Encrypted traffic classification method based on sequence feature fusion

Abstract

The present invention relates to the technical field of secure data transmission, and discloses an encrypted traffic classification method based on sequence feature fusion; the method can optimize classification tasks, is applicable to a variety of classification environments, and ensures classification accuracy. The encrypted traffic classification method based on sequence feature fusion includes the following steps: S1, data preprocessing; dividing the traffic, and after dividing the traffic, cleaning the traffic. S2, feature processing of data; extracting the TLS header of the handshake data packet; extracting spatiotemporal feature information from the original traffic, and fusing the TLS handshake header bytes with the spatiotemporal feature sequence; S3, classifying the traffic; and classifying the traffic using the STFNT classification method. The method can more comprehensively understand and identify various characteristics of the traffic, thereby improving the performance of the classification task; and has good adaptability and robustness when processing new and unknown tasks.

Description

Technical Field

[0001] The present invention relates to the technical field of data security transmission, and in particular to an encrypted traffic classification method based on sequence feature fusion. Background Art

[0002] With the development of encryption technology, encrypted communication between clients and servers has become the norm, and most web services now run over the secure hypertext transfer protocol (HTTPS). Network traffic classification and identification is an important basis for network detection and management, and is also one of the key technologies for maintaining cyberspace security. However, the highly dynamic and complex nature of network traffic, as well as the information hiding characteristics in an encrypted environment, make the identification and classification of network traffic increasingly difficult.

[0003] Faced with this situation, traditional communication traffic identification methods are powerless in dealing with the challenges of the current situation. The traditional traffic identification method that relies on port numbers is not ideal in practice due to the existence of port masquerading and application polymorphism. Similarly, although the method based on deep packet inspection can analyze relevant fields to parse traffic categories, the inspection of payload content in this method may violate user privacy policies, and may not be able to parse the payload packet when encountering encryption technology, which is easy to cause errors.

[0004] Therefore, in the face of these new challenges, researchers have proposed many methods to classify encrypted traffic using machine learning and deep learning. Encrypted traffic classification methods based on machine learning use machine learning algorithms to build classification models by counting a large number of data streams and data packet features. Machine learning-based methods focus on extracting statistical features or spatiotemporal features of traffic, which is highly dependent on the knowledge and experience of experts. At the same time, in the real scenario of real-time growth of encrypted traffic, it requires a lot of resources and takes a long time.

[0005] The neural network has excellent automatic feature learning ability, which makes deep learning technology applicable to the problem of encrypted traffic classification. The significant advantage of deep learning is that the model can select features by itself through training, without too much intervention from domain experts, and its learning ability is very strong. Therefore, many network traffic identification problems began to be solved by deep learning-based methods. Extensive research results have also proved that the encrypted traffic classification method based on deep learning has achieved good accuracy in most cases. However, with the continuous changes in the network environment, the shortcomings of the existing encrypted traffic classification methods have gradually become apparent.

[0006] (1) In the data preprocessing stage, the original traffic needs to be trimmed and its size unified. This process will cause some important structural information to be lost, so that the model cannot fully obtain the traffic characteristics;

[0007] (2) Except for the initial handshake and some header fields transmitted in plain text, the traffic or data packets are usually almost completely encrypted. In terms of computer vision, the image generated by encrypted traffic is more like a blurred picture for deep learning, so most of the original traffic is used as input, which reduces the model classification efficiency.

[0008] (3) Since encrypted traffic is dynamic, the characteristics of encrypted traffic may be affected by network conditions and temporal changes in traffic characteristics, which puts forward adaptability requirements for the classification model.

[0009] Therefore, in response to the current constantly updated changes in encrypted traffic, existing methods show the problem of insufficient adaptability, making it difficult for them to quickly perform real-time traffic classification in a real network environment. Summary of the invention

[0010] The technical problem to be solved by the present invention is to provide an encrypted traffic classification method based on sequence feature fusion, which can optimize classification tasks, is applicable to a variety of classification environments and ensures classification accuracy.

