A Classification Method for Mobile Encryption Applications Based on Traffic Sequence Behavior Characteristics

Abstract

This invention proposes a mobile encrypted application classification method based on traffic sequence behavior characteristics. The specific steps are as follows: 1) Capture and collect encrypted traffic under various encryption protocols using mobile UI controls, and simultaneously group the traffic to construct message length sequence samples under each protocol; 2) Based on the client-server traffic transmission mechanism, construct message length sequence features with consecutive MSS lengths in the same direction for TCP and QUIC protocols to characterize the correlation patterns between traffic behaviors. Use the MCFormer model to classify different application encrypted traffic under the two protocols, thereby achieving accurate classification of encrypted TCP and QUIC traffic applications in mobile scenarios; 3) Considering the message splicing characteristics of the TLS protocol, propose accumulating consecutive TLS message lengths within intervals with similar message time intervals to construct TLS message length sequence features. Use the MCFormer model to classify different application encrypted traffic under the TLS protocol, thereby achieving accurate classification of encrypted TLS traffic applications in mobile scenarios.

Description

Technical Field

[0001] This invention belongs to the field of cyberspace security technology and relates to a classification method for mobile encrypted applications based on traffic sequence behavior characteristics. Background Technology

[0002] Smartphone usage has surged due to their increased affordability, richer services, and the widespread installation of diverse applications. Mobile application categorization within encrypted traffic has become a crucial technology, enabling passive third-party observers to accurately identify application categories from encrypted traffic. This technology for identifying mobile application types from encrypted network traffic is essential for network management and security, user privacy, and Quality of Service (QoS).

[0003] However, with the rapid proliferation of network traffic encryption, message payload information is being randomized, making it no longer feasible to directly distinguish the types of mobile applications from a plaintext perspective. Furthermore, the encryption protocols used by mobile applications are constantly being updated, such as the publicly available encryption protocols TLS and QUIC, as well as TCP protocol traffic carried by specially designed proprietary protocol formats at higher layers. Consequently, encrypted traffic is often mixed with multiple mobile applications providing similar services and using the same protocols, which significantly reduces the performance of encrypted traffic classification.

[0004] To achieve accurate and efficient classification of encrypted traffic applications, researchers both domestically and internationally typically employ various techniques, generally categorized into traditional machine learning methods and deep learning methods. However, traditional methods rely on manual extraction of numerous high-order features, consuming significant computational resources and prone to overfitting. On the other hand, most deep learning methods directly input the sequence features of traffic, over-relying on the computational performance of neural networks and ignoring the significant characteristics of traffic during network transmission, resulting in reduced classification effectiveness for similar traffic under specific protocols. Essentially, these methods lack feature mining of the correlations between packets within specific encrypted traffic transmission patterns. Summary of the Invention

[0005] To address the shortcomings of existing mobile encrypted traffic application classification technologies, such as neglecting the message relationships between packets in traffic transmission modes, failing to fundamentally characterize the behavioral features of traffic sequences, and lacking robust models to mine these behavioral features, this invention proposes a mobile encrypted traffic application classification scheme based on traffic sequence behavioral features. Compared to existing mobile encrypted traffic application classification methods, this scheme comprehensively considers the message relationships between packets in traffic transmission modes, aiming to obtain more global, essential, and accurate encrypted traffic information, thus making it applicable to complex and easily confused traffic environments in real networks. This invention implements an end-to-end solution for mobile encrypted traffic collection—construction of traffic sequence behavioral features—training of the encrypted traffic application classification model, ensuring the accuracy and robustness of the application classification model. Furthermore, this method excels at distinguishing mixed traffic that uses the same protocol and provides similar services but originates from different mobile applications; this scheme can accurately classify and identify these difficult-to-classify mixed traffic flows.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] A classification method for mobile encrypted applications based on traffic sequence behavior characteristics, the method comprising the following steps:

[0008] (1) Use the UI controls of the mobile terminal to capture and collect encrypted traffic under various encryption protocols, and at the same time group the traffic according to the transport layer protocol to construct a sample set of message length sequence under each protocol;

