Malicious traffic classification method based on feature fusion

Abstract

The invention discloses a malicious traffic classification method based on feature fusion. According to the method, the traffic is converted into a grayscale image, a malicious traffic classification model specially used for classifying the traffic image is designed, and the malicious traffic classification model comprises a channel fusion module, a multi-layer feature fusion module, a down-sampling fusion module, a global average pooling layer, a full connection layer and a Softmax activation function layer. The channel fusion module expands a single-channel image into a multi-channel feature map, so that hidden features are extracted, the stability and classification performance of the model are improved, the multi-layer feature fusion module can extract texture features and multi-scale features of a flow image, and the features of different layers are added and fused, so that the expression ability and performance of the model are improved, and the method is suitable for large-scale popularization and application. The down-sampling fusion module fuses the features obtained by various pooling operations, the understanding ability of the model to the traffic image is improved, the number of feature maps is increased, and loss of useful feature information is prevented.

Description

Technical Field

[0001] The present invention relates to a traffic classification method in the field of data identification, and in particular to a malicious traffic classification method based on feature fusion. Background Art

[0002] The rapid growth of IoT devices has expanded the network attack surface, which makes them vulnerable to various attacks in the network. Once an IoT device is attacked, it will not only cause economic losses, but also endanger the security and privacy of user data. Therefore, detecting attack behaviors in the IoT is crucial to the security of the IoT. Usually, malicious traffic classification models detect attack behaviors in the network by analyzing whether the network traffic is benign or malicious. Therefore, detecting malicious traffic in the network is an urgent problem to be solved in the IoT.

[0003] The mainstream malicious traffic classification methods currently include traditional machine learning methods and deep learning methods. Although traditional machine learning methods can effectively detect malicious traffic, the selection of features is time-consuming and heavily dependent on expert experience. Compared with traditional machine learning, deep learning can automatically extract features from raw data instead of using manual feature selection. At present, it is an advanced method to convert network traffic into images and classify them using traditional convolutional neural networks. However, this method still has some shortcomings. For example, traffic images are usually small, and the downsampling operation of traditional networks will lead to the loss of feature information. In addition, traffic images are single-channel images, and the channel feature information is less than that of three-channel images. It is difficult for traditional deep learning neural networks to extract enough feature information. Summary of the invention

[0004] In order to solve the deficiencies of the above technologies, the present invention proposes a malicious traffic classification method based on feature fusion according to the characteristics of traffic images.

[0005] The present invention is implemented by the following technical solutions:

[0006] A malicious traffic classification method based on feature fusion, characterized in that the classification method comprises the following steps:

[0007] Step 1, pre-processing the pcap traffic packets containing malicious traffic packets and benign traffic packets;

[0008] Step 2, convert the preprocessed pcap traffic packet into a grayscale image;

[0009] Step 3, building a malicious traffic classification model, the malicious traffic classification model includes a channel fusion module, a multi-layer feature fusion module, a downsampling fusion module, a global average pooling layer, a fully connected layer and a Softmax activation function layer;

[0010] Step 4: Input the grayscale image of step 2 into the malicious traffic classification model to obtain the classification result.

[0011] Further, step 4 includes the following steps:

[0012] Step 4.1: Input the grayscale image into the channel fusion module of the malicious traffic classification model to obtain the output feature map A. 1 ;

[0013] Step 4.2: transform feature map A 1 Input the multi-layer feature fusion module of the malicious traffic classification model to obtain the output feature map B 1 ;

[0014] Step 4.3, feature map B 1 Input the downsampling fusion module of the malicious traffic classification model to obtain the output feature map C 1 ;

[0015] Step 4.4, the feature map C 1 Input the multi-layer feature fusion module of the malicious traffic classification model to obtain the output feature map D 1 ;

[0016] Step 4.5: transform the feature map D 1 Input the downsampling fusion module of the malicious traffic classification model to obtain the output feature map E 1 ;

[0017] Step 4.6, the feature map E 1 The global average pooling layer, fully connected layer, and Softmax activation function layer of the malicious traffic classification model are input in sequence to obtain the classification result.

