Multi-modal network traffic classification method based on deep learning

Abstract

The invention discloses a multi-modal network traffic classification method based on deep learning. The method comprises the following steps: data preprocessing; establishing a traffic classification network; training a traffic classification network; a traffic classification network is tested. According to the method, the traffic features are extracted from different angles by inputting the two modalities of the original bytes and the length sequences, so that the performance of the classifier is improved, and the problem that single-modal feature extraction is insufficient is solved. According to the method, the features of the original bytes of the traffic are extracted by using the Transform of the improved attention mechanism, meanwhile, the features of the data packet length sequence are extracted by using the bidirectional LSTM, and then the two extracted features are fused to generate a new more comprehensive feature representation, so that the accuracy of network traffic classification is improved. According to the method, on the design of the loss function, the final classification result is measured, and the classification performance of the learning features of each part is considered, so that the optimal classification performance of each part is obtained, and the overall classification accuracy is finally improved.

Description

Technical Field

[0001] The present invention relates to the field of network traffic classification and deep learning technology, and specifically to a multimodal network traffic classification method based on deep learning. Background Art

[0002] With the rapid development of the Internet, network services are diverse and network traffic is growing explosively, which not only brings great difficulties to the quality of service (QoS) guarantee, but also makes network security management more and more difficult. [1-3] In response to these problems, classifying network traffic can help network administrators to promptly discover and respond to potential security threats, and improve network security, stability, and management efficiency. On the other hand, by classifying applications, monitoring and managing network traffic can provide faster channels for high-priority data, thereby improving network QoS. Therefore, network traffic classification technology is of great significance to network security and management.

[0003] Early traffic classification mainly relied on port-based methods and deep packet inspection (DPI). Each application is identified by its registered and known port, and port-based traffic classification is achieved by matching known port numbers with standard port numbers. With the development of network technology, more and more applications use dynamically allocated ports or use commonly used communication protocol ports for disguise, which greatly reduces the availability of port number-based methods. The DPI-based method matches the packet payload with a set of stored signatures to classify network traffic. However, when the traffic is encrypted and access to the packet content is blocked, the port-based and DPI-based methods will fail.

[0004] With the rise of machine learning technology, researchers have realized that machine learning can be applied to encrypted traffic identification. Traditional machine learning-based methods use statistical features to distinguish different traffic flows, such as the duration of each flow or the average packet size. Although machine learning is widely used in traffic classification, such methods require manual feature extraction during the classification process and rely on expert experience. They cannot perform automated feature extraction and are difficult to accurately classify complex and diverse network traffic. Deep learning can solve this problem well.

[0005] Deep learning is an end-to-end learning process. It does not require analyzing data structures and defining data features. It can autonomously learn data features and learn the inherent laws and correlations of input data. At present, Convolutional Neural Networks (CNN) and Recurrent Neural Networks (RNN) are the main end-to-end traffic classification methods. By extracting features from the data and using them as input to the Softmax layer, the predicted labels can be directly output. Although the deep learning-based method has shown good performance in traffic classification, road extraction still has the following problems:

[0006] (1) Feature extraction from a single perspective: In the process of using deep learning technology, most existing studies use a single network model to extract traffic features and lack a mechanism for feature extraction from multiple perspectives.

[0007] (2) Limitations of CNN: CNN’s local convolution operation makes it less able to perceive long distances, and it performs worse than Transformer in processing global relationships. The number of operations required to simultaneously calculate the association between two locations increases as the distance increases.

[0008] (3) Limitations of self-attention: Although the self-attention mechanism of Transformer can capture the dependencies between positions in the input sequence, the attention map generated from Q and K can only capture the correlation between tokens at a single granularity. Summary of the invention

[0009] In summary, in order to further improve the ability to identify network traffic, the present invention proposes a multimodal network traffic classification method based on deep learning to solve the problems of insufficient feature extraction of a single modality and limitations of existing models.

