An encrypted traffic classification method based on a graph structure and a double-channel sequence feature mixture

Abstract

The application provides an encrypted traffic classification method based on a graph structure and a double-channel sequence feature mixture, and specific steps are as follows: 1) based on the communication process of encrypted traffic, an inter-message graph structure of the message level in the flow is constructed, three kinds of typical edge connection modes (same direction continuous message, flow direction change message, second order same direction message) are designed in the graph structure, and the global communication mode of the client-server is represented in multiple dimensions; 2) based on a double-channel modal encoder structure, a Transformer network is used to encode the length and time interval sequence of the encrypted traffic message in parallel, and the above two parallel features are fused to generate node features Node Features; 3) based on the message-aware graph Transformer architecture, a node information embedding layer is mixed, and an attention Attention mechanism is designed in combination with the spatial relationship information based on the edge, and the spatial structure information of the encrypted traffic in the form of the graph input is globally captured, so that the encrypted traffic classification task under multiple public and non-public data sets is completed with high precision.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of cyberspace security, and relates to an encrypted traffic classification method based on a graph structure and a double-channel sequence feature mixture. BACKGROUND

[0002] With the widespread use of encrypted traffic in the network, encrypted traffic classification has become an important network analysis technology, which aims to enable third-party passive observers or regulators to accurately identify application or web activity categories from encrypted traffic.

[0003] Through encrypted traffic classification, the content categories of the traffic can be understood, so that the network operator department can quickly respond and develop customized network management strategies, thereby improving service quality and protecting user experience, and also supporting different business objectives.

[0004] However, with the increasing use of encrypted traffic and anonymous network technology, the analysis of encrypted traffic becomes complex and difficult, and existing methods are difficult to accurately classify complex traffic patterns. Therefore, to establish a perfect traffic analysis framework to achieve more accurate classification, it is necessary to mine the potential strong representation of the spatial information of encrypted traffic and the interaction between messages.

[0005] Current domestic and foreign researchers usually adopt various technical means, which can be roughly divided into methods based on traditional machine learning and methods based on deep learning. The traditional method relies on manual extraction of various high-order features for machine learning model training, which requires a large amount of human resources to design features and is prone to model overfitting defects. On the other hand, most deep learning methods directly input the sequence features of the original traffic, which lack the original representation of the semantic association between messages in the traffic from a global perspective, resulting in less-than-expected model classification effect. In essence, these methods not only lack the global spatial feature mining of the inter-message association relationship in the encrypted traffic transmission mode, but also do not fully utilize the various modal features of the traffic. SUMMARY

[0006] In view of the problems that the existing encrypted traffic classification technology ignores the message association and spatial relationship between messages in the network transmission mode of encrypted traffic, fails to essentially depict the global characteristics of encrypted traffic sequence, and lacks a powerful model to mine the spatial feature information hidden in the traffic, the application provides an encrypted traffic classification scheme based on a graph structure and mixed double-channel sequence features. Compared with the existing encrypted traffic classification method, the scheme constructs a global traffic interaction graph, aiming to obtain more global, essential and accurate encrypted traffic representation, and is suitable for the mixed traffic message interaction and complex environment of traffic confusion in real networks. The application realizes an end-to-end solution of encrypted traffic collection and preprocessing, message-level traffic interaction graph construction, double-channel modal traffic length and time sequence encoder, and message-aware encrypted traffic classification model training based on a graph Transformer architecture, ensuring the accuracy and robustness of the model running for encrypted traffic classification training. Further, the method is good at representing the spatial message interaction features in the communication mode of encrypted traffic from a global perspective, and simultaneously utilizes multiple modal data of traffic, so that the scheme can accurately classify and identify the encrypted traffic classification tasks of multiple data sets.

[0007] To achieve the above purpose, the application provides the following technical scheme:

[0008] An encrypted traffic classification method based on a graph structure and mixed double-channel sequence features, the method comprising the following steps:

[0009] (1) Based on the communication mode of encrypted traffic and the paradigm of public encryption protocol, data stream preprocessing is performed on the pcap file of public data set traffic data, the encrypted traffic is grouped, the uplink and downlink messages of the stream are distinguished, and the traffic sequence form in the unit of message binary tuple (message length, time interval) is generated,

[0010] (2) Based on the client-server mode of encrypted traffic transmission, two kinds of nodes (uplink messages and downlink messages) and three typical message hetero-edge connection modes (homodirectional continuous messages, traffic direction changing messages, and second-order homodirectional messages) in the communication process are designed to construct the graph structure features MTIG of encrypted traffic interaction from a global perspective,

[0011] (3) Based on a double-channel modal coding architecture, the traffic sequence of the message binary tuple (message length, time interval) obtained by the data preprocessing in step (1) is taken as the original data, and the word embedding Embedding and position coding operations are performed on the message length and message time two sequence features in parallel, the obtained feature vectors are respectively and in parallel input into the message length and message time encoders of the Transformer architecture for analysis, and the features of the two modalities are fused to form the node content features Node Features,

[0012] (4) Based on the encrypted traffic message-aware graph transformer architecture, the encrypted traffic interaction graph structure features generated in step (2) are combined to extract the degree information to generate centrality encoding features. This feature is fused with the node content features generated in step (3) as the input of the graph transformer architecture; the topological space information is extracted from the encrypted traffic interaction graph structure generated in step (2) to form edge information encoding features to guide the attention mechanism module. This method demonstrates excellent encrypted traffic classification task capabilities and strong robustness on four widely used public datasets and one self-collected traffic dataset.