[0018] Furthermore, the channel fusion module is composed of an initial feature extraction module, a parallel channel expansion module and a channel contraction module. The initial feature extraction module is composed of a convolutional layer, a BN layer and a Relu layer in sequence. The parallel channel expansion module is composed of branch 1 and branch 2. Branch 1 is composed of a convolutional layer, a BN layer and a Relu layer in sequence. Branch 2 is composed of a convolutional layer, a BN layer and a Relu layer in sequence. The channel contraction module is composed of a deep convolutional layer DWConv, a BN layer, a Relu layer, a convolutional layer, a BN layer and a Relu layer in sequence.

[0019] Furthermore, the multi-layer feature fusion module is composed of a position feature extraction module and a multi-scale feature extraction module. The position feature extraction module is composed of a convolutional layer, a BN layer, a Relu layer, a convolutional layer, a BN layer, a Relu layer and a CA attention module in sequence. The multi-scale feature extraction module is composed of branch 1, branch 2 and branch 3. Branch 1 is composed of a deep convolutional layer DWConv, a BN layer, a Relu layer, a convolutional layer, a BN layer and a Relu layer in sequence. Branch 2 is composed of a deep convolutional layer DWConv, a BN layer, a Relu layer, a convolutional layer, a BN layer, a Relu layer, a deep convolutional layer DWConv, a BN layer, a Relu layer, a convolutional layer, a BN layer, and a Relu layer in sequence. Branch 3 is composed of a pooling layer, a convolutional layer, a BN layer and a Relu layer in sequence.

[0020] Furthermore, the downsampling fusion module is composed of branch 1, branch 2 and branch 3. Branch 1 is composed of convolutional layer, BN layer, Relu layer and average pooling layer in sequence. Branch 2 is composed of convolutional layer, BN layer, Relu layer and maximum pooling layer in sequence. Branch 3 is composed of deep convolutional layer DWConv, BN layer, Relu layer, convolutional layer, BN layer and Relu layer in sequence.

[0021] Further, step 4.1 includes the following steps:

[0022] Step 4.1.1, input the grayscale image into the initial feature extraction module to obtain the output feature map A1 1 ;

[0023] Step 4.1.2, A1 1 Input parallel channel expansion module branch 1 to get output feature map A2 1 , A1 1 Input parallel channel expansion module branch 2 to get output feature map A3 1 , the feature map A2 1 And feature map A3 1 Perform the splicing operation to obtain feature map A4 1 ;

[0024] Step 4.1.3, feature map A4 1 In the input channel contraction module, the output feature map A is obtained 1 .

[0025] Further, step 4.2 includes the following steps:

[0026] Step 4.2.1: transform feature map A 1 Input position feature extraction module, get output feature map A1 2 ;

[0027] Step 4.2.2, feature map A12 Input branch 1 of the multi-scale feature extraction module to obtain the output feature map A2 2 , the feature map A1 2 Input branch 2 of the multi-scale feature extraction module to obtain the output feature map A3 2 , the feature map A1 2 Input branch 3 of the multi-scale feature extraction module to obtain the output feature map A4 2 , the feature map A2 2 、A3 2 and A4 2 Perform the splicing operation to obtain feature map A5 2 ;

[0028] Step 4.2.3, feature map A 1 、A1 2 and A5 2 Perform the addition operation to obtain the feature map B 1 .

[0029] Further, step 4.3 includes the following steps:

[0030] Step 4.3.1, feature map B 1 Input branch 1 of the downsampling fusion module to obtain the output feature map B1 1 , the feature map B 1 Input branch 2 of the downsampling fusion module to obtain the output feature map B2 1 , the feature map B 1 Input branch 3 of the downsampling fusion module to obtain the output feature map B3 1 , the feature map B1 1 、B2 1 and B3 1 Perform the addition operation to obtain the feature map C 1 .

[0031] Further, step 4.4 includes the following steps:

[0032] Step 4.4.1, transform the feature map C 1 Input position feature extraction module, get output feature map C1 1 ;

[0033] Step 4.4.2, feature map C1 1 Input branch 1 of the multi-scale feature extraction module to obtain the output feature map C2 1 , the feature map C1 1 Input branch 2 of the multi-scale feature extraction module to obtain the output feature map C3 1 , the feature map C1 1 Input branch 3 of the multi-scale feature extraction module to obtain the output feature map C41 , the feature map C2 1 、C3 1 and C4 1 Perform the splicing operation to obtain the feature map C5 1 ;

[0034] Step 4.4.3, transform the feature map C 1 、C1 1 and C5 1 Perform the addition operation to obtain the feature map D 1 .

