Encrypted traffic classification method based on graph structure and dual-channel sequence feature mixing

Abstract

The invention provides an encrypted traffic classification method based on mixing of a graph structure and two-channel sequence features, and the method comprises the following specific steps: 1) constructing an inter-message interaction graph structure of a message level in a flow based on a communication process of encrypted traffic, three heterogeneous typical edge connection modes (equidirectional continuous messages, traffic direction change messages and second-order equidirectional messages) are designed in the graph structure, and a client-server communication global mode is represented in multiple dimensions; 2) on the basis of a two-channel modal encoder structure, using a Transform network to code and encrypt the length and time interval sequence of the traffic message in parallel, and fusing the two parallel features to generate a node feature Node Features; and 3) designing an attention mechanism based on a message-aware graph Transform architecture and a mixed node information embedding layer in combination with edge-based spatial relationship information, and globally capturing encrypted traffic space structure information in a graph input form, so as to finish encrypted traffic classification tasks under various public and non-public data sets with high precision.

Description

Technical Field

[0001] The present invention belongs to the technical field of cyberspace security and relates to an encrypted traffic classification method based on a mixture of graph structure and dual-channel sequence features. Background Art

[0002] With the widespread use of encrypted traffic in the network, encrypted traffic classification has become an important network analysis technology, which aims to enable third-party passive observers or regulators to accurately identify application or web page activity categories from encrypted traffic.

[0003] By classifying encrypted traffic, we can understand the main categories of traffic content, allowing network operators to respond quickly and develop customized network management strategies to improve service quality and ensure user experience, while also supporting different business goals.

[0004] However, the increasing use of encrypted traffic and anonymous network technologies makes the analysis of encrypted traffic complex and difficult, and existing methods are difficult to accurately classify complex traffic patterns. Therefore, to establish a complete traffic analysis framework for more accurate classification, it is necessary to explore the potential powerful representations in the encrypted traffic space information and the information interaction between packets.

[0005] At present, researchers at home and abroad usually use a variety of technical means, which can be roughly divided into traditional machine learning-based methods and deep learning-based methods. Traditional methods rely on manual extraction of multiple high-order features for machine learning model training, which requires a lot of human resources to design features and is prone to overfitting defects in the model. On the other hand, most deep learning methods directly input the sequence features of the original traffic, lacking the original representation of the semantic association between messages in the traffic from a global perspective, resulting in the model classification effect being less than expected. In essence, these methods not only lack the global spatial feature mining of the correlation between messages in the encrypted traffic transmission mode, but also fail to make full use of the multi-modal characteristics of the traffic. Summary of the invention

[0006] In view of the problems that the existing encrypted traffic classification technology ignores the message association and spatial relationship between messages in the encrypted traffic network transmission mode, fails to essentially characterize the global characteristics of the encrypted traffic sequence, and lacks a powerful model to mine the spatial feature information hidden in these flows, the present invention proposes an encrypted traffic classification scheme based on a mixture of graph structure and dual-channel sequence features. Compared with the existing encrypted traffic classification method, the scheme will globally construct a traffic interaction structure graph to obtain a more global, essential and accurate encrypted traffic representation, and thus be applicable to the complex environment of mixed traffic message interaction and traffic confusion in real networks. The present invention realizes an end-to-end solution for encrypted traffic collection and preprocessing - message-level traffic interaction graph construction - dual-channel modal traffic length and time series encoder - message-aware encrypted traffic classification model training based on the graph Transformer architecture, ensuring the accuracy and robustness of the model operation for encrypted traffic classification training. Furthermore, the method is good at characterizing the spatial message interaction characteristics in the encrypted traffic communication mode from a global perspective, while using multiple modal data of traffic in parallel. The scheme can accurately classify and identify encrypted traffic classification tasks of multiple data sets.

[0007] In order to achieve the above object, the present invention provides the following technical solutions:

[0008] A method for classifying encrypted traffic based on a mixture of graph structure and dual-channel sequence features, the method comprising the following steps:

[0009] (1) Based on the communication mode of encrypted traffic and the paradigm of public encryption protocols, data flow preprocessing is performed on the pcap file of the public data set traffic data, the encrypted traffic is grouped, the upstream and downstream messages of the flow are distinguished, and the traffic sequence form is generated in the form of message tuples (message length, time interval).

[0010] (2) Based on the client-server model of encrypted traffic transmission, two types of nodes (uplink messages and downlink messages) and three typical heterogeneous edge connection modes between messages (same-direction continuous messages, traffic direction change messages, and second-order same-direction messages) are designed in the communication process to construct the graph structure feature MTIG of encrypted traffic interaction from a global perspective.

[0011] (3) Based on the dual-channel modal coding architecture, the traffic sequence of the packet binary (packet length, time interval) obtained by data preprocessing in step (1) is used as the original data, and word embedding and position encoding operations are performed on the two sequence features of packet length and packet time in parallel. The obtained feature vectors are respectively input into the encoder analysis of the packet length and packet time of the Transformer architecture in parallel, and the features of the two modes are fused to form node content features.

