CNN (Convolutional Neural Network) and Swin-Transform malicious encrypted traffic detection method and system

Abstract

The invention discloses a method and a system for detecting malicious encrypted traffic of a CNN (Convolutional Neural Network) and a Swin-Transform, and relates to the technical field of network security, comprising the following steps: preprocessing encrypted traffic data, and dividing a preprocessed encrypted traffic data set into a plurality of subsets; carrying out feature extraction on the preprocessed data by utilizing a CNN (Convolutional Neural Network) and a Swindow-Transform, and carrying out feature fusion; and inputting the fused features into a full connection layer, processing and outputting a detection result. Malicious behaviors can be effectively detected without decrypting the traffic, so that the data privacy is protected and the decryption complexity is reduced; the CNN is combined to extract the local features and the Swin Transform is combined to extract the global features, so that the multi-dimensional features in the traffic can be comprehensively captured, and the detection precision and efficiency are remarkably improved. Meanwhile, the model has strong robustness and generalization ability, and can still maintain efficient malicious traffic identification in a complex network environment.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and system for detecting malicious encrypted traffic using CNN and Swin-Transformer. Background Art

[0002] With the rapid development of Internet technology, network security issues have become increasingly prominent. In order to protect data security and privacy, data encryption transmission has become one of the important means to deal with network security threats. However, while encryption technology protects the security of user data, it also increases the difficulty of traffic identification, bringing new challenges to network security management. For example, network attackers can use encrypted communication protocols to bypass firewalls and intrusion detection systems, thereby evading the monitoring and interception of traditional network security detection methods and carrying out covert malicious activities.

[0003] Malicious encrypted traffic detection technology is a technology that classifies encrypted normal traffic and malicious traffic, which can help analyze and monitor network traffic. With the rapid development of traffic encryption technology, the detection technology of encrypted malicious traffic is also constantly advancing.

[0004] First, the accuracy of the detection method based on decryption is relatively high because the method analyzes the payload content. However, since it involves decryption operations, which will cause user privacy leakage and destroy the end-to-end structure, this method is not widely used.

[0005] In recent years, machine learning technology has achieved good results in classification problems. Many researchers have proposed machine learning-based methods to solve the problem of encrypted traffic classification, mainly focusing on the selection of machine learning algorithms, such as C4.5 decision tree algorithm, SVM algorithm (support vector machine), LR algorithm (logistic regression), etc. Machine learning-based methods can be applied to malicious encrypted traffic detection, but these methods face challenges such as difficulty in feature extraction and insufficient model generalization when dealing with such problems. Their performance depends largely on feature engineering designed by experts, which greatly limits their versatility.

[0006] Due to the rapid development of deep learning technology, researchers have begun to apply deep learning technology to the field of network malicious traffic detection, and establish deep learning models to train pre-processed network traffic to automatically select more essential and effective features. Currently, common encrypted traffic classification based on deep learning algorithms include CNN (convolutional neural network), LSTM (long short-term memory network), SAE (sparse autoencoder), etc. However, these deep learning-based models are limited by the inherent neural network architecture, only consider the characteristics of the data itself, can only independently analyze single traffic features, ignore the correlation between events, lack of global information of the network, resulting in poor robustness of the system. Summary of the invention

[0007] The purpose of this section is to summarize some aspects of embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the specification abstract and the invention title of this application to avoid blurring the purpose of this section, the specification abstract and the invention title, and such simplifications or omissions cannot be used to limit the scope of the present invention.

[0008] In view of the above-mentioned problems, the present invention is proposed.

[0009] Therefore, the technical problems solved by the present invention are: traditional detection methods rely on manual feature design and are difficult to capture complex encrypted traffic patterns; single local or global feature extraction methods have limitations and cannot fully characterize traffic characteristics.

[0010] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0011] In a first aspect, the present invention provides a malicious encrypted traffic detection method using CNN and Swin-Transformer, which comprises:

[0012] Preprocessing the encrypted traffic data, and dividing the preprocessed encrypted traffic data set into multiple subsets;

[0013] Use CNN and Swin-Transformer to extract features from preprocessed data and perform feature fusion;

[0014] The fused features are input into the fully connected layer for processing and output of the detection results.

