Encrypted traffic content identification method and system based on multi-dimensional features

Abstract

The invention relates to the technical field of traffic classification, in particular to an encrypted traffic content identification method and system based on multi-dimensional features, and the method comprises the steps: collecting encrypted traffic data of a plurality of preset data sources every preset sampling period, so as to obtain target encrypted traffic data, performing data preprocessing operation on the target encrypted traffic data to obtain standard target encrypted traffic data; and performing feature extraction on the standard target encrypted traffic data to obtain statistical features and static features corresponding to the standard target encrypted traffic data, and encoding the statistical features and the static features to obtain a statistical feature vector and a static feature vector. According to the method, various statistical characteristics, such as packet arrival time, packet quantity, packet length, packet direction and combination characteristics of packet length and transmission direction, are extracted, the statistical characteristics can effectively reflect the time dependence and behavior pattern of the data stream, and rich information is provided for subsequent analysis and processing.

Description

Technical Field

[0001] The present invention relates to the technical field of traffic classification, and in particular to a method and system for identifying encrypted traffic content based on multi-dimensional features. Background Art

[0002] With the popularization of the Internet and the improvement of network security awareness, the identification of encrypted traffic content has become increasingly important. Encrypted traffic (such as HTTPS, VPN and TLS) improves the security of data transmission by encrypting data. However, this encryption also brings new challenges to traffic content identification (such as video, audio, file transfer, web browsing, etc.). Existing encrypted traffic content identification technologies mainly include metadata analysis, traffic feature extraction, behavior analysis, deep packet inspection (DPI), machine learning and deep learning algorithms.

[0003] Existing technologies have many shortcomings when dealing with encrypted traffic. First, the use of new encryption protocols (such as TLS1.3 and QUIC) makes it difficult for traditional traffic analysis technologies to work, because encryption protocols hide the payload content of data packets, increasing the difficulty of identification. Second, the feature extraction process is complex and requires a lot of prior knowledge and professional skills. The extracted features are not universal and difficult to adapt to different types of encrypted traffic. In addition, machine learning and deep learning algorithms require a large amount of labeled data for training, and the data acquisition and annotation process is time-consuming and labor-intensive, and there is subjectivity and inconsistency. Furthermore, the training and reasoning of deep learning models require a lot of computing resources, real-time traffic analysis is sensitive to latency, and the computational overhead of complex models may lead to performance bottlenecks. Finally, traffic content identification involves user privacy and needs to be carried out under the premise of compliance. Data decryption and deep packet inspection may violate privacy regulations. Therefore, it is still a challenge to accurately identify the content of encrypted traffic without decrypting the content of the data packet. Summary of the invention

[0004] The purpose of the present invention is to address the problems existing in the background technology and to propose a method and system for identifying encrypted traffic content based on multi-dimensional features.

[0005] The technical solution of the present invention is a method for identifying encrypted traffic content based on multi-dimensional features, comprising: Collecting encrypted traffic data of multiple preset data sources at every preset sampling period to obtain target encrypted traffic data, and performing data preprocessing operations on the target encrypted traffic data to obtain standard target encrypted traffic data; Extracting features from the standard target encrypted traffic data to obtain statistical features and static features corresponding to the standard target encrypted traffic data, and encoding the statistical features and the static features to obtain statistical feature vectors and static feature vectors; Performing feature learning on the statistical feature vector to obtain a time-dependent feature corresponding to the statistical feature vector, and performing feature learning on the static feature vector to obtain a static high-dimensional feature corresponding to the static feature vector; Calculating the adaptive dynamic weights of the time-dependent feature and the static high-dimensional feature to obtain the adaptive dynamic weights corresponding to the time-dependent feature and the static high-dimensional feature, and performing weighted feature fusion on the time-dependent feature and the static high-dimensional feature based on the adaptive dynamic weights corresponding to the time-dependent feature and the static high-dimensional feature to obtain a comprehensive feature vector; The comprehensive feature vector is input into a classifier for content classification, and the classifier outputs the content type corresponding to the target encrypted traffic data.

[0006] Preferably, collecting encrypted traffic data from a plurality of preset data sources at every preset sampling period to obtain target encrypted traffic data includes: Capturing encrypted traffic data in real time using a network traffic capture tool, and storing the captured encrypted traffic data in a PCAP file; Simulating different types of encrypted traffic data in an experimental environment to generate encrypted traffic data, wherein the different types of encrypted traffic data include video stream encrypted traffic data, file transfer encrypted traffic data, and web browsing encrypted traffic data; Obtain encrypted traffic data based on publicly available network traffic datasets.

[0007] Preferably, performing a data preprocessing operation on the target encrypted traffic data to obtain standard target encrypted traffic data includes: Read the PCAP file based on the PyShark library, traverse each data packet of the target encrypted traffic data to extract key information, the key information includes timestamp, source IP, destination IP, source port, destination port, protocol type and data packet length, and store the key information in a structured DataFrame; Performing a data cleaning operation on the target encrypted traffic data, wherein the data cleaning operation includes processing missing values ​​and removing noise data; The target encrypted traffic data is enhanced by adopting the noise injection and data translation strategies; The target encrypted traffic data is subjected to data normalization processing.

