Mobile terminal encryption application classification method based on traffic sequence behavior characteristics

Abstract

The invention provides a mobile terminal encryption application classification method based on traffic sequence behavior characteristics, and the method comprises the following specific steps: 1), capturing and collecting encryption traffic under various encryption protocols based on a mobile terminal UI control, carrying out the flow grouping, and constructing a message length sequence sample under each protocol; 2) on the basis of a client-server traffic transmission mechanism, aiming at TCP and QUIC protocols, constructing message length sequence characteristics of same-direction continuous MSS lengths and an inter-behavior association mode representing traffic, and classifying different application encryption traffic under the two protocols by using an MCFormer model, thereby realizing accurate mobile terminal scene encryption TCP and QUIC traffic application classification tasks; 3) for the message splicing characteristic of the TLS protocol, the continuous TLS message length is accumulated in the interval with the similar message time interval, and the message length sequence characteristic of the TLS is constructed; and different application encryption traffic under the TLS protocol is classified by using an MCFormer model, so that an accurate mobile terminal scene encryption TLS traffic application classification task is realized.

Description

Technical Field

[0001] The present invention belongs to the technical field of cyberspace security and relates to a mobile terminal encryption application classification method based on traffic sequence behavior characteristics. Background Art

[0002] Smartphone usage has increased dramatically due to its increased affordability, richer services, and the large number of different applications installed. Mobile application classification for encrypted traffic has become an important technology that enables a third-party passive observer to accurately identify the application category from encrypted traffic. The ability to identify the type of mobile application from encrypted network traffic is critical for network management, security, user privacy, and Quality of Service (QoS).

[0003] However, with the rapid popularization of traffic encryption in the network, the message payload information is randomized, making it no longer feasible to directly distinguish the types of mobile applications from the plaintext perspective. In addition, new encryption protocols used by mobile applications are constantly updated, such as public encryption protocols TLS and QUIC, and TCP protocol traffic with specially designed private protocol formats on the upper layer. As a result, multiple mobile applications that provide similar services and use the same protocol are mixed in the encrypted traffic, which greatly reduces the performance of encrypted traffic classification.

[0004] In order to achieve accurate and efficient classification of encrypted traffic applications, researchers at home and abroad usually use a variety of technical means, which can generally be roughly divided into traditional machine learning methods and deep learning methods. However, traditional methods rely on manual extraction of multiple high-order features, which consumes a lot of computing resources and easily causes overfitting of the model in the method. On the other hand, most deep learning methods directly input the sequence characteristics of traffic, over-rely on the computing performance of neural networks, ignore the significant characteristics of traffic during network transmission, and reduce the classification effect of the model for similar traffic under specific protocols. In essence, these methods lack feature mining of the correlation between messages in specific encrypted traffic transmission modes. Summary of the invention

[0005] In view of the problems that the existing mobile encrypted traffic application classification technology ignores the message association relationship between messages in the traffic transmission mode, fails to essentially characterize the behavioral characteristics of the traffic sequence, and lacks a powerful model to mine these behavioral characteristics, the present invention proposes a mobile encrypted application classification scheme based on the behavioral characteristics of the traffic sequence. Compared with the existing mobile encrypted traffic application classification method, this scheme will comprehensively consider the association relationship between messages in the traffic transmission mode, aiming to obtain more global, essential and accurate encrypted traffic information, and thus be applicable to the complex traffic and easily confused traffic environment of the real network. The present invention realizes an end-to-end solution of mobile encrypted traffic collection-construction of behavioral characteristics of traffic sequence-training of encrypted traffic application classification model, ensuring the accuracy and robustness of the operation of the application classification model. Furthermore, this method is good at distinguishing mixed traffic that uses the same protocol and provides similar services but comes from different mobile applications. This scheme can accurately classify and identify these difficult-to-classify mixed traffic.

