Power monitoring system encrypted traffic classification method and device, and storage medium

Abstract

The invention relates to an encrypted traffic classification method and device for a power monitoring system and a storage medium, and the method comprises the steps: S1, obtaining original traffic data, converting the original traffic data into a first multi-stage traffic representation matrix, carrying out the random shielding of the first multi-stage traffic representation matrix based on a mask auto-encoder normal form, and carrying out the random shielding of the first multi-stage traffic representation matrix; the input mask carries out matrix restoration in a self-decoder, loss is calculated, iterative training is carried out, and coding parameters are obtained; s2, acquiring marked traffic data, converting the marked traffic data into a second multi-level traffic representation matrix, inputting the second multi-level traffic representation matrix into a packet-level attention module to obtain predicted traffic distribution, calculating loss and performing iterative training to obtain a traffic classifier; and S3, acquiring to-be-detected traffic, and inputting the to-be-detected traffic into the traffic classifier to obtain a classification result. Compared with the prior art, the method has the advantages of realizing efficient classification of the flow of the electric power in an electric power monitoring system environment with limited resources and memories, and the like.

Description

Technical Field

[0001] The present invention relates to the technical field of power monitoring, and in particular to a method, device and storage medium for classifying encrypted traffic in a power monitoring system. Background Art

[0002] The power monitoring system is a key component of the power network. Real-time monitoring and analysis of traffic data is crucial to ensure the safety and stability of the power system. With the increase in cyber attacks and the demand for data privacy, encrypted traffic has been widely used in power monitoring systems. However, the classification and analysis of encrypted traffic faces greater challenges because traditional methods are difficult to directly process and analyze encrypted data. In addition, the number of devices connected to the power monitoring system is huge and their compositions are different, which also brings great challenges to the traffic management and monitoring system of the power monitoring system.

[0003] The network traffic classifier (NTC) is an important part of the current network monitoring system. It classifies network traffic according to characteristics and behaviors by detecting traffic characteristics, such as source IP, destination port, and bytes transmitted by each data packet. Through the classification behavior of NTC, network administrators can better understand the flow of data on the network and can more effectively monitor and manage network performance and security. The core goal of NTC is to identify different types of traffic, such as web browsing, file transfer, video streaming, VoIP calls, etc. It can also be used to detect and identify abnormal traffic behaviors in the network, such as network attacks, malware propagation, etc., thereby strengthening network security defense and helping to improve network availability, stability and security. Therefore, designing a network traffic classifier suitable for power monitoring system links is of great significance to strengthening and maintaining the security of power monitoring systems, and can also fill the gaps in related research.

[0004] Many power monitoring system applications require real-time data processing and rapid response, while lightweight models can quickly analyze data, provide immediate feedback and decision support. In addition, power monitoring system equipment often faces dynamic environments and constantly changing data. Lightweight models can be quickly updated and deployed to adapt to new environments and needs. Compared with large models, lightweight models show great advantages in the power monitoring system environment, and can achieve efficient operation under complex and large data conditions, meeting the needs of real-time processing and rapid response.

[0005] In the past, traffic classification mainly relied on feature engineering and traditional machine learning algorithms, such as support vector machine (SVM) and random forest (RF). With the development of deep learning, convolutional neural network (CNN) has been widely used in traffic classification tasks. However, CNN has certain limitations in processing time series data, especially in the power monitoring system environment with limited resources and memory. It cannot efficiently classify traffic, and the feature extraction of traffic data is insufficient, which cannot provide support for further traffic analysis and processing. Summary of the invention

[0006] The purpose of the present invention is to provide an encrypted traffic classification method, device and storage medium for a power monitoring system in order to achieve efficient classification of power flow in a power monitoring system environment with limited resources and memory, and to improve the adequacy of feature extraction of flow data.

[0007] The purpose of the present invention can be achieved by the following technical solutions:

[0008] A method for classifying encrypted traffic in a power monitoring system, the method comprising the following steps:

[0009] S1. Obtain the original traffic data, convert the original traffic data into a first multi-level traffic representation matrix, randomly mask the first multi-level traffic representation matrix based on the masked autoencoder paradigm, input the masked matrix into the masked autoencoder, and input the output encoder token and masker token together into the masked autodecoder to restore the matrix, calculate the loss and iterate the training to obtain the encoding parameters;

[0010] S2. Obtain the marked traffic data and convert it into a second multi-level traffic representation matrix. The second multi-level traffic representation matrix is ​​input into a packet-level attention module. The packet-level attention module is a traffic encoder using encoding parameters. The output of the packet-level attention module is used as the input of the flow-level attention module. The output of the flow-level attention module is used as the input of the multi-layer perceptron to obtain the predicted traffic distribution, calculate the loss and iteratively train to obtain a traffic classifier.