[0008] Preferably, feature extraction is performed on the standard target encrypted traffic data to obtain statistical features and static features corresponding to the standard target encrypted traffic data, and the statistical features and the static features are encoded to obtain statistical feature vectors and static feature vectors, including: Calculate the time difference between the arrival of adjacent standard target encrypted traffic data packets to extract the packet arrival time, recorded as ; By counting the data packets within the preset time window, the number of data packets can be extracted and recorded as ; The packet length information of the data packet of the standard target encrypted traffic data is taken as the packet length, recorded as ; The packet direction of the data packet is determined based on the source IP and destination IP of the data packet of the standard target encrypted traffic data, which is recorded as , where the uplink packet is recorded as 1 and the downlink packet is recorded as -1; By calculation The comprehensive characteristics of the packet combined with the packet length and transmission direction are obtained, which are recorded as ; By parsing the record layer information of the TLS protocol, the length of continuously transmitted data packets is summed to obtain the packet continuous transmission characteristics, which is recorded as ; The packet arrival time, packet quantity, packet length, packet direction, packet comprehensive characteristics and packet continuous transmission characteristics of the data packets of the standard target encrypted traffic data are combined to obtain the statistical feature vector corresponding to the standard target encrypted traffic data, which is recorded as v =[ P t , P n , P l , P o , P v , P t r ] .

[0009] Preferably, feature extraction is performed on the standard target encrypted traffic data to obtain statistical features and static features corresponding to the standard target encrypted traffic data, and the statistical features and the static features are encoded to obtain statistical feature vectors and static feature vectors, further comprising: Extracting main features and auxiliary features of the standard target encrypted traffic data, wherein the main features include protocol type and port number, and the auxiliary features include affiliation unit type, device type and geographic location information; The main features and auxiliary features of the standard target encrypted traffic data are recorded as 1, and the non-type positions are recorded as 0, to obtain the first multidimensional vector, recorded as ; The port number is encoded by the size of the port number and the frequency of occurrence. The first 100 ports with the highest frequency and a port number less than 1024 are recorded as 1, the port numbers higher than 1024 are recorded as -1, and the rest are recorded as 0. The second multidimensional vector is obtained, which is recorded as ; The first multidimensional vector and the second multidimensional vector are concatenated to obtain a static feature vector, which is recorded as .

[0010] Preferably, performing feature learning on the statistical feature vector to obtain the time-dependent feature corresponding to the statistical feature vector includes: Input the statistical feature vector , initialize the state space model parameters, and capture the time dependency in the sequence by learning the transformation matrix and the state transfer matrix. The initialization calculation formula of the state space model is as follows: ; in, represents the standard target encrypted traffic at time step The hidden state below, Represents the input at time step The statistical eigenvector of Indicates that at time step Dynamically adjusted model parameters under represents the state transition function; The importance of the statistical feature vector at the current time step to the overall sequence is calculated through a selective propagation mechanism, and the propagation of the standard target encrypted traffic is adjusted according to the importance value, wherein the selective state propagation calculation formula is as follows: ; ; ; ; in, Respectively represent the time step The update gate and reset gate under is a candidate hidden state, represents the sigmoid function, represents an element-wise multiplication operation, represents the weight matrix of the update gate, represents the weight matrix of the reset gate, represents the importance matrix of the update gate, represents the importance matrix of resetting the gate, represents the bias term of the update gate, represents the bias term for resetting the gate, The weight matrix representing the candidate hidden states, represents the bias term of the candidate hidden state, An importance matrix representing candidate hidden states; Changing the state space model parameters to adjust the state vector learning representation, and finally outputting the encrypted traffic time-dependent features .

[0011] Preferably, performing feature learning on the static feature vector to obtain a static high-dimensional feature corresponding to the static feature vector includes: The static feature vector is input into the dual fully connected layers to extract high-dimensional features, and the input static feature vector is linearly transformed based on the first fully connected layer. The calculation formula of the first fully connected layer is: ; in, represents the weight matrix of the first fully connected layer, represents the bias vector of the first fully connected layer, represents the activation function; The output features of the first fully connected layer are input into the second fully connected layer to further extract high-level features. The calculation formula of the second fully connected layer is as follows: ; in, represents static high-dimensional features, represents the output of the first fully connected layer, and Represent the weight matrix and bias term of the second fully connected layer respectively.

