Mobile network environment anonymous app traffic feature identification and classification method

Abstract

The invention discloses a mobile network environment anonymous app traffic feature identification and classification method, which comprises the following steps of: 1, running an anonymous app in a simulator by adopting a tcpdump tool to generate detailed network traffic data; step 2, data preprocessing and feature extraction; step 3, combining a time sequence and a graph structure; and step 4, model training and optimization, wherein the traffic data in the mobile network environment may have the problems of data sparsity and noise. The LSTM can effectively process noise and missing values in data through a memory mechanism of the LSTM, and the GNN can relieve the problem of data sparsity through an information propagation mechanism in a graph structure. The combination of the two can effectively improve the performance of the model under noise and sparse data.

Description

Technical Field

[0001] The present invention belongs to the technical field of the combination of mobile network technology and artificial intelligence, and specifically relates to a method for identifying and classifying anonymous app traffic characteristics in a mobile network environment. Background Art

[0002] Mobile networks have become an integral part of modern society, and mobile applications (Apps) have become essential tools in people's lives. In mobile networks, mobile App traffic accounts for a very large proportion, and this traffic is often transmitted anonymously. The characteristic of anonymous traffic is that it is difficult to identify and classify, which poses a great challenge to network security and management. Therefore, developing a method that can identify and classify anonymous mobile App traffic is crucial to ensure the security and management of mobile networks.

[0003] At present, there have been some studies on anonymous traffic identification and classification. The most common method is the port number-based identification method. This method determines the type of application to which the data packet belongs by detecting the port number of the data packet. However, this method has low accuracy, is easily disguised, and cannot distinguish between different apps of the same type.

[0004] Another common method is the identification method based on traffic statistics. This method determines the type of application to which the data packet belongs by analyzing the statistical characteristics of the traffic (such as traffic size, duration, transmission rate, etc.). However, the accuracy of this method is also low, because the traffic statistics of different apps of the same type may be very similar and difficult to distinguish.

[0005] Some studies have also used deep learning technology to identify and classify anonymous traffic. This method trains neural networks to learn the feature representation of data packets, thereby identifying and classifying anonymous traffic. Compared with traditional methods, deep learning methods are more accurate, but they require a large amount of data and computing resources for training, and the generalization ability of the model is limited.

[0006] In summary, the existing anonymous traffic identification and classification methods have some shortcomings, such as low accuracy, easy to be disguised, difficult to distinguish, etc. Therefore, we need to propose a more intelligent and efficient method to solve these problems and ensure the security and management of mobile networks. Summary of the invention

[0007] In order to solve the shortcomings of the above-mentioned prior art, the present invention proposes an anonymous mobile App traffic feature recognition and classification method based on time series graph neural network, which can more accurately identify and classify anonymous traffic and has high practical value and application prospects.

[0008] The technical solution of the present invention is: a method for identifying and classifying anonymous app traffic characteristics in a mobile network environment, comprising the following steps:

[0009] Step 1: Use the tcpdump tool to run the anonymous application in the simulator to generate detailed network traffic data;

[0010] Step 2, data preprocessing and feature extraction;

[0011] Step 3: Combining time series and graph structure;

[0012] Step 4: Model training and optimization.

[0013] Furthermore, the specific process of step 1 is as follows: through the simulator's diversified data generation mechanism, the comprehensiveness and representativeness of the data are ensured. Each traffic record includes timestamp, traffic size, transmission rate, protocol type, and port number information.

[0014] Furthermore, the specific process of step 1 is as follows: Data cleaning: remove invalid data and outliers to ensure data quality, including missing value processing, outlier detection, and duplicate data deletion; the missing value processing uses mean filling and adopts the formula X i is the data point after filling the missing values, X j is the value of a known data point; outlier detection uses the Z-score method, which represents the number of standard deviations of a data point from the mean, using the formula X is the data point, μ is the mean, and σ is the standard deviation.

[0015] Furthermore, step 2 includes feature extraction: first, time feature extraction, including timestamp and time interval; traffic feature extraction: then the traffic size, transmission rate, and number of packets are extracted; protocol feature extraction includes protocol type and port number, mainly extracting protocols in the TCP / IP protocol suite; finally, statistical features can also be extracted, including calculating the average, maximum, minimum, and standard deviation statistics.