[0013] Furthermore, the step (1) specifically includes the following sub-steps:

[0014] (1.1) Self-collection of mobile terminal traffic is to use the UI control on the mobile terminal to monitor the running mobile application software, capture and collect the traffic in the form of pcap files corresponding to the running software,

[0015] (1.2) Download the public encrypted traffic datasets including ISCX VPN dataset, ISCX Tor dataset, QUIC2019 dataset and CICIoT dataset.

[0016] (1.2.1) Perform flow preprocessing on this part of the data set. Use the traffic preprocessing tool dpkt to read the unique five-tuple identifier of each flow (source IP, sink IP, source port, sink port, transport layer protocol), express it in the dictionary form key = (src_ip, dst_ip, src_port, dst_port, prot), and complete the flow grouping (including the corresponding tags) in each pcap file.

[0017] (1.2.2) Use the dpkt library to read the payload length (pkt len) and timestamp of each packet in the flow, and obtain the characteristic sequence of the flow's packets (length, time tuples) according to the time sequence of the timestamp.

[0018] (1.3) For the traffic samples under each protocol, for each flow (five-tuple label), capture the length pkt_len of each message in time sequence, and obtain the traffic time series of message length on the TCP layer.

[0019] (1.4) Based on the characteristics of the TCP message between the client and the server, the TCP header of each message is subtracted to obtain the length of the TCP payload. At the same time, the timestamp value of the message is subtracted and normalized to a relative time denoted as ts. The absolute time of the initial test message is set to 0.

[0020] (1.5) Based on the preprocessing of the message sequence length and time characteristics of the encrypted traffic in (1.3) and (1.4), the message sequence form of the traffic is generated (with (message length, time interval) binary tuple as message unit).

[0021] Further, the step (2) specifically includes the following sub-steps:

[0022] (2.1) Based on the message sequence form of the traffic obtained in step (1) (with (message length, time interval) binary tuple as message unit), the encrypted traffic message length sequence is extracted in time sequence, and a message-level traffic interaction graph MTIG is constructed,

[0023] (2.1.1) Based on the bidirectionality of the traffic transmission process, set two heterogeneous message node types of uplink and downlink, set the request message sent by the client to the server as uplink message traffic, and set the message downloaded by the client from the server as downlink message traffic,

[0024] (2.1.2) Combined with the bidirectional message sequence of the traffic obtained in the above (2.1.1), the message unit of the client-server communication is composed of a plurality of unidirectional continuous messages, that is, a plurality of continuous messages in the same direction are aggregated to obtain a message unit Message,

[0025] (2.2) Based on the message sequence form of the traffic obtained in step (1) (with (message length, time interval) binary tuple as message unit), the encrypted traffic message length sequence is extracted in time sequence, and a message-level traffic interaction graph MTIG is constructed,

[0026] (2.2.1) Traverse the sequence of each flow in time sequence, connect the message nodes in the same uplink or downlink direction set in the above (2.1.1) and spatially continuous, and generate a continuous unidirectional edge feature type SUE (Successive Unidirectional Edge),

[0027] (2.2.2) Traverse the sequence of each flow in time sequence, combined with the characteristic that the message of the client and the server communication will change direction in the traffic transmission, connect the message direction change position set in the above (2.1.1), that is, the nodes that are spatially continuous and opposite in direction, generate a traffic communication direction change edge feature type CDE (Changed Directional Edge),

[0028] (2.2.3) Time series traversal of each flow sequence, based on the two edge types of (2.2.1) and (2.2.2) above, adding high-order message continuity features, specifically connecting the last message of the first message and the first message of the second message in two consecutive messages (two-order continuous neighbor nodes), generating a two-order continuous unidirectional edge feature type 2UE (Secondary Unidirectional Edge),

[0029] (2.3) Based on the construction method of the three edge feature types of (2.2.1), (2.2.2) and (2.2.3) above, the edge attribute of the spatial structure feature of the global flow is obtained, and a message-level traffic interaction graph MTIG is generated, which contains two elements of nodes V (uplink message nodes and downlink message nodes) and edges E (three edge types of SUE, CDE and 2UE).