[0009] (2) Extract sequence features from the mobile encrypted application traffic captured in step (1) under TCP and QUIC protocols. The algorithm concatenates consecutive messages of length MSS in the same direction within each stream to form a message length sequence feature that represents the intrinsic relationship of communication behavior. Then, use MCFormer, a Transformer architecture classifier for classifying encrypted traffic applications, to train the model for the main services of 13 and 8 applications under the TCP and QUIC protocol stacks. The message length sequence extracted in step (2) is used to classify and identify encrypted application traffic on mobile devices.

[0010] (3) Regarding the TCP packet splicing characteristics of the TLS protocol, drawing on step (2), it is proposed to accumulate the lengths of consecutive TLS packets within a time interval with similar packet time intervals to construct the TLS packet length sequence feature. Then, using MCFormer, a Transformer architecture classifier for classifying encrypted traffic applications, the packet length sequence extracted in step (3) is input into the main services of 11 applications under the TLS protocol stack to train the model, which is used to classify and identify encrypted application traffic on mobile devices.

[0011] Furthermore, step (1) specifically includes the following sub-steps:

[0012] (1.1) Use the UI controls on the mobile terminal to monitor the running application software, and capture and collect the pcap traffic corresponding to the software;

[0013] (1.2) Read the traffic in pcap format using the dpkt tool library and distinguish the transport layer protocol (TCP, TLS and QUIC) corresponding to the traffic;

[0014] (1.2.1) Use the dpkt tool under Python syntax to read the five-tuple identifier (source IP, destination IP, source port, destination port, transport layer protocol) of the flow, represented as key = (src_ip, dst_ip, src_port, dst_port, prot), and use this to group the traffic of the corresponding application label under the pcap.

[0015] (1.2.2) Use the dpkt tool under Python syntax to read the payload length pkt_len and timestamp of each packet, and arrange the sequence of time-series packets and timestamp information in the order of timestamps.

[0016] (1.3) For traffic samples under each protocol, for each flow (five-tuple label), capture the length pkt_len of each packet in chronological order to obtain the traffic chronological sequence of packet lengths on the TCP layer;

[0017] (1.4) To address the TCP message concatenation feature of the TLS protocol, the TCP transport layer message sequence in (1.3) above is used to concatenate TCP segments within the same record to generate the TLS message length sequence.

[0018] (1.4.1) Regarding the TCP segment concatenation feature of the TLS protocol, first remove the 5 bytes occupied by the header of each TCP segment to obtain the length of the payload of each TCP segment.

[0019] (1.4.2) Concatenate TCP segments belonging to the same TLS message, such that the sum of the lengths of the TCP segments equals the length of the TLS record, thus obtaining the TLS record message length sequence.

[0020] Furthermore, step (2) specifically includes the following sub-steps:

[0021] (2.1) Based on the mobile terminal's encrypted application traffic captured by the mobile terminal under the TCP and QUIC protocols, message sequence features are extracted based on the communication transmission mode of its protocol stack.

[0022] (2.1.1) Existing message sequence features mostly focus on consecutive packets in the same direction, which are spliced ​​together into a message feature called a Burst. The feature sequence of traffic is composed of time-series Burst units.

[0023] (2.1.2) However, this feature only treats a one-way communication process as a whole, without taking into account the message association between messages, and ignores the behavioral characteristics inside the one-way communication process.

[0024] (2.2) Based on the TCP transport layer, the traffic is truncated due to the limitation of the maximum transmission unit (MSS) of the network. When a message transmission reaches the MSS length, the TCP traffic will be truncated, resulting in a message being truncated into multiple message sequence fragments less than or equal to the MSS during transmission;

[0025] (2.3) In view of the truncation of the message in (2.2) above, the continuous MSS units in the same direction that are cut out in a message are reconstructed in each flow and synthesized into an ACM unit, which serves as the traffic sequence behavior feature unit under TCP and QUIC protocols.