[0006] In order to achieve the above object, the present invention provides the following technical solutions:

[0007] A mobile terminal encryption application classification method based on traffic sequence behavior characteristics, the method comprising the following steps:

[0008] (1) Use the UI controls on the mobile terminal to capture and collect encrypted traffic under various encryption protocols, and group the traffic according to the transport layer protocol to construct a sample set of message length sequences under each protocol;

[0009] (2) Sequence feature extraction is performed on the mobile encrypted application traffic under the TCP and QUIC protocols captured in step (1). The algorithm concatenates the continuous messages of length MSS in the same direction in each flow to form a message length sequence feature that characterizes the intrinsic correlation of the communication behavior. Then, MCFormer, a classifier with a Transformer architecture for classifying encrypted traffic applications, is used to input the message length sequence after feature extraction in step (2) for the main services of 13 and 8 applications under the TCP and QUIC protocol stacks to train the model for classifying and identifying encrypted application traffic on the mobile terminal.

[0010] (3) Based on the TCP message splicing characteristics of the TLS protocol, we propose to accumulate the lengths of consecutive TLS messages within the time interval with similar message time intervals to construct the message length sequence characteristics of TLS. Then, we use MCFormer, a Transformer architecture classifier for encrypted traffic application classification, to input the message length sequence after feature extraction in step (3) for the main services of 11 applications under the TLS protocol stack to train the model for classifying and identifying encrypted application traffic on mobile terminals.

[0011] Furthermore, the step (1) specifically includes the following sub-steps:

[0012] (1.1) Use the UI controls on the mobile terminal to monitor the running application software and capture and collect the pcap format traffic corresponding to the software;

[0013] (1.2) Read the traffic in pcap format through the dpkt tool library and distinguish the transport layer protocol (TCP, TLS and QUIC) corresponding to the traffic;

[0014] (1.2.1) Use the dpkt tool under Python syntax to read the five-tuple identifier of the flow (source IP, destination IP, source port, destination port, transport layer protocol), expressed as key = (src_ip, dst_ip, src_port, dst_port, prot), so as to group the traffic corresponding to the application label under the pcap.

[0015] (1.2.2) Use the dpkt tool under Python syntax to read the payload length pkt_len and timestamp timestamp of each packet, and arrange the two-tuple characteristic message sequence of the flow's timing message length and timestamp information in the order of timestamp timestamp.

[0016] (1.3) For the traffic samples under each protocol, for each flow (five-tuple label), capture the length pkt_len of each message in time sequence, and obtain the traffic time sequence of the message length on the TCP layer;

[0017] (1.4) In view of the TCP message concatenation feature of the TLS protocol, the TCP transport layer message sequence in (1.3) above is used to concatenate the TCP segments in the same record to generate the TLS message length sequence.

[0018] (1.4.1) In view of the TCP segment concatenation feature of the TLS protocol, first remove the 5 bytes occupied by the header of each TCP segment to obtain the length of each TCP segment payload;

[0019] (1.4.2) Concatenate the TCP segments belonging to the same TLS message so that the sum of the lengths of the TCP segments is equal to the length record of TLS, thereby obtaining the TLS records message length sequence.

[0020] Furthermore, the step (2) specifically includes the following sub-steps:

[0021] (2.1) Based on the mobile terminal’s captured encrypted application traffic under TCP and QUIC protocols, the message sequence features are extracted based on the communication transmission mode of its protocol stack;

[0022] (2.1.1) Existing message sequence features mostly focus on continuous packets in the same direction, which are spliced ​​into a message feature called Burst, and the characteristic sequence of traffic is composed of time-series Burst units.

[0023] (2.1.2) However, this feature only considers a one-way communication process as a whole, without considering the message association relationship between messages, and ignoring the behavioral characteristics within the one-way communication process.

[0024] (2.2) Based on the TCP transport layer, the traffic is limited by the network's maximum transmission unit (MSS), and the communication mode will be truncated. When a message transmission reaches the MSS length, the TCP traffic will be truncated, resulting in a message being truncated into multiple message sequence fragments less than or equal to the MSS during the transmission process;

[0025] (2.3) In view of the truncated characteristics of the message in (2.2) above, the continuous MSS units in the same direction divided from a message are reconstructed with each flow as the unit, and an ACM unit is synthesized as the traffic sequence behavior feature unit under the TCP and QUIC protocols;

[0026] (2.4) Based on the ACM sequences synthesized under the TCP and QUIC protocols in (2.3) above, MCFormer, a classifier with a Transformer architecture for classifying encrypted traffic applications, is used to input the training samples of the sequence for the Transformer that processes the sequence input to learn its traffic representation, thereby realizing the classification of mobile encrypted applications based on the behavioral characteristics of the traffic sequences under the TCP and QUIC protocols.