[0012] (4) Based on the encrypted traffic message-aware graph transformer architecture, the encrypted traffic interaction graph structure features generated in step (2) are combined to extract the degree information to generate centrality encoding features, which are fused with the node content features Node Features generated in step (3) as the input of the graph transformer architecture; the topological space information is extracted from the encrypted traffic interaction graph structure generated in step (2) to form edge information encoding features to guide the attention mechanism module. This method demonstrates excellent encrypted traffic classification task capabilities and strong robustness on four widely used public datasets and one traffic self-collection dataset.

[0013] Furthermore, the step (1) specifically includes the following sub-steps:

[0014] (1.1) Self-collection of mobile terminal traffic is to use the UI controls on the mobile terminal to monitor the running mobile application software, capture and collect the pcap file format traffic corresponding to the running software,

[0015] (1.2) Download the public encrypted traffic datasets including ISCX VPN dataset, ISCX Tor dataset, QUIC2019 dataset and CICIoT dataset.

[0016] (1.2.1) Perform flow preprocessing on this part of the data set. Use the traffic preprocessing tool dpkt to read the unique five-tuple identifier of each flow (source IP, sink IP, source port, sink port, transport layer protocol), and express it in the form of a dictionary key = (src_ip, dst_ip, src_port, dst_port, prot). Complete the flow grouping of each pcap file (including the corresponding label).

[0017] (1.2.2) Use the dpkt library to read the payload length pkt len ​​and timestamp of each packet in the flow, and obtain the characteristic sequence of the flow's packets (length, time tuples) according to the time sequence of the timestamp.

[0018] (1.3) For the traffic samples under each protocol, for each flow (five-tuple label), capture the length pkt_len of each message in time sequence, and obtain the traffic time sequence of the message length on the TCP layer.

[0019] (1.4) According to the characteristics of TCP messages between client and server, the length of TCP payload is obtained by subtracting the TCP header from each message, and the timestamp value of the message is subtracted and normalized to relative time recorded as ts. The absolute time of the initial test message is set to 0.

[0020] (1.5) Based on the preprocessing of the message sequence length and time characteristics of the encrypted traffic in (1.3) and (1.4), the message sequence form of the traffic is generated (with (message length, time interval) tuple as the message unit).

[0021] Furthermore, the step (2) specifically includes the following sub-steps:

[0022] (2.1) Based on the message sequence form of the traffic obtained in step (1) (with (message length, time interval) tuple as the message unit), extract the encrypted traffic message length sequence in chronological order and construct the message-level traffic interaction graph MTIG.

[0023] (2.1.1) Based on the bidirectionality of the traffic transmission process, two heterogeneous message node types, upstream and downstream, are set. The request message sent by the client to the server is set as the upstream message traffic, and the corresponding message downloaded by the client from the server is set as the downstream message traffic.

[0024] (2.1.2) Combined with the bidirectional message sequence of the traffic obtained in (2.1.1) above, the message unit of the client-server communication is composed of multiple unidirectional continuous messages, that is, a message unit Message is obtained by aggregating multiple unidirectional continuous messages.

[0025] (2.2) Based on the message sequence form of the traffic obtained in step (1) (with (message length, time interval) tuple as the message unit), extract the encrypted traffic message length sequence in chronological order and construct the message-level traffic interaction graph MTIG.

[0026] (2.2.1) Traverse the sequence of each flow in time order, connect the message nodes that are in the same uplink and downlink directions set in (2.1.1) and are continuous in space, and generate a continuous unidirectional edge feature type SUE (Successive Unidirectional Edge).

[0027] (2.2.2) Traverse the sequence of each flow in time order. Combined with the characteristic that the direction of the message communicated between the client and the server will change during traffic transmission, connect the message direction change positions set in (2.1.1) above, that is, the nodes where two messages are continuous and in opposite directions in space, and generate the edge feature type CDE (Changed Directional Edge) of the traffic communication direction change.

[0028] (2.2.3) Traverse the sequence of each flow in time order. On the basis of the above two edge types (2.2.1) and (2.2.2), add a higher-order message continuity feature, specifically connecting the last message of the previous message and the first message of the next message in two consecutive messages (second-order continuous neighbor nodes) to generate a second-order continuous unidirectional edge feature type 2UE (Secondary Unidirectional Edge).

[0029] (2.3) Combining the construction methods of the three edge feature types described in (2.2.1), (2.2.2) and (2.2.3) above, the edge attributes of the spatial structural characteristics of the global traffic are obtained, and the message-level traffic interaction graph MTIG is generated, which contains two elements: nodes V (uplink message nodes and downlink message nodes) and edges E (three edge types: SUE, CDE and 2UE).

[0030] Furthermore, the step (3) specifically includes the following sub-steps:

[0031] (3.1) Based on the packet sequence form of the traffic obtained in step (1) (with (packet length, time interval) tuple as the packet unit), separate the packet length sequence and the packet time sequence in parallel as input,

[0032] (3.1.1) Based on the message length sequence input, word embedding and position encoding operations are performed, and the feature sequence of the message length is obtained by adding them. The length encoder of the Transformer architecture is input to extract the length encoding feature. The formula is:

[0033] L out = TransformerEncoder L (length embed ,mask)

[0034] (3.1.2) Based on the message time series input, word embedding and position encoding operations are performed synchronously and in parallel, and the feature sequence of message time intervals is obtained by adding them together. The feature sequence is input into the time encoder of the Transformer architecture for time coding feature extraction.