[0026] (2.4) Based on the ACM sequence synthesized under the TCP and QUIC protocols above (2.3), the MCFormer classifier, which is a Transformer architecture for classifying encrypted traffic applications, is used to input the training samples of the sequence so that the Transformer that processes the sequence input can learn its traffic representation, so as to realize the classification of mobile encrypted applications based on the traffic sequence behavior characteristics under the TCP and QUIC protocols.

[0027] (2.5) The above (2.3) and (2.4) are respectively developed from the construction of behavioral features of traffic sequences and the deep learning model for traffic sequence input, so as to realize automatic feature extraction and end-to-end mobile encrypted application classification method, and achieve better performance in experimental results.

[0028] Furthermore, step (3) specifically includes the following sub-steps:

[0029] (3.1) Based on the mobile terminal's encrypted application traffic under the TLS protocol captured by the mobile terminal, the message sequence features are extracted based on the communication transmission mode of its protocol stack;

[0030] (3.1.1) Under the TLS protocol, the length of each message is randomized, so simply concatenating the lengths of multiple messages to represent a message is not accurate. However, in client-server communication, the method of concatenating consecutive packets in the same direction into a message (Burst) for a single communication is still applicable.

[0031] (3.1.2) Referring to (2.3) the method for generating ACM traffic sequence behavior characteristics under TCP and QUIC protocols, we draw on the temporal characteristics of message sequences and further segment the Message feature Burst of each message to find the implicit inter-message behavior characteristics.

[0032] (3.2) Based on the TLS protocol's method of truncating TCP segments in the transport layer according to TLS records, a method for restoring TLS records is designed. The length of each record is aligned with the sum of the lengths of multiple subsequent TCP segments, thereby restoring the message length sequence of the TLS layer to replace the TCP layer message data, thus characterizing the behavioral features of TLS layer traffic from the perspective of TLS communication mode.

[0033] (3.3) Referring to (2.3), the method for generating ACM traffic sequence behavior characteristics under TCP and QUIC protocols is to aggregate consecutive message lengths in the same direction with similar time intervals for each TLS flow to form a TLS ACM unit, which represents a message transmitted on the TLS layer and serves as the ACM traffic sequence behavior characteristic of the TLS layer.

[0034] (3.4) Regarding the method of aggregating TLS ACM units under the TLS protocol in (3.3), the similarity of time intervals between TLS messages is designed so that the time interval difference between multiple TLS messages that can be aggregated into one ACM unit cannot be greater than 15%, thereby ensuring that these messages that are aggregated into ACM unit characteristics belong to the same TLS message; these TLS ACM units are arranged in chronological order to form a sequence of ACM message lengths under the TLS protocol.

[0035] (3.5) Based on the ACM message length sequence under the TLS protocol synthesized in (3.3) and (3.4) above, the MCFormer classifier, which is a Transformer architecture for classifying encrypted traffic applications, is used as the input training sample of the sequence for the Transformer to learn its traffic representation, so as to realize the classification of mobile encrypted applications based on the traffic sequence behavior characteristics under the TLS protocol.

[0036] (3.6) The above (3.4) and (3.5) are respectively developed from the construction of behavioral features of traffic sequences and the deep learning model for traffic sequence input, so as to realize automatic feature extraction and end-to-end mobile encrypted application classification method, and achieve better performance in experimental results.

[0037] (3.6.1) For the main services of 13 mobile applications under the TCP protocol, based on the feature construction in (2.3) and the model method in (2.4), the classification of mobile encrypted applications based on TCP traffic sequence behavior features is realized, and the corresponding classification result confusion matrix is ​​generated.

[0038] (3.6.2) For the main services of the eight mobile applications under the QUIC protocol, based on the feature construction in (2.3) and the model method in (2.4), the classification of mobile encrypted applications based on the QUIC traffic sequence behavior features is realized, and the corresponding classification result confusion matrix is ​​generated.