[0011] The technical solution adopted by the present invention to solve the technical problem is: an encrypted traffic classification method based on sequence feature fusion, comprising the following steps:

[0012] S1, data preprocessing;

[0013] S11, dividing the traffic, the traffic division is based on the five-tuple information; dividing the continuous traffic in the original pcap file into independent session flow files; the continuous original traffic is broken down into a set of packets, using It indicates that, It is traffic The total number of packets in ; each individual packet The definition is as follows:

[0014] ;

[0015] in, Represents five-tuple information, is the start time of the packet, and Indicates the byte length of the data packet;

[0016] S12. After dividing the traffic, clean up the traffic; calculate the hash values ​​of all files and remove duplicate files with the same hash values; at the same time, delete the IP address and MAC address in the traffic by replacing the relevant string with 0x00; and clean up empty files and duplicate files;

[0017] S2, feature processing of data;

[0018] S21, truncate the input original traffic data and retain only the TLS header of the handshake data packet;

[0019] S22, extracting spatiotemporal feature information from the original traffic, wherein the spatiotemporal feature information includes a data packet size and a flow arrival time;

[0020] S23, fusing the TLS handshake header bytes with the spatiotemporal feature sequence;

[0021] Represent the handshake header byte feature vector as , the handshake header byte feature vector contains key field information in the truncated ClientHello and ServerHello messages;

[0022] Each data packet vector in the spatiotemporal feature sequence Splice to get the spatiotemporal feature matrix of the flow ;

[0023] Handshake header feature vector With the spatiotemporal feature matrix Splice to get a comprehensive feature matrix ; The specific form is as follows: ;

[0024] S3, classify the traffic;

[0025] Traffic is classified using the STFNT classification method; the STFNT classification method takes the flow time series and the TLS handshake header as input; each of the two inputs is fed into a set of separate neural network layers, the outputs of which are then concatenated and passed through an additional fully connected layer to produce the final classification;

[0026] Feed the TLS handshake header to a deep 1D CNN with max pooling; get the CNN feature vector ;

[0027] ; In the formula It is the convolution kernel weight matrix, which is responsible for extracting local features from the input data; is the input feature sequence, representing the TLS handshake header features; is the bias term, which provides a constant offset for the convolutional layer;

[0028] The stream time series passes through the first fully connected layer and then enters the three LSTM layers; the LSTM feature vector is obtained ;

[0029] ,

[0030] In the formula, Refers to the LSTM used to calculate the output The weight matrix of the hidden state and the current input Perform a linear transformation to generate oto_tot;

[0031] is at the time step The hidden state vector represents the internal state of the LSTM unit at the current time step, containing the accumulated information;

[0032] is at the time step The input vector is the feature of the current data packet;

[0033] It is the bias term of the LSTM output gate; it is used to adjust the output result;

[0034] Represents the sigmoid activation function, which is used to limit the output to the range of (0,1);

[0035] is at the time step The memory cell state represents the long-term memory state of LSTM;

[0036] represents the hyperbolic tangent activation function, which is used to compress the input into the range of (-1,1) so that LSTM can capture more subtle input changes;

[0037] Through the fully connected layer, the CNN feature vector and LSTM feature vector Fusion, construct input samples ;

[0038]

[0039] In the formula, is the weight matrix of the fully connected layer, responsible for extracting important information from the input vector; is the bias vector used to adjust the activation threshold of the neuron;

[0040] Use the Softmax function to classify the results. The formula of the Sofmax function is as follows:

[0041]

[0042] In the formula, is the input vector The output value of Softmax of the i-th element, All are between 0 and 1, and the sum of all output values ​​is 1.

[0043] Specifically, the five-tuple information in step S1 includes source IP, source port, target IP, target port, and protocol.