[0035] Further, step 4.5 includes the following steps:

[0036] Step 4.5.1: transform the feature map D 1 Input branch 1 of the downsampling fusion module to obtain the output feature map D1 1 , the feature map D 1 Input branch 2 of the downsampling fusion module to obtain the output feature map D2 1 , the feature map D 1 Input branch 3 of the downsampling fusion module to obtain the output feature map D3 1 , the feature map D1 1 、D2 1 and D3 1 Perform the addition operation to obtain the feature map E 1 .

[0037] The beneficial effect of the present invention is that the present invention proposes a malicious traffic classification method based on feature fusion according to the characteristics of traffic images. The malicious traffic classification model proposed by the method includes a channel fusion module, a multi-layer feature fusion module and a downsampling fusion module. The channel fusion module is composed of an initial feature extraction module, a parallel channel expansion module and a channel contraction module. The initial feature extraction module uses a convolution layer to extract shallow features. The parallel channel expansion module can increase the number of feature map channels and increase feature information. The channel contraction module uses deep convolution to extract feature information and reduces the number of feature maps through convolution, thereby improving the stability and detection performance of the model and reducing the complexity of the model. The multi-layer feature fusion module is composed of a position feature extraction module and a multi-scale feature extraction module. The position feature extraction module can extract texture features of traffic images and suppress noise. The multi-scale feature extraction module can simultaneously extract features of different scales at the same level, thereby increasing the receptive field and capturing the information of the image more comprehensively. The deep convolution and the convolution of size 1 can reduce the calculation amount of the model. In addition, the multi-layer feature fusion module adds and fuses the features of multiple different layers, thereby improving the expression ability and performance of the model. The downsampling fusion module doubles the number of feature maps to prevent the loss of useful feature information. In addition, the module can fuse the features obtained by multiple pooling operations, enriching the feature information and improving the model's ability to understand traffic images. Through the combination of various modules, the malicious traffic classification method based on feature fusion can effectively extract and fuse multiple features of traffic images, improving the performance of malicious traffic classification. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 A flowchart of the steps of the classification method of the present invention;

[0039] Figure 2 is a structural diagram of the channel fusion module in the present invention;

[0040] Figure 3 It is a structural diagram of the multi-layer feature fusion module in the present invention;

[0041] Figure 4 It is a structural diagram of the downsampling fusion module in the present invention. DETAILED DESCRIPTION

[0042] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] A malicious traffic classification method based on feature fusion, characterized in that the classification method comprises the following steps:

[0044] Step 1, preprocess the pcap traffic packets containing malicious traffic packets and benign traffic packets, wherein the steps of pcap traffic packet preprocessing are: divide the pcap traffic packets into multiple session data according to source IP, source port, destination IP, destination port and transport layer protocol, delete duplicate data and blank data in the session data, and delete information that may affect the traffic classification results (such as mac address) to obtain traffic data.

[0045] Step 2, converting the preprocessed pcap traffic packet into a grayscale image, wherein the pcap traffic packet is preprocessed to obtain traffic data, the traffic data is intercepted at a fixed length of 1024 bytes, each byte of the intercepted traffic data is converted into a decimal number, and then the converted 1024 decimal numbers are converted into a two-dimensional array, and finally the two-dimensional array is converted into the grayscale image, so the grayscale image size is 32×32, and the number of channels is 1.

[0046] Step 3: Build a malicious traffic classification model, which includes a channel fusion module, a multi-layer feature fusion module, a downsampling fusion module, a global average pooling layer, a fully connected layer and a Softmax activation function layer.

[0047] Step 4: Input the grayscale image of step 2 into the malicious traffic classification model to obtain the classification result.

[0048] Step 4 includes the following steps:

[0049] Step 4.1: Input the grayscale image into the channel fusion module of the malicious traffic classification model to obtain the output feature map A. 1 ;

[0050] Step 4.2: transform feature map A 1 Input the multi-layer feature fusion module of the malicious traffic classification model to obtain the output feature map B 1 ;

[0051] Step 4.3, feature map B 1 Input the downsampling fusion module of the malicious traffic classification model to obtain the output feature map C 1 ;

[0052] Step 4.4, the feature map C 1 Input the multi-layer feature fusion module of the malicious traffic classification model to obtain the output feature map D 1 ;

[0053] Step 4.5: transform the feature map D 1Input the downsampling fusion module of the malicious traffic classification model to obtain the output feature map E 1 ;

[0054] Step 4.6, the feature map E 1 The global average pooling layer, fully connected layer, and Softmax activation function layer of the malicious traffic classification model are input in sequence to obtain the classification result.

