Communication service classification method and system based on convolutional neural network

Abstract

The invention provides a communication service classification method based on a convolutional neural network, and the method comprises the steps: S1, obtaining a data package of each type of communication service in a specific environment through wireshark package capturing software; S2, carrying out the preprocessing and normalization processing of the data package of each type of communication service, obtaining a communication service data set with a label; step 3, reconstructing the dimension of the data set to make the dimension accord with the input condition of the one-dimensional CNN; and S4, outputting a classification result for the data set after CNN training through a random forest classifier. The method has the advantages that the accuracy of five types of communication services can be greatly improved by preprocessing the communication service data and utilizing the characteristics of the convolutional neural network.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a communication service classification technology. Background Art

[0002] One of the most important issues in the classification of communication services is the classification accuracy. Often, the total accuracy may not meet the standard or the accuracy of a certain category may not meet the standard during the classification process, which are very serious consequences. Most of the existing technical solutions are for network traffic classification. For example, the publication number CN109309630A provides a network traffic classification method, and the publication number CN109639481A provides a network traffic classification method based on deep learning. For data accessed through the integrated antenna communication of the sky and the earth, there is basically no communication service classification because there is no public data set for this type of communication service. In addition, the existing communication service classification is firstly a complex way of extracting features. For the communication service data set accessed through the integrated antenna communication of the sky and the earth, efforts are made to extract the original features in a simple way. Secondly, the existing communication service classification processes too many features, which will undoubtedly increase the number of parameters of the neural network and lead to too long training time. Moreover, a complex classification method is used, and the final classification accuracy is not very high. Summary of the invention

[0003] The technical problem to be solved by the present invention is how to provide a communication service classification method suitable for accessing data of a ground-ground integrated antenna.

[0004] The present invention solves the above technical problems by the following technical means: a communication service classification method based on convolutional neural network, comprising the following steps:

[0005] Step S1. Use the Wireshark packet capture software to obtain the data packets of each type of communication service in a specific environment:

[0006] Step S2. Preprocess and normalize the data packets of each type of communication service obtained in step S1 to obtain a communication service data set with labels;

[0007] Step 3. Reconstruct the dimension of the data set to make it meet the input conditions of one-dimensional CNN;

[0008] Step S4: The CNN-trained data set is passed through a random forest classifier to output the classification result.

[0009] As an optimized technical solution, in step S1:

[0010] Collection environment: Windows 11 platform, wireless LAN environment, when collecting specific communication services, only open the application software that generates such communication services;

[0011] Rules for capturing data packets: 1. When capturing data packets, it is necessary to ensure that the communication service is generated by the application software based on the application port number; 2. The data flow to be captured must be the size of the data flow required at one time to avoid repeated capture.

[0012] As an optimized technical solution, in step S2, a total of five original features are selected: protocol, average pps, rate, average bytes and average delay, which are input into the neural network structure as training parameters. These five features are processed separately. For features such as protocol, unique hot encoding is used to convert them into numbers. The other four features are converted into numbers using mathematical methods as follows:

[0013] Average pps:

[0014]

[0015] rate:

[0016]

[0017] Average Bytes:

[0018]

[0019] Average latency:

[0020]

[0021] As an optimized technical solution, the time window size is selected as 0.0025s. According to the calculation method, the communication business data set with extracted features is obtained, and then these data are manually labeled, and then the labeled data set is normalized.

[0022] As an optimized technical solution, the structure of the one-dimensional CNN is as follows:

[0023] The first is the convolution layer. In the convolution layer, the input data is convolved with a learnable filter through a convolution operation to generate a feature map. The filter is a one-dimensional matrix. A total of three convolution layers are used. The step size of each layer in the structure is set to 1, and the activation function uses the ReLU function.

[0024] Secondly, a BN layer is added after each convolutional layer. After the feature extraction part, a Flatten layer is used to flatten the multi-dimensional output into a one-dimensional vector.

[0025] The last layer is the fully connected layer. It has a four-layer stacked structure. The three parameters of the fully connected layer are: the number of neurons, the activation function, and the weight initialization. The activation function and weight initialization parameters are set to ReLU and he_normal respectively. The first three layers are the same. The last layer uses softmax as the activation function and he_normal as the weight initialization parameter.

[0026] As an optimized technical solution, the communication service classification method based on convolutional neural network also includes: step S5. Using an untrained data set as a test set to verify the robustness of the model.