[0027] (2.5) The above (2.3) and (2.4) are respectively constructed from the behavioral characteristics of the traffic sequence and the deep learning model for the traffic sequence input, thereby realizing automatic feature extraction and end-to-end mobile encryption application classification method, achieving better performance results in experimental results.

[0028] Furthermore, the step (3) specifically includes the following sub-steps:

[0029] (3.1) Based on the mobile terminal encrypted application traffic under the TLS protocol captured by the mobile terminal, the message sequence features are extracted based on the communication transmission mode of its protocol stack;

[0030] (3.1.1) Under the TLS protocol, the length of each message will be randomized, so simply concatenating multiple message lengths to represent the message is not accurate. However, in client-server communication, the method of concatenating consecutive packets in the same direction into one message characteristic Burst is still applicable.

[0031] (3.1.2) Referring to (2.3), we generate the behavior characteristics of ACM traffic sequences under TCP and QUIC protocols. We refer to the timing characteristics of message sequences and further segment the Burst feature of each message to find the implicit behavior characteristics between messages.

[0032] (3.2) Based on the TLS protocol’s method of truncating the transport layer TCP segments according to the TLS record, a method for restoring the TLS record is designed to align the length of each record with the sum of the lengths of the subsequent multiple TCP segments, thereby restoring the TLS layer message length sequence to replace the TCP layer message data, and characterizing the behavioral characteristics of the TLS layer traffic from the perspective of the TLS communication mode;

[0033] (3.3) Referring to (2.3), the method for generating the ACM traffic sequence behavior characteristics under the TCP and QUIC protocols is as follows. For each TLS flow, the lengths of continuous messages in the same direction with similar time intervals are aggregated to form a TLS ACM unit, which represents a message transmitted on the TLS layer as the ACM traffic sequence behavior characteristics of the TLS layer.

[0034] (3.4) With respect to the method of aggregating TLS ACM units under the TLS protocol in (3.3), the similarity of the time intervals between TLS messages is designed so that the time interval difference between multiple TLS messages that can be aggregated into one ACM unit cannot be greater than 15%, thereby ensuring that these messages aggregated into ACM unit characteristics all belong to the same TLS message; these TLS ACM units are arranged in chronological order to form an ACM message length sequence under the TLS protocol.

[0035] (3.5) Based on the ACM message length sequence under the TLS protocol synthesized by (3.3) and (3.4) above, MCFormer, a classifier with a Transformer architecture for classification of encrypted traffic applications, is used to input the training samples of the sequence for the Transformer that processes the sequence input to learn its traffic representation, so as to realize the classification of mobile encrypted applications based on the traffic sequence behavior characteristics under the TLS protocol.

[0036] (3.6) The above (3.4) and (3.5) are respectively constructed from the behavioral characteristics of the traffic sequence and the deep learning model for the traffic sequence input, thereby realizing automatic feature extraction and end-to-end mobile encryption application classification methods, achieving better performance results in experimental results.

[0037] (3.6.1) For the main services of 13 mobile applications under the TCP protocol, based on the feature construction in (2.3) and the model method in (2.4), the classification of mobile encryption applications based on the behavioral characteristics of TCP traffic sequences is implemented, and the corresponding classification result confusion matrix is ​​generated.

[0038] (3.6.2) For the main services of the 8 mobile applications under the QUIC protocol, based on the feature construction in (2.3) and the model method in (2.4), the classification of mobile encryption applications based on the behavioral characteristics of QUIC traffic sequences is implemented, and the corresponding classification result confusion matrix is ​​generated.

[0039] (3.6.3) For the main services of 11 mobile applications under the TLS protocol, based on the feature construction in (3.3) and (3.4) and the model method in (3.5), the classification of mobile encryption applications based on the behavioral characteristics of TLS traffic sequences is implemented, and the corresponding classification result confusion matrix is ​​generated.