[0055] Step 4.1 includes the following steps:

[0056] Step 4.1.1, the channel fusion module of the malicious traffic classification model consists of an initial feature extraction module, a parallel channel expansion module, and a channel contraction module;

[0057] Step 4.1.2: The initial feature extraction module is composed of a convolutional layer, a BN layer, and a ReLU layer with a convolution kernel size of 3, a step size of 2, a padding of 1, and a channel number of 32. The grayscale image is input into the initial feature extraction module to obtain an output feature map A1 with a size of 32×16×16. 1 ;

[0058] Step 4.1.3, the parallel channel expansion module consists of branch 1 and branch 2. Branch 1 consists of a convolutional layer with a kernel size of 1, a step size of 1, no padding, and 96 channels, a BN layer, and a ReLU layer. 1 The output feature map A2 with a size of 96×16×16 is obtained from the input branch 1 1 , branch 2 is composed of a convolutional layer with a kernel size of 1, a stride of 1, no padding, and 96 channels, a BN layer, and a ReLU layer. 1 The output feature map A3 with a size of 96×16×16 is obtained from the input branch 2 1 , the feature map A2 1 And feature map A3 1 Perform the splicing operation to obtain the feature map A4 with a size of 192×16×16 1 ;

[0059] Step 4.1.4, the channel shrinkage module is composed of a deep convolutional layer DWConv with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 192, a BN layer, a Relu layer, a convolutional layer with a convolution kernel size of 1, a step size of 1, no padding, and a channel number of 32, a BN layer, and a Relu layer. The feature map A4 1 In the input channel contraction module, an output feature map A with a size of 32×16×16 is obtained 1 .

[0060] Step 4.2 includes the following steps:

[0061] Step 4.2.1, the multi-layer feature fusion module of the malicious traffic classification model is composed of a location feature extraction module and a multi-scale feature extraction module;

[0062] Step 4.2.2, the position feature extraction module is composed of a convolution layer with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 32, a BN layer, a Relu layer, a convolution layer with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 32, a BN layer, a Relu layer, and a CA attention module. 1 Input position feature extraction module, get the output feature map A1 with size of 32×16×16 2 ;

[0063] Step 4.2.3, the multi-scale feature extraction module consists of branch 1, branch 2 and branch 3. Branch 1 is composed of a deep convolution layer DWConv with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 32, a BN layer, a Relu layer, a convolution layer with a convolution kernel size of 1, a step size of 1, no padding, and a channel number of 12, a BN layer, and a Relu layer. The feature map A1 is 2 Input branch 1 to get the output feature map A2 of size 12×16×16 2 , branch 2 is composed of a deep convolutional layer DWConv with a convolution kernel size of 3, a stride of 1, a padding of 1, and a number of channels of 32, a BN layer, a Relu layer, a convolutional layer with a convolution kernel size of 1, a stride of 1, no padding, and a number of channels of 12, a BN layer, a Relu layer, a deep convolutional layer DWConv with a convolution kernel size of 3, a stride of 1, a padding of 1, and a number of channels of 12, a BN layer, a Relu layer, a convolutional layer with a convolution kernel size of 1, a stride of 1, no padding, and a number of channels of 12, a BN layer, and a Relu layer, and the feature map A1 is constructed. 2 Input branch 2 to get the output feature map A3 of size 12×16×16 2 , branch 3 is composed of a pooling layer with a pooling window of 2, a convolution layer with a convolution kernel size of 1, a step size of 1, no padding, and a channel number of 8, a BN layer, and a ReLU layer. 2 Input branch 3 to get the output feature map A4 of size 8×16×16 2 , the feature map A2 2 、A3 2 and A4 2 Perform the splicing operation to obtain the feature map A5 with a size of 32×16×16 2 ;

[0064] Step 4.2.4, feature map A 1 、A1 2 and A5 2Perform the addition operation to obtain a feature map B with a size of 32×16×16 1 .