[0010] In order to achieve the above-mentioned object of the invention, the present invention adopts the following technical scheme:

[0011] A multimodal network traffic classification method based on deep learning includes the following steps:

[0012] A. Data Preprocessing

[0013] Collect the original data set, save the network traffic data as files in pcap or pcapng format, and prepare the traffic classification data set;

[0014] B. Build a traffic classification network

[0015] The traffic classification network is a network based on the combination of improved Transformer and LSTM. The overall architecture of the traffic classification network includes a feature extraction module, a feature fusion module and a classification module. The feature extraction module consists of two parallel branches, namely, an original byte feature extraction branch and a length sequence feature extraction branch; the feature fusion module fuses the feature vectors extracted by the original byte feature extraction branch and the length sequence feature extraction branch to generate a fusion feature for classification; the classification module outputs the classification result through full connection and Softmax.

[0016] C. Training traffic classification network

[0017] The original traffic data set prepared in step A is input into the traffic classification network for training. The initial learning rate is set to 2e-5, and the learning rate is adjusted adaptively. When the learning rate is less than 5e-7, the training is stopped.

[0018] D. Test traffic classification network

[0019] According to the traffic classification network trained in step C, multiple traffic classification network models are obtained, and the traffic classification network model with the smallest loss value on the training set is selected. At this time, the traffic classification network model is optimal in the settings of learning rate and optimizer parameters. Then, the selected traffic classification network model is loaded on the test set to test the traffic classification performance of the traffic classification network.

[0020] Furthermore, the steps of preparing the traffic classification data set in step A are as follows:

[0021] A1. Traffic segmentation: The sessions of files in pcap or pacpng format are segmented according to the same five-tuple as the segmentation standard, and wireshark is used to segment the files into smaller files according to the segmentation standard. The five-tuple includes source IP address, destination IP address, source port, destination port and protocol.

[0022] A2. Traffic cleaning: Delete duplicate packets and packets without payload. Clear IP and MAC addresses in packet headers.

[0023] A3. Unify data length: Since the length of TCP and UDP headers are different, TCP is 20 bytes and UDP is 8 bytes, the UDP header is padded to 20 bytes. After unifying the data length, the first 784 bytes of the data packet payload are intercepted.

[0024] A4. Convert packets into images: Each session is segmented into packets, and each packet is further converted into a grayscale image.

[0025] Furthermore, the method for building a traffic classification network in step B includes the following steps:

[0026] B1. Feature extraction

[0027] After preprocessing the data of the public dataset USTC-TFC2016 according to step A, the data is input into the feature extraction module, and the following feature extraction operations are performed on the input traffic:

[0028] B11. Extracting raw byte features

[0029] B111, the preprocessing result of the original byte is represented as the input sample x t ,in Input into the raw byte feature extraction branch, where m represents the number of packets and d1 represents the dimension of the packet.

[0030] B112. Each packet is treated as a patch and shallow low-dimensional features are extracted using convolutional layers consisting of sequential modules. First, a 2D convolutional layer with single-channel input and single-channel output is used, with a kernel size of 3, a stride of 1, and no padding. Then, a 2D max pooling operation with a pooling window of 2 is performed, sliding the input with a stride of 2. The basic vector features w of the packet of each session extracted from the convolutional neural network, i.e., CNN, are t , expressed as:

[0031] w t =f(x t ,θ) (1)

[0032] in, θ represents the training parameters of CNN, x t is the input sample, and d2 represents the dimension after the operation.