[0027] As an optimized technical solution, the verification method adopted in step S5 is the K-fold cross-validation method. Specifically, the data set is randomly divided into K subsets of approximately equal size, called "folds", and the K value is 5 or 10. One of the folds is selected as the verification set in turn, and the remaining K-1 folds are used as training sets. The training set is used to train the model, and the model performance is evaluated on the verification set. This process is repeated K times, each time a different fold is selected as the verification set, and the remaining K-1 folds are used as the training set. The performance of each verification is recorded, and the final model performance is comprehensively evaluated by the average and standard deviation of the K verifications.

[0028] The present invention also discloses a communication service classification system based on convolutional neural network, comprising the following modules:

[0029] Capture module: used to use wireshark to capture packets of each type of communication service in a specific environment:

[0030] Data packet processing module: used to pre-process and normalize the data packets of each type of communication service obtained by the capture module to obtain a communication service data set with labels;

[0031] The reconstruction module is used to reconstruct the dimension of the data set to make it meet the input conditions of the one-dimensional CNN;

[0032] The result output module is used to output the classification results of the data set trained by CNN through a random forest classifier.

[0033] As an optimized technical solution, in the reconstruction module, a total of five original features are selected: protocol, average pps, rate, average bytes and average delay, which are input into the neural network structure as training parameters. These five features are processed separately. For features such as protocol, one-hot encoding is used to convert them into numbers. The other four features are converted into numbers using mathematical methods as follows:

[0034] Average pps:

[0035]

[0036] rate:

[0037]

[0038] Average Bytes:

[0039]

[0040] Average latency:

[0041]

[0042] As an optimized technical solution, the structure of the one-dimensional CNN is as follows:

[0043] The first is the convolution layer. In the convolution layer, the input data is convolved with a learnable filter through a convolution operation to generate a feature map. The filter is a one-dimensional matrix. A total of three convolution layers are used. The step size of each layer in the structure is set to 1, and the activation function uses the ReLU function.

[0044] Secondly, a BN layer is added after each convolutional layer. After the feature extraction part, a Flatten layer is used to flatten the multi-dimensional output into a one-dimensional vector.

[0045] The last layer is the fully connected layer. It has a four-layer stacked structure. The three parameters of the fully connected layer are: the number of neurons, the activation function, and the weight initialization. The activation function and weight initialization parameters are set to ReLU and he_normal respectively. The first three layers are the same. The last layer uses softmax as the activation function and he_normal as the weight initialization parameter.

[0046] The advantages of the present invention are that by preprocessing the communication service data and utilizing the characteristics of the convolutional neural network, the recognition accuracy of five types of communication services (fixed communication service, cellular mobile communication service, satellite communication service, data communication service, and IP telephone service) can be effectively improved, and the accuracy of various types of communication services can be significantly improved.

[0047] The data preprocessing method adopted in the present invention reduces the computational complexity of the model and accelerates the training of the model. The encoding method of the data can also enhance the model's understanding of the features, making it easier for the model to find the correlation between the features and the target variables during the training process.

[0048] The improved neural network structure adopted in the present invention can extract features more effectively, and the correlation of features will not be lost during the convolution process. At the same time, the parameters are set reasonably, which speeds up the training speed of the network and reduces the gradient vanishing problem, thereby improving the model performance.

[0049] The present invention adopts a mechanism combining a neural network model and a machine learning classifier, which not only improves the training efficiency, but also enhances the accuracy and robustness of the model.

[0050] The data set verification method used in the present invention improves the generalization of the model, and avoids the situation where high accuracy can only be reflected in specific training sets and test sets. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 It is a flow chart of the communication service classification method based on convolutional neural network of the present invention. DETAILED DESCRIPTION

[0052] Most of the existing public data sets analyze the classification of network data traffic generated by different applications. In fact, different applications are distinguished based on network traffic. The communication service classification applied in the present invention is mainly identified and classified based on the service, which may involve different services of the same application. Identification and classification will be more difficult because the similarity of the characteristics of the network traffic data of the same application may be higher than that of the network traffic data between different applications.

[0053] See also Figure 1 As shown, the communication service classification method based on convolutional neural network of the present invention includes the following steps:

[0054] Step S1. Use the Wireshark packet capture software to obtain the data packets of each type of communication service in a specific environment:

[0055] Collection environment: Windows 11 platform, wireless LAN environment, to ensure interference from other applications, only open the application software that generates this type of communication service when collecting specific communication services, and avoid interference from network data traffic generated by opening other application software.

