predicted classification corresponding to the traffic image of the training in the second training set and the annotation information of the traffic image of the training in the second training set;

[0105] The trained new classification model is used as the fine-tuned classification model.

[0106] The weights in the fine-tuned classification model include fully connected weights for each traffic class.

[0107] For example, the fully connected weight of the fully connected layer in the fine-tuned classification model is an M×N vector; the feature output by the new pooling layer in the fine-tuned classification model is a one-dimensional vector containing M elements, where N represents N traffic categories, and the M elements in each N direction are the fully connected weights of a traffic category.

[0108] Among them, the number of traffic categories is the same as that of the single traffic category heat map.

[0109] When weighted processing is performed on the feature maps of multiple channels using the fully connected weights of each traffic category, this can be achieved using the following formula:

[0110]

[0111] Among them, M c (x, y) is the pixel value at position (x, y) in the single traffic category heat map corresponding to traffic category c, is the weight of the kth channel in the fully connected weight of traffic category c, f k (x, y) is the feature at position (x, y) of the feature map of the kth channel, that is, the activation value of the kth channel at position (x, y) in the penultimate convolutional layer.

[0112] In actual application, the original classification model can use a two-dimensional convolutional neural network as the basic network, and the two-dimensional convolutional neural network, for example, is a classic model such as ResNet, VGG, etc. The original classification model of the embodiment of the present invention can take ResNet18 as an example, and use a large number of pictures to train ResNet18 so that ResNet18 can classify objects in a large number of images, delete the last convolutional layer and fully connected layer of the trained ResNet18, and add a new pooling layer, a new fully connected layer, and a new output layer that match the flow feature dimension.

[0113] After the replacement is completed, the new ResNet18 is trained multiple times using the second training set. In each training process, the traffic image in the second training set is input into the new ResNet18, and the predicted classification corresponding to the traffic image is output. The back propagation and gradient descent algorithms, as well as the predicted classification corresponding to the traffic image and the annotation information of the traffic image are used to adjust the weights of the convolutional layer in the new ResNet18 and the fully connected weights in the fully connected layer.

[0114] In this way, the present invention uses a two-dimensional convolutional neural network pre-trained on a large-scale image training set to achieve that the unimproved two-dimensional convolutional neural network can classify and process images, improve the two-dimensional convolutional neural network, and then use the training set of traffic images corresponding to encrypted traffic information to fine-tune the improved two-dimensional convolutional neural network to obtain a heat map. By fine-tuning the pre-trained model, the powerful representation ability of the deep learning model in the image field can be fully utilized, and it can be successfully transferred and applied to the malicious encrypted traffic classification task. This innovation improves the feature extraction and learning efficiency of malicious encrypted traffic, and effectively reduces the false alarm rate and missed alarm rate.

[0115] In some embodiments, the specific implementation method of fusing the single traffic category heat maps corresponding to each traffic category to obtain a heat map containing class-significant features is:

[0116] The pixel values ​​at the same position in the single traffic class heat map corresponding to each traffic class are added together to obtain a heat map containing the class's salient features.

[0117] Exemplary, combined Figure 3 As shown in the figure, the traffic image converted from the encrypted traffic information is input into the improved two-dimensional convolutional neural network. In the two-dimensional convolutional neural network, the target convolution layer is used to perform convolution processing on the traffic image to obtain feature maps of multiple channels. The feature maps of multiple channels are weighted by using the fully connected weights in the two-dimensional convolutional neural network to obtain weighted feature maps of multiple channels corresponding to each traffic category. According to the sum of the features of the weighted feature maps of multiple channels corresponding to each traffic category at the same position, a single traffic category heat map corresponding to each traffic category is generated. The pixel values ​​at the same position in the single traffic category heat map corresponding to each traffic category are added to obtain a heat map containing class significant features.

[0118] Of course, during the processing, the fine-tuned two-dimensional convolutional neural network can be further trained according to the final processing results, so as to adjust the fully connected weights in the fully connected layer, so that the accuracy of the fully connected weights of each traffic category is relatively high, which is suitable for various new attacks.