[0012] Preferably, the adaptive dynamic weights of the time-dependent feature and the static high-dimensional feature are calculated to obtain the adaptive dynamic weights corresponding to the time-dependent feature and the static high-dimensional feature, and the time-dependent feature and the static high-dimensional feature are weightedly fused based on the adaptive dynamic weights corresponding to the time-dependent feature and the static high-dimensional feature to obtain a comprehensive feature vector, including: The time-dependent features and the static high-dimensional features are concatenated to obtain the joint features. The concatenation calculation formula is as follows: ; Among them, the dimensions of time-dependent features and static high-dimensional features are ( , )and( , ),in and represents the number of features, and represents the dimension of each feature, represents the joint feature, represents the concatenation function; The joint features are mapped into a weight matrix using a multi-layer perceptron, and then the weight matrix enters the first hidden layer containing 64 neurons, uses GELU for nonlinear activation, and then enters the second hidden layer containing 32 neurons, also uses GELU for activation, and finally enters the output layer, and is normalized by Softmax to obtain the weights of time-dependent features and static high-dimensional features; The weight matrix is ​​split and restored into time-dependent feature weights and static high-dimensional feature weights, and the weight matrix is ​​normalized so that the sum of the weights of each feature dimension is 1; The time-dependent features and static high-dimensional features are multiplied element by element with their corresponding weight matrices, and weighted fusion is performed. The weighted fusion calculation formula is as follows: ; ; ; ; in, represents a multi-layer perceptron, represents element-wise multiplication, represents the comprehensive feature vector, Represents the weight matrix of mapping the joint features to through the multi-layer perceptron, Indicates that the joint features are mapped to the weight matrix through the multi-layer perceptron The weight vector of the columns, Indicates that the joint features are mapped to the weight matrix through the multi-layer perceptron except for the first All weight vectors except the columns, represents the operation on the first dimension of the weight matrix that maps the joint features to through the multilayer perceptron, represents the operation on the second dimension of the weight matrix that maps the joint features to through the multilayer perceptron, represents the weight of the time-dependent feature, represents the weight of static high-dimensional features, express, represents the fusion feature of time-dependent features, Represents the fused features of static high-dimensional features.

[0013] Preferably, the comprehensive feature vector is input into a classifier for content classification, and the classifier outputs the content type corresponding to the target encrypted traffic data, including: The comprehensive feature vector is input into the classifier, and multi-classification is performed using full connection and Softmax. The content type corresponding to the target encrypted traffic data is output, and the output is converted into a probability distribution through the Softmax to determine the probability distribution of the sample belonging to each category. The probability distribution is used to predict the classification result. The probability distribution calculation formula is as follows: ; in, Represents the input vector The probability distribution corresponding to the elements is is the first elements, is the input vector The number of elements.

[0014] The technical solution of the present invention is: a system for identifying encrypted traffic content based on multi-dimensional features, which is applicable to the method for identifying encrypted traffic content based on multi-dimensional features, comprising: A data collection unit, the data collection unit is used to collect encrypted traffic data of multiple preset data sources at every preset sampling period to obtain target encrypted traffic data, and perform data preprocessing operations on the target encrypted traffic data to obtain standard target encrypted traffic data; A feature extraction unit, the feature extraction unit is used to extract features from the standard target encrypted traffic data to obtain statistical features and static features corresponding to the standard target encrypted traffic data, and encode the statistical features and the static features to obtain a statistical feature vector and a static feature vector; A feature learning unit, the feature learning unit is used to perform feature learning on the statistical feature vector to obtain the time-dependent feature corresponding to the statistical feature vector, and perform feature learning on the static feature vector to obtain the static high-dimensional feature corresponding to the static feature vector; A feature fusion unit, the feature fusion unit is used to calculate the adaptive dynamic weights of the time-dependent feature and the static high-dimensional feature to obtain the adaptive dynamic weights corresponding to the time-dependent feature and the static high-dimensional feature, and perform weighted feature fusion on the time-dependent feature and the static high-dimensional feature based on the adaptive dynamic weights corresponding to the time-dependent feature and the static high-dimensional feature to obtain a comprehensive feature vector; A content classification unit, wherein the content classification unit is used to input the comprehensive feature vector into a classifier for content classification, and output the content type corresponding to the target encrypted traffic data through the classifier.

[0015] Compared with the prior art, the above technical solution of the present invention has the following beneficial technical effects: 1. The present invention extracts a variety of statistical features, such as packet arrival time, packet quantity, packet length, packet direction, and the combined features of packet length and transmission direction. These statistical features can effectively reflect the time dependency and behavior pattern of data flows, and provide rich information for subsequent analysis and processing. In addition, a variety of static features are extracted, including protocol type, port number, unit type, device type, and geographic location information. These static features supplement the statistical features and provide additional contextual information, which can help the model understand the characteristics of data flows more comprehensively. Through comprehensive data feature extraction, key features in encrypted traffic can be captured more accurately, thereby improving the accuracy and comprehensiveness of the analysis.

[0016] 2. The present invention uses models suitable for dynamic sequence features and static category features respectively, which can better extract the intrinsic relationship between each feature and balance the contribution of these features to the identification of encrypted traffic content through adaptive dynamic weighting. This mechanism can dynamically adjust the weights of dynamic sequence features and static category features in the final model decision according to changes in task requirements and data characteristics, thereby achieving higher recognition accuracy and robustness in encrypted traffic content identification tasks. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A schematic flow chart of the steps of an overall method in an embodiment of the present invention; Figure 2 A schematic diagram of the overall flow of the model in an embodiment of the present invention; Figure 3 A schematic diagram of an adaptive dynamic weight calculation network in an embodiment of the present invention; Figure 4 A schematic diagram of the system architecture of an overall system in an embodiment of the present invention.