[0015] As a preferred solution of the malicious encrypted traffic detection method of CNN and Swin-Transformer of the present invention, wherein: the preprocessing includes data conversion, data standardization and image size adjustment;

[0016] The data conversion includes converting the encrypted traffic data into an image;

[0017] The data standardization includes performing standardization processing on the converted image;

[0018] The adjusting the image size includes adjusting the size of the image to match the size of the input layer.

[0019] As a preferred solution of the malicious encrypted traffic detection method of CNN and Swin-Transformer of the present invention, wherein: dividing into multiple subsets includes each subset containing a different number of samples for training and verifying the performance of the model;

[0020] In each iteration, one subset is selected as the validation set and the remaining subsets are used as the training set.

[0021] As a preferred solution of the malicious encrypted traffic detection method of CNN and Swin-Transformer described in the present invention, wherein: the feature extraction includes CNN feature extraction and Swin-Transformer feature extraction.

[0022] As a preferred solution of the malicious encrypted traffic detection method of CNN and Swin-Transformer described in the present invention, the CNN feature extraction includes using a convolution layer to perform a convolution operation on the preprocessed image to extract local features.

[0023] The Swin-Transformer feature extraction includes dividing the input image into non-overlapping image blocks, converting each image block into the input format of Swin-Transformer through Patch Partition; extracting features from the local window area using W-MSA; and performing global feature extraction in the case of cross-window through SW-MSA;

[0024] The feature full fusion includes superimposing the output feature map of CNN and the output feature map of Swin Transformer, and integrating the features extracted by the two models.

[0025] As a preferred solution of the malicious encrypted traffic detection method of CNN and Swin-Transformer of the present invention, the formula for extracting local window area features is expressed as:

[0026] Q,K,V=Linear9F prev ,d k ),

[0027]

[0028] F W-MSA =Linear(F prev ,d k )Attention9Q,K,V)

[0029] Among them, Q represents the query vector, K represents the key vector, V represents the value vector, and F prev represents the input features of the previous layer, d k Indicates the dimension of the query / key vector, Linear(F prev ,d k ) represents linear transformation, SoftMax represents normalization function, Attention(Q,K,V) represents self-attention mechanism, QK Trepresents the transposed dot product of the query vector and the key vector, represents the scaled dot product similarity, F W-MSA Represents the output features of the self-attention mechanism within the window;

[0030] The formula for feature fusion is expressed as:

[0031] F fused =F CNN +F Swin

[0032] Among them, F fused represents the fused features, F CNN represents the features extracted from CNN, F Swin Represents the features extracted from Swin-Transformer.

[0033] As a preferred solution of the malicious encrypted traffic detection method of CNN and Swin-Transformer of the present invention, the output detection result includes: the output layer receives the encrypted traffic data after feature fusion through the fully connected layer; after the fully connected layer, the softmax activation function is applied to output the detection result, and the formula is expressed as:

[0034] F fc =Linear(F fused ,d out )

[0035] P(class)=SoftMax(F fc )

[0036] Among them, Linear represents linear transformation, F fc represents the output features of the fully connected layer, F fused represents the fused features, d out Indicates the output dimension.

[0037] In a second aspect, the present invention provides a malicious encrypted traffic detection system based on CNN and Swin-Transformer, which includes:

[0038] A data processing module pre-processes the encrypted traffic data and divides the pre-processed encrypted traffic data set into multiple subsets;

[0039] The feature fusion module uses CNN and Swin-Transformer to extract features from the preprocessed data and perform feature fusion;

[0040] The detection module inputs the fused features into the fully connected layer, processes them and outputs the detection results.

[0041] In a third aspect, the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the processor executes the computer program, the steps of the malicious encrypted traffic detection method of CNN and Swin-Transformer are implemented.

[0042] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, the steps of a malicious encrypted traffic detection method of CNN and Swin-Transformer are implemented.

