Encrypted malicious traffic detection method and device based on multi-dimensional feature combination and mask auto-encoder

Abstract

The invention discloses an encrypted malicious traffic detection method and device based on multi-dimensional feature combination and a mask auto-encoder, and aims to solve the problems of insufficient feature extraction capability and low detection precision in existing encrypted traffic detection. The method comprises the following steps: firstly, extracting multi-dimensional features including an original traffic feature, a TLS plaintext message feature and a traditional statistical feature from original traffic data, and converting the one-dimensional feature data into a two-dimensional RGB image, thereby converting an encrypted traffic detection problem into an image classification problem; then, self-supervised learning is carried out by using a mask auto-encoder, pre-training is carried out on a large amount of unmarked flow data, fine tuning is carried out through a small amount of marked data, and the feature extraction capability and generalization performance of the model are improved; and finally, carrying out traffic classification by using the fine-tuned model, and effectively detecting and identifying malicious behaviors in the encrypted traffic. Experimental results show that the method has high detection precision and robustness on a plurality of actual flow data sets.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder (MAE), aiming to improve the detection accuracy and robustness of malicious behavior in encrypted traffic. Background Art

[0002] As an important protection technology in the field of network security, network anomaly detection can extract valuable traffic features from network data and use these features to build classification models to identify abnormal behaviors in network traffic. This detection technology can effectively prevent network attacks, protect personal information and assets from theft and destruction, thereby improving the security of computer systems and maintaining the overall information security of the Internet environment. Compared with traditional intrusion detection technology, network anomaly detection not only has a lower model training cost, but is also more effective in detecting abnormal network behaviors. It has become one of the key means in the modern network security protection system.

[0003] At present, network anomaly detection technology can be mainly divided into five categories: detection based on statistical learning captures historical network traffic data, analyzes the relationship between data, uses statistical models to characterize normal network behavior and detect abnormal traffic; detection methods based on machine learning analyze the correlation mapping between input and output data, train to form classification models, and automatically process large amounts of network traffic data, but traditional methods rely on manual feature extraction and have limited effectiveness in dealing with complex attacks; detection based on deep learning introduces a multi-layer neural network structure to automatically extract complex features and perform deep-level pattern recognition, which is suitable for detecting complex attack behaviors hidden in network traffic, but its model training usually requires a large amount of labeled data and computing resources; detection based on ensemble learning improves model accuracy and robustness by combining multiple learners. Although it can reduce false positives and false negatives, its complexity and cost are relatively high; detection methods based on protocol analysis rely on a deep understanding of network protocols, and detect abnormal behaviors by constructing normal behavior models and comparing them with real-time traffic, but they may be limited when processing encrypted traffic or unknown protocols.

[0004] Although existing network anomaly detection technologies have made some progress in theory and application, they still face the challenge of insufficient feature extraction capabilities. Existing feature extraction methods often fail to cover all key information in the original data, resulting in low accuracy of the detection model and high false alarm rate. In addition, in actual network environments, traffic data is usually mixed with a large amount of useless information. These "damaged data" have a negative impact on the performance of the anomaly detection model, further reducing the effectiveness of detection. Summary of the invention

[0005] This paper proposes a method for detecting encrypted malicious traffic based on multi-dimensional feature combination and masked autoencoder, aiming to solve the problems of insufficient feature extraction capability, low detection accuracy and reliance on a large amount of labeled data in existing network security technologies when detecting encrypted traffic. This method significantly improves the detection accuracy and robustness of encrypted malicious traffic by integrating multi-dimensional traffic features and combining self-supervised learning technology.

[0006] In order to solve the above technical problems, the technical solution adopted by the present invention is as follows:

[0007] The first aspect provides an encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder, including:

[0008] S1: Preprocess the input raw network traffic data, extract the raw traffic features, and construct the original traffic feature matrix;

[0009] S2: Analyze the plaintext message features in the TLS handshake packet, extract key feature fields, and form a plaintext message feature matrix with distinguishing power;

[0010] S3: Extract statistical features of network traffic and construct the corresponding feature matrix;

[0011] S4: Use RGB multi-channel fusion technology to fuse the feature matrices corresponding to the original traffic features, plaintext message features, and statistical features into an RGB image to generate a multi-dimensional feature matrix;

[0012] S5: Use a masked autoencoder to perform self-supervised pre-training on the generated RGB image. By randomly masking parts of the RGB image, the model is trained to reconstruct the masked areas, thereby learning the potential feature patterns in the encrypted traffic and obtaining a pre-trained model.

[0013] S6: Fine-tune the pre-trained model using a small amount of labeled data;

[0014] S7: Detect encrypted malicious traffic using the fine-tuned model.

[0015] In one embodiment, S1 includes:

[0016] Perform multi-level traffic representation processing on the input raw network traffic data, decompose the raw byte sequence of the network traffic into multi-level representation matrices at the byte level, packet level and flow level, so that the raw traffic data is cut into fixed-size fragments;

[0017] Each fragment is formatted to generate a multi-level traffic matrix that can fully characterize the traffic characteristics.

[0018] In one implementation, the byte-level features are represented as:

[0019]

[0020] Among them, b1 and b2 represent the first and second bytes in the data packet respectively, and s i Indicates the total number of bytes in the data packet, B i Representation of the byte-level features of the i-th data packet;

[0021] The packet-level features are expressed as:

[0022] F pkt ={f1, f2, ..., f k}

[0023] Among them, f1 and f2 represent the first and second features of the data packet respectively, and k is the number of extracted data packet features;

[0024] The flow-level features are expressed as:

[0025] T flow =t end -t start

[0026]

[0027] Among them, T flow is the flow duration, t end and t start are the end time and start time of the flow respectively; R flow is the flow rate, S flow Indicates the total size of the stream.