[0065] Step 4.3 includes the following steps:

[0066] 4.3.1, the downsampling fusion module of the malicious traffic classification model consists of branches 1, 2 and 3. Branch 1 is composed of a convolution layer with a convolution kernel size of 1, a step size of 1, no padding, and 64 channels, a BN layer, a ReLU layer, and an average pooling layer with a pooling window of 2. 1 Input branch 1 to get the output feature map B1 of size 64×8×8 1 , branch 2 is composed of a convolution layer with a kernel size of 1, a step size of 1, no padding, a channel number of 64, a BN layer, a ReLU layer, and a maximum pooling layer with a pooling window of 2. 1 Input branch 2 to get the output feature map B2 of size 64×8×8 1 , branch 3 is composed of a convolution layer DWConv with a kernel size of 3, a stride of 2, a padding of 1, and a channel number of 32, a BN layer, a Relu layer, a convolution layer with a kernel size of 1, a stride of 1, no padding, and a channel number of 64, a BN layer, and a Relu layer. 1 Input branch 3 to get the output feature map B3 of size 64×8×8 1 , the feature map B1 1 、B2 1 and B3 1 Perform the addition operation to obtain a feature map C with a size of 64×8×8 1 .

[0067] Step 4.4 includes the following steps:

[0068] Step 4.4.1, the multi-layer feature fusion module of the malicious traffic classification model is composed of a location feature extraction module and a multi-scale feature extraction module;

[0069] Step 4.4.2, the position feature extraction module is composed of a convolution layer with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 64, a BN layer, a Relu layer, a convolution layer with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 64, a BN layer, a Relu layer, and a CA attention module. 1 Input position feature extraction module, get the output feature map C1 with size of 64×8×8 1 ;

[0070] Step 4.4.3, the multi-scale feature extraction module consists of branch 1, branch 2 and branch 3. Branch 1 is composed of a deep convolution layer DWConv with a convolution kernel size of 3, a step size of 1, a padding of 1, and a channel number of 64, a BN layer, a Relu layer, a convolution layer with a convolution kernel size of 1, a step size of 1, no padding, and a channel number of 24, a BN layer, and a Relu layer. The feature map C1 1 Input branch 1 to get the output feature map C2 of size 24×8×8 1 , branch 2 is composed of a deep convolutional layer DWConv with a convolution kernel size of 3, a stride of 1, a padding of 1, and a number of channels of 64, a BN layer, a Relu layer, a convolutional layer with a convolution kernel size of 1, a stride of 1, no padding, and a number of channels of 24, a BN layer, a Relu layer, a deep convolutional layer DWConv with a convolution kernel size of 3, a stride of 1, a padding of 1, and a number of channels of 24, a BN layer, a Relu layer, a convolutional layer with a convolution kernel size of 1, a stride of 1, no padding, and a number of channels of 24, a BN layer, and a Relu layer, and the feature map C1 is constructed. 1 Input branch 2 to get the output feature map C3 of size 24×8×8 1 , branch 3 is composed of a pooling layer with a pooling window of 2, a convolution layer with a convolution kernel size of 1, a step size of 1, no padding, and a channel number of 16, a BN layer, and a ReLU layer. 1 Input branch 3 to get the output feature map C4 of size 16×8×8 1 , the feature map C2 1 、C3 1 and C4 1 Perform the concatenation operation to obtain a feature map C5 of size 64×8×8 1 ;

[0071] Step 4.4.4, transform the feature map C 1 、C1 1 and C5 1 Perform the addition operation to obtain a feature map D of size 64×8×8 1 .

[0072] Step 4.5 includes the following steps:

[0073] 4.5.1, the downsampling fusion module of the malicious traffic classification model consists of branches 1, 2 and 3. Branch 1 consists of a convolution layer with a kernel size of 1, a step size of 1, no padding, and a channel number of 128, a BN layer, a ReLU layer, and an average pooling layer with a pooling window of 2. The feature map D 1 Input branch 1 to get the output feature map D1 of size 128×4×4 1, branch 2 is composed of a convolution layer with a kernel size of 1, a step size of 1, no padding, a channel number of 128, a BN layer, a ReLU layer, and a maximum pooling layer with a pooling window of 2. The feature map D 1 Input branch 2 to get the output feature map D2 of size 128×4×4 1 , branch 3 is composed of a convolution layer DWConv with a kernel size of 3, a stride of 2, a padding of 1, and a channel number of 64, a BN layer, a Relu layer, a convolution layer with a kernel size of 1, a stride of 1, no padding, and a channel number of 128, a BN layer, and a Relu layer, and the feature map D 1 Input branch 3 to get the output feature map D3 of size 128×4×4 1 , the feature map D1 1 、D2 1 and D3 1 Perform the addition operation to obtain a feature map E with a size of 128×4×4 1 .