[0043] Compared with the prior art, the beneficial effects of the present invention are that malicious behavior can be effectively detected without decrypting traffic, which protects data privacy and reduces the complexity of decryption; combining CNN to extract local features and Swin Transformer to extract global features, it can fully capture the multi-dimensional features in the traffic and significantly improve the accuracy and efficiency of detection. At the same time, the model has strong robustness and generalization capabilities, and can still maintain efficient malicious traffic identification in complex network environments. In addition, the processing process of large-scale encrypted traffic data is optimized through preprocessing operations such as data conversion, standardization, and resizing. Finally, feature fusion and cross-validation technology further improve the performance of the model and ensure the accuracy and stability of detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0045] Figure 1 A method flow chart of a malicious encrypted traffic detection method and system using CNN and Swin-Transformer provided in one embodiment of the present invention;

[0046] Figure 2 A Swin-Transformer model structure diagram of a malicious encrypted traffic detection method and system using CNN and Swin-Transformer provided in one embodiment of the present invention;

[0047] Figure 3 An overall schematic diagram of the malicious encrypted traffic classification model architecture of a malicious encrypted traffic detection method and system using CNN and Swin-Transformer provided in one embodiment of the present invention. DETAILED DESCRIPTION

[0048] In order to make the above-mentioned purposes, features and advantages of the present invention more understandable, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0049] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, which is only to describe the distinction mode adopted by the objects of the same attributes when describing in the embodiments of the present application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0050] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0051] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0052] Example 1, reference Figure 1-Figure 3 , which is the first embodiment of the present invention, and this embodiment provides a malicious encrypted traffic detection method based on CNN and Swin-Transformer.

[0053] Swin Transformer is a hierarchical Transformer model. The Swin Transformer model structure is as follows Figure 1As shown in the figure, it realizes hierarchical extraction of image features and global context modeling by introducing local window self-attention mechanism and shifted window self-attention mechanism. Specifically, Swin Transformer first divides the input image into non-overlapping image blocks and converts the image blocks into sequences through a linear embedding layer. Then, these sequences are fed into the basic modules of Swin Transformer, namely W-MSA and SW-MSA. W-MSA calculates self-attention within non-overlapping windows, while SW-MSA allows information interaction across windows through a shifted window mechanism. This hierarchical structure enables Swin Transformer to effectively process images of different scales, and its computational complexity is linearly related to the image size.

[0054] In the field of malicious encrypted traffic analysis, image data usually has a high resolution but a relatively small size. In this scenario, directly applying the Swin Transformer model may lose key local feature information due to the downsampling process. To address this challenge, this patent proposes an innovative solution, which is to combine the output results of the convolutional neural network with the Swin Transformer. The core idea of ​​this method is to achieve a comprehensive and detailed extraction of traffic image features by integrating the hierarchical feature extraction capability of Swin Transformer with the advantages of convolutional neural networks in capturing local features, so as to improve the accuracy and robustness of the model in malicious traffic classification and detection tasks.

[0055] The model architecture proposed in this patent is an innovative hybrid model that combines the deep feature extraction capability of Swin Transformer with the local feature recognition capability of CNN to achieve accurate classification of malicious encrypted traffic data. Figure 2 This is an overall schematic diagram of the malicious encrypted traffic classification model architecture based on CNN and Swin Transformer described in the present invention.

[0056] A method flow chart of a malicious encrypted traffic detection method and system based on CNN and Swin-Transformer, including:

[0057] S1: preprocess the encrypted traffic data, and divide the preprocessed encrypted traffic data set into multiple subsets.

[0058] Preprocessing includes data conversion, data normalization, and image resizing.

[0059] Convert the original encrypted traffic data into grayscale or color images and adjust the image size to suit the model input requirements. The purpose of standardization is to ensure the consistency and clarity of the data, thereby laying a solid foundation for model training and ensuring the validity and accuracy of the model input.

[0060] Furthermore, the dataset is divided into multiple subsets, each containing a different number of samples, for training and validating the performance of the model. Then, in each iteration, one subset is selected as the validation set, and the remaining subsets are used as the training set. The performance of the model is evaluated through the cross-validation set, including indicators such as accuracy and recall, to ensure the performance of the model on unseen data.