[0016] Further, the specific process of step 3 is:

[0017] First, the LSTM unit contains input gate, forget gate and output gate, which can effectively avoid the gradient vanishing problem in traditional RNN;

[0018] Input gate: i t =σ(W i x t +U i h t-1 +b i )

[0019] Among them, i t is the activation value of the input gate, which controls the amount of current input information. σ is the sigmoid activation function, which maps the result to the range of [0,1]. W i is the weight matrix of the input gate, connecting the input x t and input gate, U i is the hidden state h t-1 The weight matrix to the input gate, b i is the bias term of the input gate;

[0020] Forget gate: f t =σ(W f x t +U f h t-1 +b f )

[0021] Among them, f t is the activation value of the forget gate, which determines how much memory of the previous time step is retained, W f is the weight matrix of the forget gate, connecting the input x t and forget gate, U f is the hidden state h t-1 To the weight matrix of the forget gate, b f is the bias term of the forget gate:

[0022] Candidate memory:

[0023] in, is the value of the candidate memory unit, which is used to update the current memory unit state. Tanh is the hyperbolic tangent activation function, which maps the result to the range of [-1,1]. c is the weight matrix of the candidate memory unit, connecting the input x t and candidate memory units, U c is the hidden state h t-1 to the weight matrix of the candidate memory unit, b c is the bias term of the candidate memory unit;

[0024] Output gate: o t =σ(W o x t +U o h t-1 +b o )

[0025] Among them, t is the activation value of the output gate, which determines the impact of the current memory unit on the final output. o is the weight matrix of the output gate, connecting the input x t and output gate, U ois the hidden state h t-1 The weight matrix to the output gate, b o is the bias term of the output gate;

[0026] Next, we construct the graph neural network.

[0027] Messaging: m i→j =agg({h i |i∈neighbors(j)})

[0028] Among them, m i→j is the aggregate message received by the node, which indicates the information summarized by the node from its neighbor nodes. neighbors(j) is the neighbor set of node j, including all other nodes directly connected to node j. i : Feature representation of node i, agg represents the aggregation function;

[0029] Node Update:

[0030] in, is the new feature representation of node j after update, is the current feature representation of the node, m i→j It is the message aggregated from neighboring nodes, and update represents the update function;

[0031] Finally, the output of the LSTM layer is connected with the output of the GNN layer, and the final prediction result is obtained through a fully connected layer.

[0032] Beneficial effects:

[0033] 1. Ability to process time series data

[0034] LSTM is a special recurrent neural network (RNN) designed specifically for processing and predicting time series data. LSTM can effectively capture and retain long-time span dependencies through its unique gating mechanism (input gate, forget gate, and output gate). App traffic data in mobile network environments usually has strong time series characteristics, and LSTM can capture these characteristics well, thereby improving the accuracy and robustness of the model.

[0035] 2. Expressive power of graph structures

[0036] GNN is good at processing graph structure data and can effectively capture the complex relationships and dependencies between nodes. In a mobile network environment, App traffic data can be modeled as a graph structure, where nodes represent traffic data at different time points and edges represent the relationship between time points. Through GNN, the model can learn the global and local structural information in the data, thereby better understanding and classifying anonymous App traffic.

[0037] 3. Combining the advantages of time series and graph structure

[0038] Combining LSTM and GNN can take full advantage of the advantages of both. LSTM is responsible for capturing the temporal dependencies in time series data, while GNN is responsible for capturing the spatial dependencies in the graph structure. Through this combination, the model can consider information in both time and space dimensions at the same time, thereby achieving more comprehensive and accurate feature recognition and classification.

[0039] 4. Improve the generalization ability of the model

[0040] In practical applications, traffic data in mobile network environments is often highly diverse and complex. Traditional single models may have difficulty adapting to this complexity. By combining LSTM and GNN, the model can better adapt to different types of traffic patterns and improve the generalization ability of the model, thereby performing well in different application scenarios.

[0041] 5. Solve data sparsity and noise problems

[0042] Traffic data in mobile network environments may have data sparsity and noise problems. LSTM can effectively handle noise and missing values ​​in data through its memory mechanism, while GNN can alleviate data sparsity problems through the information propagation mechanism in the graph structure. The combination of the two can effectively improve the performance of the model under noisy and sparse data.

[0043] 6. Realize real-time and online analysis

[0044] The combined model of LSTM and GNN can adapt to the ever-changing mobile network environment through online learning and real-time updating. This is very important for application scenarios that require real-time monitoring and analysis of traffic data, such as network security monitoring and traffic optimization. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 This is the flow chart of the present invention;

[0046] Figure 2 This is an information diagram displayed in Wireshark of the present invention. DETAILED DESCRIPTION

[0047] 1. Data Collection:

[0048] Use the tcpdump tool to run anonymous applications in the simulator to generate detailed network traffic data. The simulator's diverse data generation mechanism ensures the comprehensiveness and representativeness of the data. Each traffic record includes information such as timestamp, traffic size, transmission rate, protocol type, port number, etc. As shown in the figure below, the information is displayed in wireshark. Figure 2 .