[0028] In one embodiment, S2 includes:

[0029] Extract the "Client Hello" information in the TLS handshake packet to obtain the TLS version, cipher suite, and extension fields supported by the client;

[0030] Extract the "Server Hello" information to obtain the TLS cipher suite and extension fields selected by the server;

[0031] Parse the certificate information in the "Certificate" message, including the certificate length, serial number, and signature algorithm, to form a plaintext message feature matrix for distinguishing normal and malicious traffic.

[0032] In one implementation, the data of the TLS handshake packet is P={p1, p2, ..., p m}, the information of each field is represented in vector form:

[0033] P TLS =[v TLS , CTLS , k cert ]

[0034] Among them, p1 represents the first field feature in the TLS handshake packet data, p m represents the mth field feature in the TLS handshake packet data, represents the last feature item in the TLS handshake packet, m represents the total number of TLS handshake packet features, that is, the number of fields contained in the feature vector, v TLS Indicates the TLS version number, C TLS Indicates the cipher suite, k cert Indicates the length of the certificate.

[0035] In one embodiment, S4 includes:

[0036] The original traffic feature matrix is ​​used as the R channel of the RGB image to retain the basic communication structure of the traffic;

[0037] Map the plaintext message feature matrix to the G channel to strengthen the key encryption features in the TLS handshake packet;

[0038] The statistical feature matrix is ​​mapped to the B channel to capture the statistical behavior pattern of the traffic, and fused to form a comprehensive feature image containing multi-dimensional information, which is an RGB image.

[0039] In one embodiment, S5 includes:

[0040] S5.1: Perform random masking on the generated RGB image to cover 75% of the image area, specifically:

[0041] I masked =M⊙I RGB

[0042] Where M is the mask matrix, ⊙ is the element-by-element multiplication operation, and the input image is I RGB , the masked image is I masked ;

[0043] S5.2: Use the masked autoencoder to perform self-supervised pre-training on the masked image. The encoding process is performed through the encoder f enc Generate latent feature vector z:

[0044] z=f enc (I masked )

[0045] Then through the decoder f dec Reconstruct the image:

[0046]

[0047] And use the mean square error as the loss function to guide the model to learn the potential feature patterns in the image, where the loss function is:

[0048]

[0049] Where N is the number of training samples, is the i-th original RGB image sample, which is the three-dimensional feature matrix obtained by the Stack() operation. represents the RGB image reconstructed by the autoencoder model, which is the image reconstructed by the model based on the uncovered part;

[0050] Step S5.3: Use stochastic gradient descent to optimize the autoencoder model and update the model parameters. The optimization goal is to minimize the loss function L MSE , the parameter update formula is:

[0051]

[0052] Among them, θ is the model parameter before updating, η is the learning rate, Denotes the loss function L MSE The gradient of the parameter θ, θ′ is the updated model parameter.

[0053] Based on the same inventive concept, the second aspect of the present invention provides an encrypted malicious traffic detection device based on multi-dimensional feature combination and masked autoencoder, comprising:

[0054] The original traffic feature extraction module is used to pre-process the input original network traffic data, extract the original traffic features, and construct the original traffic feature matrix;

[0055] The plaintext message feature extraction module is used to parse the plaintext message features in the TLS handshake packet, extract key feature fields, and form a plaintext message feature matrix with distinguishing degree;

[0056] Statistical feature extraction module, used to extract statistical features of network traffic and construct corresponding feature matrix;

[0057] A fusion module is used to fuse the feature matrices corresponding to the original traffic features, plaintext message features, and statistical features into an RGB image using RGB multi-channel fusion technology to generate a multi-dimensional feature matrix;

[0058] A self-supervised training module is used to perform self-supervised pre-training on the generated RGB images using a masked autoencoder. By randomly masking parts of the RGB images, the model is trained to reconstruct the masked areas, thereby learning the potential feature patterns in the encrypted traffic and obtaining a pre-trained model.

[0059] Model fine-tuning module, used to fine-tune the pre-trained model using a small amount of labeled data;

[0060] The traffic detection module is used to detect encrypted malicious traffic using the fine-tuned model.

[0061] Based on the same inventive concept, the third aspect of the present invention provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder described in the first aspect is implemented.

[0062] Based on the same inventive concept, the fourth aspect of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder described in the first aspect is implemented.

[0063] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows:

[0064] The present invention proposes an encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder. First, by extracting multi-dimensional features from the original traffic data, including original traffic features, TLS plaintext message features and traditional statistical features, and constructing a corresponding feature matrix, these one-dimensional feature data are then converted into two-dimensional RGB images, thereby converting the encrypted traffic detection problem into an image classification problem. Then, a masked autoencoder is used for self-supervised learning, pre-training is performed on a large amount of unlabeled traffic data, and fine-tuning is performed with a small amount of labeled data to improve the feature extraction ability and generalization performance of the model. Finally, the fine-tuned model is used to classify traffic to effectively detect and identify malicious behaviors in encrypted traffic. The method of the present invention has high detection accuracy and robustness on multiple actual traffic data sets. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0066] Figure 1 This is a flow chart of data preprocessing according to an embodiment of the present invention;

[0067] Figure 2 A flowchart of model pre-training and fine-tuning for an embodiment of the present invention;

[0068] Figure 3This is a flow chart of encrypted malicious traffic detection in an embodiment of the present invention;

[0069] Figure 4 The following is a schematic diagram of the detection results of the method for detecting encrypted malicious traffic in an embodiment of the present invention;

[0070] Figure 5 A pseudo code schematic diagram of original traffic feature extraction in an embodiment of the present invention;

[0071] Figure 6 It is a pseudo code schematic diagram of plaintext message feature extraction in an embodiment of the present invention;

[0072] Figure 7 Schematic diagram of pseudo code for traditional statistical feature extraction in an embodiment of the present invention. DETAILED DESCRIPTION

[0073] The present invention proposes an encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder to solve the problems of insufficient feature extraction capability, low detection accuracy and strong dependence on labeled data in existing encrypted traffic detection technology.