[0044] Furthermore, in step S2, the extraction of spatiotemporal feature information includes the following steps:

[0045] Get a record from each flow, which contains information about each packet in the flow; the information about each packet includes the packet size and flow arrival time;

[0046] After obtaining the spatiotemporal features of each data packet, the two features of packet size and flow arrival time are uniformly represented as a fixed format containing two feature fields, namely, ;in Represents the size of the IP packet, represents the flow arrival time;

[0047] After the spatiotemporal features are expressed as above, the minimum-maximum standardization method is used to normalize the data. The specific formula is:

[0048]

[0049] In the formula, is the original eigenvalue, that is, the data point that has not been standardized; It is a feature The minimum value of feature The maximum value of x new It refers to the new eigenvalue obtained after the original eigenvalue is normalized;

[0050] After normalization, all statistical features are mapped to the range of [0,1]; the two features of IP packet size and flow arrival time are unified into a vector, namely the packet vector , which has the form:

[0051] ;

[0052] in are two features after feature embedding and conversion. is the mapping matrix.

[0053] Beneficial effects of the present invention

[0054] The encrypted traffic classification method based on sequence feature fusion described in the present invention has the following advantages:

[0055] 1. The encrypted traffic classification method based on sequence feature fusion described in the present invention uses the spatiotemporal feature sequence to supplement the structural feature information lost due to shearing during the original traffic preprocessing process, analyzes the TLS handshake original traffic through the convolutional neural network CNN to obtain global features, and uses the long short-term memory network LSTM to mine the deep characteristics of the data packet size and flow arrival time series, so as to more comprehensively understand and identify various characteristics of the traffic, thereby improving the performance of the classification task;

[0056] 2. The encrypted traffic classification method based on sequence feature fusion described in the present invention can extract more powerful feature information by modeling two feature dimensions respectively through two branches, thereby enhancing the classification ability.

[0057] 3. The encrypted traffic classification method based on sequence feature fusion described in the present invention can be effectively migrated to different data sets and maintain high performance on the new data sets.

[0058] 4. The encrypted traffic classification method based on sequence feature fusion described in the present invention has good adaptability and robustness when dealing with new and unknown tasks. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 It is a flowchart of an encrypted traffic classification method based on sequence feature fusion in an embodiment of the present invention;

[0060] Figure 2 : is a model structure diagram of the STFNT classification method in an embodiment of the present invention;

[0061] Figure 3 It is a schematic diagram of classification results of encrypted traffic classification method 2 based on sequence feature fusion in the verification experiment of the present invention;

[0062] Figure 4 It is a schematic diagram of the unencrypted 6 classification results of the encrypted traffic classification method based on sequence feature fusion in the verification experiment of the present invention;

[0063] Figure 5 It is a schematic diagram of the encrypted 6 classification results of the encrypted traffic classification method based on sequence feature fusion in the verification experiment of the present invention;

[0064] Figure 6 It is a schematic diagram of classification results of encrypted traffic classification method 12 based on sequence feature fusion in the verification experiment of the present invention;

[0065] Figure 7 This is the experimental result of the encrypted traffic classification method based on sequence feature fusion in the verification experiment of the present invention at USTC-TFC2016. DETAILED DESCRIPTION

[0066] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with embodiments and drawings. The exemplary embodiments of the present invention and their description are only used to explain the present invention and are not intended to limit the present invention.

[0067] like Figure 1 to Figure 2 As shown, the encrypted traffic classification method based on sequence feature fusion described in the present invention includes the following steps:

[0068] S1, data preprocessing;

[0069] The data preprocessing includes two main steps: traffic division and cleaning. Traffic is divided into sessions. Compared with flows, sessions have richer interactive information and are more conducive to classifying encrypted traffic.

[0070] S11. Divide the traffic, and the traffic division is based on five-tuple information; the five-tuple information includes source IP, source port, target IP, target port, and protocol.

[0071] Split the continuous traffic in the original pcap file into independent session stream files; continuous original traffic is broken down into a set of packets, using It indicates that, It is traffic The total number of packets in ; each individual packet The definition is as follows:

[0072] ;

[0073] in, Represents five-tuple information, is the start time of the packet, and Indicates the byte length of the data packet.

[0074] S12. After dividing the traffic, clean up the traffic; calculate the hash values ​​of all files and remove duplicate files with the same hash values; at the same time, delete the IP address and MAC address in the traffic by replacing the relevant string with 0x00; and clean up empty files and duplicate files;

[0075] Through the above steps, a finely processed traffic data set can be obtained, providing an ideal basis for subsequent research.