[0011] S3. Obtain the traffic to be detected, input it into the traffic classifier, and obtain the classification result.

[0012] Furthermore, the specific steps of S1 are:

[0013] S101, converting the original flow data into a first multi-level flow representation matrix;

[0014] S102, dividing the first multi-level flow representation matrix into non-overlapping 2D patches of the same size, mapping the patches into d-dimensional vectors through a linear layer, and embedding the position information of each patch together with the d-dimensional vector as the patch corresponding to the first multi-level flow representation matrix;

[0015] S103. Randomly mask the small blocks in the first multi-level flow representation matrix after segmentation, embed the patches corresponding to the masked first multi-level flow representation matrix into the input masked autoencoder, extract effective features from the masked autoencoder, output encoder tokens, input the encoder tokens and the masker tokens into the masked self-decoder together, reconstruct the input by predicting the pixel values ​​of the masked small blocks, calculate the reconstruction loss based on the output of the masked self-decoder, perform iterative training, and obtain a trained masked autoencoder. Extract the network parameters of the trained masked autoencoder as encoding parameters. The masked self-decoder and the masked autoencoder are constructed based on the lightweight visual Transformer MobileViT.

[0016] Furthermore, the specific steps of S101 are:

[0017] The original traffic data is divided into session streams according to the IP address, port number and protocol type, the Ethernet header of the session stream is deleted, and the IP of the session stream is replaced with a random address. Then the 5 adjacent data packets at the head of the session stream are captured, and each data packet is formatted into a two-dimensional packet-level matrix of the same size, in which each row contains only one type of traffic bytes. In this way, the two-dimensional packet-level matrix is ​​divided into an IP header row, a transport layer protocol header TCP / UDP row and a payload row. If the number of valid bytes in the two-dimensional packet-level matrix is ​​not enough to fill a row, 0 bytes are used to fill it to a fixed length. Each two-dimensional packet-level matrix contains the same number of three byte rows, and then the two-dimensional packet-level matrices are stacked as the first multi-level traffic representation matrix.

[0018] Furthermore, the specific steps of S2 are:

[0019] S201, converting the marked flow data into a second multi-level flow representation matrix using the same method as S101;

[0020] S202, using the same method as S102 to divide the second multi-level flow representation matrix into non-overlapping 2D patches of the same size;

[0021] S203, the second multi-level traffic representation matrix inputs a packet-level attention module, the packet-level attention module is a traffic encoder using encoding parameters, and the packet-level attention module outputs packet-level patch features;

[0022] S204, the packet-level patch features are input into the flow-level attention module, average pooling is performed, and the final representation of the entire flow representation matrix is ​​output;

[0023] S205, the final representation of the entire traffic representation matrix is ​​input into a multilayer perceptron to obtain a predicted traffic distribution;

[0024] S206. Calculate the loss function based on the cross entropy loss between the predicted traffic distribution and the true value label, and use the back propagation algorithm for iterative training to obtain a traffic classifier.

[0025] Furthermore, the packet-level attention module is composed of alternating multi-head self-attention layers and feedforward layers. The feedforward layer uses a double-layer ReLU network, and the multi-head attention results calculated by the multi-head self-attention layer are projected to the feedforward layer.

[0026] Furthermore, the traffic encoder of the packet-level attention module only performs multi-head self-attention between small-block patch features generated by the same byte rows in the same data packet to form packet-level patch features for each data packet. The small-block patches generated by the same byte rows represent small-block patches in the same IP header row, transport layer protocol header TCP / UDP row or payload row.

[0027] Furthermore, the packet-level patch features are input into the flow-level attention module for average pooling, and the specific steps of outputting the final representation of the entire flow representation matrix are as follows:

[0028] The packet-level patch features are input into the flow-level attention module, and row-by-row pooling is performed to generate row patches. Then all row patches corresponding to the second multi-level traffic representation matrix are input into the traffic encoder of the flow-level attention module to obtain a column of row patch features. The column of row patch features are then column-pooled, and the eigenvalues ​​of each column are aggregated to generate the final representation of the entire traffic representation matrix. The traffic encoder of the flow-level attention module shares parameters with the traffic encoder of the packet-level attention module.