[0018] Figure numerals: 1. Data acquisition unit; 2. Feature extraction unit; 3. Feature learning unit; 4. Feature fusion unit; 5. Content classification unit. DETAILED DESCRIPTION

[0019] Embodiment 1, as Figure 1 As shown, the present invention proposes a method for identifying encrypted traffic content based on multi-dimensional features, including: S1. Collect encrypted traffic data from multiple preset data sources at every preset sampling period to obtain target encrypted traffic data, and perform data preprocessing operations on the target encrypted traffic data to obtain standard target encrypted traffic data; S2. Extracting features from the standard target encrypted traffic data to obtain statistical features and static features corresponding to the standard target encrypted traffic data, and encoding the statistical features and static features to obtain statistical feature vectors and static feature vectors; S3, performing feature learning on the statistical feature vector to obtain the time-dependent feature corresponding to the statistical feature vector, and performing feature learning on the static feature vector to obtain the static high-dimensional feature corresponding to the static feature vector; S4, calculating the adaptive dynamic weights of the time-dependent features and the static high-dimensional features to obtain the adaptive dynamic weights corresponding to the time-dependent features and the static high-dimensional features, and performing weighted feature fusion on the time-dependent features and the static high-dimensional features based on the adaptive dynamic weights corresponding to the time-dependent features and the static high-dimensional features to obtain a comprehensive feature vector; S5. Input the comprehensive feature vector into a classifier for content classification, and output the content type corresponding to the target encrypted traffic data through the classifier.

[0020] Embodiment 2, as Figure 2 and Figure 3 As shown, the encrypted traffic content identification method based on multi-dimensional features proposed by the present invention, compared with the first embodiment, this embodiment also includes: collecting encrypted traffic data of multiple preset data sources at every preset sampling period to obtain target encrypted traffic data, including: A1. Use network traffic capture tools to capture encrypted traffic data in real time, and store the captured encrypted traffic data in a PCAP file; A2. Simulate different types of encrypted traffic data in the experimental environment to generate encrypted traffic data. The different types of encrypted traffic data include video stream encrypted traffic data, file transfer encrypted traffic data, and web browsing encrypted traffic data. A3. Obtain encrypted traffic data based on public network traffic datasets.

[0021] In this embodiment, the network traffic capture tools include but are not limited to Wireshark and tcpdump, and the public network traffic data sets include but are not limited to UNSW-NB15 and ISCX.

[0022] In an optional embodiment, performing a data preprocessing operation on the target encrypted traffic data to obtain standard target encrypted traffic data includes: B1. Read the PCAP file based on the PyShark library, traverse the data packets of each target encrypted traffic data to extract key information, including timestamp, source IP, destination IP, source port, destination port, protocol type and data packet length, and store the key information in a structured DataFrame. B2. Perform data cleaning operations on the target encrypted traffic data, including processing missing values ​​and removing noise data; B3, using noise injection and data translation strategies to encrypt traffic data for data enhancement; B4. Perform data normalization on the target encrypted traffic data.

[0023] It should be noted that PCAP files are file formats generated by network packet capture tools (such as Wireshark), which are used to store captured data of network data packets. They contain detailed information about network traffic for subsequent analysis and diagnosis. PyShark is a Python library for parsing and processing PCAP files. It provides a convenient interface to read and parse data packets in PCAP files, making it easy to extract, analyze and manipulate network traffic data. DataFrame is a data structure that is commonly used for data analysis and manipulation. It organizes data in a tabular form. Each column can contain different data types, and each row represents a data record. In Python, the pandas library provides the DataFrame data structure for efficient data processing and analysis.

[0024] In an optional embodiment, feature extraction is performed on the standard target encrypted traffic data to obtain statistical features and static features corresponding to the standard target encrypted traffic data, and the statistical features and static features are encoded to obtain statistical feature vectors and static feature vectors, including: C1. Calculate the time difference between the arrival of adjacent standard target encrypted traffic data packets to extract the packet arrival time, recorded as ; C2. Count and count the data packets within the preset time window to extract the number of data packets, recorded as ; C3. The packet length information of the data packet of the standard target encrypted traffic data is used as the packet length, recorded as ; C4, based on the source IP and destination IP of the data packet of the standard target encrypted traffic data, determine the packet direction of the data packet, denoted as , where the uplink packet is recorded as 1 and the downlink packet is recorded as -1; C5. By calculation The comprehensive characteristics of the packet combined with the packet length and transmission direction are obtained, which are recorded as ; C6. By parsing the record layer information of the TLS protocol, the length of the continuously transmitted data packets is summed to obtain the packet continuous transmission feature, which is recorded as ; C7. Combine the packet arrival time, packet quantity, packet length, packet direction, packet comprehensive characteristics and packet continuous transmission characteristics of the data packets of the standard target encrypted traffic data to obtain the statistical feature vector corresponding to the standard target encrypted traffic data, recorded as v =[ P t , P n , P l , P o , P v , P t r ] .