[0049] 2. Data preprocessing:

[0050] Data cleaning: The first step of data preprocessing, the main purpose is to remove invalid data and outliers to ensure data quality. It includes missing value processing, outlier detection, and duplicate data deletion. The missing value processing uses mean filling and adopts the formula X i is the data point after filling the missing values, X j is the value of a known data point; outlier detection uses the Z-score method, which represents the number of standard deviations of a data point from the mean. X is the data point, μ is the mean, and σ is the standard deviation.

[0051] Feature extraction: First, the time features are extracted, including timestamps and time intervals; traffic features: then the traffic size, transmission rate, number of packets, etc. are extracted; there is also protocol feature extraction, including protocol type and port number. In our experiment, we mainly extract protocols in the TCP / IP protocol suite; finally, statistical features can also be extracted, including calculating statistics such as average, maximum, minimum, and standard deviation.

[0052] Data standardization: First, normalize using the formula: Among them, X norm is the normalized value, X is the original eigenvalue, X min is the minimum value of the feature, which is used to determine the starting point of normalization. max is the maximum value of the feature, which is used to determine the end point of normalization.

[0053] Scaling the features to the range of [0,1] makes different features have the same dimension. Then standardization converts the features into a standard normal distribution with a mean of 0 and a standard deviation of 1, which helps to speed up the training process and improve model performance. The formula is: Where X is the original data point, μ is the mean of the eigenvalue, σ is the standard deviation of the eigenvalue, and X standard is the annotated value.

[0054] Data Splitting: Split the dataset into training, validation, and test sets based on timestamps, making sure there is no overlap between these datasets.

[0055] K-fold cross validation: Divide the dataset into K subsets (folds), use K-1 subsets for training each time, and use the remaining subset for validation. Make sure that each subset is used as a validation set by rotating. Use the formula Among them, the indicator is the evaluation result of each fold.

[0056] Data enhancement: Data enhancement is performed using time window sliding and noise addition. The window sliding step is set to a fixed value, and the entire time series is divided into multiple window segments. Noise addition uses formula X noisy =X+noise, where noise is a normally distributed noise with a mean of 0 and a standard deviation of a set value.

[0057] 3. Combination of time series and graph structure:

[0058] The outputs of LSTM (for time series analysis) and GNN (for graph structure analysis) are combined to achieve comprehensive processing of time series graphs.

[0059] First, the LSTM unit contains an input gate, a forget gate, and an output gate, which can effectively avoid the gradient vanishing problem in traditional RNNs.

[0060] Input gate: i t =σ(W i x t +U i h t-1 +b i )

[0061] Among them, i t is the activation value of the input gate, which controls the amount of current input information. σ is the sigmoid activation function, which maps the result to the range [0,1]. i is the weight matrix of the input gate, connecting the input x t and input gate. i is the hidden state h t-1 The weight matrix to the input gate. b i is the bias term of the input gate.

[0062] Forget gate: f t =σ(W f x t +U f h t-1 +b f )

[0063] Among them, f t is the activation value of the forget gate, which determines how much memory of the previous time step is retained. f is the weight matrix of the forget gate, connecting the input x t and the forget gate. f is the hidden state h t-1 To the weight matrix of the forget gate. b f is the bias term of the forget gate.

[0064] Candidate memory:

[0065] in, is the value of the candidate memory unit, which is used to update the current memory unit state. tanh is the hyperbolic tangent activation function, which maps the result to the range of [-1,1]. c is the weight matrix of the candidate memory unit, connecting the input x t and candidate memory units. c is the hidden state h t-1 to the weight matrix of the candidate memory unit. b c is the bias term of the candidate memory cell.

[0066] Output gate: o t =σ(W o x t +U o h t-1 +b o )

[0067] Among them, t Is the activation value of the output gate, which determines the impact of the current memory unit on the final output. o is the weight matrix of the output gate, connecting the input x t and output gate. o is the hidden state h t-1 The weight matrix to the output gate. b o is the bias term of the output gate.

[0068] Next, we construct the graph neural network.

[0069] Messaging: m i→j =agg({h i |i∈neighbors(j)})

[0070] Among them, m i→j It is the aggregate message received by the node, which represents the information summarized by the node from its neighbor nodes. neighbors(j) is the neighbor set of node j, which contains all other nodes directly connected to node j. i : Feature representation of node i. agg represents the aggregation function.