[0030] Further, the step (3) specifically comprises the following sub-steps:

[0031] (3.1) Based on the message sequence form (with (message length, time interval) binary tuple as message unit) of the flow obtained in step (1), separate the message length sequence and the message time sequence as input in a parallel manner,

[0032] (3.1.1) Based on the message length sequence input, perform word embedding Embedding and position encoding operation, and add to obtain the feature sequence of the message length, input the length encoder of the Transformer architecture for length coding feature extraction, and the formula is

[0033] L out =TransformerEncoder L (length embed ,mask)

[0034] (3.1.2) Based on the message time sequence input, synchronously and in parallel, perform word embedding Embedding and position encoding operation, and add to obtain the feature sequence of the message time interval, input the time encoder of the Transformer architecture for time coding feature extraction,

[0035] T out =TransformerEncoder T (time embed ,mask)

[0036] (3.2) For the Transformer architecture encoder in (3.1), input the sequence feature, and use the attention mechanism to solve the long dependence problem, which corresponds to the long flow data in the traffic,

[0037] (3.2.1) The attention mechanism Attention set query Q, keyword K and value V three key parameter vectors learn the word embedding form Z of the message feature sequence obtained in (3.1), and optimize W through the parameter learning mechanism of the neural network q ,W k ,W v Three feature matrices, the formula is

[0038] (Q,K,V)=(W q *Z,W k *Z,W v *Z)

[0039] (3.2.2) For (3.2.1) above, use the dot product function to act on the query Q and the keyword K (matrix transpose K T for matrix calculation), to reduce the dimension to Use the softmax function to constrain the probability distribution function obtained by the model, and multiply the value V to obtain the weight accumulation sum of the category, the formula is

[0040]

[0041] (3.3) Use the concatenation function Concat in Pytorch to fuse the message length and time two modal information in (3.1.1) and (3.1.2), and aggregate to obtain the message node feature Node Features, the formula is

[0042] Node embed =MLP(Concat[L out ,T out ])

[0043] (3.4) Based on the message node feature Node Features obtained in (3.3), as the content feature part of the input of the graph Transformer network; At the same time, this part of information set is also used for spatial coding matrix, as the information input of the matrix.

[0044] Further, the step (4) specifically comprises the following sub-steps:

[0045] (4.1) Establish the centrality encoding Centrality Encoding for representing the spatial position information of the message-level traffic interaction graph MTIG, encode the position word embedding vector z deg (v) from the degree information of the node, and add it to the node feature Node Features (originally x v ) to obtain x v (0) , the formula is

[0046] x v (0) = x v + z deg (v)

[0047] (4.2) Establish a quantification function for characterizing the spatial correlation in the message-level traffic interaction graph structure MTIG, specifically for any two feature vectors (v i , v j ), calculate its corresponding shortest path function Floyd (denoted as φ(v i , v j )), add a learnable parameter bias term (b is the bias bias) to the self-attention mechanism (the calculation method is described in (3.2.2), h i and h j correspond to the query, W Q and W K correspond to the learnable matrix of the two feature vectors) denoted as b φ (v i , v j ), the formula is

[0048]

[0049] (4.3) Based on the self-attention mechanism formula in (4.2) above and the added bias term information, the edge encoding matrix Edge Encoding is introduced to quantify and evaluate the shortest path correlation between node pairs (w n corresponds to the weight term w n E of the nth edge e out ), the shortest path vector of the edge is averaged dot product operation (N corresponds to the number of vectors), and the learnable word embedding matrix is introduced, the formula is

[0050]

[0051] (4.4) Based on the edge encoding matrix Edge Encoding introduced in (4.3) above, modify the original spatial feature matrix and add it to the self-attention mechanism, the formula is (4.2) The spatial features of the self-attention mechanism combined with the bias term plus (4.3) The edge encoding matrix EdgeEncoding of the edge, get the final modified attention mechanism with spatial features,

[0052]

[0053] (4.5) Based on the node feature input mixed by the double-channel sequence features obtained in (3.4) and the self-attention module designed in (4.4) to fuse spatial feature information, a graph Transformer network DigTraffic for message-level traffic interaction graph structure MTIG recognition is constructed, which is used for encrypted traffic classification of public data sets and self-collected data sets.

[0054] The performance quantification of the encrypted traffic classification task can be embodied as the classification accuracy Precision of unknown category traffic by the model method DigTraffic trained by the scheme in an open world network environment, and the discount graph distribution result is as shown in Figure 2 The horizontal coordinate represents the number of unknown categories input into the model, and the vertical coordinate represents the classification accuracy of each model, wherein the comparison method is a bidirectional LSTM model bi-LSTM, a Transformer model and a graph attention neural network model GAT; the robustness quantification of the encrypted traffic classification task can be embodied as the classification F1 index associated with the different packet sequence lengths input into the model, and the discount graph distribution result is as shown in Figure 2 The horizontal coordinate represents the number of unknown categories input into the model, and the vertical coordinate represents the classification accuracy of each model, wherein the comparison method is a bidirectional LSTM model bi-LSTM, a Transformer model and a graph attention neural network model GAT; the robustness quantification of the encrypted traffic classification task can be embodied as the classification F1 index associated with the different packet sequence lengths input into the model, and the discount graph distribution result is as shown in

[0055] Compared with the prior art, the present application has the following advantages and beneficial effects:

[0056] (1) The designed message-level traffic interaction graph structure MTIG fully considers the packet association relationship mode in the information interaction of the flow in the client-server communication mode. MTIG uses the data packet level information as the node to learn the inherent semantic relationship in the message-level interaction, and can grasp the traffic spatial dimension characteristics from a global perspective.

[0057] (2) The double-channel modal encoder architecture used can parallelly mine the features in two typical modalities of packet length and packet time interval, thereby fully utilizing the multiple paradigms of traffic, enhancing the node information at the packet level and the sequence level, and enabling the neural network model to learn the characteristics of the traffic from multiple different angles.