[0040] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0041] (1) Considering the message correlation mode mechanism between encrypted traffic messages in client and server communications in various popular encryption protocols on the current network, we design a behavioral feature construction method based on the correlation between traffic sequence messages in the TCP, QUIC and TLS protocol modes. This feature engineering can be applied to real networks and complex environments.

[0042] (2) The neural network with Transformer architecture is used to process the high-dimensional feature data of encrypted traffic. The model supports parallel computing and is easy to adapt to concurrent and high-speed network environments. The model converges quickly and has good application classification effect for encrypted traffic, which scientifically solves the problem of difficult classification of applications with similar functions.

[0043] (3) Mining the network communication process of encrypted traffic, deeply capturing the correlation between the behavioral characteristics of encrypted traffic messages in a single communication between the client and the server, not only accurately identifying different applications of the same protocol and the same service that are easily confused, but also enhancing the interpretability of the behavioral characteristics of the encrypted traffic sequence.

[0044] In general, the present invention realizes deep mining of the behavioral characteristics of encrypted traffic sequences by integrating the pattern characteristics of network communication processes, analysis of multiple encryption protocols, and a neural network architecture based on the Transformer model. It can achieve high-precision classification and identification of mobile encryption applications, which is of great significance for strengthening network service supervision and protecting user privacy. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 The classification process of mobile encryption applications based on traffic sequence behavior characteristics is proposed.

[0046] Figure 2 Classification confusion matrix for mobile encryption applications based on TCP protocol,

[0047] Figure 3 Classification confusion matrix for mobile encryption applications based on TLS protocol,

[0048] Figure 4 Confusion matrix for classifying mobile encryption applications based on the QUIC protocol. DETAILED DESCRIPTION

[0049] The technical solution provided by the present invention will be described in detail below in conjunction with specific embodiments. It should be understood that the following specific implementation methods are only used to illustrate the present invention and are not used to limit the scope of the present invention.

[0050] Embodiment: The present invention proposes a mobile terminal encryption application classification method based on traffic sequence behavior characteristics, which is mainly composed of three parts: a traffic collection module for each encryption protocol, a traffic behavior feature construction module for two protocol modes, and an encryption application classification module based on the MCFormer model (Transformer architecture). The traffic collection module in the first part uses the UI control of the mobile terminal to capture and collect encrypted traffic under various encryption protocols, and at the same time, it groups the traffic according to the transport layer protocol of the traffic to construct a message length sequence sample set under each protocol; the traffic behavior feature construction module in the second part extracts sequence features based on the captured mobile encryption application traffic under TCP and QUIC protocols, and the algorithm splices the continuous length of MSS messages in the same direction in each flow to form a message length sequence feature that characterizes the intrinsic correlation of the communication behavior; at the same time, based on the TCP message splicing characteristics for the TLS protocol, it is proposed to accumulate the continuous TLS message lengths within the time interval with similar message time intervals to construct the message length sequence feature of TLS. The third part of the encrypted application classification model training module uses MCFormer, a Transformer architecture classifier for encrypted traffic application classification. For the main services of different applications under each protocol stack, the message length sequence after feature extraction in the second part is input to train the model for classifying and identifying encrypted application traffic on mobile terminals.

[0051] Specifically, the present invention has the following steps:

[0052] (1) The mobile UI control is used to capture and collect encrypted traffic under various encryption protocols. At the same time, the traffic is grouped according to the transport layer protocol of the traffic to construct a sample set of message length sequences under each protocol. Specifically, for mobile encrypted application traffic under TCP and QUIC protocols, the message length sequence of the transport layer is composed in time sequence, corresponding to each application tag, as the original sample set of each protocol; for mobile encrypted application traffic under TLS protocol, multiple TCP message segments corresponding to each TLS record are spliced ​​in time sequence to obtain the TLS records message length sequence, corresponding to each application tag, as the original sample set of TLS;

[0053] The specific process of this step is as follows:

[0054] (1.1) Use the UI controls on the mobile terminal to monitor the running application software and capture and collect the pcap format traffic corresponding to the software;

[0055] (1.2) Read the traffic in pcap format through the dpkt tool library and distinguish the transport layer protocol (TCP, TLS and QUIC) corresponding to the traffic;

[0056] (1.2.1) Use the dpkt tool under Python syntax to read the five-tuple identifier of the flow (source IP, destination IP, source port, destination port, transport layer protocol), expressed as key = (src_ip, dst_ip, src_port, dst_port, prot), so as to group the traffic corresponding to the application label under the pcap.