[0074] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0075] Embodiment 1

[0076] The present invention discloses an encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder, comprising:

[0077] S1: Preprocess the input raw network traffic data, extract the raw traffic features, and construct the original traffic feature matrix;

[0078] S2: Analyze the plaintext message features in the TLS handshake packet, extract key feature fields, and form a plaintext message feature matrix with distinguishing power;

[0079] S3: Extract statistical features of network traffic and construct the corresponding feature matrix;

[0080] S4: Use RGB multi-channel fusion technology to fuse the feature matrices corresponding to the original traffic features, plaintext message features, and statistical features into an RGB image to generate a multi-dimensional feature matrix;

[0081] S5: Use a masked autoencoder to perform self-supervised pre-training on the generated RGB image. By randomly masking parts of the RGB image, the model is trained to reconstruct the masked areas, thereby learning the potential feature patterns in the encrypted traffic and obtaining a pre-trained model.

[0082] S6: Fine-tune the pre-trained model using a small amount of labeled data;

[0083] S7: Detect encrypted malicious traffic using the fine-tuned model.

[0084] Specifically, steps S1 to S4 are data preprocessing and feature extraction, S5 is self-supervised pre-training based on masked autoencoder, S6 is model fine-tuning, and S7 is the specific application of the model.

[0085] In the specific implementation process, S1 can be realized in the following way: multi-level traffic representation processing is performed on the input raw network traffic data. First, the network traffic data is decomposed into a multi-level representation matrix at the byte level, packet level, and flow level to capture the fine-grained characteristics of the traffic data. By cutting the raw traffic data into fixed-size fragments and formatting each fragment, a multi-level traffic matrix that can fully characterize the traffic characteristics is generated.

[0086] S21 can be implemented in the following ways: parsing the plaintext message features in the TLS handshake packet through the Wireshark tool, extracting key feature fields including TLS version number, cipher suite, certificate information, etc., forming a plaintext message feature matrix with distinguishing degree to enrich the feature representation of encrypted traffic;

[0087] S31 can be implemented in the following ways: combining multiple traditional statistical features, such as packet size, time interval, flow duration, number of data packets, flag bits, etc., to construct a statistical feature matrix, and using data preprocessing techniques such as normalization and standardization to enhance the representativeness of features and the stability of model training;

[0088] S4 can be implemented in the following ways: using RGB multi-channel fusion technology, the feature matrices of the above three different dimensions (i.e., original traffic features, plaintext message features, and statistical features) are fused into an RGB image representation to achieve a joint representation of multi-dimensional features and retain the fine-grained information of traffic features;

[0089] S5: The generated RGB images are pre-trained using a masked autoencoder (MAE) to perform self-supervised pre-training. By randomly masking parts of the image, the model is trained to reconstruct the masked areas, thereby deeply learning the potential feature patterns in the encrypted traffic and improving the generalization ability of the model.

[0090] S6: Use a small amount of labeled data to fine-tune the pre-trained model so that the model can accurately distinguish malicious traffic from normal traffic in encrypted traffic, and finally achieve accurate detection of encrypted malicious traffic through S7.

[0091] In one embodiment, the multi-level traffic representation process includes segmenting each flow into a byte sequence matrix of a fixed size, wherein the rows of the matrix represent different levels of traffic (such as byte level, packet level, and flow level), and the columns represent specific attributes of each level (such as protocol type, source and destination addresses, ports, etc.), including:

[0092] Divide network traffic data into different communication traffic segments according to its five-tuple (source / destination IP address, source / destination port number and protocol type);

[0093] Remove the Ethernet header information, set the port number to zero, and replace the IP address with a random address to prevent the model from learning irrelevant information;

[0094] These traffic segments are formatted into fixed-size two-dimensional matrices, each of which contains fine-grained features at the byte level, packet level, and flow level.

[0095] In one embodiment, S2 includes:

[0096] Extract the "Client Hello" information in the TLS handshake packet to obtain the TLS version, cipher suite, and extension fields supported by the client;

[0097] Extract the "Server Hello" information to obtain the TLS cipher suite and extension fields selected by the server;

[0098] Parse the certificate information in the "Certificate" message, including the certificate length, serial number, and signature algorithm, to form a plaintext message feature matrix for distinguishing normal and malicious traffic.

[0099] In one embodiment, the statistical feature extraction in S3 includes statistics on time, space, and flag features in network traffic, specifically including the extraction and calculation of source port, destination port, session duration, number of data packets, total number of bytes, etc., specifically:

[0100] Use time-related features such as session duration, time interval, etc. to calculate the time series pattern of traffic;

[0101] Use spatially relevant features, such as the number of packets, total bytes, and packet length, to analyze traffic transmission behavior;

[0102] By using flag-related features, such as PUSH, ACK, and RST, the control information in each flow is recorded to form a statistical feature matrix.