[0025] In an optional embodiment, feature extraction is performed on the standard target encrypted traffic data to obtain statistical features and static features corresponding to the standard target encrypted traffic data, and the statistical features and static features are encoded to obtain statistical feature vectors and static feature vectors, further comprising: C8. extracting the main features and auxiliary features of the standard target encrypted traffic data, wherein the main features include the protocol type and the port number, and the auxiliary features include the type of the affiliated unit, the device type and the geographical location information; C9. The main features and auxiliary features of the standard target encrypted traffic data are recorded as 1, and the non-type positions are recorded as 0, and the first multidimensional vector is obtained, which is recorded as ; C10. Encode the port number by using the port number size and the frequency of occurrence. The first 100 ports with the highest frequency and a port number less than 1024 are recorded as 1, the port numbers with a frequency greater than 1024 are recorded as -1, and the rest are recorded as 0. The second multidimensional vector is obtained and recorded as ; C11. Concatenate the first multidimensional vector and the second multidimensional vector to obtain a static feature vector, denoted as .

[0026] It should be noted that the attribution unit type is divided into network communication operators, cloud service providers, dedicated network operators and other corporate organizations, the device type is divided into servers, personal computers, mobile phones, etc., and the geographical location is classified by country and region. The attribution unit type is a social attribute feature, which helps identify potential communication subjects or user groups in encrypted traffic by analyzing the source of the traffic or the organization to which it belongs; the device type is a physical attribute feature, which helps distinguish the encrypted traffic characteristics generated by different devices by identifying the hardware devices involved in the communication; the geographical location information is a geographical attribute feature, which helps identify the encrypted traffic characteristics and applications of specific regions or countries by analyzing the geographical source of the traffic.

[0027] In an optional embodiment, feature learning is performed on the statistical feature vector to obtain a time-dependent feature corresponding to the statistical feature vector, including: D1. Input statistical feature vector , initialize the state space model parameters, and capture the time dependency in the sequence by learning the transformation matrix and the state transfer matrix. The initialization calculation formula of the state space model is as follows: ; in, represents the standard target encrypted traffic at time step The hidden state below, Represents the input at time step The statistical eigenvector of Indicates that at time step Dynamically adjusted model parameters under represents the state transition function; D2. Calculate the importance of the statistical feature vector at the current time step to the overall sequence through the selective propagation mechanism, and adjust the propagation of the standard target encrypted traffic according to the importance value. The selective state propagation calculation formula is as follows: ; ; ; ; in, Respectively represent the time step The update gate and reset gate under is a candidate hidden state, represents the sigmoid function, represents an element-wise multiplication operation, represents the weight matrix of the update gate, represents the weight matrix of the reset gate, represents the importance matrix of the update gate, represents the importance matrix of resetting the gate, represents the bias term of the update gate, represents the bias term for resetting the gate, The weight matrix representing the candidate hidden states, represents the bias term of the candidate hidden state, An importance matrix representing candidate hidden states; D3. Change the state space model parameters to adjust the state vector learning representation and finally output the encrypted traffic time-dependent features .

[0028] In an optional embodiment, feature learning is performed on the static feature vector to obtain a static high-dimensional feature corresponding to the static feature vector, including: E1. Input the static feature vector into the double fully connected layer to extract high-dimensional features. Perform a linear transformation on the input static feature vector based on the first fully connected layer. The calculation formula of the first fully connected layer is: ; in, represents the weight matrix of the first fully connected layer, represents the bias vector of the first fully connected layer, represents the activation function; E2. Input the output features of the first fully connected layer into the second fully connected layer to further extract high-level features. The calculation formula of the second fully connected layer is as follows: ; in, represents static high-dimensional features, represents the output of the first fully connected layer, and Represent the weight matrix and bias term of the second fully connected layer respectively.

[0029] In an optional embodiment, the adaptive dynamic weights of the time-dependent features and the static high-dimensional features are calculated to obtain the adaptive dynamic weights corresponding to the time-dependent features and the static high-dimensional features, and the time-dependent features and the static high-dimensional features are weightedly fused based on the adaptive dynamic weights corresponding to the time-dependent features and the static high-dimensional features to obtain a comprehensive feature vector, including: The time-dependent features and static high-dimensional features are concatenated to obtain joint features. The concatenation calculation formula is as follows: ; Among them, the dimensions of time-dependent features and static high-dimensional features are , and , ,in and represents the number of features, and represents the dimension of each feature, represents the joint feature, represents the concatenation function; The joint features are mapped into a weight matrix using a multi-layer perceptron. The weight matrix then enters the first hidden layer containing 64 neurons, uses GELU for nonlinear activation, and then enters the second hidden layer containing 32 neurons, also using GELU for activation, and finally enters the output layer, which is normalized by Softmax to obtain the weights of time-dependent features and static high-dimensional features. The weight matrix is ​​split and restored into time-dependent feature weights and static high-dimensional feature weights, and the weight matrix is ​​normalized so that the sum of the weights of each feature dimension is 1; The time-dependent features and static high-dimensional features are multiplied element by element with their corresponding weight matrices, and weighted fusion is performed. The weighted fusion calculation formula is as follows: ; ; ; ; in, represents a multi-layer perceptron, represents element-wise multiplication, represents the comprehensive feature vector, Represents the weight matrix of mapping the joint features to through the multi-layer perceptron, Indicates that the joint features are mapped to the weight matrix through the multi-layer perceptron The weight vector of the columns, Indicates that the joint features are mapped to the weight matrix through the multi-layer perceptron except for the first All weight vectors except the columns, represents the operation on the first dimension of the weight matrix that maps the joint features to through the multilayer perceptron, represents the operation on the second dimension of the weight matrix that maps the joint features to through the multilayer perceptron, represents the weight of the time-dependent feature, represents the weight of static high-dimensional features, express, represents the fusion feature of time-dependent features, Represents the fused features of static high-dimensional features.