[0035] T out = TransformerEncoder T (time embed ,mask)

[0036] (3.2) For the Transformer architecture encoder in (3.1), the input sequence features are used to solve the long dependency problem using the attention mechanism, which specifically corresponds to the long flow data in the traffic.

[0037] (3.2.1) Attention mechanism Attention sets query Q, keyword K and value V three key parameter vector learning (3.1) The word embedding form Z of the message feature sequence is obtained, and W is optimized through the parameter learning mechanism of the neural network q ,W k ,W v The three feature matrices are given by

[0038] (Q,K,V)=(W q *Z,W k *Z,W v *Z)

[0039] (3.2.2) For (3.2.1) above, use the dot product function on the query Q, keyword K (matrix transposed to K T for matrix calculations), used to reduce the dimension to The probability distribution function obtained by the softmax function constraint model is multiplied by the value V to obtain the weighted sum of the categories. The formula is:

[0040]

[0041] (3.3) Use the concatenation function Concat in Pytorch to fuse the two modal information of message length and time in (3.1.1) and (3.1.2), and aggregate them to obtain the message node features Node Features, whose formula is:

[0042] Node embed =MLP(Concat[L out ,T out ])

[0043] (3.4) Based on the message node features obtained in (3.3), they are used as the content feature part of the input to the graph Transformer network; at the same time, this part of the information set is also used for the spatial coding matrix as the information input of the matrix.

[0044] Furthermore, the step (4) specifically includes the following sub-steps:

[0045] (4.1) Establish a centrality encoding for characterizing the spatial location information of the message-level traffic interaction graph structure MTIG, and encode the position word embedding vector z from the node degree information deg (v) and added to the node features (originally x v ) to get x v (0) , whose formula is

[0046] x v (0) =x v +z deg (v)

[0047] (4.2) A quantitative function is established to characterize the spatial correlation in the message-level traffic interaction graph structure MTIG. Specifically, for any two eigenvectors (v i ,v j ), calculate the corresponding shortest path function Floyd (expressed as φ(v i ,v j ), in the self-attention mechanism (the calculation method is described in (3.2.2), h i and h j Corresponding query, W Q and W K The learnable matrix corresponding to the two eigenvectors) adds a learnable parameter bias term (b is the bias) expressed as b φ (v i ,v j ), whose formula is

[0048]

[0049] (4.3) Based on the self-attention mechanism formula in (4.2) and the added bias information, the edge encoding matrix Edge Encoding is introduced to quantify the shortest path association between node pairs ( Corresponding to the nth edge e n The corresponding weight item w n E ), perform an average dot product operation on the shortest path vector of the edge (N corresponds to the number of vectors), and introduce a learnable word embedding matrix, whose formula is

[0050]

[0051] (4.4) Based on the edge encoding matrix Edge Encoding introduced in (4.3) above, the original spatial feature matrix is ​​modified and added to the self-attention mechanism. The formula is the self-attention mechanism in (4.2) combined with the spatial features of the bias term, plus the edge encoding matrix Edge Encoding in (4.3), to obtain the final modified attention mechanism that introduces spatial features.

[0052]

[0053] (4.5) Based on the node feature input of the dual-channel sequence feature mixture obtained in (3.4) and the self-attention module designed in (4.4) to integrate spatial feature information, a graph Transformer network DigTraffic is constructed for the recognition of message-level traffic interaction graph structure MTIG, which is used to classify encrypted traffic in public datasets and self-collected datasets.

[0054] The performance quantification of the encrypted traffic classification task can be reflected in the classification accuracy Precision of the unknown category traffic in the open world network environment by the DigTraffic model method trained by this scheme. The distribution results of its discount graph are as follows: Figure 2 The horizontal axis represents the number of unknown categories of the model input, and the vertical axis represents the classification accuracy of each model. The comparison methods are bidirectional LSTM model bi-LSTM, Transformer model and graph attention neural network model GAT; the robustness quantification of the encrypted traffic classification task can be reflected in the different message sequence lengths of the input model and the associated classification F1 index. The discount graph distribution results are shown in Figure 2 As shown in the figure, the horizontal axis represents the number of packets in the traffic sequence input to the model, and the vertical axis represents the classification F1 index of each model. Four of the figures are public datasets of encrypted traffic.

[0055] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0056] (1) The designed graph structure of message-level traffic interaction, MTIG, fully considers the message association relationship pattern in the information interaction of the flow in the client-server communication mode. MTIG uses the data packet-level information as a node to learn the inherent semantic relationship in the message-level interaction and grasp the spatial dimension characteristics of the traffic from a global perspective.

[0057] (2) The dual-channel modal encoder architecture used can mine the features of two typical modes, namely, packet length and packet time interval, in parallel, thereby making full use of multiple paradigms of traffic, enhancing the node information at the packet level and sequence level, and enabling the neural network model to learn the characteristics of traffic from multiple different angles.