[0039] (3.6.3) For the main services of 11 mobile applications under the TLS protocol, based on the feature construction in (3.3) and (3.4) and the model method in (3.5), the classification of mobile encrypted applications based on the behavior characteristics of TLS traffic sequence is realized, and the corresponding classification result confusion matrix is ​​generated.

[0040] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0041] (1) Considering the message association mode mechanism between encrypted traffic messages in client and server communication in various currently popular network encryption protocols, design behavioral feature construction methods based on the association between traffic sequence messages under the TCP, QUIC and TLS protocol modes respectively. This feature engineering can be applied to real networks and complex environments.

[0042] (2) The neural network with Transformer architecture is used to process the high-dimensional feature data of encrypted traffic. The model supports parallel computing, is easy to apply to concurrent and high-speed network environments, converges quickly, and has good application classification effect for encrypted traffic, which scientifically solves the problem of difficult application classification for similar functions.

[0043] (3) By mining the network communication process of encrypted traffic, we can capture the behavioral characteristics of encrypted traffic messages in a single communication between the client and the server. This not only enables accurate identification of different applications of the same protocol and the same service that are easily confused, but also enhances the interpretability of the behavioral characteristics of encrypted traffic sequences.

[0044] Overall, this invention achieves in-depth mining of the behavioral characteristics of encrypted traffic sequences by integrating network communication process pattern characteristics, analysis of multiple encryption protocols, and a neural network architecture based on the Transformer model. It can achieve high-precision classification and identification of mobile encrypted applications, which is of great significance for strengthening network service supervision and protecting user privacy. Attached Figure Description

[0045] Figure 1 A classification process for mobile encrypted applications based on traffic sequence behavior characteristics.

[0046] Figure 2 A confusion matrix for classifying TCP-based mobile encryption applications.

[0047] Figure 3 A categorization obfuscation matrix for mobile encryption applications based on the TLS protocol.

[0048] Figure 4 A confusion matrix for classifying mobile encrypted applications based on the QUIC protocol. Detailed Implementation

[0049] The technical solutions provided by the present invention will be described in detail below with reference to specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0050] Example: This invention proposes a mobile encrypted application classification method based on traffic sequence behavior features, mainly composed of three parts: a traffic acquisition module for various encryption protocols, a traffic behavior feature construction module for two protocol modes, and an encrypted application classification module based on the MCFormer model (Transformer architecture). The first part, the traffic acquisition module, utilizes the mobile terminal's UI controls to capture and collect encrypted traffic under various encryption protocols, and simultaneously groups the traffic according to the transport layer protocol to construct a sample set of message length sequences for each protocol. The second part, the traffic behavior feature construction module, extracts sequence features from the captured mobile encrypted application traffic under TCP and QUIC protocols. The algorithm concatenates consecutive messages of length MSS in the same direction within each stream, combining them into a message length sequence feature that characterizes the intrinsic correlation of communication behavior. Simultaneously, based on the TCP message concatenation characteristics for the TLS protocol, it proposes accumulating the lengths of consecutive TLS messages within time intervals with similar message time intervals to construct the TLS message length sequence feature. The third part, the encrypted application classification model training module, uses MCFormer, a Transformer architecture classifier for classifying encrypted traffic applications. For the main services of different applications under each protocol stack, the message length sequence extracted from the features in the second part is input to train the model, which is used to classify and identify encrypted application traffic on mobile devices.

[0051] Specifically, the present invention includes the following steps:

[0052] (1) The UI controls of the mobile terminal are used to capture and collect encrypted traffic under various encryption protocols. At the same time, the traffic is grouped according to the transport layer protocol to construct a sample set of message length sequence under each protocol. Specifically, for mobile encrypted application traffic under TCP and QUIC protocols, the message length sequence of the transport layer is composed according to the time sequence, corresponding to each application tag, as the original sample set of each protocol. For mobile encrypted application traffic under TLS protocol, multiple TCP segment segments corresponding to each TLS record are concatenated according to the time sequence to obtain the message length sequence of TLS records, corresponding to each application tag, as the original sample set of TLS.