[0071] Node Update:

[0072] in, is the new feature representation of node j after update, is the current feature representation of the node, m i→j It is the message aggregated from neighboring nodes, and update represents the update function.

[0073] Finally, the output of the LSTM layer is connected to the output of the GNN layer, and the final prediction result is obtained through a fully connected layer (Denselayer).

[0074] The above algorithm input includes: time series data: X = {x1, x2, ...., x t}, where x i ∈R dx represents the d-dimensional feature vector at time step i.

[0075] Graph structure: G = (V, E), where V is the node set and E is the edge set.

[0076] Node characteristics: H = {h1,h2,....,h n}, where h i ∈R dh d represents the node i h -dimensional feature vector.

[0077] Final output: Represents the comprehensive prediction results of each node in time series and graph structure.

[0078] Where n is the number of nodes in the graph. f Represents the dimension of the final output. R represents a set of real numbers.

[0079] 4. Model training and optimization:

[0080] This step includes loss function, optimization algorithm, and regularization.

[0081] First, the loss function uses the cross entropy loss function (for classification tasks): Loss = -∑ i y i log(y); mean square error (for regression tasks): y i is the actual value and y is the predicted value.

[0082] The optimization algorithm uses stochastic gradient descent (SDG) and Adam optimizer to update model parameters and adaptively adjust the learning rate.

[0083] SDGs:

[0084] Among them, θ is the model parameter, η is the learning rate, is the gradient of the loss function.

[0085] Adam:

[0086]

[0087]

[0088] Among them, m t is the first-order moment estimate, v t is the second-order moment estimate, β1 and β2 are the decay rates of the first-order and second-order moment estimates, ∈ is a smoothing term to avoid division by zero, θ is the model parameter, η is the learning rate, is the gradient of the loss function;

[0089] Finally, regularization is required, using the formula L1 regularization and L2 regularization, the formula is as follows:

[0090] LossL1=Loss original +λ∑ i |θ i |

[0091]

[0092] Among them, Loss original is the original loss function; λ is the regularization parameter, θ i is the model weight;

[0093] 5. Model evaluation: Use the test set to evaluate the model. The evaluation indicators include classification indicators: accuracy, precision, recall, F1 value and regression indicators: mean square error (MSE) and mean absolute error (MAE);

[0094] Accuracy:

[0095] Accuracy:

[0096] Recall:

[0097] F1 value:

[0098] Among them, TRUE Positives are true positives, True Negatives are true negatives, False Positives are false positives, and False Negatives are false negatives;

[0099]

[0100]

[0101] Where N is the number of samples, y i is the actual value and y is the predicted value.

[0102] Using the extracted features, different application types can be classified, such as:

[0103] Social Media Apps:

[0104] Features: Small size data packets, frequent time intervals, using HTTPS protocol.

[0105] Classification: Data characteristics point to social media applications such as QQ and WeChat.

[0106] Video streaming applications:

[0107] Characteristics: A large number of continuous high-volume data packets, high transmission rate, and use of specific ports.

[0108] Classification: These features indicate that the traffic comes from video streaming services such as Tencent Video and iQiyi.

[0109] File Sharing Apps:

[0110] Characteristics: large volume of data, irregular time intervals, and use of specific file transfer protocols.

[0111] Classification: Features correspond to BitTorrent or other P2P file sharing services.

[0112] The above-mentioned traffic feature identification and classification methods have important application value for enterprises, marketing teams, and network service providers.

[0113] The marketing team can develop personalized marketing strategies and advertising based on user portraits, push the latest movie and TV series recommendations to "video lovers", and push new features and activities of social applications to "social experts".

[0114] Network service providers can optimize network resource allocation and improve user experience based on user behavior analysis results, and provide higher bandwidth services for users who frequently use video streaming applications.

[0115] The product development team can improve product features and user interface design based on the results of user behavior analysis. When it is found that users frequently encounter problems when using a certain function, targeted optimization and improvement can be carried out.

[0116] By analyzing changes in user behavior, you can also identify users with a high risk of churn and take appropriate measures to recover them. Send coupons or special event invitations to users who have not logged in for a long time to improve user retention.

[0117] Let's take a simple example: suppose an Internet company operates a comprehensive application that includes social, video, shopping and other functions. Through user behavior analysis, the following points are found:

[0118] User 1 mainly uses office functions during the day on weekdays and frequently uses social functions at night.

[0119] User 2 watches a lot of videos during the weekend, and the viewing time is relatively long.