[0058] (3) We mine the network communication process of encrypted traffic and construct a message-aware graph Transformer neural network structure, which can adapt to the message-level traffic interaction graph structure MTIG designed in (1) and simultaneously incorporate the implicit spatial structure features in the traffic heterogeneous graph to optimize the attention mechanism module and better characterize the essential message interaction pattern of encrypted traffic, thereby achieving a variety of high-accuracy encrypted traffic classification tasks.

[0059] In general, the present invention realizes deep mining of message interaction characteristics and global traffic space characteristics in encrypted traffic by deeply designing the graph structure of message-level traffic interaction, dual-channel modal encoder architecture, and message-aware graph Transformer neural network structure. It can achieve high-precision encrypted traffic classification and identification effects under various data sets, which is of great significance in helping regulatory agencies or network service providers strengthen network service supervision and protect user privacy of application services. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 The encrypted traffic classification method flow is based on the hybrid of graph structure and dual-channel sequence features.

[0061] Figure 2 This is a line chart of the classification accuracy of this method in an open world environment for the ISCX2016-VPN public dataset.

[0062] Figure 3 The F1 line graph of the classification of this method under changing input message sequence length for four public datasets.

[0063] Specific implementation:

[0064] The technical solution provided by the present invention will be described in detail below in conjunction with specific embodiments. It should be understood that the following specific implementation methods are only used to illustrate the present invention and are not used to limit the scope of the present invention.

[0065] Embodiment 1: The present invention proposes an encrypted traffic classification system based on a hybrid of graph structure and dual-channel sequence features, which is mainly composed of four parts: an encrypted traffic collection and preprocessing module, a message-level traffic interaction graph MTIG construction module, a dual-channel modal message length and time series encoder module, and a message-aware encrypted traffic classification model training module based on a graph Transformer architecture. The encrypted traffic collection and preprocessing module in the first part uses a public traffic collection tool to capture and collect encrypted traffic in an actual network environment, and at the same time performs preprocessing work such as grouping according to the transport layer protocol of the traffic, and constructs a message sequence sample set of encrypted traffic, where the message unit is a binary feature of the message payload length and time interval; the message-level traffic interaction graph MTIG construction module in the second part, based on the communication process of encrypted traffic, globally constructs a message-level message-to-message interaction graph structure within the flow, and designs three heterogeneous typical edge connection modes in the graph structure (same-direction continuous messages, traffic direction change messages, and second-order same-direction messages), which characterizes the global communication mode of the client-server in multiple dimensions and fully explores the spatial correlation representation form of the global traffic. The dual-channel modal message length and time series encoder module in the third part, based on the dual-channel modal encoder structure, uses the Transformer network to parallel encode the length and time interval sequence of the encrypted traffic message, and fuses the above two parallel features to generate node features; the message-aware encrypted traffic classification model training module based on the graph Transformer architecture in the fourth part, is based on the message-aware graph Transformer architecture, a hybrid node information embedding layer, and an attention mechanism designed in combination with the edge-based spatial relationship information, which globally captures the spatial structure information of the encrypted traffic in the form of graph input, thereby completing the encrypted traffic classification tasks under a variety of public and non-public data sets with high precision.

[0066] Embodiment 2: An encrypted traffic classification method based on a mixture of graph structure and dual-channel sequence features, the method comprising the following steps:

[0067] (1) Use public traffic collection tools to capture and collect encrypted traffic in the actual network environment, and perform preprocessing such as grouping according to the transport layer protocol of the traffic to construct a sample set of encrypted traffic message sequences. The message unit is a binary feature of the message payload length and time interval. At the same time, synchronize the above preprocessing mode with the traffic of the public data set to obtain the sample set of encrypted traffic message sequences of the public data set;

[0068] The specific process of this step is as follows:

[0069] (1.1) Self-collection of mobile terminal traffic is to use the UI controls on the mobile terminal to monitor the running mobile application software, capture and collect the pcap file format traffic corresponding to the running software,

[0070] (1.2) Download the public encrypted traffic datasets including ISCX VPN dataset, ISCX Tor dataset, QUIC2019 dataset and CICIoT dataset.

[0071] (1.2.1) Perform flow preprocessing on this part of the data set. Use the traffic preprocessing tool dpkt to read the unique five-tuple identifier of each flow (source IP, sink IP, source port, sink port, transport layer protocol), and express it in the form of a dictionary key = (src_ip, dst_ip, src_port, dst_port, prot). Complete the flow grouping of each pcap file (including the corresponding label).

[0072] (1.2.2) Use the dpkt library to read the payload length pkt_len and timestamp of each packet in the stream, and obtain the characteristic sequence of the stream's packets (length, time tuples) according to the time sequence of the timestamp.

[0073] (1.3) For the traffic samples under each protocol, for each flow (five-tuple label), capture the length pkt_len of each message in time sequence, and obtain the traffic time sequence of the message length on the TCP layer.

[0074] (1.4) According to the characteristics of TCP messages between client and server, the length of TCP payload is obtained by subtracting the TCP header from each message, and the timestamp value of the message is subtracted and normalized to relative time recorded as ts. The absolute time of the initial test message is set to 0.