[0057] (1.2.2) Use the dpkt tool under Python syntax to read the payload length pkt_len and timestamp timestamp of each packet, and arrange the two-tuple characteristic message sequence of the flow's timing message length and timestamp information in the order of timestamp timestamp.

[0058] (1.3) For the traffic samples under each protocol, for each flow (five-tuple label), capture the length pkt_len of each message in time sequence, and obtain the traffic time sequence of the message length on the TCP layer;

[0059] (1.4) In view of the TCP message concatenation feature of the TLS protocol, the TCP transport layer message sequence in (1.3) above is used to concatenate the TCP segments in the same record to generate the TLS message length sequence.

[0060] (1.4.1) In view of the TCP segment concatenation feature of the TLS protocol, first remove the 5 bytes occupied by the header of each TCP segment to obtain the length of each TCP segment payload;

[0061] (1.4.2) Concatenate the TCP segments belonging to the same TLS message so that the sum of the lengths of the TCP segments is equal to the length of TLS record, thereby obtaining the TLS records message length sequence.

[0062] (2) Sequence feature extraction is performed on the mobile encrypted application traffic under the TCP and QUIC protocols captured in step (1). The algorithm concatenates the continuous messages of length MSS in the same direction in each flow to form a message length sequence feature that characterizes the intrinsic correlation of the communication behavior. Then, MCFormer, a classifier with a Transformer architecture for classifying encrypted traffic applications, is used to input the message length sequence after feature extraction in step (2) for the main services of 13 and 8 applications under the TCP and QUIC protocol stacks to train the model for classifying and identifying encrypted application traffic on the mobile terminal.

[0063] The specific process of this step is as follows:

[0064] (2.1) Based on the mobile terminal’s captured encrypted application traffic under TCP and QUIC protocols, the message sequence features are extracted based on the communication transmission mode of its protocol stack;

[0065] (2.1.1) Existing message sequence features mostly focus on continuous packets in the same direction, which are spliced ​​into a message feature called Burst, and the characteristic sequence of traffic is composed of time-series Burst units.

[0066] (2.1.2) However, this feature only considers a one-way communication process as a whole, without considering the message association relationship between messages, and ignoring the behavioral characteristics within the one-way communication process.

[0067] (2.2) Based on the TCP transport layer, the traffic is limited by the network's maximum transmission unit (MSS), and the communication mode will be truncated. When a message transmission reaches the MSS length, the TCP traffic will be truncated, resulting in a message being truncated into multiple message sequence fragments less than or equal to the MSS during the transmission process;

[0068] (2.3) In view of the truncated characteristics of the message in (2.2) above, the continuous MSS units in the same direction divided from a message are reconstructed with each flow as the unit, and an ACM unit is synthesized as the traffic sequence behavior feature unit under the TCP and QUIC protocols;

[0069] (2.4) Based on the ACM sequences synthesized under the TCP and QUIC protocols in (2.3) above, MCFormer, a classifier with a Transformer architecture for classifying encrypted traffic applications, is used to input the training samples of the sequence for the Transformer that processes the sequence input to learn its traffic representation, thereby realizing the classification of mobile encrypted applications based on the behavioral characteristics of the traffic sequences under the TCP and QUIC protocols.

[0070] (2.5) The above (2.3) and (2.4) are respectively constructed from the behavioral characteristics of the traffic sequence and the deep learning model for the traffic sequence input, thereby realizing automatic feature extraction and end-to-end mobile encryption application classification method, achieving better performance results in experimental results.