[0033] B113. Use Transformer to model the sequence information of the data packet. The flattening operation is as follows:

[0034] z t =W×w t +PE (2)

[0035] Among them, W is the linear flattening operation, which is a linear transformation matrix, × represents matrix multiplication, PE is the position embedding, z t is the final session embed,

[0036] B114. In order to further extract the structural information of the session, the classic Transformer encoding module of the ViT network is used, which consists of a hybrid attention layer, namely the GMA layer, and a feedforward network layer, namely the FFN layer. The Q / K / V entries are evenly divided into five parts, and four of them are grouped and aggregated, respectively. Represents the part split from the Q / K / V entry, generating group agents Q', K' and V', i∈[1,2,3,4], and finally, performing attention calculation on the group agent and finally outputting attention:

[0037]

[0038] B115, FFN layer consists of two linear transformations, and nonlinear transformation is performed through activation function. t represents the final representation of each session, m is the number of packets in the session, and d2 is the embedding dimension. B116. Use the maximum pooling operation to transform s t Convert to a one-dimensional feature vector and get the original byte feature h1:

[0039] h1=z max (s t ) (4)

[0040] Among them, z max (·) indicates the max pooling operation.

[0041] B12. Extract length sequence features

[0042] Use bidirectional LSTM to extract packet length sequence features. Bidirectional LSTM takes the packet length sequence in the session as input, models the length sequence, and extracts packet length sequence features. The specific steps are as follows:

[0043] B121. Extract the length of the data packet to construct a data packet length sequence. Let L be the data packet length sequence, defined as:

[0044] L={l1,…,l i …,l m}={length(P1),…,length(P m )} (5)

[0045] Where length() is the length extraction function, l i is the length of the ith data packet in bytes, P m Indicates the mth data packet.

[0046] B122. After obtaining the length sequence, use bidirectional LSTM to learn the order correlation of the length sequence and obtain the length sequence feature h2:

[0047]

[0048] LSTM(·) means using LSTM to model the length sequence, and Concat(·) means connecting the bidirectional LSTM.

[0049] B2. Feature Fusion

[0050] The features learned by the original byte feature extraction branch and the length sequence feature extraction branch are fused through concatenation to obtain the fused feature h:

[0051] h=Concat(h1,h2) (7)

[0052] Among them, h1 and h2 represent the original byte features and length sequence features respectively.

[0053] B3. Traffic Classification

[0054] The fused features are input into the classification module for classification. The classification module consists of a fully connected layer and a Softmax layer. After the fused features pass through the fully connected layer, the feature vector of the sample and the mapping of the sample classification score are obtained. Softmax is regarded as a normalization process. After Softmax, the sample classification score output by the fully connected layer will be converted into a probability. The specific steps are as follows:

[0055] B31. After obtaining the h1 and h2 feature vectors, perform full connection and Softmax operations on them respectively, and obtain the classification results γ1 and γ2.

[0056]

[0057]

[0058] in is the weight for fully connecting h1, is the emphasis on full connection of h1; W h2 is the weight for full connection of h2, b h2 It is a focus on full connection of h2.

[0059] B32. Connect h1 and h2, and classify them again through full connection and Softmax operation to obtain the final classification result γ3.

[0060]

[0061] Where W h3 is the weight of fully connecting h, b h3 It is the emphasis on fully connecting h.

[0062] B33. Use cross entropy as the loss function for the classification results described in steps B31 and B32 to obtain loss1, loss2 and loss3. The formula is as follows:

[0063]

[0064]

[0065] in is the integer value corresponding to the i-th network flow label, T is the number of sample training, and N is the number of application categories.

[0066] B34, loss of the entire traffic classification network total is the sum of the three losses in step B33, and the calculation formula is as follows:

[0067]

[0068] Compared with the prior art, the present invention has the following beneficial effects:

[0069] 1. The present invention extracts traffic features from different angles by inputting two modes, namely, original bytes and length sequences, so as to improve the classifier performance and improve the problem of insufficient feature extraction of a single mode.

[0070] 2. The present invention uses the Transformer with improved attention mechanism to extract the features of the original bytes of the traffic, and uses the bidirectional LSTM to extract the features of the packet length sequence. The two extracted features are then fused to generate a new and more comprehensive feature representation to improve the accuracy of network traffic classification.