[0075] (1.5) Based on the preprocessing of the message sequence length and time characteristics of the encrypted traffic in (1.3) and (1.4), the message sequence form of the traffic is generated (with (message length, time interval) tuple as the message unit).

[0076] (2) Based on the communication process of encrypted traffic, a global message-level graph structure of message interactions within the flow is constructed. Three typical heterogeneous edge connection methods (same-direction continuous messages, traffic direction change messages, and second-order same-direction messages) are designed in the graph structure to characterize the global communication mode between the client and the server in multiple dimensions. This further explores the spatial interaction characteristics of the traffic and forms an essential representation form.

[0077] The specific process of this step is as follows:

[0078] (2.1) Based on the message sequence form of the traffic obtained in step (1) (with (message length, time interval) tuple as the message unit), extract the encrypted traffic message length sequence in chronological order and construct the message-level traffic interaction graph MTIG.

[0079] (2.1.1) Based on the bidirectionality of the traffic transmission process, two heterogeneous message node types, upstream and downstream, are set. The request message sent by the client to the server is set as the upstream message traffic, and the corresponding message downloaded by the client from the server is set as the downstream message traffic.

[0080] (2.1.2) Combined with the bidirectional message sequence of the traffic obtained in (2.1.1) above, the message unit of the client-server communication is composed of multiple unidirectional continuous messages, that is, a message unit Message is obtained by aggregating multiple unidirectional continuous messages.

[0081] (2.2) Based on the message sequence form of the traffic obtained in step (1) (with (message length, time interval) tuple as the message unit), extract the encrypted traffic message length sequence in chronological order and construct the message-level traffic interaction graph MTIG.

[0082] (2.2.1) Traverse the sequence of each flow in time order, connect the message nodes that are in the same uplink and downlink directions set in (2.1.1) and are continuous in space, and generate a continuous unidirectional edge feature type SUE (Successive Unidirectional Edge).

[0083] (2.2.2) Traverse the sequence of each flow in time order. Combined with the characteristic that the direction of the message communicated between the client and the server will change during traffic transmission, connect the message direction change positions set in (2.1.1) above, that is, the nodes where two messages are continuous and in opposite directions in space, and generate the edge feature type CDE (Changed Directional Edge) of the traffic communication direction change.

[0084] (2.2.3) Traverse the sequence of each flow in time order. On the basis of the above two edge types (2.2.1) and (2.2.2), add a higher-order message continuity feature, specifically connecting the last message of the previous message and the first message of the next message in two consecutive messages (second-order continuous neighbor nodes) to generate a second-order continuous unidirectional edge feature type 2UE (Secondary Unidirectional Edge).

[0085] (2.3) Combining the construction methods of the three edge feature types described in (2.2.1), (2.2.2) and (2.2.3) above, the edge attributes of the spatial structural characteristics of the global traffic are obtained, and the message-level traffic interaction graph MTIG is generated, which contains two elements: nodes V (uplink message nodes and downlink message nodes) and edges E (three edge types: SUE, CDE and 2UE).

[0086] (3) Based on the dual-channel modal encoder structure, the Transformer network is used to encode the length and time interval sequence of the encrypted traffic message in parallel, and the above two parallel features are fused to generate node features; this is used to help the neural network learn the key feature forms of the traffic message sequence in parallel from multiple modal perspectives.

[0087] The specific process of this step is as follows:

[0088] (3.1) Based on the packet sequence form of the traffic obtained in step (1) (with (packet length, time interval) tuple as the packet unit), separate the packet length sequence and the packet time sequence in parallel as input,

[0089] (3.1.1) Based on the message length sequence input, word embedding and position encoding operations are performed, and the feature sequence of the message length is obtained by adding them. The length encoder of the Transformer architecture is input to extract the length encoding feature. The formula is:

[0090] L out = TransformerEncoder L (length embed ,mask)

[0091] (3.1.2) Based on the message time series input, word embedding and position encoding operations are performed synchronously and in parallel, and the feature sequence of message time intervals is obtained by adding them together. The feature sequence is input into the time encoder of the Transformer architecture for time coding feature extraction.

[0092] T out = TransformerEncoder T (time embed ,mask)

[0093] (3.2) For the Transformer architecture encoder in (3.1), the input sequence features are used to solve the long dependency problem using the attention mechanism, which specifically corresponds to the long flow data in the traffic.

[0094] (3.2.1) Attention mechanism Attention sets query Q, keyword K and value V three key parameter vector learning (3.1) The word embedding form Z of the message feature sequence is obtained, and W is optimized through the parameter learning mechanism of the neural network q ,W k ,W v The three feature matrices are given by

[0095] (Q,K,V)=(W q *Z,W k *Z,W v *Z)

[0096] (3.2.2) For (3.2.1) above, use the dot product function on the query Q, keyword K (matrix transposed to K T for matrix calculations), used to reduce the dimension to The probability distribution function obtained by the softmax function constraint model is multiplied by the value V to obtain the weighted sum of the categories. The formula is:

[0097]

[0098] (3.3) Use the concatenation function Concat in Pytorch to fuse the two modal information of message length and time in (3.1.1) and (3.1.2), and aggregate them to obtain the message node features Node Features, whose formula is:

[0099] Node embed =MLP(Concat[L out ,T out ])

[0100] (3.4) Based on the message node features obtained in (3.3), they are used as the content feature part of the input to the graph Transformer network; at the same time, this part of the information set is also used for the spatial coding matrix as the information input of the matrix.