[0061] Furthermore, the preprocessing step ensures that the encrypted traffic data can be processed in a way that is suitable for deep learning models. By converting the encrypted traffic into images and standardizing them, the input data is consistent and available in the model. At the same time, subset partitioning introduces training sets and validation sets, so that the model can improve its generalization ability through cross-validation and ensure the application effect in the actual network environment.

[0062] S2: Use CNN and Swin-Transformer to extract features from the preprocessed data and perform feature fusion.

[0063] Use CNN to perform convolution operations on the preprocessed image to extract local features. Apply ReLU activation function and maximum pooling layer to gradually reduce the spatial dimension of the data while increasing the abstract level of the features. The formula of the convolution operation is expressed as:

[0064] F conv =Conv(F prev ,W)+b

[0065] Among them, F conv Represents the output features after convolution, Conv9F prev ,W) represents the convolution operation, F prev It represents the feature map of the previous layer output of the current convolutional layer, W represents the convolution kernel weight, and b represents the bias term.

[0066] Patch Partition is used to divide the image into non-overlapping patches, each containing a fixed number of pixels. A linear embedding layer is applied to each patch to convert the pixel value into a high-dimensional vector as the input of the SwinTransformer model. SwinTransformer uses W-MSA and SW-MSA modules to calculate self-attention in different window configurations to extract local and global features. The calculation formula of W-MSA is:

[0067] Q,K,V=Linear(F prev ,d k ),

[0068]

[0069] F W-MSA =Linear(F prev ,d k )Attention(Q,K,V

[0070] Among them, Q represents the query vector, K represents the key vector, V represents the value vector, and F prev represents the input features of the previous layer, d k Indicates the dimension of the query / key vector, Linear(F prev ,d k ) represents linear transformation, SoftMax represents normalization function, Attention(Q,K,V) represents self-attention mechanism, QK T represents the transposed dot product of the query vector and the key vector, represents the scaled dot product similarity, F W-MSA Represents the output features of the self-attention mechanism within the window.

[0071] The output feature map of CNN is superimposed with the output feature map of Swin Transformer to integrate the features extracted by the two models.

[0072] The formula for feature fusion is expressed as:

[0073] F fused =F CNN +F Swin

[0074] Among them, F fused represents the fused features, F CNN represents the features extracted from CNN, F Swin Represents the features extracted from Swin-Transformer.

[0075] Furthermore, by combining CNN and Swin Transformer to extract local and global features, the model can more comprehensively understand the complex patterns in encrypted traffic. CNN is responsible for extracting local information such as edges and textures, while Swin Transformer can process global contextual information and capture a wider range of patterns and dependencies in traffic. Feature fusion makes the advantages of the two complement each other, greatly improving the detection effect and robustness of the model, and solving the problem of information missing when relying only on local or global features.

[0076] S3: Input the fused features into the fully connected layer, process them and output the detection results.

[0077] The output layer receives the encrypted traffic data after feature fusion through the fully connected layer; after the fully connected layer, the softmax activation function is applied to output the detection result, which is expressed as:

[0078] F fc =Linear(F fused ,d out )

[0079] P(class)=SoftMax(F fc )

[0080] Among them, Linear represents linear transformation, F fc represents the output features of the fully connected layer, F fused represents the fused features, d out Indicates the output dimension.

[0081] class indicates the category to which the currently input encrypted traffic data belongs, including normal traffic and malicious traffic.

[0082] The cross entropy loss function is applied for training and parameter optimization.

[0083] The formula of the cross entropy loss function is expressed as:

[0084]

[0085] Among them, L represents the cross entropy loss function, N represents the total number of samples; P(y i |F fc ) represents the feature F output of a given fully connected layer fc After that, the model predicts that sample i belongs to the true category y i probability.

[0086] When new encrypted traffic data needs to be used for malicious encrypted traffic and abnormal behavior detection, the new data set is input into the trained model, the data is forward calculated, and the classification results are output.