[0071] 3. In the design of the loss function, the present invention not only measures the final classification result, but also takes into account the classification performance of the features learned in each part, so as to obtain the best classification performance of each part and ultimately improve the overall classification accuracy.

[0072] 4. In summary, the present invention has broad application prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] Figure 1 It is a structural diagram of the present invention.

[0074] Figure 2 Diagram of the data preprocessing process.

[0075] Figure 3 It is a diagram of the mixed attention structure.

[0076] Figure 4 This is a bidirectional LSTM network structure diagram.

[0077] Figure 5 It is a schematic diagram of the classification accuracy confusion matrix of the 1D-CNN traffic classification network.

[0078] Figure 6 It is a schematic diagram of the classification accuracy confusion matrix of the Fs-Net traffic classification network.

[0079] Figure 7 It is a schematic diagram of the classification accuracy confusion matrix of the App-Net traffic classification network.

[0080] Figure 8 It is a schematic diagram of the classification accuracy confusion matrix of the MIMETC traffic classification network.

[0081] Fig. 9 It is a schematic diagram of the classification accuracy confusion matrix of the traffic classification network of the present invention. DETAILED DESCRIPTION

[0082] The present invention will be further described below in conjunction with the accompanying drawings. Figure 1 As shown in FIG. 1 , a multimodal network traffic classification method based on deep learning is shown in FIG. 1 . The specific steps are as follows:

[0083] Step 1: Collect network traffic data. Download the original network traffic data set from various research institutions, and save the collected network traffic data as files in pcap or pcapng format.

[0084] Step 2: Preprocessing of raw data. Merge pcap files of the same type to obtain pcap packages corresponding to each traffic type. Select the first 784 bytes of the data packet payload, truncate the data exceeding 784 bytes, and fill the data less than 784 bytes with 0. At the same time, due to the different lengths of TCP and UDP headers (TCP is 20 bytes and UDP is 8 bytes), 0 will be filled at the end of the UDP header. After converting each byte to a value between 0-255, normalize it to obtain 784 values ​​between 0-1. Take each value as a pixel and convert it into a 28×28 grayscale image through Python code as the input of the neural network.

[0085] Step 3: Dataset division: The processed dataset is randomly divided into training set and test set in a ratio of 4:1.

[0086] Step 4: Build a traffic classification network. The network of the present invention is an end-to-end multimodal deep learning framework based on a parallel strategy. The overall architecture is mainly a Transformer module and an LSTM module for improving attention. The Transformer module includes a normalization layer, a hybrid attention layer, and a feedforward network layer. After the raw data processed by the data preprocessing process, the data packet in each session is converted into a 28×28 grayscale image, the image is input into a 3×3 convolution layer, and then a 2D maximum pooling operation is performed to obtain the vector features of each data packet, which are input into the Transformer, the vector is normalized in the normalization layer, and input into the hybrid attention layer to calculate the attention, and finally input into the feedforward network layer, and the vector of the original bytes of the data packet is output; at the same time, in the process of preprocessing the data packet, the length information of each data packet is obtained through the length acquisition function, and a length sequence is generated, and the length sequence is input into the embedding layer for embedding position encoding, and the input vector of the embedding layer is input into the bidirectional LSTM, and the length sequence feature vector is output. Finally, the two learned feature vectors are fused through feature fusion to obtain the fused feature, which is input into the softmax layer as the feature of traffic classification for traffic category prediction.

[0087] Step 5: Train the traffic classification network. Input the data set divided in Step 3 into the traffic classification network and train it simultaneously on an NVIDIA GeForce RTX 3090 graphics card. The initial learning rate is set to 2e-5, and the learning rate is adjusted adaptively. When the learning rate is less than 5e-7, stop training. Select the network parameters with the smallest loss value on the training set, and test the network's traffic classification performance on the test set.

[0088] Step 6: Perform performance test on the traffic classification network. Input the test data set obtained in Step 4 into the network and output the corresponding traffic category.