[0058] (3) The network communication process of encrypted traffic is mined, and a message-aware graph Transformer neural network structure is constructed, which can adapt to the message-level traffic interaction graph structure MTIG designed in (1) and simultaneously integrate the spatial structure characteristics implied in the traffic heterogeneous graph, for optimizing the attention mechanism module and better representing the essential message interaction mode of encrypted traffic, thereby realizing multiple high-accuracy encrypted traffic classification tasks.

[0059] Overall, the present application realizes deep mining of message interaction features and global traffic space features in encrypted traffic by deeply designing the graph structure of message-level traffic interaction, the dual-channel modal encoder architecture, and the message-aware graph Transformer neural network structure, and can achieve high-precision encrypted traffic classification and recognition effect under multiple data sets, which is of great significance for helping regulatory units or network service providers to strengthen network service supervision and protect user privacy of application services. BRIEF DESCRIPTION OF DRAWINGS

[0060] Figure 1 For the encrypted traffic classification method based on graph structure and dual-channel sequence feature mixing,

[0061] Figure 2 For the classification accuracy line graph of the present method under the open world environment for the ISCX2016-VPN public data set,

[0062] Figure 3 For the classification F1 line graph of the present method under the change of input message sequence length for four public data sets.

[0063] DETAILED DESCRIPTION

[0064] The technical solutions provided by the present application will be described in detail below in conjunction with specific embodiments, and it should be understood that the following specific embodiments are only used to illustrate the present application and not to limit the scope of the present application.

[0065] Embodiment 1: The application proposes an encrypted traffic classification system based on a graph structure and a mixed dual-channel sequence feature, mainly composed of four parts: an encrypted traffic collection and preprocessing module, a message-level traffic interaction graph (MTIG) construction module, a dual-channel modality message length and time sequence encoder module, and a message-aware encrypted traffic classification model training module based on a graph Transformer architecture. The first part of the encrypted traffic collection and preprocessing module uses a public traffic collection tool to capture and collect encrypted traffic in an actual network environment, and performs preprocessing work such as flow grouping according to the transmission layer protocol of the traffic, to construct a message sequence sample set of encrypted traffic, with the message unit being a two-tuple feature of message payload length and time interval. The second part of the message-level traffic interaction graph (MTIG) construction module is based on the communication process of encrypted traffic, and globally constructs the inter-message graph structure within the flow, with three kinds of heterogeneous typical edge connection modes (same-direction continuous messages, flow direction changing messages, and second-order same-direction messages) designed in the graph structure to represent the global communication mode of the client-server in multiple dimensions and fully exploit the spatial correlation representation form of the global traffic. The third part of the dual-channel modality message length and time sequence encoder module uses a dual-channel modality encoder structure to parallelly encode the length and time interval sequence of encrypted traffic messages using a Transformer network, and fuses the above two parallel features to generate node features. The fourth part of the message-aware encrypted traffic classification model training module based on a graph Transformer architecture mixes node information embedding layers and designs an attention mechanism based on edge spatial relationship information, globally capturing the spatial structure information of encrypted traffic in the form of graph input, thereby completing the encrypted traffic classification task on multiple public and non-public data sets with high precision.

[0066] Embodiment 2: A method for encrypted traffic classification based on a graph structure and a mixed dual-channel sequence feature, the method comprising the following steps:

[0067] (1) Use a public traffic collection tool to capture and collect encrypted traffic in an actual network environment, and perform preprocessing work such as flow grouping according to the transmission layer protocol of the traffic, to construct a message sequence sample set of encrypted traffic, with the message unit being a two-tuple feature of message payload length and time interval. At the same time, the traffic of the public data set is preprocessed in the same way to obtain the message sequence sample set of encrypted traffic of the public data set;

[0068] The specific process of this step is as follows:

[0069] (1.1) Self-collected mobile terminal traffic is to monitor the running mobile application software on the UI control of the mobile terminal, capture and collect the traffic in the form of pcap file corresponding to the running software,

[0070] (1.2) Download public encrypted traffic dataset, which is VPN dataset of ISCX, Tor dataset of ISCX, QUIC2019 dataset and CICIoT dataset,

[0071] (1.2.1) Flow preprocessing is performed on this part of the dataset, and the unique five-tuple identifier (source IP, destination IP, source port, destination port, transmission layer protocol) of each flow is read using the flow preprocessing tool dpkt, which is represented as a dictionary form key=(src_ip,dst_ip,src_port,dst_port,prot), and the flow (including the corresponding label) in each pcap file is grouped,

[0072] (1.2.2) Using the dpkt library, read the payload length pkt_len and timestamp of each packet in the flow, and get the packet (length, time two-tuple) feature sequence of the flow according to the time sequence of the timestamp,

[0073] (1.3) For each flow (five-tuple label) under each protocol, the length pkt_len of each packet is captured in time sequence to obtain the traffic time sequence of the packet length on the TCP layer,

[0074] (1.4) For the TCP packet characteristics of the client-server, the length of the TCP payload is obtained by subtracting the TCP header from each packet, and the timestamp timestamp value of the packet is subtracted and normalized as relative time ts, and the absolute time of the initial packet is set to 0,

[0075] (1.5) Based on the preprocessing of the packet sequence length and time characteristics of the encrypted traffic in (1.3) and (1.4), the packet sequence form of the traffic is generated (with (packet length, time interval) two-tuple as packet unit).