[0030] It should be noted that the Multi-Layer Perceptron (MLP) is a feedforward neural network, including an input layer, one or more hidden layers and an output layer. The neurons in each layer are fully connected to the neurons in the next layer, and nonlinearity is introduced through the activation function. This structure enables MLP to learn and represent complex nonlinear relationships, and is often used in classification and regression tasks.

[0031] In an optional embodiment, the comprehensive feature vector is input into a classifier for content classification, and the classifier outputs the content type corresponding to the target encrypted traffic data, including: The comprehensive feature vector is input into the classifier, and multi-classification is performed using full connection and Softmax. The content type corresponding to the target encrypted traffic data is output. The output is converted into a probability distribution through Softmax to determine the probability distribution of the sample belonging to each category. The probability distribution is used to predict the classification result. The probability distribution calculation formula is as follows: ; in, Represents the input vector The probability distribution corresponding to the elements is is the first elements, is the input vector The number of elements.

[0032] Embodiment three, as Figure 4 As shown, a system for identifying encrypted traffic content based on multi-dimensional features is applicable to the above-mentioned method for identifying encrypted traffic content based on multi-dimensional features, including: The data collection unit 1 is used to collect encrypted traffic data of multiple preset data sources at every preset sampling period to obtain target encrypted traffic data, and perform data preprocessing operations on the target encrypted traffic data to obtain standard target encrypted traffic data; Feature extraction unit 2, feature extraction unit 2 is used to extract features from the standard target encrypted traffic data to obtain statistical features and static features corresponding to the standard target encrypted traffic data, and encode the statistical features and static features to obtain statistical feature vectors and static feature vectors; Feature learning unit 3, the feature learning unit 3 is used to perform feature learning on the statistical feature vector to obtain the time-dependent feature corresponding to the statistical feature vector, and perform feature learning on the static feature vector to obtain the static high-dimensional feature corresponding to the static feature vector; The feature fusion unit 4 is used to calculate the adaptive dynamic weights of the time-dependent features and the static high-dimensional features to obtain the adaptive dynamic weights corresponding to the time-dependent features and the static high-dimensional features, and perform weighted feature fusion on the time-dependent features and the static high-dimensional features based on the adaptive dynamic weights corresponding to the time-dependent features and the static high-dimensional features to obtain a comprehensive feature vector; The content classification unit 5 is used to input the comprehensive feature vector into the classifier for content classification, and output the content type corresponding to the target encrypted traffic data through the classifier.

[0033] The embodiments of the present invention are described in detail above with reference to the accompanying drawings, but the present invention is not limited thereto, and various changes can be made within the knowledge scope of technicians in the relevant technical field without departing from the purpose of the present invention.

Claims

1. A method for identifying encrypted traffic content based on multi-dimensional features, characterized in that: include: Collecting encrypted traffic data of multiple preset data sources at every preset sampling period to obtain target encrypted traffic data, and performing data preprocessing operations on the target encrypted traffic data to obtain standard target encrypted traffic data; Extracting features from the standard target encrypted traffic data to obtain statistical features and static features corresponding to the standard target encrypted traffic data, and encoding the statistical features and the static features to obtain statistical feature vectors and static feature vectors; Performing feature learning on the statistical feature vector to obtain a time-dependent feature corresponding to the statistical feature vector, and performing feature learning on the static feature vector to obtain a static high-dimensional feature corresponding to the static feature vector; Calculating the adaptive dynamic weights of the time-dependent feature and the static high-dimensional feature to obtain the adaptive dynamic weights corresponding to the time-dependent feature and the static high-dimensional feature, and performing weighted feature fusion on the time-dependent feature and the static high-dimensional feature based on the adaptive dynamic weights corresponding to the time-dependent feature and the static high-dimensional feature to obtain a comprehensive feature vector; The comprehensive feature vector is input into a classifier for content classification, and the classifier outputs the content type corresponding to the target encrypted traffic data.