[0103] In one implementation, the RGB multi-channel fusion technology in S4 maps the original traffic feature matrix, the plaintext message feature matrix, and the statistical feature matrix to three channels of the RGB image, respectively, thereby achieving a joint representation of multi-dimensional features, including:

[0104] The original traffic feature matrix is ​​used as the R channel of the RGB image to retain the basic communication structure of the traffic;

[0105] Map the plaintext message feature matrix to the G channel to strengthen the key encryption features in the TLS handshake packet;

[0106] The statistical feature matrix is ​​mapped to the B channel to capture the statistical behavior pattern of the traffic, and a comprehensive feature image containing multi-dimensional information is formed through these fusions.

[0107] In one embodiment, the mask autoencoder pre-training in S5 includes randomly masking 75% of the area in the RGB image and reconstructing the masked area through model training to learn the deep feature representation of the flow, including:

[0108] Randomly mask 75% of the input RGB image so that the model only relies on the remaining 25% of information for reconstruction during training;

[0109] The encoder extracts the features of the uncovered area, and the decoder reconstructs the covered part;

[0110] The mean square error (MSE) is used as the loss function to guide the model to learn the latent feature patterns in the image to improve the generalization ability of the model.

[0111] In one embodiment, the fine-tuning step in S6 includes using a small amount of labeled malicious traffic and normal traffic data to optimize the model through cross-validation and parameter adjustment, so that it can efficiently identify malicious traffic in encrypted traffic, including:

[0112] After self-supervised pre-training on a large amount of unlabeled data, the model is fine-tuned using a small amount of labeled data;

[0113] Select the optimal model parameters through cross-validation, including learning rate, batch size, etc.;

[0114] The model weights are adjusted using evaluation indicators such as classification accuracy, recall rate, and F1 score to ensure that the model has high detection accuracy and robustness when facing new or variant malicious traffic.

[0115] The main key points of the present invention include:

[0116] 1. Multi-dimensional feature fusion:

[0117] Comparative Document 1 (CN115426137A) mentions the statistical feature extraction of multi-dimensional network flows, but it mainly focuses on traditional statistical features, such as packet size, time interval, etc., which are relatively simple and lack in-depth analysis of the encryption protocol level. The present invention not only extracts traditional statistical features, but also focuses on parsing the plaintext message features in the TLS handshake packet, extracting deep-level features such as TLS version number, cipher suite, and certificate information. By further exploring these key encryption protocol features, the present invention can construct a more comprehensive traffic feature matrix, so that the detection model has stronger recognition capabilities, especially when facing complex encrypted traffic, it can effectively improve the model's feature extraction capabilities.

[0118] In addition, although the fusion of multiple features is a common technical means, the present invention optimizes the depth of feature extraction and the joint representation of features. It is a new method different from the conventional fusion of multiple features. Through RGB imaging technology, multi-dimensional features are mapped to three-channel images, which not only retains the independence of features, but also fully explores the correlation between various features through joint representation. Compared with simple statistical feature extraction, this feature fusion method effectively overcomes the problem of information hiding in encrypted traffic, making the characteristics of malicious traffic more prominent.

[0119] Technical difficulties: In an encrypted traffic environment, it is difficult to extract features through traditional content analysis methods because the communication content is encrypted. This invention makes up for this deficiency by combining deep protocol analysis with multi-dimensional features, especially in the extraction of handshake packets and transmission features of encryption protocols. It constructs a feature matrix that can effectively characterize traffic, and ensures the adaptability of the model in complex traffic environments by integrating multi-dimensional features.

[0120] 2. Innovative applications of masked autoencoders:

[0121] As a self-supervised learning model, masked autoencoders have been applied in the prior art. For example, reference document 2 (CN118400195A) uses masked autoencoders to reconstruct network traffic features, and reference document 3 (CN116346384A) uses variational autoencoders for malicious traffic detection. However, the present invention makes specific optimizations in the application of autoencoders.

[0122] The masked autoencoder in the present invention adopts a coding and decoding mechanism for multi-dimensional feature images in structure. By randomly covering part of the image area, the model can not only perform self-supervised learning on unlabeled data, but also reconstruct deep features on incomplete data. In addition, compared with the masked autoencoder in Comparative Document 2 which focuses on the reconstruction of general traffic features, the present invention focuses more on extracting features in encrypted traffic through deep self-supervised pre-training, and introduces a hierarchical multi-scale feature extraction mechanism in structure, so that the model can learn complex patterns of encrypted traffic at different scales. Specifically, the encoder of the present invention not only performs simple feature reconstruction on the input data, but also can perform deeper learning of features through a multi-level coding structure to capture hidden encrypted traffic patterns. This design enables the model to have higher accuracy when processing feature associations and abnormal patterns in encrypted traffic. At the same time, the model can obtain a deep understanding of complex traffic features in the unsupervised learning stage, reducing the dependence on a large amount of labeled data.

[0123] Compared with the variational autoencoder in Comparative Document 3, the masked autoencoder focuses on feature reconstruction by masking part of the input, and is more adaptable in self-supervised learning, especially in an encrypted traffic environment, and can effectively improve the model's feature representation capabilities without relying on the probability distribution of the generative model like the variational autoencoder. In addition, the present invention also combines the specific scenario of encrypted traffic and optimizes the structure of the model, so that it can overcome the information loss problem caused by encryption when processing encrypted traffic.

[0124] Technical advantages: The application of masked autoencoders in this solution not only enables the model to be effectively pre-trained on unlabeled data, but also reduces the reliance on labeled data through self-supervised learning. At the same time, combined with the input of RGB multi-channel feature images, the model can reconstruct and extract features in multi-dimensional space, improving the accuracy of malicious traffic detection.