[0089] Step 7: Evaluate the prediction results based on the traffic classification network. Use accuracy, F1 score and confusion matrix to evaluate the prediction results. Figure 5-9As shown, the "rows" of the confusion matrix represent the true categories, and the "columns" represent the predicted categories. It can be observed from the figure that the classification accuracy of 7 applications of the present invention on the data set USTC-TFC2016 has reached 100%, and the number of other models with an accuracy of 100% is less than that of the present invention. Among them, 1D-CNN has the lowest accuracy, with only four applications with an accuracy of 100%, and the classification accuracy of Gmail is the lowest, only 77%, while the classification accuracy of Gmail of the present invention is much higher than that of 1D-CNN. At the same time, although the accuracy of Fs-Net is closest to the present invention, and it also successfully predicts 100% of seven applications, for categories that cannot be completely correctly predicted, the average accuracy of the present invention is higher than that of the Fs-Net method. The classification accuracy of Gmail of the other two methods, App-Net and MIMETC, is lower than that of the present invention, which is only 92% and 94% respectively. Through the analysis of the experimental results, it can be seen that the present invention has significant advantages over the other four methods, which fully proves its effectiveness.

[0090] The present invention is not limited to this embodiment, and any equivalent concepts or changes within the technical scope disclosed by the present invention are included in the protection scope of the present invention.

Claims

1. A multimodal network traffic classification method based on deep learning, characterized by: The following steps are involved: A. Data Preprocessing Collect the original data set, save the network traffic data as files in pcap or pcapng format, and prepare the traffic classification data set; B. Build a traffic classification network The traffic classification network is a network based on the combination of improved Transformer and LSTM. The overall architecture of the traffic classification network includes a feature extraction module, a feature fusion module and a classification module. The feature extraction module consists of two parallel branches, namely, a raw byte feature extraction branch and a length sequence feature extraction branch. The feature fusion module fuses the feature vectors extracted by the original byte feature extraction branch and the length sequence feature extraction branch to generate a fusion feature for classification; the classification module outputs the classification result through full connection and Softmax; C. Training traffic classification network Input the original traffic data set prepared in step A into the traffic classification network for training; the initial learning rate is set to 2e-5, and the learning rate is adjusted adaptively. When the learning rate is less than 5e-7, stop training; D. Test traffic classification network According to the traffic classification network trained in step C, multiple traffic classification network models are obtained, and the traffic classification network model with the smallest loss value on the training set is selected. At this time, the traffic classification network model is optimal in the settings of learning rate and optimizer parameters. Then, the selected traffic classification network model is loaded on the test set to test the traffic classification performance of the traffic classification network.

2. According to claim 1, a multimodal network traffic classification method based on deep learning is characterized by: The steps for preparing the traffic classification data set described in step A are as follows: A1. Traffic segmentation: The sessions of files in pcap or pacpng format are segmented according to the same five-tuple as the segmentation standard, and wireshark is used to segment the files into smaller files according to the segmentation standard. The five-tuple includes source IP address, destination IP address, source port, destination port and protocol; A2. Traffic cleaning: Delete duplicate packets and packets without payload; clear IP and MAC addresses in packet headers; A3. Unify data length: Since the length of TCP and UDP headers are different, TCP is 20 bytes and UDP is 8 bytes, the UDP header is padded to 20 bytes; after unifying the data length, the first 784 bytes of the data packet payload are intercepted; A4. Convert packets into images: Each session is segmented into packets, and each packet is further converted into a grayscale image.