[0053] The specific process for this step is as follows:

[0054] (1.1) Use the UI controls on the mobile terminal to monitor the running application software, and capture and collect the pcap traffic corresponding to the software;

[0055] (1.2) Read the traffic in pcap format using the dpkt tool library and distinguish the transport layer protocol (TCP, TLS and QUIC) corresponding to the traffic;

[0056] (1.2.1) Use the dpkt tool under Python syntax to read the five-tuple identifier (source IP, destination IP, source port, destination port, transport layer protocol) of the flow, represented as key = (src_ip, dst_ip, src_port, dst_port, prot), and use this to group the traffic of the corresponding application label under the pcap.

[0057] (1.2.2) Use the dpkt tool under Python syntax to read the payload length pkt_len and timestamp of each packet, and arrange the sequence of time-series packets and timestamp information in the order of timestamps.

[0058] (1.3) For traffic samples under each protocol, for each flow (five-tuple label), capture the length pkt_len of each packet in chronological order to obtain the traffic chronological sequence of packet lengths on the TCP layer;

[0059] (1.4) To address the TCP message concatenation feature of the TLS protocol, the TCP transport layer message sequence in (1.3) above is used to concatenate TCP segments within the same record to generate the TLS message length sequence.

[0060] (1.4.1) Regarding the TCP segment concatenation feature of the TLS protocol, first remove the 5 bytes occupied by the header of each TCP segment to obtain the length of the payload of each TCP segment.

[0061] (1.4.2) Concatenate TCP segments belonging to the same TLS message, such that the sum of the lengths of the TCP segments equals the length of the TLS record, thus obtaining the TLS record message length sequence.

[0062] (2) Extract sequence features from the mobile encrypted application traffic captured in step (1) under TCP and QUIC protocols. The algorithm concatenates consecutive messages of length MSS in the same direction within each stream to form a message length sequence feature that represents the intrinsic relationship of communication behavior. Then, use MCFormer, a Transformer architecture classifier for classifying encrypted traffic applications, to train the model for the main services of 13 and 8 applications under the TCP and QUIC protocol stacks. The message length sequence extracted in step (2) is used to classify and identify encrypted application traffic on mobile devices.

[0063] The specific process for this step is as follows:

[0064] (2.1) Based on the mobile terminal's encrypted application traffic captured by the mobile terminal under the TCP and QUIC protocols, message sequence features are extracted based on the communication transmission mode of its protocol stack.

[0065] (2.1.1) Existing message sequence features mostly focus on consecutive packets in the same direction, which are spliced ​​together into a message feature called a Burst. The feature sequence of traffic is composed of time-series Burst units.

[0066] (2.1.2) However, this feature only treats a one-way communication process as a whole, without taking into account the message association between messages, and ignores the behavioral characteristics inside the one-way communication process.

[0067] (2.2) Based on the TCP transport layer, the traffic is truncated due to the limitation of the maximum transmission unit (MSS) of the network. When a message transmission reaches the MSS length, the TCP traffic will be truncated, resulting in a message being truncated into multiple message sequence fragments less than or equal to the MSS during transmission;

[0068] (2.3) In view of the truncation of the message in (2.2) above, the continuous MSS units in the same direction that are cut out in a message are reconstructed in each flow and synthesized into an ACM unit, which serves as the traffic sequence behavior feature unit under TCP and QUIC protocols.

[0069] (2.4) Based on the ACM sequence synthesized under the TCP and QUIC protocols above (2.3), the MCFormer classifier, which is a Transformer architecture for classifying encrypted traffic applications, is used to input the training samples of the sequence so that the Transformer that processes the sequence input can learn its traffic representation, so as to realize the classification of mobile encrypted applications based on the traffic sequence behavior characteristics under the TCP and QUIC protocols.

[0070] (2.5) The above (2.3) and (2.4) are respectively developed from the construction of behavioral features of traffic sequences and the deep learning model for traffic sequence input, so as to realize automatic feature extraction and end-to-end mobile encrypted application classification method, and achieve better performance in experimental results.