[0120] User 3 browses and purchases products frequently during the shopping festival.

[0121] Based on these analysis results, the company can:

[0122] Push more work-related features and content to user 1, and push social activities and interactive information in the evening.

[0123] Provide video recommendations and viewing discounts to user 2 during the weekend to enhance the user's viewing experience.

[0124] During the shopping festival, personalized product recommendations and shopping discounts are pushed to user 3 to improve conversion rate.

[0125] The above methods can help enterprises gain a deeper understanding of user needs, optimize products and services, and improve user satisfaction and business benefits.

Claims

1. A method for identifying and classifying anonymous app traffic characteristics in a mobile network environment, characterized in that: The following steps are involved: Step 1: Use the tcpdump tool to run the anonymous application in the simulator to generate detailed network traffic data; Step 2, data preprocessing and feature extraction; Step 3: Combining time series and graph structure; Step 4: Model training and optimization.

2. The method for identifying and classifying anonymous app traffic characteristics in a mobile network environment according to claim 1 is characterized in that: The specific process of step 1 is as follows: through the simulator's diversified data generation mechanism, the comprehensiveness and representativeness of the data are ensured. Each traffic record includes timestamp, traffic size, transmission rate, protocol type, and port number information.

3. The method for identifying and classifying anonymous app traffic characteristics in a mobile network environment according to claim 1 is characterized in that: The specific process of step 1 is as follows: Data cleaning: remove invalid data and outliers to ensure data quality, including missing value processing, outlier detection, and duplicate data deletion; the missing value processing uses mean filling and adopts the formula X i is the data point after filling the missing values, X j is the value of a known data point; outlier detection uses the Z-score method, which represents the number of standard deviations of a data point from the mean, using the formula X is the data point, μ is the mean, and σ is the standard deviation.

4. The method for identifying and classifying anonymous app traffic characteristics in a mobile network environment according to claim 1, characterized in that: Feature extraction in step 2: First, extract the time features, including timestamp and time interval; Traffic characteristics: Then extract the traffic size, transmission rate, and number of packets; also extract protocol features, including protocol type, port number, mainly extracting protocols in the TCP / IP protocol suite; finally, extract statistical features, including calculating the average, maximum, minimum, and standard deviation statistics.

5. The method for identifying and classifying anonymous app traffic characteristics in a mobile network environment according to claim 1, characterized in that: The specific process of step 3 is: First, the LSTM unit contains input gate, forget gate and output gate, which can effectively avoid the gradient vanishing problem in traditional RNN; Input gate: i t =σ(W i x t +U i h t-1 +b i ) Among them, i t is the activation value of the input gate, which controls the amount of current input information. σ is the sigmoid activation function, which maps the result to the range of [0,1]. W i is the weight matrix of the input gate, connecting the input x t and input gate, U i is the hidden state h t-1 The weight matrix to the input gate, b i is the bias term of the input gate; Forget gate: f t =σ(W f x t +U f h t-1 +b f ) Among them, f t is the activation value of the forget gate, which determines how much memory of the previous time step is retained, W f is the weight matrix of the forget gate, connecting the input x t and forget gate, U f is the hidden state h t-1 To the weight matrix of the forget gate, b f is the bias term of the forget gate: Candidate memory: in, is the value of the candidate memory unit, which is used to update the current memory unit state. Tanh is the hyperbolic tangent activation function, which maps the result to the range of [-1,1]. c is the weight matrix of the candidate memory unit, connecting the input x t and candidate memory units, U c is the hidden state h t-1 to the weight matrix of the candidate memory unit, b c is the bias term of the candidate memory unit; Output gate: o t =σ(W o x t +U o h t-1 +b o ) Among them, t is the activation value of the output gate, which determines the impact of the current memory unit on the final output. o is the weight matrix of the output gate, connecting the input x t and output gate, U o is the hidden state h t-1 The weight matrix to the output gate, b o is the bias term of the output gate; Next, we construct the graph neural network. Messaging: m i→j =agg({h i |i∈neighbors(j)}) Among them, m i→j is the aggregate message received by the node, which indicates the information summarized by the node from its neighbor nodes. neighbors(j) is the neighbor set of node j, including all other nodes directly connected to node j. i : Feature representation of node i, agg represents the aggregation function; Node Update: in, is the new feature representation of node j after update, is the current feature representation of the node, m i→j It is the message aggregated from neighboring nodes, and update represents the update function; Finally, the output of the LSTM layer is connected with the output of the GNN layer, and the final prediction result is obtained through a fully connected layer.

Images