[0076] (2) Based on the communication process of encrypted traffic, the inter-packet interaction graph structure of the message level in the flow is constructed globally, three kinds of typical edge connection modes (same direction continuous packet, flow direction changing packet, two-order same direction packet) are designed in the graph structure, to represent the global mode of client-server communication in multiple dimensions, further mine the spatial interaction characteristics of the traffic and form the essential representation form.

[0077] The specific process of this step is as follows:

[0078] (2.1) Based on the message sequence form of the traffic obtained in step (1) (with (message length, time interval) binary tuple as message unit), the encrypted traffic message length sequence is extracted in time sequence, and the message level traffic interaction graph MTIG is constructed,

[0079] (2.1.1) Based on the bidirectionality of the traffic transmission process, set two kinds of heterogeneous message node types of uplink and downlink, set the request message sent by the client to the server as the uplink message traffic, and set the message downloaded by the client from the server as the downlink message traffic,

[0080] (2.1.2) Combined with the bidirectional message sequence of the traffic obtained in (2.1.1) above, the message unit of client-server communication is composed of a plurality of unidirectional continuous messages, that is, a plurality of continuous same direction messages are aggregated to obtain a message unit Message,

[0081] (2.2) Based on the message sequence form of the traffic obtained in step (1) (with (message length, time interval) binary tuple as message unit), the encrypted traffic message length sequence is extracted in time sequence, and the message level traffic interaction graph MTIG is constructed,

[0082] (2.2.1) Time sequence traverses the sequence of each flow, connects the message nodes in the same uplink and downlink direction set in (2.1.1) above, and generates the continuous same direction edge feature type SUE (Successive Unidirectional Edge),

[0083] (2.2.2) Time sequence traverses the sequence of each flow, and combines the characteristics that the message of the client and the server communication in the traffic transmission will change direction, connects the message direction change position set in (2.1.1) above, that is, the nodes that are spatially continuous and opposite in direction, to generate the edge feature type CDE (Changed Directional Edge) of traffic communication direction change,

[0084] (2.2.3) Time sequence traverses the sequence of each flow, and on the basis of the two edge types in (2.2.1) and (2.2.2) above, increases the high-order message continuity feature, which is to connect the last message of the first message and the first message of the second message in two consecutive messages (two-order continuous neighbor nodes), to generate the two-order continuous same direction edge feature type 2UE (Secondary Unidirectional Edge),

[0085] (2.3) Combined with the construction methods of the three edge feature types described in (2.2.1) and (2.2.2) and (2.2.3), the edge attribute of the spatial structure feature of the global flow is obtained, and a message-level traffic interaction graph MTIG is generated, which contains two elements of nodes V (uplink packet nodes and downlink packet nodes) and edges E (SUE, CDE and 2UE three edge types).

[0086] (3) Based on the dual-channel modal encoder structure, the length and time interval sequence of encrypted traffic packets are encoded in parallel using the Transformer network, and the above two parallel features are fused to generate node features Node Features; to help the neural network learn the key feature form of the traffic packet sequence from multiple modal angles in parallel.

[0087] The specific process of this step is as follows:

[0088] (3.1) Based on the traffic packet sequence form obtained in step (1) (with (packet length, time interval) binary tuple as packet unit), separate the packet length sequence and packet time sequence as input in parallel,

[0089] (3.1.1) Based on the packet length sequence input, perform word embedding Embedding and position encoding operation, and add to obtain the feature sequence of the packet length, input the length encoder of the Transformer architecture for length coding feature extraction, and the formula is

[0090] L out =TransformerEncoder L (length embed ,mask)

[0091] (3.1.2) Based on the packet time sequence input, perform word embedding Embedding and position encoding operation in parallel, and add to obtain the feature sequence of the packet time interval, input the time encoder of the Transformer architecture for time coding feature extraction,

[0092] T out =TransformerEncoder T (time embed ,mask)

[0093] (3.2) For the Transformer architecture encoder in (3.1), input the sequence feature, and use the attention mechanism to solve the long dependence problem, which corresponds to the long flow data in the traffic,

[0094] (3.2.1) The attention mechanism Attention set query Q, keyword K and value V three key parameter vectors learn the word embedding form Z of the message feature sequence obtained in (3.1), and optimize W through the parameter learning mechanism of the neural network q ,W k ,W v Three feature matrices, whose formulas are

[0095] (Q,K,V)=(W q *Z,W k *Z,W v *Z)

[0096] (3.2.2) For (3.2.1) above, use the dot product function to act on the query Q and the keyword K (matrix transpose K T for matrix calculation), to reduce the dimension to Use the softmax function to constrain the probability distribution function obtained by the model, and multiply the value V to obtain the weight accumulation sum of the category, whose formula is

[0097]

[0098] (3.3) Use the concatenation function Concat in Pytorch to fuse the message length and time two modal information in (3.1.1) and (3.1.2), and aggregate the message node features Node Features, whose formula is

[0099] Node embed =MLP(Concat[L out ,T out ])

[0100] (3.4) Based on the message node features Node Features obtained in (3.3), as the content feature part of the input of the graph Transformer network; at the same time, this part of information set is also used for spatial coding matrix, as the information input of the matrix.