2. The method for identifying encrypted traffic content based on multi-dimensional features according to claim 1, characterized in that: The encrypted traffic data of multiple preset data sources are collected at every preset sampling period to obtain target encrypted traffic data, including: Capturing encrypted traffic data in real time using a network traffic capture tool, and storing the captured encrypted traffic data in a PCAP file; Simulating different types of encrypted traffic data in an experimental environment to generate encrypted traffic data, wherein the different types of encrypted traffic data include video stream encrypted traffic data, file transfer encrypted traffic data, and web browsing encrypted traffic data; Obtain encrypted traffic data based on publicly available network traffic datasets.

3. The method for identifying encrypted traffic content based on multi-dimensional features according to claim 2, characterized in that: Performing data preprocessing operations on the target encrypted traffic data to obtain standard target encrypted traffic data includes: Read the PCAP file based on the PyShark library, traverse each data packet of the target encrypted traffic data to extract key information, the key information includes timestamp, source IP, destination IP, source port, destination port, protocol type and data packet length, and store the key information in a structured DataFrame; Performing a data cleaning operation on the target encrypted traffic data, wherein the data cleaning operation includes processing missing values ​​and removing noise data; The target encrypted traffic data is enhanced by adopting the noise injection and data translation strategies; The target encrypted traffic data is subjected to data normalization processing.

4. The method for identifying encrypted traffic content based on multi-dimensional features according to claim 1, characterized in that: Extracting features from the standard target encrypted traffic data to obtain statistical features and static features corresponding to the standard target encrypted traffic data, encoding the statistical features and the static features to obtain statistical feature vectors and static feature vectors, including: Calculate the time difference between the arrival of adjacent standard target encrypted traffic data packets to extract the packet arrival time, recorded as ; By counting the data packets within the preset time window, the number of data packets can be extracted and recorded as ; The packet length information of the data packet of the standard target encrypted traffic data is taken as the packet length, recorded as ; The packet direction of the data packet is determined based on the source IP and destination IP of the data packet of the standard target encrypted traffic data, which is recorded as , where the uplink packet is recorded as 1 and the downlink packet is recorded as -1; By calculation The comprehensive characteristics of the packet combined with the packet length and transmission direction are obtained, which are recorded as ; By parsing the record layer information of the TLS protocol, the length of continuously transmitted data packets is summed to obtain the packet continuous transmission characteristics, which is recorded as ; The packet arrival time, packet quantity, packet length, packet direction, packet comprehensive characteristics and packet continuous transmission characteristics of the data packets of the standard target encrypted traffic data are combined to obtain the statistical feature vector corresponding to the standard target encrypted traffic data, which is recorded as .

5. The method for identifying encrypted traffic content based on multi-dimensional features according to claim 4 is characterized in that: Extracting features from the standard target encrypted traffic data to obtain statistical features and static features corresponding to the standard target encrypted traffic data, encoding the statistical features and the static features to obtain statistical feature vectors and static feature vectors, further comprising: Extracting main features and auxiliary features of the standard target encrypted traffic data, wherein the main features include protocol type and port number, and the auxiliary features include affiliation unit type, device type and geographic location information; The main features and auxiliary features of the standard target encrypted traffic data are recorded as 1, and the non-type positions are recorded as 0, to obtain the first multidimensional vector, recorded as ; The port number is encoded by the size of the port number and the frequency of occurrence. The first 100 ports with the highest frequency and a port number less than 1024 are recorded as 1, the port numbers higher than 1024 are recorded as -1, and the rest are recorded as 0. The second multidimensional vector is obtained, which is recorded as ; The first multidimensional vector and the second multidimensional vector are concatenated to obtain a static feature vector, which is recorded as .

6. The method for identifying encrypted traffic content based on multi-dimensional features according to claim 5, characterized in that: Performing feature learning on the statistical feature vector to obtain a time-dependent feature corresponding to the statistical feature vector includes: Input the statistical feature vector , initialize the state space model parameters, and capture the time dependency in the sequence by learning the transformation matrix and the state transfer matrix. The initialization calculation formula of the state space model is as follows: ； in, represents the standard target encrypted traffic at time step The hidden state below, Represents the input at time step The statistical eigenvector of Indicates that at time step Dynamically adjusted model parameters under represents the state transition function; The importance of the statistical feature vector at the current time step to the overall sequence is calculated through a selective propagation mechanism, and the propagation of the standard target encrypted traffic is adjusted according to the importance value, wherein the selective state propagation calculation formula is as follows: ； ； ； ； in, Respectively represent the time step The update gate and reset gate under is a candidate hidden state, represents the sigmoid function, represents an element-wise multiplication operation, represents the weight matrix of the update gate, represents the weight matrix of the reset gate, represents the importance matrix of the update gate, represents the importance matrix of resetting the gate, represents the bias term of the update gate, represents the bias term for resetting the gate, The weight matrix representing the candidate hidden states, represents the bias term of the candidate hidden state, An importance matrix representing candidate hidden states; Changing the state space model parameters to adjust the state vector learning representation, and finally outputting the encrypted traffic time-dependent features .