[0101] (4) We design an encrypted traffic classifier DigTraffic based on the message-aware graph Transformer architecture, a hybrid node information embedding layer, and an attention mechanism designed in combination with edge-based spatial relationship information. This can globally capture the spatial structure information of encrypted traffic in the form of graph input, thereby completing the encrypted traffic classification task under a variety of public and non-public datasets with high accuracy.

[0102] The specific process of this step is as follows:

[0103] (4.1) Establish a centrality encoding for characterizing the spatial location information of the message-level traffic interaction graph structure MTIG, and encode the position word embedding vector z from the node degree information deg (v) and added to the node features (originally x v ) to get x v (0) , whose formula is

[0104] x v (0) =x v +z deg (v)

[0105] (4.2) A quantitative function is established to characterize the spatial correlation in the message-level traffic interaction graph structure MTIG. Specifically, for any two eigenvectors (v i ,v j ), calculate the corresponding shortest path function Floyd (expressed as φ(v i ,v j ), in the self-attention mechanism (the calculation method is described in (3.2.2), h i and h j Corresponding query, W Q and W K The learnable matrix corresponding to the two eigenvectors) adds a learnable parameter bias term (b is the bias) expressed as b φ (v i ,v j ), whose formula is

[0106]

[0107] (4.3) Based on the self-attention mechanism formula in (4.2) and the added bias information, the edge encoding matrix Edge Encoding is introduced to quantify the shortest path association between node pairs ( Corresponding to the nth edge e n The corresponding weight item w n E ), perform an average dot product operation on the shortest path vector of the edge (N corresponds to the number of vectors), and introduce a learnable word embedding matrix, whose formula is

[0108]

[0109] (4.4) Based on the edge encoding matrix Edge Encoding introduced in (4.3) above, the original spatial feature matrix is ​​modified and added to the self-attention mechanism. The formula is the self-attention mechanism in (4.2) combined with the spatial features of the bias term, plus the edge encoding matrix Edge Encoding in (4.3), to obtain the final modified attention mechanism that introduces spatial features.

[0110]

[0111] (4.5) Based on the node feature input of the dual-channel sequence feature mixture obtained in (3.4) and the self-attention module designed in (4.4) to integrate spatial feature information, a graph Transformer network DigTraffic is constructed for the recognition of message-level traffic interaction graph structure MTIG, which is used to classify encrypted traffic in public datasets and self-collected datasets.

[0112] The performance quantification of the encrypted traffic classification task can be reflected in the classification accuracy Precision of the unknown category traffic in the open world network environment by the DigTraffic model method trained by this scheme. The distribution results of its discount graph are as follows: Figure 2 The horizontal axis represents the number of unknown categories of the model input, and the vertical axis represents the classification accuracy of each model. The comparison methods are bidirectional LSTM model bi-LSTM, Transformer model and graph attention neural network model GAT; the robustness quantification of the encrypted traffic classification task can be reflected in the different message sequence lengths of the input model and the associated classification F1 index. The discount graph distribution results are shown in Figure 2 As shown in the figure. The horizontal axis represents the number of packets in the traffic sequence input to the model, and the vertical axis represents the classification F1 index of each model. Four of the figures are public datasets of encrypted traffic.

[0113] It should be noted that the above embodiments are not intended to limit the protection scope of the present invention, and equivalent changes or substitutions made on the basis of the above technical solutions all fall within the protection scope of the claims of the present invention.

Claims

1. An encrypted traffic classification method based on a mixture of graph structure and dual-channel sequence features, characterized in that: The steps include: (1) Based on the communication mode of encrypted traffic and the paradigm of public encryption protocols, data flow preprocessing is performed on the pcap file of the public data set traffic data, the encrypted traffic is grouped, the upstream and downstream messages of the flow are distinguished, and the traffic sequence form is generated in the form of message tuples (message length, time interval). (2) Based on the client-server model of encrypted traffic transmission, two types of nodes (uplink messages and downlink messages) and three typical heterogeneous edge connection modes between messages (same-direction continuous messages, traffic direction change messages, and second-order same-direction messages) are designed in the communication process to construct the graph structure feature MTIG of encrypted traffic interaction from a global perspective. (3) Based on the dual-channel modal coding architecture, the traffic sequence of the packet binary (packet length, time interval) obtained by data preprocessing in step (1) is used as the original data, and word embedding and position encoding operations are performed on the two sequence features of packet length and packet time in parallel. The obtained feature vectors are respectively input into the encoder analysis of the packet length and packet time of the Transformer architecture in parallel, and the features of the two modes are fused to form node content features. (4) Based on the encrypted traffic message-aware graph Transformer architecture, the encrypted traffic interaction graph structure features generated in step (2) are combined to extract the degree information to generate a centrality encoding feature, which is then fused with the node content feature Node Features generated in step (3) as the input of the graph Transformer architecture; the topological space information is extracted from the encrypted traffic interaction graph structure generated in step (2) to form an edge information encoding feature to guide the attention mechanism module.