[0101] (4) Based on the message-aware graph Transformer architecture design of the encrypted traffic classifier DigTraffic, the hybrid node information embedding layer is combined with the attention mechanism based on the edge spatial relationship information, and the global graph input form of the encrypted traffic spatial structure information is captured, so as to complete the encrypted traffic classification task with high precision under multiple public and non-public data sets.

[0102] The specific process of this step is as follows:

[0103] (4.1) Establish centrality encoding for characterizing the spatial location information of the message-level traffic interaction graph structure MTIG, and encode the position word embedding vector z from the node degree information deg (v) and added to the node features Node Features (originally x v ) to get x v (0) , whose formula is

[0104] x v (0) =x v +z deg (v)

[0105] (4.2) Establish a quantitative function for characterizing the spatial correlation in the message-level traffic interaction graph structure MTIG. Specifically, for any two eigenvectors (v i ,v j ), calculate the corresponding shortest path function Floyd (expressed as φ(v i ,v j )), in the self-attention mechanism (the calculation method is described in (3.2.2), h i and h j Corresponding query, W Q and W K The learnable parameter bias term (b is the bias) is added to the learnable matrix corresponding to the two eigenvectors and is expressed as b φ (v i ,v j ), whose formula is

[0106]

[0107] (4.3) Based on the self-attention mechanism formula in (4.2) and the added bias information, the edge encoding matrix Edge Encoding is introduced to quantify the shortest path correlation between node pairs ( Corresponding to the nth edge e n The corresponding weight item w n E ), perform the average dot product operation on the shortest path vector of the edge (N corresponds to the number of vectors), and introduce a learnable word embedding matrix, whose formula is

[0108]

[0109] (4.4) Based on the edge encoding matrix introduced in the above (4.3), modify the original spatial feature matrix, add it to the self-attention mechanism, and the formula is the spatial feature combined with the bias term in the self-attention mechanism in (4.2), plus the edge encoding matrix EdgeEncoding in (4.3), get the final modified attention mechanism with spatial features,

[0110]

[0111] (4.5) Based on the node feature input of the mixed sequence feature in (3.4), and the self-attention module designed in (4.4) to fuse spatial feature information, construct the graph Transformer network DigTraffic for message-level traffic interaction graph structure MTIG recognition, which is used for encrypted traffic classification of public data sets and self-collected data sets.

[0112] The performance quantification of the encrypted traffic classification task can be embodied as the classification accuracy Precision of unknown class traffic by the model method DigTraffic trained by the scheme in the open world network environment, and the discount graph distribution result is as shown in Figure 2 The horizontal coordinate represents the number of unknown classes input to the model, and the vertical coordinate represents the classification accuracy of each model. The comparison method is a bidirectional LSTM model bi-LSTM, a Transformer model and a graph attention neural network model GAT. The robustness quantification of the encrypted traffic classification task can be embodied as the classification F1 index associated with the different packet sequence lengths input to the model, and the discount graph distribution result is as shown in Figure 2 The horizontal coordinate represents the number of unknown classes input to the model, and the vertical coordinate represents the classification accuracy of each model. The comparison method is a bidirectional LSTM model bi-LSTM, a Transformer model and a graph attention neural network model GAT. The robustness quantification of the encrypted traffic classification task can be embodied as the classification F1 index associated with the different packet sequence lengths input to the model, and the discount graph distribution result is as shown in

[0113] It should be noted that the above embodiments are not intended to limit the scope of protection of the present application, and any equivalent transformations or substitutions made on the basis of the above technical solutions fall within the scope of protection claimed by the present application.

Claims

1. A method for encrypted traffic classification based on graph structure and dual-channel sequence feature mixing, characterized in that, Comprise the following steps: (1) Based on the communication mode of encrypted traffic and the paradigm of public encryption protocol, the data stream preprocessing is performed on the pcap file of public data set traffic data, the encrypted traffic is grouped, the uplink and downlink messages of the stream are distinguished, and the traffic sequence in the form of message binary tuple, i.e. message length and time interval, is generated, (2) Based on the client-server mode of encrypted traffic transmission, two nodes in the communication process, i.e. uplink message and downlink message, and three typical heterogeneous edge connection modes between messages, i.e. same direction continuous message, flow direction changing message and second order same direction message, are designed to construct the graph structure feature MTIG of encrypted traffic interaction from the global perspective, (3) Based on the dual-channel modal encoding architecture, the traffic sequence of message binary tuple obtained by step (1) data preprocessing is taken as the original data, and the word embedding Embedding and position encoding operation are performed on the two sequence features of message length and message time in parallel, the obtained feature vectors are respectively parallel into the message length and message time encoders of the Transformer architecture for analysis, and the features of the two modalities are fused to form the node content feature Node Features, (4) Based on the graph Transformer architecture of encrypted traffic message perception, the degree information is extracted from the encrypted traffic interaction graph structure feature generated in step (2) to generate the centrality encoding feature, which is combined with the node content feature Node Features generated in step (3) to form the input of the graph Transformer architecture; the topological space information is extracted from the encrypted traffic interaction graph structure generated in step (2) to form the edge information encoding feature, which is used to guide the attention mechanism module.