[0076] S2, feature processing of data;

[0077] The input of deep learning consists of two parts: TLS handshake header bytes and stream spatiotemporal sequences.

[0078] S21. In order to facilitate the input of deep learning, the input raw traffic data is truncated and only the TLS header of the handshake packet is retained; TLS handshake header bytes: explicit features such as SNI and password information are removed in preprocessing to reduce the model's reliance on these information. Since this method is applied to encrypted traffic, almost all traffic payloads are encrypted. Data packets other than handshake packets (i.e., ClientHello and ServerHello messages) are redundant and hardly expose any meaningful information to the model. Therefore, the input raw traffic data is truncated and only the TLS header of the handshake packet is retained.

[0079] S22, extracting spatiotemporal feature information from the original traffic, wherein the spatiotemporal feature information includes a data packet size and a flow arrival time;

[0080] In the process of extracting spatiotemporal feature information from raw traffic, we first obtain a record from each flow, which contains the information of each packet in the flow, namely, a list of pairs of {packet size, flow arrival time}.

[0081] After obtaining the spatiotemporal features of each data packet, the two features are uniformly represented as a fixed format containing two feature fields, namely, ; In the formula, Represents the size of the IP packet, Represents the flow arrival time.

[0082] After the spatiotemporal features are expressed as above, the data is normalized using the minimum-maximum standardization method. The formula is:

[0083]

[0084] In the formula, is the original eigenvalue, that is, the data point that has not been standardized; It is a feature The minimum value of feature The maximum value of x new It refers to the new eigenvalue obtained after the original eigenvalue is normalized.

[0085] After normalization, all statistical features are mapped to the range of [0,1]. Finally, the two features of IP packet size and flow arrival time have been unified into a vector, namely the packet vector , which is in the form of .in are two features after feature embedding and conversion. is the mapping matrix. Through this series of feature processing, the two main characteristics of the original network traffic: IP packet size and flow arrival time, are embedded and converted into a vector of unified form, which can be directly used as the input of the deep learning model.

[0086] This normalization ensures that the model remains fair when processing packets of different sizes and time distributions. In addition, it helps prevent outliers and extreme scenarios from adversely affecting the model's classification performance.

[0087] S23, fusing the TLS handshake header bytes with the spatiotemporal feature sequence;

[0088] Represent the handshake header byte feature vector as , the handshake header byte feature vector contains key field information in the truncated ClientHello and ServerHello messages;

[0089] Each data packet vector in the spatiotemporal feature sequence Splice to get the spatiotemporal feature matrix of the flow ;

[0090] Handshake header feature vector With the spatiotemporal feature matrix Splice to get a comprehensive feature matrix ; The specific form is as follows: ;

[0091] In this comprehensive feature matrix In the , handshake header byte features and spatiotemporal feature sequences are uniformly represented and combined together; in this way, a feature set is constructed, which contains the key information of the handshake process and the dynamic spatiotemporal features of the flow.

[0092] S3, classify the traffic;

[0093] After data feature processing, it is necessary to further select a suitable model and adjust hyperparameters for training to perform traffic classification. Figure 2 The figure shows the model structure diagram of the STFNT classification method of the present invention.

[0094] Traffic is classified using the STFNT classification method; the STFNT classification method takes the flow time series and the TLS handshake header as input; each of the two inputs is fed into a set of separate neural network layers, the outputs of which are then concatenated and passed through an additional fully connected layer to produce the final classification;

[0095] LSTM and CNN are used to encode the processed spatiotemporal feature vector sequence R and the original traffic T. LSTM and CNN each have their own unique advantages: LSTM's powerful ability to capture long-term dependencies makes it an ideal tool for understanding the dynamic behavior of network traffic; while CNN is good at extracting local and global features of raw data, which is crucial to understanding the structure and content of data packets. By processing the spatiotemporal feature vector sequence R and the original traffic T in parallel, two sets of rich and descriptive feature vectors can be obtained: LSTM feature vector and CNN feature vector .