[0119] For the traffic images in the second training set, combined with Figure 4 As shown, an embodiment of the present invention provides a method for generating a traffic image, including:

[0120] S400: extracting original traffic data from the device, and dividing the original traffic data into encrypted traffic information of the conversation between two devices;

[0121] The original traffic data is usually a continuous data stream, and the traffic data needs to be segmented according to the communication session. Each communication session corresponds to a continuous network communication process, which can contain multiple network data packets (pcap). The purpose of traffic segmentation is to divide the entire traffic data set into multiple communication sessions, with each communication session as the unit of classification.

[0122] S401: performing data cleaning and anonymization processing on the encrypted traffic information of the conversation between two devices;

[0123] Among them, after the traffic is split, there may be some invalid data or data containing sensitive information, so the traffic encryption information of the conversation between the two devices after the split needs to be cleaned and anonymized to protect user privacy and data security.

[0124] The cleaning operation includes removing abnormal data, removing noise data, etc. Abnormal data can be irrelevant data, partially missing data, etc. Irrelevant data can be understood as a session other than the session between two devices. For example, device A will have a session with device B and device C. When the malicious traffic classification of the session between device A and device B is determined, the session between device A and device C is irrelevant data.

[0125] The anonymization operation is to desensitize sensitive information in the data, such as IP addresses, port numbers, etc. When desensitizing, sensitive information such as IP addresses and port numbers need to be deleted; or sensitive information such as IP addresses and port numbers need to be replaced with numbers that do not represent any characteristics, such as 0. Sensitive information can be converted into 0s with the same number of bytes as the sensitive information.

[0126] S402: Unifying the length of encrypted traffic information of multiple sessions between two devices.

[0127] Since the traffic lengths of different communication sessions may be different, in order to ensure the consistency of the data input to the convolutional layer, the lengths of multiple encrypted traffic information need to be unified.

[0128] When the length of the encrypted traffic information of the conversation between the two devices is longer than the preset length, the encrypted traffic information of the conversation between the two devices is truncated so that the length of the encrypted traffic information of the conversation between the two devices is equal to the preset length. When truncating the encrypted traffic information of the conversation between the two devices, data irrelevant to the classification can be deleted, for example, the 0 converted by the sensitive information described above can be deleted.

[0129] When the length of the encrypted traffic information of the conversation between the two devices is shorter than the preset length, the encrypted traffic information of the conversation between the two devices is padded so that the length of the encrypted traffic information of the conversation between the two devices is equal to the preset length. When padding the encrypted traffic information of the conversation between the two devices, a number that does not represent any characteristics, such as 0, can be used to add the number of bytes until the length of the encrypted traffic information of the conversation between the two devices is equal to the preset length.

[0130] S403: converting the encrypted traffic information of the multiple pairwise sessions between the devices into the encrypted traffic information of the multiple pairwise sessions between the devices in binary representation, and mapping the encrypted traffic information of the multiple pairwise sessions between the devices in binary representation into pixel values ​​of multiple grayscale images.

[0131] The pixel value is from 0 to 255.

[0132] S404: Rearrange the pixel values ​​of the one-dimensional grayscale image into a corresponding two-dimensional grayscale image.

[0133] S405: Up-sample the generated two-dimensional grayscale image, and assign the single-channel grayscale image to a three-channel grayscale image.

[0134] The generated two-dimensional grayscale image is upsampled to reach the expected resolution and suitable for input into the two-dimensional convolutional neural network. The single-channel grayscale image is copied to form a three-channel grayscale image, that is, an RGB image. This step ensures that the number of channels of the input image is consistent with the expected number of input channels of the two-dimensional convolutional neural network, and the three-channel grayscale image is input into the two-dimensional convolutional neural network for subsequent training.

[0135] In some embodiments, in combination Figure 5 As shown, the heat map and traffic features are fused to obtain fusion features, including:

[0136] S500: using the heat map as a weight, weighting the traffic feature to obtain the weighted traffic feature;

[0137] In detail, the traffic characteristics are obtained by converting the encrypted traffic information into encrypted traffic information represented by binary; dividing the encrypted traffic information represented by binary by bytes to obtain multiple groups of information, and mapping each group of information into multiple traffic characteristics represented by grayscale values.