[0087] Furthermore, by inputting the fused features into the fully connected layer and applying the softmax activation function, the present invention can classify the encrypted traffic as malicious or normal traffic. This step simplifies the output mode of the model and provides a highly interpretable detection result through the probability value generated by the softmax function. This result not only reflects the prediction ability of the model, but also provides an efficient solution for application in actual network environments, avoiding the complex rule matching or decryption requirements in traditional methods.

[0088] Embodiment 2 is an embodiment of the present invention, which provides a malicious encrypted traffic detection system based on CNN and Swin-Transformer, including:

[0089] The data processing module pre-processes the encrypted traffic data and divides the pre-processed encrypted traffic data set into multiple subsets.

[0090] The feature fusion module uses CNN and Swin-Transformer to extract features from the preprocessed data and perform feature fusion.

[0091] The detection module inputs the fused features into the fully connected layer, processes them and outputs the detection results.

[0092] Embodiment 3, an embodiment of the present invention, is different from the first two embodiments in that:

[0093] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0094] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0095] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0096] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0097] In Example 4, the test object is a simulated encrypted traffic data set, which contains multiple types of traffic data, including normal traffic and malicious traffic. First, the traffic data is preprocessed to convert the original encrypted traffic into an image format, specifically mapping the traffic data packets into grayscale images in chronological order. After this step is completed, the image is standardized to ensure that the distribution of the input data is uniform and consistent to avoid imbalance of features in the network.

[0098] Next, the preprocessed dataset is divided into multiple subsets, which are divided into training sets and test sets in a ratio of 8:2. In each training process, different subsets are selected for verification to ensure the generalization ability of the model. After that, a convolutional neural network (CNN) is used to extract local features of each image block. CNN can extract low-level features such as local information such as edges and textures. At the same time, Swin-Transformer is used to extract global features of traffic data. The model extracts local context information by segmenting image blocks and applying the window self-attention mechanism (W-MSA), and then extracts global context features in cross-window situations through the shifted window self-attention mechanism (SW-MSA).

[0099] After feature extraction, the local features extracted by CNN and the global features extracted by Swin-Transformer are fused. By superimposing features, local and global features are integrated to enhance classification capabilities. The fused features are input into the fully connected layer and output to the softmax layer after linear transformation. The softmax layer maps the results into probability values ​​of malicious traffic and normal traffic.

[0100] To verify the effectiveness of this method, different encrypted traffic data sets are used in the experiment and compared with traditional detection methods based on rule matching and using only CNN. The experimental results are shown in Table 1.

[0101] Table 1 Experimental data table

[0102]

[0103]

[0104] As can be seen from the above table, the malicious encrypted traffic detection method based on CNN and Swin-Transformer of the present invention is superior to the traditional rule matching detection method and the detection method using CNN alone in all indicators. Taking a data set with a total of 1,000 data as an example, the malicious traffic detection rate of the traditional rule detection method is 75%, the normal traffic detection rate is 70%, and the overall accuracy and F1-score are 72% and 71% respectively. In contrast, using the detection method using only CNN, the detection rate is increased to 85% and 80%, and the accuracy rate reaches 82%, but it is still susceptible to insufficient local features in a complex network environment.

[0105] By combining CNN and Swin-Transformer, the present invention effectively integrates local and global features, and the malicious traffic detection rate is increased to 95%, the normal traffic detection rate is increased to 93%, and the recall rate and F1-score are also 94% respectively. When the data set is increased to 5,000, the present invention still maintains a high detection accuracy rate (94%) and F1-score (91%), while the detection rate of traditional methods is further reduced. This shows that when dealing with large-scale complex encrypted traffic, the generalization ability and robustness of the present invention are significantly better than the existing technology.

[0106] Through experimental comparison, it can be concluded that the innovation of the present invention is reflected in the use of Swin-Transformer's global context feature extraction method, which solves the problem of insufficient local feature extraction of traditional CNN, and significantly improves the accuracy of detection through feature fusion. In addition, the present invention optimizes the data processing process, realizes efficient malicious traffic detection without decrypting the traffic, and reduces false positives and missed positives compared to existing rule-based matching methods. Therefore, the present invention not only has a high detection accuracy, but also has advantages in the efficiency of large-scale data processing, and has a strong practical application value.