[0029] Furthermore, the specific steps of obtaining the traffic to be detected and inputting it into the traffic classifier are as follows:

[0030] The traffic to be detected is obtained, and the traffic to be detected is converted into a third multi-level traffic representation matrix using the same method as S1, and then the third multi-level traffic representation matrix is ​​input into the traffic classifier.

[0031] Another aspect of the present invention provides an encrypted traffic classification device for an electric power monitoring system, comprising a memory, a processor, and a program stored in the memory, wherein the processor implements the above method when executing the program.

[0032] Another aspect of the present invention provides a computer-readable storage medium having a program stored thereon, wherein the program implements the above method when executed.

[0033] Compared with the prior art, the present invention has the following beneficial effects:

[0034] (1) The mask encoder / decoder of the present invention innovatively uses a lightweight visual Transformer model MobileViT to complete matrix reconstruction, which greatly reduces the pre-training cost without affecting the model performance. It can adapt to the environment of a large amount of complex data in the power monitoring system, as well as the power monitoring system environment with limited resources and memory, and efficiently complete the traffic classification task.

[0035] (2) The present invention designs an innovative multi-level traffic representation matrix to represent the original traffic. This matrix successfully captures the multi-level information of the original traffic by distinguishing the IP header row, TCP / UDP header row, and load row and stacking them in a certain format. The multi-level traffic representation matrix uses the original bytes as the initial features of the traffic, that is, the value of each point in the traffic representation matrix is ​​represented by the original bytes, but three special designs are performed at the byte level, packet level, and flow level, respectively: byte level. Each row of the traffic representation matrix contains only one type of traffic byte; packet level. The byte rows of each packet are stacked on the second dimension to form a packet-level matrix of the same size; flow level. Adjacent data packet-level matrices of the same size are stacked on the second dimension to form the final flow representation matrix. Therefore, the multi-level traffic matrix is ​​allowed to fully extract the multi-level features of the traffic. The multi-level traffic representation matrix can more effectively represent the potential features of the traffic, providing strong support for further traffic analysis and processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 It is a structural schematic diagram of the present invention;

[0037] Figure 2 The present invention is a multi-level flow representation matrix construction process;

[0038] Figure 3 This is a module structure diagram of the package-level attention module of the present invention. DETAILED DESCRIPTION

[0039] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. This embodiment is implemented based on the technical solution of the present invention, and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to the following embodiments.

[0040] Example 1

[0041] The present invention proposes a method for classifying encrypted traffic of power monitoring system with self-supervised learning capability, which uses a lightweight ViT architecture MobileViT to learn latent representations from a large amount of unlabeled power monitoring system traffic data, and uses the masked autoencoder (MAE) paradigm in pre-training to obtain more successful classification. The flowchart of the present invention is as follows Figure 1 The present invention comprises the following steps:

[0042] The method of the present invention comprises the following steps:

[0043] S1. Obtain the original traffic data, convert the original traffic data into a first multi-level traffic representation matrix, randomly mask the first multi-level traffic representation matrix based on the masked autoencoder paradigm, input the masked matrix into the masked autoencoder, and input the output encoder token and masker token together into the masked autodecoder to restore the matrix, calculate the loss and iterate the training to obtain the encoding parameters;

[0044] S2. Obtain the marked traffic data and convert it into a second multi-level traffic representation matrix. The second multi-level traffic representation matrix is ​​input into a packet-level attention module. The packet-level attention module is a traffic encoder using encoding parameters. The output of the packet-level attention module is used as the input of the flow-level attention module. The output of the flow-level attention module is used as the input of the multi-layer perceptron to obtain the predicted traffic distribution, calculate the loss and iteratively train to obtain a traffic classifier.

[0045] S3. Obtain the traffic to be detected, input it into the traffic classifier, and obtain the classification result.

[0046] Step S1 is a pre-training step, and the specific steps are as follows:

[0047] Step S101, converting the original traffic into a multi-level traffic representation matrix. The construction process of the multi-level traffic representation matrix is ​​as follows: Figure 2 As shown. First, the original traffic is divided into flows according to the IP address, port number, and protocol type. Then, to avoid introducing bias interference, the Ethernet header of the flow is deleted and the IP is replaced with a random address. Finally, the 5 adjacent data packets at the head of the flow are captured, and each packet is formatted into a two-dimensional matrix of size 40×40, which is stacked as a representation of the flow.