[0056] Rules for capturing data packets: 1. In a Windows environment, when all application software is closed, network data traffic generated by Windows built-in software will also appear. Therefore, when capturing data packets, it is necessary to ensure that this type of communication service is generated by this application software based on the application port number; 2. To capture data traffic, you need to capture the required data traffic size at one time and avoid capturing it again, because the application port number will change each time the data traffic is recaptured. In addition, the data traffic packet is timestamped, which will lead to time inconsistency of the data packet when analyzing time-related features.

[0057] The data used in the present invention comes from the packet capture service of the Wireshark packet capture software. Unlike some public network traffic classifications on the Internet, the data set derived from the packet capture service of the Wireshark software often involves a certain type of business involving multiple applications or scenarios, which is more complex than application classification or anomaly detection.

[0058] Step S2. Preprocess and normalize the data packets of each type of communication service obtained in step S1 to obtain a communication service data set with labels:

[0059] There are a large number of data packets obtained from Wireshark. If each data packet is taken as a unit, it will increase the burden of neural network training. Therefore, the average index within a certain time range is taken as the embodiment of the feature. Since the density of data packets of different categories of communication services is different, when a time step is selected, the number of data packets within the time step may be 0. At this time, its feature is set to 0 for easy calculation. In the present invention, a total of five original features are selected: protocol, average pps (that is, how many packets are sent per second), rate, average bytes and average delay, which are input into the neural network structure as training parameters. These five features are processed separately. For features such as protocols, due to the irrelevance between different protocols, the unique hot encoding method is adopted to convert them into numbers. The other four features use mathematical methods as follows:

[0060]

[0061]

[0062] Considering that a large number of data packets are generated per second and certain types of services can generate a large number of data packets in a short period of time, in order to ensure that the number of training samples is sufficient, the time window size is selected as 0.0025s. According to the above calculation method, the communication service data set with extracted features is obtained, and then these data are manually labeled.

[0063] The labeled data set is then normalized to prevent overfitting during training.

[0064] Step 3. Reconstruct the dimension of the dataset to make it meet the input conditions of a one-dimensional CNN (convolutional neural network)

[0065] At present, most of the convolutional neural network structures used in the market are two-dimensional image processing. However, considering the number and structure of features of the space-ground integrated antenna access communication service data set obtained from Wireshark, the present invention adopts the method that is most suitable for this data set, that is, one-dimensional CNN (1dCNN).

[0066] According to the number and dimension of features, the normalized data set is converted into a structure that can be trained by 1dCNN as input into the neural network structure. The structure of the 1dCNN is as follows:

[0067] First is the convolution layer, which is one of the core components of CNN and is used to extract the features of input data. In the convolution layer, the input data is convolved with a learnable filter through a convolution operation to generate a feature map. Several important parameters of the convolution layer, the filter is generally a two-dimensional matrix, but in the structure of the present invention, it is a one-dimensional matrix. Then there is the convolution operation, which is mainly used to extract the features of the input data. In this operation, the filter is element-wise multiplied with the local area of ​​the input data, and the results are added to obtain the value of the corresponding position in the feature map. The increase in the sliding step size will reduce the size of the generated feature map, which is generally set to 1. Other parameters such as activation function and padding are specifically set according to the situation. In the structure of the present invention, a total of three convolution layers are used. Since the number of features of the integrated antenna access communication service data set obtained from wireshark is not large, the step size of each layer in the structure is set to 1, and the activation function adopts the ReLU function. The reason for using this activation function is that compared with traditional activation functions (such as sigmoid and tanh), ReLU will not cause the gradient disappearance problem during the back propagation process. The gradient vanishing problem causes the gradient of the network to become very small during training, which slows down or even stops the weight update. The gradient of the ReLU function in the positive interval is always 1, which helps to converge faster.

[0068] Secondly, after each convolution layer, the present invention adds a Batch Normalization layer (BN layer). Compared with the Dropout layer of the traditional neural network, the BN layer is more suitable for the structure of the ground-ground integrated antenna access communication service data set obtained from Wireshark, and it can stabilize the training process, accelerate convergence and partial regularization.

[0069] Then there is the pooling layer, which is mainly used in CNN to reduce the spatial dimension of the feature map, reduce the number of parameters and the amount of calculation and improve the robustness of the model. It is used in front of the fully connected layer, which greatly reduces the number of parameters calculated in the fully connected layer. One of the biggest changes in the structure of the present invention is that the maximum pooling layer is not used. Since the number of features is small, if the dimension is reduced again, the dimension will be too low, and some features may be ablated. Therefore, there is no maximum pooling layer in the structure of the present invention.