[0138] Since multiple traffic features are represented by one-dimensional vectors, in order to use the heat map as a weighted traffic feature, the heat map is flattened, that is, the features contained in the heat map are generally vectors of multiple rows and columns, which are transformed into vectors of one row. For example, a heat map includes 9×9 features, that is, features of 9 rows and 9 columns, which are transformed into 81 features arranged in one row.

[0139] Optionally, before converting the heat map using a vector representation of multiple rows and columns into a vector representation of one row, the heat map is normalized to limit the features contained in the heat map to a numerical range, which may be 0 to 255. And when it is determined that the number of features of the heat map is less than the number of traffic features, the number of features of the heat map is increased to the number of traffic features through an upsampling technique, thereby achieving one-to-one weighted processing.

[0140] Among them, the features contained in the heat map can be understood as the pixel values ​​of the heat map.

[0141] In some embodiments, the weighting of traffic characteristics is achieved by the following formula:

[0142] F=M′·G

[0143] Among them, F is the weighted traffic feature, M′ is the normalized heat map, and G is the traffic feature.

[0144] S501: Convert the weighted traffic features into grayscale values, and use the grayscale values ​​as fusion features.

[0145] In some embodiments, the weighted flow features are converted into grayscale values ​​by:

[0146]

[0147] Among them, Gi is the grayscale value converted from the i-th weighted flow feature, Jmin is the minimum value in the weighted flow feature; Jmax is the maximum value in the weighted flow feature, and xi is the i-th weighted flow feature.

[0148] For example, when the weighted traffic feature values ​​include -10 to 10, then the grayscale value of -10 converted is calculated to be 0 through the above formula:

[0149]

[0150] And so on, the grayscale values ​​of -9 to 10 are calculated respectively.

[0151] Among them, for the data with decimal points calculated, it is necessary to remove the decimal points so that the grayscale values ​​after conversion are all integers.

[0152] In this way, the embodiment of the present invention obtains the heat map of the two-dimensional traffic image and converts it into a one-dimensional form to merge with the traffic features. This process strengthens the captured class-significant features, improves the accuracy and credibility of malicious encrypted traffic classification, and enables the detection system to more effectively identify malicious behavior, thereby protecting network security.

[0153] In some embodiments, the encrypted traffic information is classified according to the fusion feature to detect the traffic category to which it belongs, including:

[0154] The fusion features are convolved using a convolutional neural network to obtain a fusion feature map;

[0155] The classifier is used to classify the fused feature graph to determine the traffic category to which the encrypted traffic information belongs.

[0156] Among them, the convolutional neural network can be a one-dimensional convolutional neural network.

[0157] Combination Figure 6 As shown, the heat map is flattened and converted into a one-dimensional vector, the traffic features represented by the one-dimensional vector are fused with the heat map represented by the one-dimensional vector, the fused features are converted into grayscale values, and the grayscale values ​​are input into a one-dimensional convolutional neural network for convolution processing to obtain a fused feature map, and the fused feature map is classified by a classifier to determine the traffic category to which the encrypted traffic information belongs.

[0158] Before determining the traffic category to which the encrypted traffic information belongs, the method further includes training a convolutional neural network and a classifier;

[0159] The convolutional neural network and the classifier are trained multiple times using the third training set. In each training process, the fused features in the third training set are input into the convolutional neural network, and the output values ​​of the convolutional neural network are input into the classifier. The classifier outputs the predicted classification corresponding to the fused features. The cross entropy loss function, gradient descent and other optimization algorithms, as well as the predicted classification corresponding to the fused features and the labeling information of the fused features are used to adjust the parameters in the convolutional neural network and the classifier, so that they can more accurately classify encrypted traffic.

[0160] The third training set includes multiple fusion features and annotation information of the fusion features. The annotation information of the fusion features is the classification result of the fusion features. The fusion features in the training set can be the traffic image used to train the new classification model, the heat map generated by the traffic image, and the traffic features extracted from the encrypted traffic information corresponding to the traffic image.