[0048] Step S102, split the matrix into non-overlapping 2D patches of size 2×2 to further process the information in the matrix. Then, these patches are mapped to d-dimensional vectors as patch embeddings through a linear layer. In addition, in order to maintain the crucial position information in the flow representation matrix, we also add the position information of each patch to the patch embedding as the input of the encoder.

[0049] In step S103, the MAE paradigm is used to randomly mask the patches in the traffic representation matrix, and an asymmetric encoder-decoder architecture is used to reconstruct the original bytes in the matrix. A certain proportion of patches are randomly masked, and only a small portion of patches are input into the model for further processing. Both the MAE encoder and decoder are based on MobileViT

[20] , where the encoder first processes the patches with position embeddings added, extracts the effective features of these patches through a series of MobileViT blocks, and then outputs encoder tokens. The encoder tokens and the patches used for encoding are then input into the decoder together. The mask token is a shared learning vector, and the decoder uses the encoder token and the mask token to restore the masked areas of the original traffic representation. MAE reconstructs the input by predicting the pixel values ​​of each masked patch and calculates the reconstruction loss to continue training.

[0050] Step S2 is a fine-tuning step, and the specific steps are:

[0051] Step S201, converting the marked original traffic into a multi-level traffic representation matrix, the method is the same as step S101.

[0052] Step S202, dividing the matrix into non-overlapping 2D patches of size 2×2 to further process the information in the matrix. The method is the same as step S102.

[0053] Step S203, input the patches into the packet-level attention module. In the packet-level attention module, a traffic encoder based on traditional ViT is used. The encoder is composed of alternating multi-head self-attention layers (MSA) and feedforward layers, and the initial parameters are copied from the MAE encoder in the pre-training stage. The multi-head attention result calculated by the MSA layer will be projected to the feedforward layer. The feedforward layer uses a two-layer ReLU network. In order to prioritize learning the dependencies between patches of the same type at the packet level, the traffic encoder only performs multi-head self-attention between patches generated by the same byte rows in the same packet, rather than all patches. The module structure of the packet-level attention module is shown in Figure 3 In this work, n = 4 parallel attention heads and L = 16 alternating layers are used.

[0054] Step S204, input the obtained packet-level patch features into the flow-level attention module for average pooling. First, row pooling is used to coarse-grainedly learn the flow-level features, and the feature part of the output patch of the packet-level attention is pooled row by row to generate row patches. After that, all row patches in the flow representation matrix are input into the flow encoder, and the MSA layer is used to capture the flow-level information between row patches. Then, the obtained column of row patch features is column pooled, and the feature values ​​of each column are aggregated to generate a higher-level representation to obtain the final representation of the entire flow representation matrix.

[0055] Step S205: Flatten the generated final features and input them into a multilayer perceptron (MLP). Each neuron in the hidden layer and the output layer calculates its output through this process. The training of MLP uses the back propagation algorithm, and the predicted distribution is obtained through the output of MLP.

[0056] Step S206: Calculate the classification loss based on the cross entropy loss between the predicted distribution and the true value label to continue training.

[0057] In step S3, the traffic to be detected is converted into a multi-level traffic representation matrix and input into the traffic classifier. The predicted distribution output by the traffic classifier is the classification detection result of the traffic. The specific steps are the same as steps S201 to S205.

[0058] The present invention designs an innovative multi-level traffic representation matrix to represent the original traffic. This matrix successfully captures the multi-level information of the original traffic by distinguishing the IP header line, TCP / UDP header line, and payload line and stacking them in a certain format. The lightweight visual Transformer model MobileViT is innovatively used in the pre-trained mask encoder / decoder to complete the matrix reconstruction, which greatly reduces the pre-training cost without affecting the model performance, and can adapt to the environment of large amounts of complex data in the power monitoring system.

[0059] The multi-level traffic representation matrix of the present invention uses the original bytes as the initial features of the traffic, that is, the value of each point in the traffic representation matrix is ​​represented by the original bytes, but three special designs of byte level, packet level and flow level are performed: Byte level. Each row of the traffic representation matrix contains only one type of traffic bytes.

[0060] Packet level. The byte rows of each packet are stacked on the second dimension to form a packet-level matrix of the same size.

[0061] Flow level. Adjacent packet-level matrices of the same size are stacked on the second dimension to form the final flow representation matrix.

[0062] This allows the multi-level traffic matrix to fully extract the multi-level characteristics of the traffic. The multi-level traffic representation matrix can more effectively represent the potential characteristics of the traffic, providing strong support for further traffic analysis and processing.