[0096] Specifically: Feed the TLS handshake header to a deep one-dimensional CNN with max pooling; get the CNN feature vector ;

[0097] ;

[0098] In the formula It is the convolution kernel weight matrix, which is responsible for extracting local features from the input data; is the input feature sequence, representing the TLS handshake header features; is the bias term, which provides a constant offset for the convolutional layer.

[0099] The stream time series passes through the first fully connected layer and then enters the three LSTM layers; the LSTM feature vector is obtained ;

[0100] ,, ;

[0101] In the formula, Refers to the LSTM used to calculate the output The weight matrix of the hidden state and the current input Perform a linear transformation to generate oto_tot;

[0102] is at the time step The hidden state vector represents the internal state of the LSTM unit at the current time step, containing the accumulated information;

[0103] is at the time step The input vector is the feature of the current data packet;

[0104] It is the bias term of the LSTM output gate; it is used to adjust the output result;

[0105] Represents the sigmoid activation function, which is used to limit the output to the range of (0,1);

[0106] is at the time step The memory cell state represents the long-term memory state of LSTM;

[0107] represents the hyperbolic tangent activation function, which is used to compress the input into the range of (-1,1) so that LSTM can capture more subtle input changes;

[0108] Since a stack of three LSTM layers is used, a large amount of data packet information is not required, and the spatiotemporal feature sequence is used to make up for the missing feature information in the original traffic.

[0109] The two feature vectors are fused through the fully connected layer to construct the input sample ;

[0110]

[0111] In the formula, is the weight matrix of the fully connected layer, responsible for extracting important information from the input vector; is the bias vector used to adjust the activation threshold of the neuron;

[0112] After learning the above two independent models, the relevant features between the learning modalities are captured through the fully connected layer, and the results are classified using the Softmax function. The formula of the Sofmax function is as follows:

[0113]

[0114] In the formula, is the input vector The output value of Softmax of the i-th element, All are between 0 and 1, and the sum of all output values ​​is 1.

[0115] Experimental verification

[0116] 1. Experimental environment and dataset

[0117] The experiments were all trained and tested on the Ubuntu 16.04 64-bit operating system. The GPU used in the experiment was NVIDIAA4000, with a video memory of 16G, the CPU was 12th Gen Intel(R) Core(TM) i5-12490F 3.00 GHz, and the RAM size was 32G. The Python environment used in the experiment was Python38, and the program was developed using the Pytorch framework, with the Pytorch version being 2.0.0+cu12.0.

[0118] In order to verify the effectiveness and practicality of the algorithm, experiments were conducted on two datasets: ISCX VPN-nonVPN2016 traffic dataset and USTC-TFC2016 dataset.

[0119] The ISCX VPN-nonVPN2016 dataset is based on an OpenVPN channel, captured by Wireshark and TCPDUMP, and provided by the Canadian Institute for Cyber ​​Security. The dataset contains both non-VPN and VPN traffic and involves many popular applications. The experiments refer to the DeepPacket experiment to label the raw traffic in the dataset. As shown in Table 1, the labeled ISCX dataset has 12 categories, including 6 VPN traffic categories and 6 non-VPN traffic categories.

[0120] Table 1 Labels of ISCX VPN-nonVPN2016 dataset

[0121] Non-VPN VPN Email Email , Gmail Email, Gmail Chat Facebook, Hangouts,Wechat, ICQ,AIM, Skype Facebook, Hangouts,ICQ, AIM, Skype Streaming Vimeo, Youtube, Netflix, Spotify Vimeo, Youtube, Netflix File Transfer FTPS, SFTP, SCP, FTP, Skype FTP, FTPS, SFTP, Skype VoIP Facebook, Skype, VoipBuster,Hangouts voice calls Hangouts, Skype, VoipBuster P2P uTorrent, Bittorrent uTorrent, Bittorrent

[0122] The USTC-TFC2016 dataset is a public network traffic dataset created by the University of Science and Technology of China in 2016. It aims to provide rich, diverse and accurate data for the research of network traffic classification and anomaly detection. A large number of network traffic data generated by various network services such as BitTorrent, FTP, Gmail, etc. form the backbone of this dataset. The dataset contains ten categories of network traffic, each of which has detailed labels, allowing researchers to conduct in-depth training and evaluation of models based on the specific characteristics of each category. This design not only achieves a balance between detail and practicality, but also ensures the scientificity and complexity of the data while providing diversity.