[0161] Based on the above introduction, combined with Figure 7 The embodiment of the present invention provides an encrypted traffic classification method, comprising:

[0162] S700: extracting one-dimensional traffic features from encrypted traffic information of conversations between two devices, and converting the encrypted traffic information of conversations between two devices into a traffic image;

[0163] S701: using the target convolution layer to perform convolution processing on the flow image to obtain feature maps of multiple channels;

[0164] S702: using the fully connected weights of the fully connected layer in the fine-tuned classification model, weighted processing is performed on the feature maps of multiple channels to obtain weighted feature maps of multiple channels corresponding to each traffic category;

[0165] S703: Generate a single traffic category heat map corresponding to each traffic category according to the sum of the features of the weighted feature maps of multiple channels corresponding to each traffic category at the same position, and fuse the single traffic category heat maps corresponding to each traffic category to obtain a heat map containing class-significant features;

[0166] S704: fusing the heat map with the one-dimensional flow feature to obtain a fusion feature;

[0167] S705: Use a convolutional neural network to perform convolution processing on the fused features to obtain a fused feature map, and use a classifier to classify the fused feature map to determine the traffic category to which the encrypted traffic information belongs.

[0168] In detail, the present invention adapts the new classification model to encrypted traffic information, and can make full use of the general features learned in the image classification task, so as to play a better performance in the encrypted traffic classification task. The introduction of heat map technology can intuitively show the degree of attention of the model to the input data, visualize the decision-making process of the detection model, and provide a clear basis for security analysts to understand and verify the detection. Finally, by flattening the generated two-dimensional heat map into a one-dimensional vector and fusing it with the one-dimensional traffic feature, the model can make full use of the significant features in the heat map, thereby further improving the accuracy and robustness of encrypted traffic classification.

[0169] The beneficial effects of a malicious encrypted traffic classification method and system provided by the embodiment of the present invention are as follows:

[0170] First, improving security protection capabilities: The present invention enhances network security protection capabilities, improves the accuracy and explainability of detecting malicious encrypted traffic, and helps to promptly discover and respond to network security threats.

[0171] Second, improving classification efficiency: by using the pre-training model fine-tuning and heat map learning methods, the present invention effectively improves the feature extraction and learning efficiency of malicious encrypted traffic, and reduces the false alarm rate and missed alarm rate.

[0172] Third, strengthening network security defense: By integrating heat maps with original traffic data, the method of the present invention improves the ability to identify malicious encrypted traffic, strengthens network security defense, and protects the security of user networks and data.

[0173] like Figure 8As shown, the present invention also provides a malicious encrypted traffic classification system, comprising:

[0174] The acquisition module 800 is used to obtain the encrypted traffic information of the session between two devices;

[0175] An extraction module 810, configured to convert the encrypted traffic information into a heat map containing class-significant features, and to extract traffic features from the encrypted traffic information;

[0176] A fusion module 820 is used to fuse the heat map and the traffic feature to obtain a fusion feature;

[0177] The classification module 830 is used to perform classification according to the fusion feature and detect the traffic category to which the encrypted traffic information belongs.

[0178] Optionally, the extraction module 810 is specifically configured to:

[0179] Converting the encrypted traffic information into a traffic image;

[0180] Using a target convolution layer to perform convolution processing on the flow image to obtain feature maps of multiple channels;

[0181] The feature maps of multiple channels are weighted by using the fully connected weights of each traffic category to obtain weighted feature maps of multiple channels corresponding to each traffic category.

[0182] Generate a single traffic category heat map corresponding to each traffic category according to the sum of the features of the weighted feature maps of multiple channels corresponding to each traffic category at the same position;

[0183] The single traffic category heat maps corresponding to each traffic category are fused to obtain a heat map containing the class's significant features.

[0184] Optionally, the fully connected weight of each traffic category is the fully connected weight of the fully connected layer in the fine-tuned classification model;

[0185] The fine-tuned classification model is a new classification model pre-trained using a second training set; wherein the second training set includes a plurality of traffic images and annotation information of the traffic images; the annotation information includes the traffic category to which the encrypted traffic data information forming the traffic image belongs;

[0186] The new classification model is obtained by replacing the last convolutional layer and the structure after the last convolutional layer in the original classification model with a new pooling layer, a new fully connected layer, and a new output layer;

[0187] The original classification model is pre-trained based on a first training set; the first training set includes a plurality of object images and information marking the object flow category in each object image; the original classification model is used to distinguish the category of the object in the object image;

[0188] The target convolutional layer is the convolutional layer in the fine-tuned classification model.