[0071] (3) Based on the TCP message splicing characteristics of the TLS protocol, we propose to accumulate the lengths of consecutive TLS messages within the time interval with similar message time intervals to construct the message length sequence characteristics of TLS. Then, we use MCFormer, a Transformer architecture classifier for encrypted traffic application classification, to input the message length sequence after feature extraction in step (3) for the main services of 11 applications under the TLS protocol stack to train the model for classifying and identifying encrypted application traffic on mobile terminals.

[0072] The specific process of this step is as follows:

[0073] (3.1) Based on the mobile terminal encrypted application traffic under the TLS protocol captured by the mobile terminal, the message sequence features are extracted based on the communication transmission mode of its protocol stack;

[0074] (3.1.1) Under the TLS protocol, the length of each message will be randomized, so simply concatenating multiple message lengths to represent the message is not accurate. However, in client-server communication, the method of concatenating consecutive packets in the same direction into one message characteristic Burst is still applicable.

[0075] (3.1.2) Referring to (2.3), we generate the behavior characteristics of ACM traffic sequences under TCP and QUIC protocols. We refer to the timing characteristics of message sequences and further segment the Burst feature of each message to find the implicit behavior characteristics between messages.

[0076] (3.2) Based on the TLS protocol’s method of truncating the transport layer TCP segments according to the TLS record, a method for restoring the TLS record is designed to align the length of each record with the sum of the lengths of the subsequent multiple TCP segments, thereby restoring the TLS layer message length sequence to replace the TCP layer message data, and characterizing the behavioral characteristics of the TLS layer traffic from the perspective of the TLS communication mode;

[0077] (3.3) Referring to (2.3), the method for generating the ACM traffic sequence behavior characteristics under the TCP and QUIC protocols is as follows. For each TLS flow, the lengths of continuous messages in the same direction with similar time intervals are aggregated to form a TLS ACM unit, which represents a message transmitted on the TLS layer as the ACM traffic sequence behavior characteristics of the TLS layer.

[0078] (3.4) With respect to the method of aggregating TLS ACM units under the TLS protocol in (3.3), the similarity of the time intervals between TLS messages is designed so that the time interval difference between multiple TLS messages that can be aggregated into one ACM unit cannot be greater than 15%, thereby ensuring that these messages aggregated into ACM unit characteristics all belong to the same TLS message; these TLS ACM units are arranged in chronological order to form an ACM message length sequence under the TLS protocol.

[0079] (3.5) Based on the ACM message length sequence under the TLS protocol synthesized by (3.3) and (3.4) above, MCFormer, a classifier with a Transformer architecture for classification of encrypted traffic applications, is used to input the training samples of the sequence for the Transformer that processes the sequence input to learn its traffic representation, so as to realize the classification of mobile encrypted applications based on the traffic sequence behavior characteristics under the TLS protocol.

[0080] (3.6) The above (3.4) and (3.5) are respectively constructed from the behavioral characteristics of the traffic sequence and the deep learning model for the traffic sequence input, thereby realizing automatic feature extraction and end-to-end mobile encryption application classification methods, achieving better performance results in experimental results.

[0081] (3.6.1) For the main services of 13 mobile applications under the TCP protocol, based on the feature construction in (2.3) and the model method in (2.4), the classification of mobile encryption applications based on the behavioral characteristics of TCP traffic sequences is implemented, and the corresponding classification result confusion matrix is ​​generated.

[0082] (3.6.2) For the main services of the 8 mobile applications under the QUIC protocol, based on the feature construction in (2.3) and the model method in (2.4), the classification of mobile encryption applications based on the behavioral characteristics of QUIC traffic sequences is implemented, and the corresponding classification result confusion matrix is ​​generated.

[0083] (3.6.3) For the main services of 11 mobile applications under the TLS protocol, based on the feature construction in (3.3) and (3.4) and the model method in (3.5), the classification of mobile encryption applications based on the behavioral characteristics of TLS traffic sequences is implemented, and the corresponding classification result confusion matrix is ​​generated.

[0084] It should be noted that the above embodiments are not intended to limit the protection scope of the present invention, and equivalent changes or substitutions made on the basis of the above technical solutions all fall within the protection scope of the claims of the present invention.