[0063] The invention enables the model to adapt to the power monitoring system environment with limited resources and memory, and efficiently complete the traffic classification task. Evaluations on three real-world power monitoring system traffic datasets show that this classification method based on lightweight visual Transformer achieves the best performance in terms of comprehensive performance and model complexity compared with some state-of-the-art methods for current traffic classification.

[0064] Example 2

[0065] This embodiment provides an encrypted traffic classification method for an electric power monitoring system, including a memory and a processor. The memory stores a computer program, and the method of embodiment 1 is implemented when the processor executes the program.

[0066] The electronic device of the present invention includes a central processing unit (CPU), which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) or loaded from a storage unit into a random access memory (RAM). In the RAM, various programs and data required for device operation can also be stored. The CPU, ROM and RAM are connected to each other via a bus. An input / output (I / O) interface is also connected to the bus.

[0067] Multiple components in the device are connected to the I / O interface, including: input units, such as keyboards, mice, etc.; output units, such as various types of displays, speakers, etc.; storage units, such as disks, optical disks, etc.; and communication units, such as network cards, modems, wireless communication transceivers, etc. The communication unit allows the device to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunication networks.

[0068] The processing unit performs the various methods and processes described above, such as methods S1 to S3. For example, in some embodiments, methods S1 to S3 may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit. In some embodiments, part or all of the computer program may be loaded and / or installed on the device via a ROM and / or a communication unit. When the computer program is loaded into the RAM and executed by the CPU, one or more steps of methods S1 to S3 described above may be performed. Alternatively, in other embodiments, the CPU may be configured to execute methods S1 to S3 in any other appropriate manner (e.g., by means of firmware).

[0069] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0070] The program code for implementing the method of the present invention can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code can be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0071] For the improvement of a technology, it can be clearly distinguished whether it is a hardware improvement (for example, improvement of the circuit structure of diodes, transistors, switches, etc.) or a software improvement (improvement of the method flow). However, with the development of technology, many improvements of the method flow today can be regarded as direct improvements of the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be implemented with a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming themselves, without having to ask chip manufacturers to design and make dedicated integrated circuit chips. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0072] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0073] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0074] For the convenience of description, the above device is described as being divided into various units according to their functions. Of course, when implementing the present invention, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0075] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0076] Example 3

[0077] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method provided in Example 1 is implemented.

[0078] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0079] In the context of the present invention, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0080] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0081] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0082] The present invention may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present invention may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0083] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0084] The present invention may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present invention may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0085] Each embodiment of the present invention is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0086] The above description is only an embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of the claims of the present invention.

[0087] The preferred specific embodiments of the present invention are described in detail above. It should be understood that a person skilled in the art can make many modifications and changes based on the concept of the present invention without creative work. Therefore, any technical solution that can be obtained by a person skilled in the art through logical analysis, reasoning or limited experiments based on the concept of the present invention on the basis of the prior art should be within the scope of protection determined by the claims.

Claims

1. A method for classifying encrypted traffic in a power monitoring system, characterized in that: The method comprises the following steps: S1. Obtain the original traffic data, convert the original traffic data into a first multi-level traffic representation matrix, randomly mask the first multi-level traffic representation matrix based on the masked autoencoder paradigm, input the masked matrix into the masked autoencoder, and input the output encoder token and masker token together into the masked autodecoder to restore the matrix, calculate the loss and iterate the training to obtain the encoding parameters; S2. Obtain the marked traffic data and convert it into a second multi-level traffic representation matrix. The second multi-level traffic representation matrix is ​​input into a packet-level attention module. The packet-level attention module is a traffic encoder using encoding parameters. The output of the packet-level attention module is used as the input of the flow-level attention module. The output of the flow-level attention module is used as the input of the multi-layer perceptron to obtain the predicted traffic distribution, calculate the loss and iteratively train to obtain a traffic classifier. S3. Obtain the traffic to be detected, input it into the traffic classifier, and obtain the classification result.