2. The method of claim 1, wherein the method is based on a graph structure and a hybrid of dual-channel sequence features. The step (1) specifically comprises the following sub-steps: (1.1) Self-collected mobile terminal traffic is monitored by using the UI control on the mobile terminal to capture and collect the pcap file form traffic corresponding to the running software, (1.2) Download public encrypted traffic data sets, including VPN data set of ISCX, Tor data set of ISCX, QUIC2019 data set and CICIoT data set, (1.2.1) Stream preprocessing is performed on the part of the data set, and the unique five-tuple identifier of each stream is read by using the traffic preprocessing tool dpkt, i.e. source IP, destination IP, source port, destination port and transmission layer protocol, which is represented as a dictionary form key=(src_ip,dst_ip,src_port,dst_port,prot), and the traffic in each pcap file is grouped, (1.2.2) The load length pkt_len and timestamp of each message packet in the stream are read by using the dpkt library, and the message feature sequence of the stream is obtained according to the time sequence of the timestamp timestamp, (1.3) For each flow, i.e. five-tuple label, the length pkt_len of each message is captured in time sequence for each protocol traffic sample, and the traffic time sequence of the message length on the TCP layer is obtained, (1.4) For the TCP message characteristics of the client-server, subtract the TCP header of each message to get the length of the TCP load, and subtract the timestamp value of the message to normalize the relative time as ts, and set the absolute time of the initial message as 0, (1.5) Based on the preprocessing of the message sequence length and time characteristics of the encrypted traffic in (1.3) and (1.4), the message sequence form of the traffic is generated, and the message length and time interval are taken as the message unit.

3. The method of claim 2, wherein the method is based on a graph structure and a hybrid of dual-channel sequence features. The step (2) specifically requires: (2.1) Based on the message sequence form of the traffic obtained in step (1), the encrypted traffic message length sequence is extracted in time sequence with the message length and time interval as the message unit, and the message level traffic interaction graph MTIG is constructed, (2.1.1) Based on the bidirectionality of the traffic transmission process, set two heterogeneous message node types of uplink and downlink, set the request message sent by the client to the server as the uplink message traffic, and set the message downloaded by the client from the server as the downlink message traffic, (2.1.2) Combine the bidirectional message sequence obtained in (2.1.1) above, the message unit of the client-server communication is composed of a plurality of unidirectional continuous messages, that is, a message unit Message is obtained by aggregating a plurality of continuous messages in the same direction, (2.2) Based on the message sequence form of the traffic obtained in step (1), the encrypted traffic message length sequence is extracted in time sequence with the message length and time interval as the message unit, and the message level traffic interaction graph MTIG is constructed, (2.2.1) Traverse the sequence of each flow in time sequence, connect the message nodes in the same uplink or downlink direction set in (2.1.1) above and continuous in space, generate the continuous unidirectional edge feature type SUE, that is, Successive Unidirectional Edge, (2.2.2) Traverse the sequence of each flow in time sequence, combine the characteristics that the message of the client and the server communication will change direction in the traffic transmission, connect the message direction change position set in (2.1.1) above, that is, the nodes that are continuous in space and opposite in direction, generate the edge feature type CDE of the change of traffic communication direction, that is, Changed Directional Edge, (2.2.3) Traverse the sequence of each flow in time sequence, on the basis of the two edge types in (2.2.1) and (2.2.2) above, increase the high-order message continuity feature, which is to connect the last message of the first message and the first message of the second message in two continuous messages, that is, the second-order continuous neighbor nodes, generate the second-order continuous unidirectional edge feature type 2UE, that is, Secondary Unidirectional Edge, (2.3) Combined with the construction methods of the three edge feature types described in (2.2.1) and (2.2.2) and (2.2.3), the edge attribute of the spatial structure feature of the global flow is obtained, and a message-level traffic interaction graph MTIG is generated, which contains two elements of nodes V, i.e., uplink packet nodes and downlink packet nodes, and edges E, i.e., three edge types of SUE, CDE and 2UE.