[0070] Finally, there is the fully connected layer, in which each neuron is connected to all neurons in the previous layer. Each neuron receives all outputs from the previous layer, calculates the weighted sum, and then activates it through the activation function. The fully connected layer is the layer with the largest number of calculation parameters in CNN. The connection between the input layer and the fully connected layer is dense. Each input feature is connected to each neuron in the fully connected layer. Each connection has a weight parameter for weighting the input feature. Each neuron in the fully connected layer has a bias parameter for adjusting the offset of the weighted sum. The fully connected layer usually appears at the end of the neural network and is used to combine and transform the features extracted by the previous layer and finally output the prediction results of the network. In the same way, the fully connected layer adopts a four-layer superimposed structure, and the activation function is also ReLU, but the last layer uses softmax, and the final output is the probability of classification.

[0071] The above description shows that the present invention is different from the previous neural network structure. The structural parameters of the neural network of the present invention will be described in detail below.

[0072] First, build a one-dimensional CNN model. The model is built using the Sequential class in Keras, which means that the layers of the network are stacked in sequence, and the input of each layer comes directly from the output of the previous layer. This is a linear stacked network structure.

[0073] The number of filters in the first convolutional layer is set to 32, the size of the convolution kernel is 3, which means that each convolution kernel slides 3 elements on the input data, the stride size is set to 1, which means that the convolution kernel slides 1 element each time, the padding method is set to same, which means that the input and output lengths are the same, the boundaries are padded with zeros, the activation function uses ReLU to introduce nonlinearity, and the weight initialization is set to he_normal, which is an initialization method suitable for the ReLU activation function, which can help the network converge faster.

[0074] Then add a BachNormalization layer after each convolution to normalize the output of each batch of data, which can speed up training and reduce overfitting. After this layer, add two similar combinations of convolutional layers + batch normalization layers. The purpose of this is to increase the model capacity and extract higher-level features while keeping the length of the input data unchanged. In this way, this entire convolutional layer part constitutes a feature extraction block, whose role is to extract different levels of features from the original data.

[0075] After the feature extraction part, the Flatten layer is used to flatten the multi-dimensional output into a one-dimensional vector in preparation for the subsequent fully connected layer.

[0076] Regarding the fully connected layer, there are four layers of fully connected layers. The three main parameters of the fully connected layer are the number of neurons, activation function and weight initialization. The activation function and weight initialization parameters are set to ReLU and he_normal respectively, which are the same for all three layers. Then regarding the parameter of the number of neurons, each of the three layers is set to 1024, 128, and 16 respectively, so as to gradually reduce the number of parameters and avoid too long training time. In the last output layer of the fully connected layer, the number of neurons is set to 5, which is the number of classification categories. The activation function uses softmax, and the weight initialization is still he_normal.

[0077] Step S4: The CNN-trained data set is passed through a random forest classifier to output the classification result.

[0078] Random forest classifier: Random forest classifier is an ensemble learning algorithm that consists of multiple decision trees and performs classification or regression by integrating the prediction results of these trees. Random forest uses the integrated results of multiple decision trees for prediction. Each decision tree is trained independently, and the final classification result is determined by voting (classification task) or averaging (regression task) the results of all trees. Random forest uses bagging method in the training process. Specifically, the training data set generates multiple subsets by random sampling with replacement, and each subset is used to train a decision tree. In this way, each tree is trained based on a different subset of data, thereby reducing overfitting. In the process of constructing each decision tree, random forest also introduces feature randomness. When splitting at each node, instead of considering all features, a subset is randomly selected from all features for splitting. This further increases the diversity of the model and reduces the excessive influence of a single feature on the model. Based on these characteristics, the present invention introduces a random forest classification model after the output of the CNN model for final classification.

[0079] The classification model of the present invention introduces a random forest classifier at the end because the softmax output of CNN is a probability, and the final classification result will be based on the one with the largest probability. Then, when the probabilities of different categories are not much different, the results may be biased. Therefore, the random forest is introduced to classify them again. The actual classification accuracy is better than that of the single CNN classification.

[0080] Step S5: Use the untrained data set as the test set to verify the robustness of the model.