[0074] Step 4.6 includes the following steps:

[0075] The feature map E 1 Input the global average pooling layer of the malicious traffic classification model to obtain a global feature map of size 128×1×1;

[0076] Global average pooling layer, the global average pooling layer is used for feature map E 1 The average operation is performed on each channel of the feature vector to generate a one-dimensional vector with the same number of feature channels. This operation has no parameters to be optimized, so it helps prevent overfitting;

[0077] Input the global feature map into the fully connected layer;

[0078] Fully connected layer,The fully connected layer accepts the output from the global average pooling layer and combines it with the category discrimination information.,The fully connected layer contains two neurons, each corresponding to the benign / malicious traffic category.

[0079] The output of the fully connected layer is input into the Softmax activation function layer and mapped into the probability values ​​of the two categories. The one with the largest probability value is taken as the final classification result.

[0080] The above-mentioned embodiments only express several implementation methods of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A malicious traffic classification method based on feature fusion, characterized in that: The classification method includes the following steps: Step 1, pre-processing the pcap traffic packets containing malicious traffic packets and benign traffic packets; Step 2, convert the preprocessed pcap traffic packet into a grayscale image; Step 3, building a malicious traffic classification model, the malicious traffic classification model includes a channel fusion module, a multi-layer feature fusion module, a downsampling fusion module, a global average pooling layer, a fully connected layer and a Softmax activation function layer; Step 4: Input the grayscale image of step 2 into the malicious traffic classification model to obtain the classification result.

2. The malicious traffic classification method based on feature fusion as claimed in claim 1 is characterized in that: Step 4 includes the following steps: Step 4.1: Input the grayscale image into the channel fusion module of the malicious traffic classification model to obtain the output feature map A. 1 ; Step 4.2: transform feature map A 1 Input the multi-layer feature fusion module of the malicious traffic classification model to obtain the output feature map B 1 ; Step 4.3, feature map B 1 Input the downsampling fusion module of the malicious traffic classification model to obtain the output feature map C 1 ; Step 4.4, the feature map C 1 Input the multi-layer feature fusion module of the malicious traffic classification model to obtain the output feature map D 1 ; Step 4.5: transform the feature map D 1 Input the downsampling fusion module of the malicious traffic classification model to obtain the output feature map E 1 ; Step 4.6, the feature map E 1 The global average pooling layer, fully connected layer, and Softmax activation function layer of the malicious traffic classification model are input in sequence to obtain the classification result.

3. The malicious traffic classification method based on feature fusion as claimed in claim 2 is characterized in that: The channel fusion module is composed of an initial feature extraction module, a parallel channel expansion module and a channel contraction module. The initial feature extraction module is composed of a convolutional layer, a BN layer and a Relu layer in sequence. The parallel channel expansion module is composed of branch 1 and branch 2. Branch 1 is composed of a convolutional layer, a BN layer and a Relu layer in sequence. Branch 2 is composed of a convolutional layer, a BN layer and a Relu layer in sequence. The channel contraction module is composed of a deep convolutional layer DWConv, a BN layer, a Relu layer, a convolutional layer, a BN layer and a Relu layer in sequence.

4. The malicious traffic classification method based on feature fusion as claimed in claim 2 is characterized in that: The multi-layer feature fusion module is composed of a position feature extraction module and a multi-scale feature extraction module. The position feature extraction module is composed of a convolutional layer, a BN layer, a Relu layer, a convolutional layer, a BN layer, a Relu layer and a CA attention module in sequence. The multi-scale feature extraction module is composed of branch 1, branch 2 and branch 3. Branch 1 is composed of a deep convolutional layer DWConv, a BN layer, a Relu layer, a convolutional layer, a BN layer and a Relu layer in sequence. Branch 2 is composed of a deep convolutional layer DWConv, a BN layer, a Relu layer, a convolutional layer, a BN layer, a Relu layer, a deep convolutional layer DWConv, a BN layer, a Relu layer, a convolutional layer, a BN layer, and a Relu layer in sequence. Branch 3 is composed of a pooling layer, a convolutional layer, a BN layer and a Relu layer in sequence.