[0125] Regarding multi-scale feature extraction: This solution adopts a multi-dimensional and multi-level approach to extract network traffic features, which is specifically reflected in the joint extraction of original traffic features, plaintext message features, and traditional statistical features. These three types of features reflect different levels of information on network traffic.

[0126] 1. Original traffic characteristics: reflect the underlying structure of the traffic, such as byte-level and packet-level characteristics.

[0127] This application processes the original data as follows. First, in actual traffic analysis, it is usually necessary to analyze each group of communications separately, that is, to cut the original pcap into multiple sub-pcaps, each of which represents a group of communication traffic. According to the experiments conducted by Wang et al. on the impact of different traffic representation forms on the model, it can be seen that the overall effect of using Session is better than that of Flow, but the effect difference under different conditions is also different and unstable. Therefore, this application first cuts the complete traffic pcap package with Session as the granularity. Then delete the Ethernet header of the traffic, set the port number to zero, and replace the IP with a random address, but retain its direction. This measure prevents the model from learning irrelevant information. Finally, capture M adjacent data packets in the traffic and format them into a two-dimensional matrix of size H*W as a representation of the traffic, where H and W represent the height and width of the two-dimensional matrix, respectively. It should be noted that when there are fewer than M data packets in the data stream, the matrix only contains the bytes of the existing data packets, and other positions are not filled.

[0128] At the same time, the present invention adopts a multi-level traffic representation method to represent the traffic as a fixed-size representation matrix containing 5 packet-level matrices to capture data features at different levels. The specific pseudo code is as follows Figure 5 shown.

[0129] 2. Plaintext message features: By extracting the features of plaintext messages in encrypted traffic (such as TLS handshake packet information), the protocol layer features in the traffic are obtained.

[0130] In encrypted malicious traffic detection, plaintext message features involve analyzing unencrypted information to identify potential malicious traffic. There are some plaintext transmission parts in the handshake process of the SSL / TLS protocol, such as key fields in the Client Hello and ServerHello messages, which can be used to distinguish malicious TLS traffic. By extracting handshake packet information, malicious traffic can be effectively identified and detection accuracy can be improved. The specific pseudo code is as follows Figure 6 shown.

[0131] 3. Statistical characteristics: Extract statistical information from the macro behavior of network traffic, such as packet size, time interval, etc., to reflect the overall distribution of network traffic.

[0132] Traditional statistical features: With the popularization of communication encryption technology, it is increasingly difficult for intrusion detection systems (IDS) based on content analysis to directly detect traffic content. Therefore, the use of statistical features to analyze and identify traffic behavior has shown unique advantages. Statistical features are mainly derived from basic data of network traffic, such as packet size, time interval, flow duration, etc. By analyzing these features, abnormal behavior can be discovered, thereby identifying potential malicious traffic, while not relying on direct access to encrypted content. This method protects content privacy and is suitable for real-time analysis. The specific pseudo code is as follows Figure 7 shown.

[0133] The multi-scale feature extraction mechanism ensures that the model can simultaneously capture local information (such as byte and packet-level features) and global information (such as statistical features) in the traffic by jointly extracting features at different levels and dimensions, thereby improving the model's ability to perceive new and hidden attacks.

[0134] Masked Autoencoder

[0135] The Masked Autoencoder (MAE) used in the prior art can theoretically be used for traffic feature reconstruction in this solution, but it cannot achieve the technical effect of the solution of the present invention:

[0136] Similarities:

[0137] The structure of the masked autoencoder is similar: the masked autoencoder in Comparative Document 2 and the MAE used in this solution both train the model by partially masking (masking) the input and reconstructing the masked part through the remaining information. This self-supervised learning method can effectively extract features from unlabeled data, so its basic principles are the same and can theoretically be used to reconstruct traffic features.

[0138] Differences:

[0139] Difference in applicability: The masked autoencoder in Comparative Document 2 is mainly used for the reconstruction of general images or sequence data, while the autoencoder in the present invention is specifically optimized for encrypted traffic features. In network traffic data, especially encrypted traffic, it has more complex structures and noise characteristics. The present invention uses a multi-dimensional feature joint mechanism (including original traffic features, plaintext message features, and statistical features) to make feature extraction more suitable for traffic detection tasks. The masked autoencoder in Comparative Document 2 is not specifically optimized for the multi-dimensional features in network traffic and cannot fully capture the key information in encrypted traffic.

[0140] Ability to reconstruct traffic features: The masked autoencoder in the present invention not only processes imaged traffic data, but also utilizes a multi-dimensional feature fusion and optimization process. This means that the model not only relies on simple masking and reconstruction, but also combines different levels of information in the traffic, especially the plaintext message features and statistical features in encrypted traffic. The autoencoder in Comparative Document 2 does not have a dedicated traffic feature optimization and may perform poorly when processing complex network traffic, especially for hidden attack patterns in encrypted traffic.

[0141] Therefore, although the masked autoencoder in Comparative Document 2 can be used to reconstruct general traffic features, if the method in Comparative Document 2 is applied to Comparative Document 1, only general traffic features are reconstructed, and the detection accuracy is not high. Since the masked autoencoder in the present invention is optimized and multi-dimensional feature fusion is performed, it can better adapt to the complex features in encrypted traffic. Therefore, the autoencoder in the scheme of the present invention is more suitable for the reconstruction of multi-dimensional traffic features, and has higher robustness and detection accuracy when processing encrypted malicious traffic detection tasks.