[0071] (3) Regarding the TCP packet splicing characteristics of the TLS protocol, drawing on step (2), it is proposed to accumulate the lengths of consecutive TLS packets within a time interval with similar packet time intervals to construct the TLS packet length sequence feature. Then, using MCFormer, a Transformer architecture classifier for classifying encrypted traffic applications, the packet length sequence extracted in step (3) is input into the main services of 11 applications under the TLS protocol stack to train the model, which is used to classify and identify encrypted application traffic on mobile devices.

[0072] The specific process for this step is as follows:

[0073] (3.1) Based on the mobile terminal's encrypted application traffic under the TLS protocol captured by the mobile terminal, the message sequence features are extracted based on the communication transmission mode of its protocol stack;

[0074] (3.1.1) Under the TLS protocol, the length of each message is randomized, so simply concatenating the lengths of multiple messages to represent a message is not accurate. However, in client-server communication, the method of concatenating consecutive packets in the same direction into a message (Burst) for a single communication is still applicable.

[0075] (3.1.2) Referring to (2.3) the method for generating ACM traffic sequence behavior characteristics under TCP and QUIC protocols, we draw on the temporal characteristics of message sequences and further segment the Message feature Burst of each message to find the implicit inter-message behavior characteristics.

[0076] (3.2) Based on the TLS protocol's method of truncating TCP segments in the transport layer according to TLS records, a method for restoring TLS records is designed. The length of each record is aligned with the sum of the lengths of multiple subsequent TCP segments, thereby restoring the message length sequence of the TLS layer to replace the TCP layer message data, thus characterizing the behavioral features of TLS layer traffic from the perspective of TLS communication mode.

[0077] (3.3) Referring to (2.3), the method for generating ACM traffic sequence behavior characteristics under TCP and QUIC protocols is to aggregate consecutive message lengths in the same direction with similar time intervals for each TLS flow to form a TLS ACM unit, which represents a message transmitted on the TLS layer and serves as the ACM traffic sequence behavior characteristic of the TLS layer.

[0078] (3.4) Regarding the method of aggregating TLS ACM units under the TLS protocol in (3.3), the similarity of time intervals between TLS messages is designed so that the time interval difference between multiple TLS messages that can be aggregated into one ACM unit cannot be greater than 15%, thereby ensuring that these messages that are aggregated into ACM unit characteristics belong to the same TLS message; these TLS ACM units are arranged in chronological order to form a sequence of ACM message lengths under the TLS protocol.

[0079] (3.5) Based on the ACM message length sequence under the TLS protocol synthesized in (3.3) and (3.4) above, the MCFormer classifier, which is a Transformer architecture for classifying encrypted traffic applications, is used as the input training sample of the sequence for the Transformer to learn its traffic representation, so as to realize the classification of mobile encrypted applications based on the traffic sequence behavior characteristics under the TLS protocol.

[0080] (3.6) The above (3.4) and (3.5) are respectively developed from the construction of behavioral features of traffic sequences and the deep learning model for traffic sequence input, so as to realize automatic feature extraction and end-to-end mobile encrypted application classification method, and achieve better performance in experimental results.

[0081] (3.6.1) For the main services of 13 mobile applications under the TCP protocol, based on the feature construction in (2.3) and the model method in (2.4), the classification of mobile encrypted applications based on TCP traffic sequence behavior features is realized, and the corresponding classification result confusion matrix is ​​generated.

[0082] (3.6.2) For the main services of the eight mobile applications under the QUIC protocol, based on the feature construction in (2.3) and the model method in (2.4), the classification of mobile encrypted applications based on the QUIC traffic sequence behavior features is realized, and the corresponding classification result confusion matrix is ​​generated.

[0083] (3.6.3) For the main services of 11 mobile applications under the TLS protocol, based on the feature construction in (3.3) and (3.4) and the model method in (3.5), the classification of mobile encrypted applications based on the behavior characteristics of TLS traffic sequence is realized, and the corresponding classification result confusion matrix is ​​generated.