5. The malicious traffic classification method based on feature fusion as claimed in claim 2 is characterized in that: The downsampling fusion module consists of branch 1, branch 2 and branch 3. Branch 1 consists of convolutional layer, BN layer, Relu layer and average pooling layer in sequence. Branch 2 consists of convolutional layer, BN layer, Relu layer and maximum pooling layer in sequence. Branch 3 consists of deep convolutional layer DWConv, BN layer, Relu layer, convolutional layer, BN layer and Relu layer in sequence.

6. The malicious traffic classification method based on feature fusion as claimed in claim 3 is characterized in that: Step 4.1 includes the following steps: Step 4.1.1, input the grayscale image into the initial feature extraction module to obtain the output feature map A1 1 ; Step 4.1.2, A1 1 Input parallel channel expansion module branch 1 to get output feature map A2 1 , A1 1 Input parallel channel expansion module branch 2 to get output feature map A3 1 , the feature map A2 1 And feature map A3 1 Perform the splicing operation to obtain feature map A4 1 ; Step 4.1.3, feature map A4 1 In the input channel contraction module, the output feature map A is obtained 1 .

7. The method for classifying malicious traffic based on feature fusion as claimed in claim 4, characterized in that: Step 4.2 includes the following steps: Step 4.2.1: transform feature map A 1 Input position feature extraction module, get output feature map A1 2 ; Step 4.2.2, feature map A1 2 Input branch 1 of the multi-scale feature extraction module to obtain the output feature map A2 2 , the feature map A1 2 Input branch 2 of the multi-scale feature extraction module to obtain the output feature map A3 2 , the feature map A1 2 Input branch 3 of the multi-scale feature extraction module to obtain the output feature map A4 2 , the feature map A2 2 、A3 2 and A4 2 Perform the splicing operation to obtain feature map A5 2 ; Step 4.2.3, feature map A 1 、A1 2 and A5 2 Perform the addition operation to obtain the feature map B 1 .

8. The malicious traffic classification method based on feature fusion as claimed in claim 5 is characterized in that: Step 4.3 includes the following steps: Step 4.3.1, feature map B 1 Input branch 1 of the downsampling fusion module to obtain the output feature map B1 1 , the feature map B 1 Input branch 2 of the downsampling fusion module to obtain the output feature map B2 1 , the feature map B 1 Input branch 3 of the downsampling fusion module to obtain the output feature map B3 1 , the feature map B1 1 、B2 1 and B3 1 Perform the addition operation to obtain the feature map C 1 .

9. The malicious traffic classification method based on feature fusion as claimed in claim 4 is characterized in that: Step 4.4 includes the following steps: Step 4.4.1, transform the feature map C 1 Input position feature extraction module, get output feature map C1 1 ; Step 4.4.2, feature map C1 1 Input branch 1 of the multi-scale feature extraction module to obtain the output feature map C2 1 , the feature map C1 1 Input branch 2 of the multi-scale feature extraction module to obtain the output feature map C3 1 , the feature map C1 1 Input branch 3 of the multi-scale feature extraction module to obtain the output feature map C4 1 , the feature map C2 1 、C3 1 and C4 1 Perform the splicing operation to obtain the feature map C5 1 ; Step 4.4.3, transform the feature map C 1 、C1 1 and C5 1 Perform the addition operation to obtain the feature map D 1 .

10. The method for classifying malicious traffic based on feature fusion according to claim 5, characterized in that: Step 4.5 includes the following steps: Step 4.5.1: transform the feature map D 1 Input branch 1 of the downsampling fusion module to obtain the output feature map D1 1 , the feature map D 1 Input branch 2 of the downsampling fusion module to obtain the output feature map D2 1 , the feature map D 1 Input branch 3 of the downsampling fusion module to obtain the output feature map D3 1 , the feature map D1 1 、D2 1 and D3 1 Perform the addition operation to obtain the feature map E 1 .

Images