2. According to claim 1, a method for classifying encrypted traffic in a power monitoring system is characterized in that: The specific steps of S1 are: S101, converting the original flow data into a first multi-level flow representation matrix; S102, dividing the first multi-level flow representation matrix into non-overlapping 2D patches of the same size, mapping the patches into d-dimensional vectors through a linear layer, and embedding the position information of each patch together with the d-dimensional vector as the patch corresponding to the first multi-level flow representation matrix; S103. Randomly mask the small blocks in the first multi-level flow representation matrix after segmentation, embed the patches corresponding to the masked first multi-level flow representation matrix into the input masked autoencoder, extract effective features from the masked autoencoder, output encoder tokens, input the encoder tokens and the masker tokens into the masked self-decoder together, reconstruct the input by predicting the pixel values ​​of the masked small blocks, calculate the reconstruction loss based on the output of the masked self-decoder, perform iterative training, and obtain a trained masked autoencoder. Extract the network parameters of the trained masked autoencoder as encoding parameters. The masked self-decoder and the masked autoencoder are constructed based on the lightweight visual Transformer MobileViT.

3. The method for classifying encrypted traffic in a power monitoring system according to claim 2, characterized in that: The specific steps of S101 are: The original traffic data is divided into session streams according to the IP address, port number and protocol type, the Ethernet header of the session stream is deleted, and the IP of the session stream is replaced with a random address. Then the 5 adjacent data packets at the head of the session stream are captured, and each data packet is formatted into a two-dimensional packet-level matrix of the same size, in which each row contains only one type of traffic bytes. In this way, the two-dimensional packet-level matrix is ​​divided into an IP header row, a transport layer protocol header TCP / UDP row and a payload row. If the number of valid bytes in the two-dimensional packet-level matrix is ​​not enough to fill a row, 0 bytes are used to fill it to a fixed length. Each two-dimensional packet-level matrix contains the same number of three byte rows, and then the two-dimensional packet-level matrices are stacked as the first multi-level traffic representation matrix.

4. The method for classifying encrypted traffic in a power monitoring system according to claim 3, characterized in that: The specific steps of S2 are: S201, converting the marked flow data into a second multi-level flow representation matrix using the same method as S101; S202, using the same method as S102 to divide the second multi-level flow representation matrix into non-overlapping 2D patches of the same size; S203, the second multi-level traffic representation matrix inputs a packet-level attention module, the packet-level attention module is a traffic encoder using encoding parameters, and the packet-level attention module outputs packet-level patch features; S204, the packet-level patch features are input into the flow-level attention module, average pooling is performed, and the final representation of the entire flow representation matrix is ​​output; S205, the final representation of the entire traffic representation matrix is ​​input into a multilayer perceptron to obtain a predicted traffic distribution; S206. Calculate the loss function based on the cross entropy loss between the predicted traffic distribution and the true value label, and use the back propagation algorithm for iterative training to obtain a traffic classifier.

5. A method for classifying encrypted traffic in a power monitoring system according to claim 4, characterized in that: The packet-level attention module is composed of alternating multi-head self-attention layers and feed-forward layers. The feed-forward layer uses a double-layer ReLU network, and the multi-head attention results calculated by the multi-head self-attention layer are projected to the feed-forward layer.

6. A method for classifying encrypted traffic in a power monitoring system according to claim 5, characterized in that: The traffic encoder of the packet-level attention module only performs multi-head self-attention between the small-block patch features generated by the same byte rows in the same data packet to form packet-level patch features for each data packet. The small-block patches generated by the same byte rows represent the small-block patches in the same IP header row, transport layer protocol header TCP / UDP row or payload row.

7. A method for classifying encrypted traffic in a power monitoring system according to claim 6, characterized in that: The packet-level patch features are input into the flow-level attention module for average pooling, and the specific steps of outputting the final representation of the entire flow representation matrix are as follows: The packet-level patch features are input into the flow-level attention module, and row-by-row pooling is performed to generate row patches. Then all row patches corresponding to the second multi-level traffic representation matrix are input into the traffic encoder of the flow-level attention module to obtain a column of row patch features. The column of row patch features are then column-pooled, and the eigenvalues ​​of each column are aggregated to generate the final representation of the entire traffic representation matrix. The traffic encoder of the flow-level attention module shares parameters with the traffic encoder of the packet-level attention module.

8. The method for classifying encrypted traffic in a power monitoring system according to claim 1, characterized in that: The specific steps to obtain the traffic to be detected and input the traffic classifier are as follows: The traffic to be detected is obtained, and the traffic to be detected is converted into a third multi-level traffic representation matrix using the same method as S1, and then the third multi-level traffic representation matrix is ​​input into the traffic classifier.

9. An encrypted flow classification device for a power monitoring system, comprising a memory, a processor, and a program stored in the memory, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 8 is implemented.

10. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed, the method according to any one of claims 1 to 8 is implemented.

Images