[0084] It should be noted that the above embodiments are not intended to limit the scope of protection of the present invention. Equivalent transformations or substitutions made based on the above technical solutions all fall within the scope of protection of the claims of the present invention.

Claims

1.A method for classifying mobile end encryption applications based on traffic sequence behavior characteristics, characterized in that, Comprise the following steps: (1) Use the UI control of mobile terminal to realize the capture and collection of encrypted traffic under various encryption protocols, and group the traffic according to the transport layer protocol to construct the message length sequence sample set under each protocol; (2) Extract the sequence characteristics of the mobile encrypted application traffic captured in step (1) under TCP and QUIC protocols, concatenate the messages with the same direction and continuous length of MSS in each flow to form the message length sequence characteristics representing the internal correlation of communication behavior; then use the MCFormer, a classifier based on the Transformer architecture for encrypted traffic application classification, to input the message length sequence after feature extraction in step (2) to train the model for the main services of 13 and 8 kinds of applications under the TCP and QUIC protocol stacks, which is used for classification and identification of mobile encrypted application traffic, (3) For the TCP message concatenation characteristics of the TLS protocol, referring to step (2), propose to accumulate the continuous TLS message length in the time interval with similar message time interval to construct the message length sequence characteristics of TLS, and then use the MCFormer, a classifier based on the Transformer architecture for encrypted traffic application classification, to input the message length sequence after feature extraction in step (3) to train the model for the main services of 11 kinds of applications under the TLS protocol stack, which is used for classification and identification of mobile encrypted application traffic; Wherein, the step (1) specifically comprises the following sub-steps: (1.1) Use the UI control on the mobile terminal to monitor the running application software, capture and collect the pcap form traffic corresponding to the software, (1.2) Read the pcap form traffic through the dpkt tool library, and distinguish the transport layer protocol (TCP, TLS and QUIC) corresponding to the traffic, (1.2.1) Use the dpkt tool under python syntax to read the five tuple identification (source IP, destination IP, source port, destination port and transport layer protocol) of the flow, denoted as key=(src_ip,dst_ip,src_port,dst_port,prot), to group the traffic corresponding to the application label under the pcap, (1.2.2) Use the dpkt tool under python syntax to read the payload length pkt_len and timestamp of each message packet, and arrange the time sequence message length and timestamp information of the flow according to the timestamp timestamp, (1.3) For the traffic sample under each protocol, arrange the length pkt_len of each message captured according to the time sequence for each flow (five tuple label) to obtain the traffic time sequence of the message length on the TCP layer, (1.4) For the TCP message concatenation characteristics of the TLS protocol, concatenate the TCP segments in the same record using the TCP transport layer message sequence in the above (1.3) to generate the message length sequence of TLS, (1.4.1) For the TCP segment splicing characteristics of the TLS protocol, first remove the 5 bytes of the header of each TCP segment, get the length part of each TCP segment Segment load, (1.4.2) Splice the TCP segments belonging to the same TLS message, so that the length of the TCP segments is equal to the length of the TLS record, and thus the length sequence of the TLS record is obtained; The step (2) specifically requires: (2.1) Based on the mobile terminal captured TCP, QUIC protocol under the mobile terminal encryption application flow, based on the communication transmission mode of its protocol stack, the message sequence feature is extracted, (2.1.1) The existing message sequence feature focuses on continuous same direction packets, which are spliced into a message Message feature called Burst, and the Burst unit is used to form the feature sequence of the flow, (2.1.2) Improve the Burst unit in step (2.1.1), divide the behavior characteristics in the Burst unit according to the message association relationship between messages, and combine the continuous same direction packets to form a flow sequence of multiple ACM units, (2.2) Based on the TCP transport layer, the flow is limited by the maximum transmission unit MSS and will be truncated, when a message Message transmission reaches the length of MSS, the TCP flow will be truncated, resulting in a message Message being truncated into multiple message sequence fragments less than or equal to MSS in the transmission process, (2.3) For the characteristics of the message Message being