7. The method for identifying encrypted traffic content based on multi-dimensional features according to claim 6, characterized in that: Performing feature learning on the static feature vector to obtain a static high-dimensional feature corresponding to the static feature vector includes: The static feature vector is input into the dual fully connected layers to extract high-dimensional features, and the input static feature vector is linearly transformed based on the first fully connected layer. The calculation formula of the first fully connected layer is: ； in, represents the weight matrix of the first fully connected layer, represents the bias vector of the first fully connected layer, represents the activation function; The output features of the first fully connected layer are input into the second fully connected layer to further extract high-level features. The calculation formula of the second fully connected layer is as follows: ； in, represents static high-dimensional features, represents the output of the first fully connected layer, and Represent the weight matrix and bias term of the second fully connected layer respectively.

8. The method for identifying encrypted traffic content based on multi-dimensional features according to claim 7, characterized in that: The adaptive dynamic weights of the time-dependent feature and the static high-dimensional feature are calculated to obtain the adaptive dynamic weights corresponding to the time-dependent feature and the static high-dimensional feature, and the time-dependent feature and the static high-dimensional feature are weightedly fused based on the adaptive dynamic weights corresponding to the time-dependent feature and the static high-dimensional feature to obtain a comprehensive feature vector, including: The time-dependent features and the static high-dimensional features are concatenated to obtain the joint features. The concatenation calculation formula is as follows: ; Among them, the dimensions of time-dependent features and static high-dimensional features are ( , )and( , ),in and represents the number of features, and represents the dimension of each feature, represents the joint feature, represents the concatenation function; The joint features are mapped into a weight matrix using a multi-layer perceptron, and then the weight matrix enters the first hidden layer containing 64 neurons, uses GELU for nonlinear activation, and then enters the second hidden layer containing 32 neurons, also uses GELU for activation, and finally enters the output layer, and is normalized by Softmax to obtain the weights of time-dependent features and static high-dimensional features; The weight matrix is ​​split and restored into time-dependent feature weights and static high-dimensional feature weights, and the weight matrix is ​​normalized so that the sum of the weights of each feature dimension is 1; The time-dependent features and static high-dimensional features are multiplied element by element with their corresponding weight matrices, and weighted fusion is performed. The weighted fusion calculation formula is as follows: ； ； ； ； in, represents a multi-layer perceptron, represents element-wise multiplication, represents the comprehensive feature vector, Represents the weight matrix of mapping the joint features to through the multi-layer perceptron, Indicates that the joint features are mapped to the weight matrix through the multi-layer perceptron The weight vector of the columns, Indicates that the joint features are mapped to the weight matrix through the multi-layer perceptron except for the first All weight vectors except the columns, represents the operation on the first dimension of the weight matrix that maps the joint features to through the multilayer perceptron, represents the operation on the second dimension of the weight matrix that maps the joint features to through the multilayer perceptron, represents the weight of the time-dependent feature, represents the weight of static high-dimensional features, express, represents the fusion feature of time-dependent features, Represents the fused features of static high-dimensional features.

9. The method for identifying encrypted traffic content based on multi-dimensional features according to claim 1, characterized in that: Inputting the comprehensive feature vector into a classifier for content classification, and outputting the content type corresponding to the target encrypted traffic data through the classifier, including: The comprehensive feature vector is input into the classifier, and multi-classification is performed using full connection and Softmax. The content type corresponding to the target encrypted traffic data is output, and the output is converted into a probability distribution through the Softmax to determine the probability distribution of the sample belonging to each category. The probability distribution is used to predict the classification result. The probability distribution calculation formula is as follows: ； in, Represents the input vector The probability distribution corresponding to the elements is is the first elements, is the input vector The number of elements of .

10. A system for identifying encrypted traffic content based on multidimensional features, which is applicable to a method for identifying encrypted traffic content based on multidimensional features as described in any one of claims 1 to 9, characterized in that: include: A data collection unit (1), the data collection unit (1) being used to collect encrypted traffic data from a plurality of preset data sources at every preset sampling period to obtain target encrypted traffic data, and to perform data preprocessing operations on the target encrypted traffic data to obtain standard target encrypted traffic data; A feature extraction unit (2), the feature extraction unit (2) being used to extract features from the standard target encrypted traffic data to obtain statistical features and static features corresponding to the standard target encrypted traffic data, and to encode the statistical features and the static features to obtain statistical feature vectors and static feature vectors; A feature learning unit (3), the feature learning unit (3) being used to perform feature learning on the statistical feature vector to obtain a time-dependent feature corresponding to the statistical feature vector, and to perform feature learning on the static feature vector to obtain a static high-dimensional feature corresponding to the static feature vector; A feature fusion unit (4), the feature fusion unit (4) being used to calculate the adaptive dynamic weights of the time-dependent feature and the static high-dimensional feature to obtain the adaptive dynamic weights corresponding to the time-dependent feature and the static high-dimensional feature, and to perform weighted feature fusion on the time-dependent feature and the static high-dimensional feature based on the adaptive dynamic weights corresponding to the time-dependent feature and the static high-dimensional feature to obtain a comprehensive feature vector; A content classification unit (5), the content classification unit (5) is used to input the comprehensive feature vector into a classifier for content classification, and output the content type corresponding to the target encrypted traffic data through the classifier.

Images