[0123] 2. In order to evaluate the proposed method, three commonly used performance indicators are used in the experiment: precision, recall and Scores. These metrics are used to measure the performance of the STFNT model in the encrypted traffic classification task.

[0124] Precision: Precision indicates how many of the samples classified as positive are actually positive. Its calculation formula is as follows:

[0125]

[0126] In this formula, True Positives (TP) refers to the number of samples correctly classified as positive by the model, and False Positives (FP) refers to the number of negative samples incorrectly labeled as positive by the model. Precision measures the classification accuracy of the model, that is, the proportion of positive samples correctly classified by the model to all samples classified as positive by the model.

[0127] Recall: Recall indicates how many samples of all actual positive categories are correctly classified as positive. Its calculation formula is as follows:

[0128]

[0129] In this formula, True Positives (TP) refers to the number of samples correctly classified as positive by the model, and False Negatives (FN) refers to the number of positive samples incorrectly labeled as negative by the model. The recall rate measures whether the model can capture all actual positive samples, that is, the comprehensiveness of the model.

[0130] Fraction: The score is the harmonic mean of precision and recall, which is used to comprehensively evaluate the performance of the model. The score is calculated as follows:

[0131]

[0132] The score considers the balance between precision and recall. It is suitable for tasks that require a balance between the accuracy and comprehensiveness of the classifier. The score ranges from 0 to 1, with higher values ​​indicating better model performance.

[0133] 3. Experimental process and analysis of experimental results

[0134] The verification experiment is divided into three parts: the first part is to determine the accuracy of the STFNT method in four classification scenarios; the second part is to compare the method proposed in this paper with other traffic classification methods based on the completion of the first part using the ISCX VPN-nonVPN2016 public dataset; the third part is to use the encrypted traffic dataset USTC-TFC2016 collected in the actual network environment to compare and verify the method proposed in this paper based on the second part.

[0135] 3.1 Model Classification Experiment

[0136] First, we classified the encrypted and unencrypted traffic in the ISCX VPN-nonVPN2016 dataset, and then conducted a six-category classification experiment on these two types of traffic. This is to identify encrypted traffic from coarse to fine, first determine whether the traffic is encrypted, and then identify the specific protocol, application, service, etc. to which the traffic belongs. Considering that sometimes all traffic needs to be classified at once, a 12-category classification experiment was also conducted, that is, all traffic is directly classified by application type using 12-category classifiers.

[0137] Table 2 Experimental results of the STFNT method in four experimental scenarios

[0138] 2. Classification Encryption 6 categories Non-encrypted 6 categories 12 Categories P 100.00 98.51 97.42 98.26 R 100.00 98.49 97.41 98.25 F1 100.00 98.49 97.41 98.25

[0139] The experimental results are shown in Table 2. It can be seen from Table 2 that the average values ​​of precision P, recall R, and F1 of the two-classification experiment in experimental scenario 1 can reach 100%, and the annotation error is zero. The reason is that for this coarse-grained classification, the classification model only needs to identify whether the traffic is encrypted. The requirements are relatively simple, and all indicators can achieve relatively good results. For the subdivision of 6-class encrypted traffic and non-encrypted traffic, the various indicators can reach 98.49% and 97.41%. Due to the influence of the encryption suite, the identification difficulty is different. The various indicators of the non-encrypted traffic classification experiment are several percentage points lower than those of the encrypted traffic classification experiment. The various indicators of the STFNT method in the 12-classification experimental scenario can reach more than 98.25%. Figures 3 to 6 From the confusion matrix, we can see that the STFNT method can well identify the service type of traffic with high accuracy.

[0140] 3.2 Model comparison experiment

[0141] In order to verify the effectiveness of the proposed method, four representative models that were used in related research on the same dataset were selected for comparative experiments. These four models are 1D-CNN, LSTM, HAST, and CNN-LSTM. A comparative study of 12 categories of classification was conducted in these four models. In order to ensure the effectiveness of the experimental results, the structures and parameters of all these network models were reproduced according to the original description.