[0189] Optionally, the device further comprises a training module; the training module is connected to the extraction module;

[0190] Training modules are specifically used for:

[0191] The new classification model is trained multiple times using the second training set;

[0192] For each training, the traffic image of the training in the second training set is input into the new classification model, and the predicted classification corresponding to the traffic image of the training in the second training set is output; wherein each training corresponds to a traffic image of the second training set;

[0193] adjusting the weights in the new classification model according to the predicted classification corresponding to the traffic image of the training in the second training set and the annotation information of the traffic image of the training in the second training set;

[0194] The trained new classification model is used as the fine-tuned classification model.

[0195] Optionally, the extraction module 810 is further used to:

[0196] Converting the encrypted traffic information into the encrypted traffic information in binary representation;

[0197] Dividing the encrypted traffic information represented in binary into bytes to obtain multiple groups of information, and mapping each group of information into multiple traffic features represented by grayscale values;

[0198] The plurality of flow features are used as a plurality of pixel values, and a flow image is formed according to the plurality of pixel values.

[0199] Optionally, the fusion module 820 is specifically used for:

[0200] Using the heat map as a weight, weighting the traffic feature to obtain a weighted traffic feature;

[0201] The weighted flow features are converted into gray values, and the gray values ​​are used as fusion features.

[0202] Optionally, the classification module 830 is specifically used for:

[0203] Using a convolutional neural network to perform convolution processing on the fusion features to obtain convolution fusion features;

[0204] The convolution fusion features are classified by using a classifier to determine the traffic category to which the encrypted traffic information belongs.

[0205] In addition, combined Figure 1-Figure 8 The malicious encrypted traffic classification method and system described in the embodiments of the present invention may be implemented by an electronic device.

[0206] Electronic devices, including: processors;

[0207] a memory for storing instructions executable by the processor;

[0208] The processor is configured to execute the instructions to implement the malicious encrypted traffic classification method as described in any one of the above descriptions.

[0209] Based on the above introduction, an exemplary Fig. 9 electronic equipment structure.

[0210] The electronic device may include a processor 910 and a memory 920 storing computer program instructions.

[0211] Specifically, the processor 910 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present invention.

[0212] The memory 920 may include a large capacity memory for data or instructions. For example, but not limitation, the memory 920 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 920 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 920 may be inside or outside the data processing device. In a specific embodiment, the memory 920 is a non-volatile solid-state memory. In a specific embodiment, the memory 920 includes a read-only memory (ROM). In appropriate cases, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM) or a flash memory or a combination of two or more of these.

[0213] The processor 910 implements any one of the methods for performing tasks in the above embodiments by reading and executing computer program instructions stored in the memory 920 .

[0214] In one example, the electronic device may further include a communication interface 930 and a bus 940. Fig. 9 As shown, the processor 910, the memory 920, and the communication interface 930 are connected via a bus 940 and communicate with each other.

[0215] The communication interface 930 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiment of the present invention.

[0216] Bus 940 includes hardware, software or both, and the parts of electronic equipment are coupled to each other.For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front side bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 940 may include one or more buses. Although the embodiment of the present invention describes and shows a specific bus, the present invention considers any suitable bus or interconnection.

[0217] The electronic device can execute the malicious encrypted traffic classification method in the embodiment of the present invention based on the received task, thereby realizing the combination Figure 1-Figure 8 Described is a method and system for classifying malicious encrypted traffic.

[0218] In addition, in combination with the electronic device in the above embodiments, an embodiment of the present invention may provide a storage medium, and when the instructions in the storage medium are executed by the processor of the electronic device, the electronic device can execute the malicious encrypted traffic classification method as described in any one of the above items.