[0142] The technical solution of the present invention comprises the following steps:

[0143] Step 1, data preprocessing and feature extraction. Perform multi-level traffic representation processing on the input raw network traffic data. First, decompose the network traffic data into a multi-level representation matrix at the byte level, packet level, and flow level to capture the fine-grained features of the traffic data. Then, use tools such as Wireshark to parse the plaintext message features in the TLS handshake packet, extract key fields such as TLS version number, cipher suite, certificate information, and generate a TLS feature matrix. In addition, extract the statistical features of the network traffic, including packet size, time interval, flow duration, and number of packets, and generate a feature matrix in a unified format through normalization and standardization. Finally, these multi-dimensional features are converted into a two-dimensional RGB image representation through RGB multi-channel fusion technology to achieve the joint representation of multi-dimensional features.

[0144] Step 2: Input the RGB image generated in step 1 into the masked autoencoder (MAE) for self-supervised pre-training. The structure of the model includes an input layer, a masked autoencoder, and a classifier module. Specifically, the input layer receives the multi-dimensional feature matrix after feature extraction and image processing, and inputs it into the masked autoencoder. In the masked autoencoder, 75% of the RGB image is randomly masked, and the model relies on the unmasked 25% area to reconstruct the masked part during training, thereby learning the potential feature patterns in the image. The masked autoencoder consists of an encoder and a decoder: the encoder only processes the unmasked part of the image and extracts deep feature representations; the decoder uses these features and position information to reconstruct the complete image, especially the masked area. Through this layer-by-layer encoding and decoding process, the masked autoencoder effectively extracts and reconstructs the information in the traffic feature image, enhancing the feature extraction ability of the entire model in dealing with new or covert attacks. After pre-training, the model weights of the masked autoencoder can be further used for fine-tuning and malicious traffic classification tasks. This step does not rely on labeled data, significantly improves the generalization ability of the model, reduces dependence on large amounts of labeled data, and enables the model to exhibit greater robustness and detection accuracy in encrypted traffic environments.

[0145] Step 3: After completing the self-supervised pre-training, fine-tune the model using a small amount of labeled traffic data. The model parameters are optimized through the classification information in the labeled data, so that the model can more accurately identify malicious behavior in encrypted traffic. The fine-tuned model can effectively detect malicious traffic in encrypted traffic in an actual network environment. The verification results show that the present invention is superior to the existing technology in terms of detection accuracy and robustness. Figure 4As shown, FlowPrint: FlowPrint is a method for detecting malicious encrypted traffic by generating fingerprints by capturing spatial and temporal features of network traffic. AppScanner: AppScanner is an application traffic analysis tool based on random forests, which performs data mining by analyzing traffic features generated by applications. DF (Deep Fingerprinting): DF is a traffic detection method based on directional sequence and convolutional neural network, mainly used for deep fingerprint analysis of network traffic. 2D-CNN (Two-dimensional Convolutional Neural Network): 2D-CNN uses header and payload information to construct a two-dimensional matrix for traffic analysis, and extracts traffic features through convolutional neural network. 3D-CNN (Three-dimensional Convolutional Neural Network): 3D-CNN extends the two-dimensional convolutional neural network and combines the time dimension for traffic analysis to improve detection accuracy. FS-Net: FS-Net is a feature selection network based on CNN for classification and detection of network traffic. PERT (Pre-trained Transformer): PERT uses a pre-trained model based on BERT for traffic classification, mainly used for transfer learning of natural language processing tasks. ET-BERT: ET-BERT is an extended BERT model with specific byte pair encoding and pre-training tasks for encrypted traffic classification.

[0146] Step 1 specifically includes the following steps:

[0147] Step 1.1: For the input raw network traffic data, first perform a hierarchical representation of the byte level, packet level, and flow level to extract the basic features related to network traffic. Suppose the traffic data is X = {x1, x2, ..., x n}, normalize the features of each data packet to ensure data consistency:

[0148]

[0149] Among them, x i is the original feature value of the ith data packet, x′ i is the normalized feature value of the ith data packet, whose features include packet size, transmission protocol, timestamp, etc. min(X) and max(X) represent the minimum and maximum values ​​of the traffic data, respectively.

[0150] Byte-level representation: Let data packet x′ i The byte representation is B i , whose size is s i . This feature can be expressed as:

[0151]

[0152] Among them, b j Indicates the jth byte in the data packet, s i Indicates the total number of bytes in the packet.

[0153] Packet level representation: For each packet x′ i , extract its protocol type, port number and other network layer features to form a feature vector F pkt

[0154] F pkt ={f1, f2, ..., f k}

[0155] Among them, f i represents a feature of the data packet, and k is the number of extracted features (such as protocol type, source port, destination port, etc.).

[0156] Flow-level representation: For each complete network flow X, its flow duration and packet transmission rate are extracted and expressed as:

[0157] T flow =t end --t start

[0158]

[0159] Among them, T flow is the flow duration, t end and t start are the end time and start time of the flow respectively; R flow is the flow rate, S flow Indicates the total size of the stream.

[0160] Step 1.2, parse the plaintext message features in the TLS handshake packet, extract key fields including TLS version number, cipher suite, certificate length, etc., and generate a TLS feature matrix. Suppose the TLS handshake packet data is P = {p1, p2, ..., p m}, the information of each field can be expressed in vector form:

[0161] P TLS =[v TLS , c TLS , l cert ]

[0162] Among them, p1 represents the first field feature in the TLS handshake packet data, which may be the TLS version number or other first feature item, p mIndicates the mth field feature in the TLS handshake packet data, indicating the last feature item in the TLS handshake packet, which may be the certificate length or other related features. m represents the total number of TLS handshake packet features, that is, the number of fields contained in the feature vector. v TLS Indicates the TLS version number, c TLS Indicates the cipher suite, l cert Indicates the length of the certificate.