[0081] Most of the models in the traditional sense simply use the method of 8:2 or 7:3 to divide the training set and the test set, and then keep training with this part of the training set. The method adopted in the present invention is the K-fold cross-validation method, specifically, the data set is randomly divided into K subsets of roughly equal size, called "folds". Commonly used K values ​​are 5 and 10, but the appropriate K value can be selected according to the size of the data set. K in the present invention is 10, and one of the folds is selected in turn as the validation set, and the remaining K-1 folds are used as training sets. Use the training set to train the model, and evaluate the model performance on the validation set. This process is repeated K times, and each time a different fold is selected as the validation set, and the remaining K-1 folds are used as training sets. Record the performance of each verification (such as accuracy, F1 score, etc.). The final model performance is comprehensively evaluated by the mean value and standard deviation of K verifications.

[0082] This method effectively utilizes the entire dataset, and every sample is used for training and validation, reducing the model's dependence on data partitioning and making the evaluation more robust. Through multiple training and validation, the risk of overfitting can be reduced.

[0083] Embodiment 2

[0084] This embodiment provides a communication service classification system based on convolutional neural network, including the following modules:

[0085] Capture module: used to use the wireshark capture software to obtain data packets of each type of communication service in a specific environment:

[0086] Data packet processing module: used to pre-process and normalize the data packets of each type of communication service obtained by the capture module to obtain a communication service data set with labels;

[0087] The reconstruction module is used to reconstruct the dimension of the data set to make it meet the input conditions of the one-dimensional CNN;

[0088] The result output module is used to output the classification results of the data set trained by CNN through a random forest classifier;

[0089] The validation module is used to use a dataset that has not been trained as a test set to verify the robustness of the model.

[0090] Among them, in the capture module, the collection environment: Windows 11 platform, wireless LAN environment, when collecting specific communication services, only the application software that generates this type of communication service is opened; the rules for capturing data packets: 1. When capturing data packets, it is necessary to ensure that this type of communication service is generated by this application software based on the port number of the application; 2. When capturing data traffic, the required data traffic size must be captured at one time to avoid capturing again.

[0091] In the reconstruction module, a total of five original features are selected: protocol, average pps, rate, average bytes and average delay, which are input into the neural network structure as training parameters. These five features are processed separately. For features such as protocol, one-hot encoding is used to convert them into numbers. The other four features are converted using mathematical methods as follows:

[0092] Average pps:

[0093]

[0094] rate:

[0095]

[0096] Average Bytes:

[0097]

[0098] Average latency:

[0099]

[0100] The size of the time window is selected as 0.0025s. According to the calculation method, the communication business data set with extracted features is obtained, and then these data are manually labeled, and then the labeled data set is normalized.

[0101] The structure of the one-dimensional CNN is as follows:

[0102] The first is the convolution layer. In the convolution layer, the input data is convolved with a learnable filter through a convolution operation to generate a feature map. The filter is a one-dimensional matrix. A total of three convolution layers are used. The step size of each layer in the structure is set to 1, and the activation function uses the ReLU function.

[0103] Secondly, a BN layer is added after each convolutional layer. After the feature extraction part, a Flatten layer is used to flatten the multi-dimensional output into a one-dimensional vector.

[0104] The last layer is the fully connected layer. It has a four-layer stacked structure. The three parameters of the fully connected layer are: the number of neurons, the activation function, and the weight initialization. The activation function and weight initialization parameters are set to ReLU and he_normal respectively. The first three layers are the same. The last layer uses softmax as the activation function and he_normal as the weight initialization parameter.

[0105] In the validation module, the validation method adopted is the K-fold cross-validation method. Specifically, the data set is randomly divided into K subsets of roughly equal size, called "folds", with the K value of 5 or 10. One of the folds is selected as the validation set in turn, and the remaining K-1 folds are used as training sets. The model is trained using the training set, and the model performance is evaluated on the validation set. This process is repeated K times, each time a different fold is selected as the validation set, and the remaining K-1 folds are used as training sets. The performance of each validation is recorded, and the final model performance is comprehensively evaluated by the average and standard deviation of the K validations.

[0106] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A communication service classification method based on convolutional neural network, characterized in that: The steps include: Step S1. Use the Wireshark packet capture software to obtain the data packets of each type of communication service in a specific environment: Step S2. Preprocess and normalize the data packets of each type of communication service obtained in step S1 to obtain a communication service data set with labels; Step 3. Reconstruct the dimension of the data set to make it meet the input conditions of one-dimensional CNN; Step S4: The CNN-trained data set is passed through a random forest classifier to output the classification result.