2. The encrypted traffic classification method based on the hybrid of graph structure and dual-channel sequence features according to claim 1 is characterized in that: The step (1) specifically includes the following sub-steps: (1.1) Self-collection of mobile terminal traffic is to use the UI controls on the mobile terminal to monitor the running mobile application software, capture and collect the pcap file format traffic corresponding to the running software, (1.2) Download the public encrypted traffic datasets including ISCX VPN dataset, ISCX Tor dataset, QUIC2019 dataset and CICIoT dataset. (1.2.1) Perform flow preprocessing on this part of the data set. Use the traffic preprocessing tool dpkt to read the unique five-tuple identifier of each flow (source IP, sink IP, source port, sink port, transport layer protocol), and express it in the form of a dictionary key = (src_ip, dst_ip, src_port, dst_port, prot). Complete the flow grouping of each pcap file (including the corresponding label). (1.2.2) Use the dpkt library to read the payload length pkt_len and timestamp of each packet in the stream, and obtain the characteristic sequence of the stream's packets (length, time tuples) according to the time sequence of the timestamp. (1.3) For the traffic samples under each protocol, for each flow (five-tuple label), capture the length pkt_len of each message in time sequence, and obtain the traffic time sequence of the message length on the TCP layer. (1.4) According to the characteristics of TCP messages between client and server, the length of TCP payload is obtained by subtracting the TCP header from each message, and the timestamp value of the message is subtracted and normalized to relative time recorded as ts. The absolute time of the initial test message is set to 0. (1.5) Based on the preprocessing of the message sequence length and time characteristics of the encrypted traffic in (1.3) and (1.4), the message sequence form of the traffic is generated (with (message length, time interval) tuple as the message unit).

3. The encrypted traffic classification method based on the hybrid of graph structure and dual-channel sequence features according to claim 2 is characterized in that: The specific requirements of step (2) are: (2.1) Based on the message sequence form of the traffic obtained in step (1) (with (message length, time interval) tuple as the message unit), extract the encrypted traffic message length sequence in time order and construct the message-level traffic interaction graph MTIG. (2.1.1) Based on the bidirectionality of the traffic transmission process, set two heterogeneous message node types, upstream and downstream. Set the request message sent by the client to the server as the upstream message traffic, and set the corresponding message downloaded by the client from the server as the downstream message traffic. (2.1.2) Combined with the bidirectional message sequence of the traffic obtained in (2.1.1) above, the message unit of the client-server communication is composed of multiple unidirectional continuous messages, that is, a message unit Message is obtained by aggregating multiple unidirectional continuous messages. (2.2) Based on the message sequence form of the traffic obtained in step (1) (with (message length, time interval) tuple as the message unit), extract the encrypted traffic message length sequence in time order and construct the message-level traffic interaction graph MTIG. (2.2.1) Traverse the sequence of each flow in time order, connect the message nodes with the same uplink and downlink directions set in (2.1.1) and continuous in space, and generate a continuous unidirectional edge feature type SUE (Successive Unidirectional Edge). (2.2.2) Traverse the sequence of each flow in time order. Combined with the characteristic that the direction of the message communicated between the client and the server will change during traffic transmission, connect the message direction change positions set in (2.1.1) above, that is, the nodes where two messages are continuous and in opposite directions in space, and generate the edge feature type CDE (Changed Directional Edge) of the traffic communication direction change. (2.2.3) Traverse the sequence of each flow in time order. On the basis of the above two edge types (2.2.1) and (2.2.2), add a higher-order message continuity feature, specifically connecting the last message of the previous message and the first message of the next message in two consecutive messages (second-order continuous neighbor nodes) to generate a second-order continuous unidirectional edge feature type 2UE (Secondary Unidirectional Edge). (2.3) Combining the construction methods of the three edge feature types described in (2.2.1), (2.2.2) and (2.2.3) above, the edge attributes of the spatial structural characteristics of the global traffic are obtained, and the message-level traffic interaction graph MTIG is generated, which contains two elements: nodes V (uplink message nodes and downlink message nodes) and edges E (three edge types: SUE, CDE and 2UE).