4. The method of claim 3, wherein the method is based on a graph structure and a hybrid of dual-channel sequence features. The step (3) specifically comprises the following steps: (3.1) Based on the packet sequence form of the flow obtained in step (1), the packet length and time interval two-tuple are taken as the packet unit, and the packet length sequence and the packet time sequence are separated as inputs in a parallel manner, (3.1.1) Based on the packet length sequence input, word embedding Embedding and position coding operation are performed, and the feature sequence of the packet length is obtained by adding, and the length encoder of the Transformer architecture is input to perform length coding feature extraction, and the formula is L out = TransformerEncoder L (length embed , mask) (3.1.2) Based on the packet time sequence input, word embedding Embedding and position coding operation are synchronously and in parallel, and the feature sequence of the packet time interval is obtained by adding, and the time encoder of the Transformer architecture is input to perform time coding feature extraction, T out = TransformerEncoder T (time embed , mask) (3.2) For the Transformer architecture encoder in (3.1), the sequence features are input, and the attention mechanism is used to solve the long dependence problem, which specifically corresponds to the long flow data in the flow, (3.2.1) The three key parameter vectors of attention mechanism Attention, keyword K and value V learn the word embedding form Z of the message feature sequence obtained in (3.1), and optimize W through the parameter learning mechanism of neural network q ,W k ,W v Three feature matrices, the formula is (Q, K, V) = (W q *Z, W k *Z, W v *Z) (3.2.2) For (3.2.1) above, use dot product function to operate on query Q, keyword K, i.e. matrix transpose is K T For matrix calculation, for reducing dimensionality Use softmax function to constrain the probability distribution function obtained by the model, and multiply the value V to obtain the weight accumulation sum of the category, and the formula is (3.3) The concatenation function Concat in Pytorch is used to fuse the packet length and time two modal information in (3.1.1) and (3.1.2), and the aggregated packet node features Node Features are obtained, and the formula is Node embed = MLP(Concat[L out , T out ]) (3.4) Based on the packet node features Node Features obtained in (3.3), the content feature part of the input of the graph Transformer network is taken; at the same time, the information set of this part is also used for the matrix of spatial coding, as the information input of the matrix.

5. The method of claim 4, wherein the method is based on a graph structure and a hybrid of dual-channel sequence features. The step (4) specifically comprises the following steps: (4.1) Establish a centrality encoding for characterizing message-level traffic interaction graph structure MTIG spatial location information, encode location word embedding vectors z from node degree information deg (v), and add to the node features Node Features to get x v (0) , whose formula is x v (0) = x v + z deg (v) (4.2) Establish a quantification function for characterizing the spatial correlation in the message-level traffic interaction graph structure MTIG, specifically for any two feature vectors (v i ,v j ), calculate its corresponding shortest path function Floyd, denoted as φ(v i ,v j ), and add a learnable parameter bias term to the self-attention mechanism, b as bias denoted as b φ (v i ,v j ), whose formula is (4.3) Based on the self-attention mechanism formula in the above (4.2) and the added bias term information, the edge encoding matrix Edge Encoding is introduced again to quantify the correlation degree between the shortest paths of node pairs, The corresponding weight term w n The corresponding weight term w n E , the shortest path vector of the edge is subjected to an average dot product operation, N corresponds to the number of vectors, and a learnable word embedding matrix is introduced, and the formula is (4.4) Based on the edge encoding matrix Edge Encoding introduced in the above (4.3), the original spatial feature matrix is modified and added to the self-attention mechanism, and the formula is that the spatial feature of the self-attention mechanism combined with the bias term in (4.2) is added to the edge encoding matrix EdgeEncoding in (4.3) to obtain the final modified attention mechanism with spatial features, (4.5) Based on the node feature input of the mixed double-channel sequence features obtained in (3.4) and the self-attention module designed in (4.4) to fuse spatial feature information, a graph Transformer network DigTraffic for message-level traffic interaction graph structure MTIG recognition is constructed, which is used for encrypted traffic classification of public data sets and self-collected data sets.

6. An encrypted traffic classification system based on a hybrid of graph structure and dual-channel sequence features, characterized in that: The application discloses a method for realizing the encryption traffic classification based on the mixed graph structure and double-channel sequence characteristics according to any one of claims 1-5, and the classification system comprises an encryption traffic collection and preprocessing module, a message-level traffic interaction graph (MTIG) construction module, a double-channel mode message length and time sequence encoder module and a message-aware encryption traffic classification model training module based on a graph Transformer architecture, wherein the first part of the encryption traffic collection and preprocessing module is used for realizing the capture and collection of the encryption traffic in an actual network environment by using a public traffic collection tool, performing stream preprocessing work according to the transmission layer protocol of the traffic, and constructing a message sequence sample set of the encryption traffic, and the message unit is a binary tuple feature of the message payload length and the time interval. The second part of the message-level traffic interaction graph (MTIG) construction module is used for globally constructing the inter-message graph structure in the stream according to the communication process of the encryption traffic, designing three kinds of heterogeneous typical edge connection modes in the graph structure, namely the same-direction continuous message, the traffic direction change message and the second-order same-direction message, representing the global communication mode of the client-server in multiple dimensions, and fully mining the spatial correlation representation form of the global traffic, the third part of the double-channel mode message length and time sequence encoder module is used for encoding the length and time interval sequence of the encryption traffic message in parallel by using the Transformer network based on the double-channel mode encoder structure, and fusing the two parallel features to generate the node feature NodeFeatures, and the fourth part of the message-aware encryption traffic classification model training module based on the graph Transformer architecture is used for globally capturing the spatial structure information of the encryption traffic in the form of the graph input by using the message-aware graph Transformer architecture, mixing the node information embedding layer, combining the attention Attention mechanism based on the spatial relationship information of the edge, and thus completing the encryption traffic classification task under multiple public and non-public data sets with high precision.

Images