2. A communication service classification method based on convolutional neural network as claimed in claim 1, characterized in that: In step S1: Collection environment: Windows 11 platform, wireless LAN environment, when collecting specific communication services, only open the application software that generates such communication services; Rules for capturing data packets:

1. When capturing data packets, it is necessary to ensure that the communication service is generated by the application software based on the application port number; 2. The data flow to be captured must be the size of the data flow required at one time to avoid repeated capture.

3. A communication service classification method based on convolutional neural network as claimed in claim 1, characterized in that: In step S2, a total of five original features are selected: protocol, average pps, rate, average bytes and average delay, which are input into the neural network structure as training parameters. These five features are processed separately. For features such as protocol, one-hot encoding is used to convert them into numbers. The other four features are converted into numbers using mathematical methods as follows: Average pps: rate: Average Bytes: Average latency:

4. A communication service classification method based on convolutional neural network as claimed in claim 3, characterized in that: The size of the time window is selected as 0.0025s. According to the calculation method, the communication business data set with extracted features is obtained, and then these data are manually labeled, and then the labeled data set is normalized.

5. A communication service classification method based on convolutional neural network as claimed in claim 1, characterized in that: The structure of the one-dimensional CNN is as follows: The first is the convolution layer. In the convolution layer, the input data is convolved with a learnable filter through a convolution operation to generate a feature map. The filter is a one-dimensional matrix. A total of three convolution layers are used. The step size of each layer in the structure is set to 1, and the activation function uses the ReLU function. Secondly, a BN layer is added after each convolutional layer. After the feature extraction part, a Flatten layer is used to flatten the multi-dimensional output into a one-dimensional vector. The last layer is the fully connected layer. It has a four-layer stacked structure. The three parameters of the fully connected layer are: the number of neurons, the activation function, and the weight initialization. The activation function and weight initialization parameters are set to ReLU and he_normal respectively. The first three layers are the same. The last layer uses softmax as the activation function and he_normal as the weight initialization parameter.

6. A communication service classification method based on convolutional neural network as claimed in claim 1, characterized in that: Also includes: Step S5: Use the untrained data set as the test set to verify the robustness of the model.

7. A communication service classification method based on convolutional neural network as claimed in claim 6, characterized in that: The validation method adopted in step S5 is the K-fold cross-validation method, which specifically involves randomly dividing the data set into K subsets of roughly equal size, called "folds", with a K value of 5 or 10. One of the folds is selected as the validation set, and the remaining K-1 folds are used as training sets. The model is trained using the training set, and the model performance is evaluated on the validation set. This process is repeated K times, each time a different fold is selected as the validation set, and the remaining K-1 folds are used as the training set. The performance of each validation is recorded, and the final model performance is comprehensively evaluated by the average and standard deviation of the K validations.

8. A communication service classification system based on convolutional neural network, characterized in that: Includes the following modules: Capture module: used to use wireshark to capture packets of each type of communication service in a specific environment: Data packet processing module: used to pre-process and normalize the data packets of each type of communication service obtained by the capture module to obtain a communication service data set with labels; The reconstruction module is used to reconstruct the dimension of the data set to make it meet the input conditions of the one-dimensional CNN; The result output module is used to output the classification results of the data set trained by CNN through a random forest classifier.

9. A communication service classification system based on convolutional neural network as claimed in claim 8, characterized in that: In the reconstruction module, a total of five original features are selected: protocol, average pps, rate, average bytes and average delay, which are input into the neural network structure as training parameters. These five features are processed separately. For features such as protocol, one-hot encoding is used to convert them into numbers. The other four features are converted into numbers using mathematical methods as follows: Average pps: rate: Average Bytes: Average latency:

10. A communication service classification system based on convolutional neural network as claimed in claim 1, characterized in that: The structure of the one-dimensional CNN is as follows: The first is the convolution layer. In the convolution layer, the input data is convolved with a learnable filter through a convolution operation to generate a feature map. The filter is a one-dimensional matrix. A total of three convolution layers are used. The step size of each layer in the structure is set to 1, and the activation function uses the ReLU function. Secondly, a BN layer is added after each convolutional layer. After the feature extraction part, a Flatten layer is used to flatten the multi-dimensional output into a one-dimensional vector. The last layer is the fully connected layer. It has a four-layer stacked structure. The three parameters of the fully connected layer are: the number of neurons, the activation function, and the weight initialization. The activation function and weight initialization parameters are set to ReLU and he_normal respectively. The first three layers are the same. The last layer uses softmax as the activation function and he_normal as the weight initialization parameter.

Images