[0219] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0220] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0221] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0222] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0223] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for classifying malicious encrypted traffic, characterized in that: include: Get the encrypted traffic information of the conversation between two devices; Converting the encrypted traffic information into a heat map containing class-significant features, and extracting traffic features from the encrypted traffic information; Fusing the heat map and the traffic feature to obtain a fused feature; Classification is performed according to the fusion feature to detect the traffic category to which the encrypted traffic information belongs.

2. The method according to claim 1, characterized in that The step of converting the encrypted traffic information into a heat map containing class-significant features comprises: Converting the encrypted traffic information into a traffic image; Using a target convolution layer to perform convolution processing on the flow image to obtain feature maps of multiple channels; The feature maps of multiple channels are weighted by using the fully connected weights of each traffic category to obtain weighted feature maps of multiple channels corresponding to each traffic category. Generate a single traffic category heat map corresponding to each traffic category according to the sum of the features of the weighted feature maps of multiple channels corresponding to each traffic category at the same position; The single traffic category heat maps corresponding to each traffic category are fused to obtain a heat map containing the class's significant features.

3. The method according to claim 2, characterized in that in, The fully connected weight of each traffic category is the fully connected weight of the fully connected layer in the fine-tuned classification model; The fine-tuned classification model is a new classification model pre-trained using a second training set; wherein the second training set includes a plurality of traffic images and annotation information of the traffic images; the annotation information includes the traffic category to which the encrypted traffic data information forming the traffic image belongs; The new classification model is obtained by replacing the last convolutional layer and the structure after the last convolutional layer in the original classification model with a new pooling layer, a new fully connected layer, and a new output layer; The original classification model is pre-trained based on a first training set; the first training set includes a plurality of object images and information for marking the object category in each object image; the original classification model is used to distinguish the category of the object in the object image; The target convolutional layer is the convolutional layer in the fine-tuned classification model.

4. The method according to claim 3, characterized in that: The fine-tuned classification model is obtained in the following way: The new classification model is trained multiple times using the second training set; For each training, the traffic images of the training in the second training set are input into the new classification model, and the predicted classification corresponding to the traffic images of the training in the second training set is output; wherein each training corresponds to a batch of traffic images of the second training set; adjusting the weights in the new classification model according to the predicted classification corresponding to the traffic image of the training in the second training set and the annotation information of the traffic image of the training in the second training set; The trained new classification model is used as the fine-tuned classification model.

5. The method according to claim 2, characterized in that: The converting the encrypted traffic information into a traffic image includes: Converting the encrypted traffic information into the encrypted traffic information in binary representation; Dividing the encrypted traffic information represented in binary into bytes to obtain multiple groups of information, and mapping each group of information into multiple traffic features represented by grayscale values; The plurality of flow features are used as a plurality of pixel values, and a flow image is formed according to the plurality of pixel values.

6. The method according to any one of claims 1 to 5, characterized in that: The step of fusing the heat map and the traffic feature to obtain a fused feature includes: Using the heat map as a weight, weighting the traffic feature to obtain a weighted traffic feature; The weighted flow features are converted into gray values, and the gray values ​​are used as fusion features.

7. The method according to claim 6, characterized in that The classifying according to the fusion feature to detect the traffic category to which the encrypted traffic information belongs includes: Using a convolutional neural network to perform convolution processing on the fusion features to obtain convolution fusion features; The convolution fusion features are classified by using a classifier to determine the traffic category to which the encrypted traffic information belongs.

8. A malicious encrypted traffic classification system, characterized in that: include: An acquisition module, used to acquire encrypted traffic information of a session between two devices; An extraction module, used to convert the encrypted traffic information into a heat map containing class significant features, and to extract traffic features from the encrypted traffic information; A fusion module, used for fusing the heat map and the traffic feature to obtain a fusion feature; A classification module is used to perform classification according to the fusion feature and detect the traffic category to which the encrypted traffic information belongs.

9. An electronic device, characterized in that: include: Memory, used to store computer programs or instructions; A processor is used to execute the computer program or instructions in the memory so that the malicious encrypted traffic classification method as described in any one of claims 1-7 is executed.

10. A computer-readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor, the processor is enabled to execute the malicious encrypted traffic classification method as described in any one of claims 1-7.

Images