Claims

1. A mobile terminal encryption application classification method based on traffic sequence behavior characteristics, characterized in that: The steps include: (1) Use the UI controls on the mobile terminal to capture and collect encrypted traffic under various encryption protocols, and group the traffic according to the transport layer protocol to construct a sample set of message length sequences under each protocol; (2) Sequence feature extraction is performed on the mobile encrypted application traffic under the TCP and QUIC protocols captured in step (1). The algorithm concatenates the continuous messages of length MSS in the same direction in each flow to form a message length sequence feature that characterizes the intrinsic correlation of the communication behavior. Then, MCFormer, a Transformer architecture classifier for encrypted traffic application classification, is used to input the message length sequence after feature extraction in step (2) for the main services of 13 and 8 applications under the TCP and QUIC protocol stacks to train the model for classifying and identifying encrypted application traffic on the mobile terminal. (3) Based on the TCP message splicing characteristics of the TLS protocol, we draw on step (2) and propose to accumulate the continuous TLS message lengths within the time interval with similar message time intervals to construct the TLS message length sequence characteristics. Then, we use MCFormer, a classifier with a Transformer architecture for the classification of encrypted traffic applications. For the main services of the 11 applications under the TLS protocol stack, we input the message length sequence after feature extraction in step (3) to train the model, which is used to classify and identify encrypted application traffic on mobile terminals.

2. According to claim 1, the mobile terminal encryption application classification method based on traffic sequence behavior characteristics is characterized in that: The step (1) specifically includes the following sub-steps: (1.1) Use the UI controls on the mobile terminal to monitor the running application software, capture and collect the pcap format traffic corresponding to the software, (1.2) Read the traffic in pcap format through the dpkt tool library and distinguish the transport layer protocol (TCP, TLS and QUIC) corresponding to the traffic. (1.2.1) Use the dpkt tool under Python syntax to read the five-tuple identifier of the flow (source IP, sink IP, source port, sink port, transport layer protocol), expressed as key = (src_ip, dst_ip, src_port, dst_port, prot), so as to group the traffic corresponding to the application label under the pcap. (1.2.2) Use the dpkt tool under Python syntax to read the payload length pkt_len and timestamp timestamp of each packet, and arrange the two-tuple characteristic message sequence of the flow's timing message length and timestamp information in the order of timestamp timestamp. (1.3) For the traffic samples under each protocol, for each flow (five-tuple label), capture the length pkt_len of each message in time sequence, and obtain the traffic time sequence of the message length on the TCP layer. (1.4) In view of the TCP message concatenation feature of the TLS protocol, the TCP transport layer message sequence in (1.3) above is used to concatenate the TCP segments in the same record to generate the TLS message length sequence. (1.4.1) In view of the TCP segment concatenation feature of the TLS protocol, first remove the 5 bytes occupied by the header of each TCP segment to obtain the length of each TCP segment payload. (1.4.2) Concatenate the TCP segments belonging to the same TLS message so that the sum of the lengths of the TCP segments is equal to the length of TLS record, thereby obtaining the TLS records message length sequence.

3. The mobile terminal encryption application classification method based on traffic sequence behavior characteristics according to claim 2 is characterized in that: The specific requirements of step (2) are: (2.1) Based on the mobile terminal’s captured mobile terminal encrypted application traffic under TCP and QUIC protocols, the message sequence features are extracted based on the communication transmission mode of its protocol stack. (2.1.1) Existing message sequence features mostly focus on continuous packets in the same direction, which are spliced ​​into a message feature called Burst. The time-series Burst units form a feature sequence of traffic. (2.1.2) Improve the Burst unit in step (2.1.1), divide the behavior characteristics within the Burst unit according to the message association relationship between the messages, and combine continuous messages in the same direction to form a traffic sequence of multiple ACM units. (2.2) Based on the TCP transport layer, the traffic is limited by the network's maximum transmission unit (MSS), and the communication mode will be truncated. When a message transmission reaches the MSS length, the TCP traffic will be truncated, resulting in a message being truncated into multiple message sequence fragments less than or equal to the MSS during transmission. (2.3) In view of the truncated message in (2.2) above, the continuous MSS units in the same direction divided from a message are reconstructed for each flow, and synthesized into an ACM unit as the traffic sequence behavior feature unit under the TCP and QUIC protocols. (2.4) Based on the ACM sequences of TCP and QUIC protocols synthesized in (2.3) above, MCFormer, a classifier with a Transformer architecture for classification of encrypted traffic applications, is used to input the training samples of the sequence for the Transformer that processes the sequence input to learn its traffic representation, so as to achieve mobile encrypted application classification based on the traffic sequence behavior characteristics under TCP and QUIC protocols. (2.5) The above (2.3) and (2.4) are respectively constructed from the behavioral characteristics of the traffic sequence and the deep learning model for the traffic sequence input, thereby realizing automatic feature extraction and end-to-end mobile encryption application classification method, achieving better performance results in experimental results.