[0163] Step 1.3, extract the statistical characteristics of network traffic, such as packet size, time interval and number of data packets.

[0164] Packet size statistics: Let the size of the i-th data packet in the traffic be S i , the average packet size in the traffic can be calculated:

[0165]

[0166] Where n is the number of packets, S i is the size of the ith data packet.

[0167] Time interval statistics: Let the time interval between the i-th and i+1-th data packets be t interval , the calculation formula is:

[0168] t interval =t i+1 -t i

[0169] Among them, t i and t i+1 are the timestamps of the i-th and i+1-th packets respectively.

[0170] Packet count statistics: Assume the total number of packets contained in the network traffic is Npkt. This feature can be directly expressed as:

[0171]

[0172] Where n is the number of packets in the flow.

[0173] Step 1.4: The original traffic features extracted in step 1.1, the plaintext message features in the TLS handshake packet extracted in step 1.2, and the statistical features extracted in step 1.3 are converted into a two-dimensional RGB image representation through RGB multi-channel fusion technology to generate a multi-dimensional feature matrix M, and finally form a fused feature image I. RGB :

[0174] I RGB =Stack(M R , M G , M B )

[0175] Among them, M R , M G , M B Represent the corresponding channel matrices respectively. The Stack() operation stacks these matrices according to the channel dimension to form a three-dimensional matrix I with three channels. RGB .

[0176] Step 2, self-supervised pre-training based on masked autoencoder, is described in detail as follows:

[0177] Step 2.1, perform random masking on the RGB image generated in step 1.4, covering 75% of the image area. Suppose the input image is I RGB , the masked image is I masked , expressed as:

[0178] I masked =M⊙I RGB

[0179] Where M is the mask matrix and ⊙ is the element-by-element multiplication operation.

[0180] Step 2.2, use the masked autoencoder to perform self-supervised pre-training on the masked image. The encoding process is done by the encoder f enc Generate latent feature vector z:

[0181] z=f enc (I masked )

[0182] Then through the decoder f dec Reconstruct the image:

[0183]

[0184] The loss function of the model is defined as the mean squared error between the input image and the reconstructed image:

[0185]

[0186] Where N is the number of training samples, The i-th original RGB image sample, which is the three-dimensional feature matrix obtained by the Stack() operation, Represents the RGB image reconstructed by the autoencoder model. This is the image reconstructed by the model based on the uncovered part.

[0187] Step 2.3, use stochastic gradient descent to optimize the autoencoder model and update the model parameters. The optimization goal is to minimize the loss function L MSE , the parameter update formula is:

[0188]

[0189] Among them, θ is the model parameter, η is the learning rate, Denotes the loss function L MSE The gradient of the parameter θ. Denotes the loss function L MSE Partial derivatives with respect to each parameter θ.

[0190] Step 3: Model fine-tuning and malicious traffic detection.

[0191] Step 3.1, use a small amount of labeled traffic data to fine-tune the pre-trained mask autoencoder. The fine-tuning process uses the cross entropy loss function to optimize the model:

[0192]

[0193] Among them, i represents the i-th sample in the training sample set, y i is the true label, is the model prediction result, N is the number of training samples;

[0194] Step 3.2: After the model is fine-tuned, deploy the fine-tuned model in the actual network environment to detect malicious traffic. At this point, the model will classify the encrypted traffic captured in real time and identify the malicious behavior. The specific process is as follows:

[0195] First, use a network sniffing tool (such as Wireshark) to capture network traffic data in real time. Assume that the captured traffic data is:

[0196] X real ={x1,x2,…,x T}

[0197] where x t is a traffic sample captured at time t.

[0198] Then, the collected real-time traffic data is subjected to feature extraction and preprocessing. It is converted into the same feature representation as the training data to generate the input feature matrix M real . This is then fed into the fine-tuned model.

[0199] The model's input feature matrix M real Perform forward propagation and output the corresponding classification probability P(y|M real ). The specific classification probability calculation formula is:

[0200]

[0201] Among them, z is the linear output of the model, K is the total number of classification categories, k is a specific category, P(y|M real ) is the probability that the traffic belongs to category y, z y 、z k Represents the linear output or logit value for class y, k in the linear output.

[0202] The technical solution of the present invention is further specifically described below through embodiments and in conjunction with the accompanying drawings.

[0203] Example:

[0204] The input raw data of the present invention adopts an encrypted traffic data set. Before training and testing the encrypted malicious traffic detection model, the initial input data will be preprocessed. Figure 1 First, we perform multi-level representation processing on the original traffic data, decompose the network traffic data into multi-level representation matrices at the byte level, packet level, and flow level, and normalize these data. For the TLS handshake packet data involved in the traffic, we extract the TLS feature matrix by parsing the TLS version number, cipher suite, certificate information and other fields. Finally, we combine the above features with statistical features (such as packet size, time interval, etc.) to generate a fused multi-dimensional feature matrix, and convert it into a two-dimensional image representation through the RGB imaging method to meet the input requirements of the subsequent deep learning model.

[0205] Figure 2 This is the model pre-training and fine-tuning process of the present invention. First, use the masked autoencoder to Figure 1 The pre-training is done by self-supervising on the RGB images generated in . Specifically, by randomly masking 75% of the image, the model needs to reconstruct the masked parts during training to learn the deep features in the image. Subsequently, the pre-trained model is fine-tuned on the basis of a small amount of labeled data to improve its classification accuracy and generalization ability in the encrypted malicious traffic detection task. The goal of pre-training and fine-tuning is to optimize the model parameters so that it can accurately distinguish between normal and malicious traffic.