[0107] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. The malicious encrypted traffic detection method based on CNN and Swin-Transformer is characterized by: include, Preprocessing the encrypted traffic data, and dividing the preprocessed encrypted traffic data set into multiple subsets; Use CNN and Swin-Transformer to extract features from preprocessed data and perform feature fusion; The fused features are input into the fully connected layer for processing and output of the detection results.

2. The malicious encrypted traffic detection method of CNN and Swin-Transformer as claimed in claim 1, characterized in that: The preprocessing includes data conversion, data standardization and image size adjustment; The data conversion includes converting the encrypted traffic data into an image; The data standardization includes performing standardization processing on the converted image; The adjusting the image size includes adjusting the size of the image to match the size of the input layer.

3. The malicious encrypted traffic detection method of CNN and Swin-Transformer as claimed in claim 2, characterized in that: Dividing into multiple subsets includes that each subset contains a different number of samples for training and verifying the performance of the model; In each iteration, one subset is selected as the validation set and the remaining subsets are used as the training set.

4. The malicious encrypted traffic detection method of CNN and Swin-Transformer as claimed in claim 3, characterized in that: The feature extraction includes CNN feature extraction and Swin-Transformer feature extraction.

5. The malicious encrypted traffic detection method of CNN and Swin-Transformer as claimed in claim 4, characterized in that: The CNN feature extraction includes using a convolution layer to perform a convolution operation on the preprocessed image to extract local features; The Swin-Transformer feature extraction includes dividing the input image into non-overlapping image blocks, converting each image block into the input format of Swin-Transformer through PatchPartition; extracting features from the local window area using W-MSA; and performing global feature extraction in the case of cross-window through SW-MSA; The feature full fusion includes superimposing the output feature map of CNN and the output feature map of Swin Transformer, and integrating the features extracted by the two models.

6. The malicious encrypted traffic detection method of CNN and Swin-Transformer as claimed in claim 5, characterized in that: The formula for extracting local window area features is expressed as: Q,K,V=Linear(F prev ,d k ), F W-MSA =Linear(F prev ,d k )Attention(Q,K,V) Among them, Q represents the query vector, K represents the key vector, V represents the value vector, and F prev represents the input features of the previous layer, d k Indicates the dimension of the query / key vector, Linear(F prev , d k ) represents linear transformation, SoftMax represents normalization function, Attention(Q, K, V) represents self-attention mechanism, QK T represents the transposed dot product of the query vector and the key vector, represents the scaled dot product similarity, F W-MSA Represents the output features of the self-attention mechanism within the window; The formula for feature fusion is expressed as: F fused =F CNN +F Swin Among them, F fused represents the fused features, F CNN represents the features extracted from CNN, F Swin Represents the features extracted from Swin-Transformer.

7. The malicious encrypted traffic detection method of CNN and Swin-Transformer as claimed in claim 6, characterized in that: The output detection result includes: the output layer receives encrypted traffic data after feature fusion through the fully connected layer; After the fully connected layer, the softmax activation function is applied to output the detection result. The formula is expressed as: F f c=Linear(F fused ,d out ) P(class)=SoftMax(F fc ) Among them, Linear represents linear transformation, F fc represents the output features of the fully connected layer, F fused represents the fused features, d out Indicates the output dimension.

8. A malicious encrypted traffic detection system based on CNN and Swin-Transformer, based on the malicious encrypted traffic detection method based on CNN and Swin-Transformer according to any one of claims 1 to 7, characterized in that: A data processing module pre-processes the encrypted traffic data and divides the pre-processed encrypted traffic data set into multiple subsets; The feature fusion module uses CNN and Swin-Transformer to extract features from the preprocessed data and perform feature fusion; The detection module inputs the fused features into the fully connected layer, processes them and outputs the detection results.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the malicious encrypted traffic detection method of CNN and Swin-Transformer described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the malicious encrypted traffic detection method of CNN and Swin-Transformer described in any one of claims 1 to 7 are implemented.

Images