truncated in the above (2.2), reconstruct the continuous same direction MSS unit divided in a message Message in each flow, and synthesize an ACM unit as the behavior feature unit of the flow sequence under TCP, QUIC protocol, (2.4) Based on the above (2.3) synthesized ACM sequence under TCP, QUIC protocol, use MCFormer, a Transformer architecture classifier for encrypted traffic application classification, input the training sample of the sequence to process the sequence input of the Transformer to learn its flow representation, so as to realize the classification of mobile terminal encryption application based on the behavior feature of TCP, QUIC protocol flow sequence, (2.5) The above (2.3) and (2.4) respectively construct the behavior feature of the flow sequence and the deep learning model for the input of the flow sequence, so as to realize the automatic feature extraction and end-to-end mobile terminal encryption application classification method, and achieve better performance effect in experimental effect; The step (3) specifically includes the following steps: (3.1) Based on the mobile terminal captured TLS protocol under the mobile terminal encryption application flow, based on the communication transmission mode of its protocol stack, the message sequence feature is extracted; (3.1.1) Based on the length of each message under the TLS protocol, the length of each message under the TLS protocol will be randomized, and the communication mode of the client and the server will be combined. The message (i.e., continuous same direction packets) corresponding to the single communication is a message message feature, (3.1.2) Refer to (2.3), the method for generating ACM traffic sequence behavior characteristics under TCP and QUIC protocols, according to the time sequence characteristics of the message sequence, the burst characteristics of each message message are divided, and the implicit inter-packet behavior characteristics ACM unit traffic sequence are obtained, (3.2) Based on the TLS protocol, the truncation method of the transmission layer segment TCP segment is designed to restore the TLS record. The length of each record and the length of the subsequent TCP segment are aligned, and the length of the TLS layer message sequence is restored to replace the TCP layer message data, thereby representing the behavior characteristics of the TLS layer traffic from the perspective of the TLS communication mode, (3.3) Refer to (2.3), the method for generating ACM traffic sequence behavior characteristics under TCP and QUIC protocols, for each TLS stream, the lengths of the continuous same direction packets in the time interval are aggregated to form a TLS ACM unit, representing a message message of the communication transmission on the TLS layer, as the ACM traffic sequence behavior characteristics of the TLS layer, (3.4) For the aggregation method of the ACM unit of the TLS protocol in (3.3), the time interval difference between the TLS packets that can be aggregated into an ACM unit should not be greater than 15%, so that these aggregated ACM unit features belong to the same TLS message message. Arrange these TLS ACM units in chronological order to form the ACM packet length sequence under the TLS protocol, (3.5) Based on the above (3.3) and (3.4) synthesized ACM packet length sequence under the TLS protocol, use the MCFormer, a Transformer architecture classifier for encrypted traffic application classification, to input the training sample of the sequence for processing sequence input Transformer to learn its traffic representation, to realize mobile encrypted application classification based on the behavior characteristics of the traffic sequence under the TLS protocol, (3.6) The above (3.4) and (3.5) respectively construct the behavior characteristics of the traffic sequence and the deep learning model for the input of the traffic sequence, thereby realizing automatic feature extraction and end-to-end mobile encrypted application classification method, which achieves better performance effect in experimental results, (3.6.1) For the main services of 13 mobile applications under TCP protocol, based on the feature construction in (2.3) and the model method in (2.4), the mobile encrypted application classification based on the TCP traffic sequence behavior characteristics is realized, and the corresponding classification result confusion matrix is generated, (3.6.2) For the main services of 8 mobile applications under the QUIC protocol, based on the feature construction in (2.3) and the model method in (2.4), the classification of mobile encrypted applications based on the behavior characteristics of QUIC traffic sequence is realized, and the corresponding classification result confusion matrix is generated, (3.6.3) For the main services of 11 mobile applications under the TLS protocol, based on the feature construction in (3.3) and (3.4) and the model method in (3.5), the classification of mobile encrypted applications based on the behavior characteristics of TLS traffic sequence is realized, and the corresponding classification result confusion matrix is generated.

Images