4. The encrypted traffic classification method based on the hybrid of graph structure and dual-channel sequence features according to claim 3 is characterized in that: The step (3) specifically comprises the following steps: (3.1) Based on the packet sequence form of the traffic obtained in step (1) (with (packet length, time interval) tuple as the packet unit), separate the packet length sequence and the packet time sequence in parallel as input, (3.1.1) Based on the message length sequence input, word embedding and position encoding operations are performed, and the feature sequence of the message length is obtained by adding them. The length encoder of the Transformer architecture is input to extract the length encoding feature. The formula is: L out =TransformerEncoder L (length embed ,mask) (3.1.2) Based on the message time series input, word embedding and position encoding operations are performed synchronously and in parallel, and the feature sequence of message time intervals is obtained by adding them together. The feature sequence is input into the time encoder of the Transformer architecture for time coding feature extraction. out = TransformerEncoder T (time embed ,mask) (3.2) For the Transformer architecture encoder in (3.1), the input sequence features are used to solve the long dependency problem using the attention mechanism, which specifically corresponds to the long flow data in the traffic. (3.2.1) Attention mechanism Attention sets query Q, keyword K and value V three key parameter vector learning (3.1) The word embedding form Z of the message feature sequence is obtained, and W is optimized through the parameter learning mechanism of the neural network q ,W k ,W v The three feature matrices are as follows: (Q, K, V) = (W q *Z,W k *Z,W v *Z) (3.2.2) For (3.2.1) above, use the dot product function on the query Q, keyword K (matrix transposed to K T for matrix calculations), used to reduce the dimension to The probability distribution function obtained by the softmax function constraint model is multiplied by the value V to obtain the weighted sum of the categories. The formula is: (3.3) Use the concatenation function Concat in Pytorch to fuse the two modal information of message length and time in (3.1.1) and (3.1.2), and aggregate them to obtain the message node features Node Features, whose formula is: Node embed =MLP(Concat[L out ,T out ]) (3.4) Based on the message node features obtained in (3.3), they are used as the content feature part of the input to the graph Transformer network; at the same time, this part of the information set is also used for the spatial coding matrix as the information input of the matrix.

5. The encrypted traffic classification method based on the hybrid of graph structure and dual-channel sequence features according to claim 4 is characterized in that: The step (4) specifically comprises the following steps: (4.1) Establish a centrality encoding for characterizing the spatial location information of the message-level traffic interaction graph structure MTIG, and encode the position word embedding vector z from the node degree information deg (v) and added to the node features (originally x v ) to get x v (0) , whose formula is x v (0) =x v +z deg (v) (4.2) A quantitative function is established to characterize the spatial correlation in the message-level traffic interaction graph structure MTIG. Specifically, for any two eigenvectors (v i ,v j ), calculate the corresponding shortest path function Floyd (expressed as φ(v i ,v j ), in the self-attention mechanism (the calculation method is described in (3.2.2), h i and h j Corresponding query, W Q and W K The learnable matrix corresponding to the two eigenvectors) adds a learnable parameter bias term (b is the bias) expressed as b φ (v i ,v j ), whose formula is (4.3) Based on the self-attention mechanism formula in (4.2) and the added bias information, the edge encoding matrix Edge Encoding is introduced to quantify the shortest path association between node pairs ( Corresponding to the nth edge e n The corresponding weight item w n E ), perform an average dot product operation on the shortest path vector of the edge (N corresponds to the number of vectors), and introduce a learnable word embedding matrix, whose formula is (4.4) Based on the edge encoding matrix Edge Encoding introduced in (4.3) above, the original spatial feature matrix is ​​modified and added to the self-attention mechanism. The formula is the self-attention mechanism in (4.2) combined with the spatial features of the bias term, plus the edge encoding matrix Edge Encoding in (4.3), to obtain the final modified attention mechanism that introduces spatial features. (4.5) Based on the node feature input of the dual-channel sequence feature mixture obtained in (3.4) and the self-attention module designed in (4.4) to integrate spatial feature information, a graph Transformer network DigTraffic is constructed for the recognition of message-level traffic interaction graph structure MTIG, which is used to classify encrypted traffic in public datasets and self-collected datasets.

6. An encrypted traffic classification system based on a hybrid of graph structure and dual-channel sequence features, characterized in that: The method for classifying encrypted traffic based on a mixture of graph structure and dual-channel sequence features is used to implement any one of claims 1-5, wherein the classification system includes an encrypted traffic collection and preprocessing module, a message-level traffic interaction graph MTIG construction module, a dual-channel modal message length and time series encoder module, and a message-aware encrypted traffic classification model training module based on a graph Transformer architecture, wherein the encrypted traffic collection and preprocessing module in the first part uses a public traffic collection tool to capture and collect encrypted traffic in an actual network environment, and at the same time performs preprocessing such as grouping according to the transport layer protocol of the traffic, and constructs a message sequence sample set of the encrypted traffic, wherein the message unit is a binary feature of the message payload length and the time interval; The message-level traffic interaction graph MTIG construction module in the second part, based on the communication process of encrypted traffic, globally constructs the message-level message interaction graph structure within the flow, and designs three heterogeneous typical edge connection methods in the graph structure (same-direction continuous messages, traffic direction change messages, and second-order same-direction messages), which characterizes the global communication mode of the client-server in multiple dimensions and fully explores the spatial correlation representation form of the global traffic. The message length and time series encoder module of the dual-channel modality in the third part, based on the dual-channel modality encoder structure, uses the Transformer network to parallel encode the length and time interval sequence of the encrypted traffic message, and fuses the above two parallel features to generate node features NodeFeatures; the message-aware encrypted traffic classification model training module based on the graph Transformer architecture in the fourth part, based on the message-aware graph Transformer architecture, hybrid node information embedding layer, and combined with the edge-based spatial relationship information to design the attention mechanism, globally capture the spatial structure information of the encrypted traffic in the form of graph input, thereby completing the encrypted traffic classification task under a variety of public and non-public data sets with high precision.

Images