[0142] The specific experimental results are shown in Table 3:

[0143] Table 3 Comparative experimental results on ISIC VPN-nonVPN2016

[0144] method Accuracy Recall F1 1D-CNN 0.865 0.863 0.864 LSTM 0.918 0.912 0.915 HAST 0.937 0.936 0.936 CNN-LSTM 0.944 0.941 0.942 This article STFNT 0.983 0.983 0.983

[0145] According to the experimental results in Table 3, it can be clearly seen that the STFNT method surpasses the 1D-CNN, HAST-II, LSTM and CNN-LSTM models in terms of overall accuracy, precision, recall and F1 score on the ISCX VPN-nonVPN2016 dataset. Compared with the baseline LSTM model, the SFTFNT model has improved by 0.68, 0.65, 0.71 and 0.68 in accuracy, precision, recall and F1 score respectively. This result clearly shows that compared with using only LSTM or CNN models to extract a single feature, allowing the model to simultaneously consider the temporal and spatial characteristics of network traffic can bring better classification results.

[0146] In addition, compared with the serial CNN-LSTM model, the STFNT model improves accuracy, precision, recall and F1 score by 0.42, 0.39, 0.42 and 0.41 respectively. This result further proves that compared with the cross-extraction of spatiotemporal features, the STFNT method can extract more powerful feature information by modeling two feature dimensions separately through two branches, thereby enhancing the classification ability. These results confirm the effectiveness of the method proposed in this paper.

[0147] The above convincing experiments prove that the STFNT method has significant advantages in extracting network traffic features and classifying traffic, both in theory and in practice.

[0148] 3.3 Model transfer experiment

[0149] In order to further prove that the encrypted traffic classification method based on sequence feature fusion described in the present invention has wide applicability in different application environments, a model transfer experiment was conducted. The main goal of this type of experiment is to prove that the STFNT method can be trained on one data set and effectively predicted on another different data set. In practical applications, this feature is very important because the effective transfer ability of the model can significantly improve its generalization ability.

[0150] The training and test datasets selected for the experiment are publicly available and widely used for network traffic classification. The model is first trained on the VPN-nonVPN2016 dataset, and then the trained model is applied to the USTC-TFC2016 dataset for evaluation. The STFNT method achieves an accuracy of 99.93% on the USTC-TFC2016 dataset.

[0151] Figure 7 The detailed results of the experiment are shown. It can be observed that the STFNT method maintains a high classification performance for different categories of traffic. The accuracy on the USTC-TFC2016 dataset is higher than that on the ISCX VPN-nonVPN2016 dataset because the traffic in the USTC-TFC2016 dataset is clearly classified and their characteristics can be grasped more easily. This significant experimental result shows that the STFNT method can be effectively migrated to different datasets and maintain high performance on new datasets. This shows that the STFNT method has good adaptability and robustness when dealing with new and unknown tasks.

[0152] In summary, the encrypted traffic classification method based on sequence feature fusion described in the present invention adopts an encrypted traffic classification neural network architecture (STFNT) based on CNN and LSTM, which uses spatiotemporal feature sequences to supplement the structural feature information lost due to shearing during the original traffic preprocessing process, and uses convolutional neural networks (CNN) to analyze the TLS handshake original traffic to obtain global features. With the help of long short-term memory networks (LSTM), the deep characteristics of the packet size and flow arrival time series are mined, so that the STFNT method can more comprehensively understand and identify various characteristics of the traffic, thereby improving the performance of the classification task. Experiments on two data sets have proved that the STFNT method not only has a high-precision classification performance, but also has good migration and robustness in the face of different data sets.