3. According to the multimodal network traffic classification method based on deep learning in claim 1, it is characterized by: The method for building a traffic classification network in step B includes the following steps: B1. Feature extraction After preprocessing the data of the public dataset USTC-TFC2016 according to step A, the data is input into the feature extraction module, and the following feature extraction operations are performed on the input traffic: B11. Extracting raw byte features B111, the preprocessing result of the original byte is represented as the input sample x t ,in Input into the raw byte feature extraction branch, where m represents the number of packets and d1 represents the dimension of the packet; B112. Each packet is treated as a patch, and shallow low-dimensional features are extracted using a convolutional layer composed of sequential modules. First, a two-dimensional convolutional layer with a single-channel input and a single-channel output is used, with a kernel size of 3, a stride of 1, and no padding. Then, a 2D maximum pooling operation with a pooling window of 2 is performed, sliding the input with a stride of 2. The basic vector features w of the packet of each session extracted from the convolutional neural network, i.e., CNN, are t , expressed as: w t =f(x t ,θ) (1) in, θ represents the training parameters of CNN, x t is the input sample, d2 represents the dimension after operation; B113. Use Transformer to model the sequence information of the data packet. The flattening operation is as follows: z t =W×w t +OR (2) Among them, W is the linear flattening operation, which is a linear transformation matrix, × represents matrix multiplication, PE is the position embedding, z t is the final session embed, B114. In order to further extract the structural information of the conversation, the classic Transformer encoding module of the ViT network is used, which consists of a hybrid attention layer, namely the GMA layer, and a feedforward network layer, namely the FFN layer; the Q / K / V items are evenly divided into five parts, and four of them are grouped and aggregated, respectively. Represents the part split from the Q / K / V entry, generating group agents Q', K' and V', i∈[1,2,3,4], and finally, performing attention calculation on the group agent and finally outputting attention: B115, FFN layer consists of two linear transformations, and nonlinear transformation is performed through activation function; t represents the final representation of each session, m is the number of packets in a session, d2 is the embedding dimension; B116, through the maximum pooling operation, s t Convert to a one-dimensional feature vector and get the original byte feature h1: h1=z max (s t ) (4) Among them, z max (·) indicates the maximum pooling operation; B12. Extract length sequence features Use bidirectional LSTM to extract packet length sequence features. Bidirectional LSTM takes the packet length sequence in the session as input, models the length sequence, and extracts packet length sequence features. The specific steps are as follows: B121. Extract the length of the data packet to construct a data packet length sequence; let L be the data packet length sequence, defined as: L={l1,…,l i …,l m }={length(P1),…,length(P m )} (5) Where length() is the length extraction function, l i is the length of the ith data packet in bytes, P m Indicates the mth data packet; B122. After obtaining the length sequence, use bidirectional LSTM to learn the order correlation of the length sequence and obtain the length sequence feature h2: LSTM(·) means using LSTM to model the length sequence, and Concat(·) means connecting bidirectional LSTM. B2. Feature Fusion The features learned by the original byte feature extraction branch and the length sequence feature extraction branch are fused through concatenation to obtain the fused feature h: h=Concat(h1,h2) (7) Among them, h1 and h2 represent the original byte features and length sequence features respectively; B3. Traffic Classification The fused features are input into the classification module for classification; the classification module is composed of a fully connected layer and a Softmax layer; after the fused features pass through the fully connected layer, the feature vector of the sample and the mapping of the sample classification score are obtained. Softmax is regarded as a normalization process. After Softmax, the sample classification score output by the fully connected layer will be converted into a probability. The specific steps are as follows: B31. After obtaining the h1 and h2 feature vectors, perform full connection and Softmax operations on them respectively, and obtain the classification results γ1 and γ2; in is the weight for fully connecting h1, is the emphasis on full connection of h1; W h2 is the weight for full connection of h2, b h2 It is a preference for full connection of h2; B32, connect h1 and h2, and classify them again through full connection and Softmax operation to obtain the final classification result γ3; Where W h3 is the weight of fully connecting h, b h3 It is the emphasis on full connection of h; B33. Use cross entropy as the loss function for the classification results described in steps B31 and B32 to obtain loss1, loss2 and loss3. The formula is as follows: in is the integer value corresponding to the i-th network flow label, T is the number of sample training, N is the number of application categories; B34, loss of the entire traffic classification network total is the sum of the three losses in step B33, and the calculation formula is as follows:

Images