4. The mobile terminal encryption application classification method based on traffic sequence behavior characteristics according to claim 3 is characterized in that: The step (3) specifically comprises the following steps: (3.1) Based on the mobile terminal encrypted application traffic under the TLS protocol captured by the mobile terminal, the message sequence features are extracted based on the communication transmission mode of its protocol stack; (3.1.1) Based on the randomization of the length of each message under the TLS protocol, in the communication mode between the client and the server, the Message corresponding to a single communication (i.e., continuous packets in the same direction) is concatenated into a message feature. (3.1.2) Referring to (2.3), the method for generating the behavior characteristics of ACM traffic sequences under TCP and QUIC protocols is to segment the Burst characteristics of each message according to the timing characteristics of the message sequence, and obtain the implicit inter-message behavior characteristics ACM unit traffic sequence. (3.2) Based on the TLS protocol’s method of truncating the transport layer TCP segments according to the TLS record, a method for restoring the TLS record is designed to align the length of each record with the sum of the lengths of the subsequent multiple TCP segments, thereby restoring the TLS layer message length sequence to replace the TCP layer message data, and characterizing the behavioral characteristics of the TLS layer traffic from the perspective of the TLS communication mode. (3.3) Referring to (2.3), the method for generating the ACM traffic sequence behavior characteristics under the TCP and QUIC protocols is used. For each TLS flow, the lengths of continuous messages in the same direction with similar time intervals are aggregated to form a TLS ACM unit, which represents a message transmitted on the TLS layer as the ACM traffic sequence behavior characteristics of the TLS layer. (3.4) According to the method of aggregating TLS ACM units under the TLS protocol in (3.3), the similarity of the time intervals between TLS messages is designed. The time interval difference between multiple TLS messages that can be aggregated into one ACM unit cannot be greater than 15%, thereby ensuring that these messages aggregated into ACM unit characteristics belong to the same TLS message; these TLS ACM units are arranged in chronological order to form an ACM message length sequence under the TLS protocol. (3.5) Based on the ACM message length sequence under the TLS protocol synthesized by (3.3) and (3.4), MCFormer, a classifier with a Transformer architecture for encryption traffic application classification, is used to input the training samples of the sequence for the Transformer that processes the sequence input to learn its traffic representation, so as to realize the classification of mobile encryption applications based on the traffic sequence behavior characteristics under the TLS protocol. (3.6) The above (3.4) and (3.5) are respectively constructed from the behavioral characteristics of the traffic sequence and the deep learning model for the traffic sequence input, thereby realizing automatic feature extraction and end-to-end mobile encryption application classification methods, achieving better performance results in experimental results. (3.6.1) For the main services of 13 mobile applications under the TCP protocol, based on the feature construction in (2.3) and the model method in (2.4), the classification of mobile encryption applications based on the behavior characteristics of TCP traffic sequence is realized, and the confusion matrix of the corresponding classification results is generated. (3.6.2) For the main services of the eight mobile applications under the QUIC protocol, based on the feature construction in (2.3) and the model method in (2.4), the classification of mobile encryption applications based on the behavior characteristics of QUIC traffic sequences is implemented, and the confusion matrix of the corresponding classification results is generated. (3.6.3) For the main services of 11 mobile applications under the TLS protocol, based on the feature construction in (3.3) and (3.4) and the model method in (3.5), the classification of mobile encryption applications based on the behavioral characteristics of TLS traffic sequences is implemented, and the corresponding classification result confusion matrix is ​​generated.

Images