Claims

1. The encrypted traffic classification method based on sequence feature fusion is characterized by: The following steps are involved: S1, data preprocessing; S11, dividing the traffic, wherein the traffic division is based on quintuple information; Split the continuous traffic in the original pcap file into independent session stream files; continuous original traffic is broken down into a set of packets, using It indicates that, It is traffic The total number of packets in ; each individual packet The definition is as follows: ； in, Represents five-tuple information, is the start time of the packet, and Indicates the byte length of the data packet; S12. After dividing the traffic, clean up the traffic; calculate the hash values ​​of all files and remove duplicate files with the same hash values; at the same time, delete the IP address and MAC address in the traffic by replacing the relevant string with 0x00; and clean up empty files and duplicate files; S2, feature processing of data; S21, truncate the input original traffic data and retain only the TLS header of the handshake data packet; S22, extracting spatiotemporal feature information from the original traffic, wherein the spatiotemporal feature information includes a data packet size and a flow arrival time; S23, fusing the TLS handshake header bytes with the spatiotemporal feature sequence; Represent the handshake header byte feature vector as , the handshake header byte feature vector contains the key field information in the truncated ClientHello and ServerHello messages; Each data packet vector in the spatiotemporal feature sequence Splice to get the spatiotemporal feature matrix of the flow ; Handshake header feature vector With the spatiotemporal feature matrix Splice to get a comprehensive feature matrix ; The specific form is as follows: ; S3, classify the traffic; Traffic is classified using the STFNT classification method; the STFNT classification method takes the flow time series and the TLS handshake header as input; each of the two inputs is fed into a set of separate neural network layers, the outputs of which are then concatenated and passed through an additional fully connected layer to produce the final classification; Feed the TLS handshake header to a deep 1D CNN with max pooling; get the CNN feature vector ; ； In the formula, It is the convolution kernel weight matrix, which is responsible for extracting local features from the input data; is the input feature sequence, representing the TLS handshake header features; is the bias term, which provides a constant offset for the convolutional layer; The stream time series passes through the first fully connected layer and then enters the three LSTM layers; the LSTM feature vector is obtained ; ， ； In the formula, Refers to the LSTM used to calculate the output The weight matrix of the hidden state and the current input Perform a linear transformation to generate oto_tot; is at the time step The hidden state vector represents the internal state of the LSTM unit at the current time step, containing the accumulated information; is at the time step The input vector is the feature of the current data packet; It is the bias term of the LSTM output gate; it is used to adjust the output result; Represents the sigmoid activation function, which is used to limit the output to the range of (0,1); is at the time step The memory cell state represents the long-term memory state of LSTM; represents the hyperbolic tangent activation function, which is used to compress the input into the range of (-1,1) so that LSTM can capture more subtle input changes; Through the fully connected layer, the CNN feature vector and LSTM feature vector Fusion, construct input samples ; ； In the formula, is the weight matrix of the fully connected layer, responsible for extracting important information from the input vector; is the bias vector used to adjust the activation threshold of the neuron; Use the Softmax function to classify the results. The formula of the Sofmax function is as follows: ； In the formula, is the input vector The output value of Softmax of the i-th element, All are between 0 and 1, and the sum of all output values ​​is 1.

2. The encrypted traffic classification method based on sequence feature fusion as claimed in claim 1, characterized in that: The five-tuple information in step S1 includes source IP, source port, target IP, target port, and protocol.

3. The encrypted traffic classification method based on sequence feature fusion as described in claim 2 is characterized by: In step S2, the extraction of spatiotemporal feature information includes the following steps: Get a record from each flow, which contains information about each packet in the flow; the information about each packet is a list of pairs of packet size and flow arrival time; After obtaining the spatiotemporal features of each data packet, the two features of packet size and flow arrival time are uniformly represented as a fixed format containing two feature fields, namely, ;in Represents the size of the IP packet, represents the flow arrival time; After the spatiotemporal features are expressed as above, the minimum-maximum standardization method is used to normalize the data. The specific formula is: ； In the formula, is the original eigenvalue, that is, the data point that has not been standardized; It is a feature The minimum value of feature The maximum value of x new It refers to the new eigenvalue obtained after the original eigenvalue is normalized; After normalization, all statistical features are mapped to the range of [0,1]; the two features of IP packet size and flow arrival time are unified into a vector, namely the packet vector , which has the form: ； in are two features after feature embedding and conversion. is the mapping matrix.

Images