[0206] Figure 3 This is the malicious traffic detection process of the present invention. Figure 1 The test sample set generated in the test is input into the fine-tuned model for malicious traffic detection. The model calculates the probability distribution of each category through forward propagation and selects the most likely category as the final prediction result based on the multi-classification decision rule. If the prediction result points to malicious traffic, the system will issue an alarm and record relevant information so that further security measures can be taken; if the prediction is normal traffic, it will be allowed to pass through the network system normally.

[0207] Embodiment 2

[0208] Based on the same inventive concept, this embodiment discloses an encrypted malicious traffic detection device based on multi-dimensional feature combination and masked autoencoder, including:

[0209] The original traffic feature extraction module is used to pre-process the input original network traffic data, extract the original traffic features, and construct the original traffic feature matrix;

[0210] The plaintext message feature extraction module is used to parse the plaintext message features in the TLS handshake packet, extract key feature fields, and form a plaintext message feature matrix with distinguishing degree;

[0211] Statistical feature extraction module, used to extract statistical features of network traffic and construct corresponding feature matrix;

[0212] A fusion module is used to fuse the feature matrices corresponding to the original traffic features, plaintext message features, and statistical features into an RGB image using RGB multi-channel fusion technology to generate a multi-dimensional feature matrix;

[0213] A self-supervised training module is used to perform self-supervised pre-training on the generated RGB images using a masked autoencoder. By randomly masking parts of the RGB images, the model is trained to reconstruct the masked areas, thereby learning the potential feature patterns in the encrypted traffic and obtaining a pre-trained model.

[0214] Model fine-tuning module, used to fine-tune the pre-trained model using a small amount of labeled data;

[0215] The traffic detection module is used to detect encrypted malicious traffic using the fine-tuned model.

[0216] Since the device introduced in the second embodiment of the present invention is a device used to implement the encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder in the first embodiment of the present invention, based on the method introduced in the first embodiment of the present invention, the person skilled in the art can understand the specific structure and deformation of the device, so it is not repeated here. All devices used in the method in the first embodiment of the present invention belong to the scope of protection of the present invention.

[0217] Embodiment 3

[0218] Based on the same inventive concept, the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method described in the first embodiment is implemented.

[0219] Since the computer-readable storage medium introduced in the third embodiment of the present invention is a computer-readable storage medium used to implement the encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder in the first embodiment of the present invention, based on the method introduced in the first embodiment of the present invention, the person skilled in the art can understand the specific structure and deformation of the computer-readable storage medium, so it is not repeated here. All computer-readable storage media used in the method of the first embodiment of the present invention belong to the scope of protection of the present invention.

[0220] Embodiment 4

[0221] The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in Embodiment 1 when executing the program.

[0222] Since the computer device introduced in the fourth embodiment of the present invention is a computer device used to implement the encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder in the first embodiment of the present invention, based on the method introduced in the first embodiment of the present invention, the person skilled in the art can understand the specific structure and deformation of the computer device, so it is not repeated here. All computer devices used in the method of the first embodiment of the present invention belong to the scope of protection of the present invention.

[0223] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0224] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0225] Although preferred embodiments of the present invention have been described, additional changes and modifications may be made to these embodiments by those skilled in the art once the basic creative concepts are known. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention. Obviously, those skilled in the art may make various changes and modifications to the embodiments of the present invention without departing from the spirit and scope of the embodiments of the present invention. Thus, if these modifications and variations of the embodiments of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for detecting encrypted malicious traffic based on multi-dimensional feature combination and masked autoencoder, characterized in that: include: S1: Preprocess the input raw network traffic data, extract the raw traffic features, and construct the original traffic feature matrix; S2: Analyze the plaintext message features in the TLS handshake packet, extract key feature fields, and form a plaintext message feature matrix with distinguishing power; S3: Extract statistical features of network traffic and construct the corresponding feature matrix; S4: Use RGB multi-channel fusion technology to fuse the feature matrices corresponding to the original traffic features, plaintext message features, and statistical features into an RGB image to generate a multi-dimensional feature matrix; S5: Use a masked autoencoder to perform self-supervised pre-training on the generated RGB image. By randomly masking parts of the RGB image, the model is trained to reconstruct the masked areas, thereby learning the potential feature patterns in the encrypted traffic and obtaining a pre-trained model. S6: Fine-tune the pre-trained model using a small amount of labeled data; S7: Detect encrypted malicious traffic using the fine-tuned model.

2. The encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder as claimed in claim 1 is characterized in that: S1 includes: Perform multi-level traffic representation processing on the input raw network traffic data, decompose the raw byte sequence of the network traffic into multi-level representation matrices at the byte level, packet level and flow level, so that the raw traffic data is cut into fixed-size fragments; Each fragment is formatted to generate a multi-level traffic matrix that can fully characterize the traffic characteristics.

3. The encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder as claimed in claim 2 is characterized in that: The byte-level features are represented as: Among them, b1 and b2 represent the first and second bytes in the data packet respectively, and s i Indicates the total number of bytes in the data packet, B i Representation of the byte-level features of the i-th data packet; The packet-level features are expressed as: F pkt ={f1,f2,…,f k } Among them, f1 and f2 represent the first and second features of the data packet respectively, and k is the number of extracted data packet features; The flow-level features are expressed as: T flow =t end -t start Among them, T flow is the flow duration, t end and t start are the end time and start time of the flow respectively; R flow is the flow rate, S flow Indicates the total size of the stream.

4. The encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder as claimed in claim 1, characterized in that S2 include: Extract the "Client Hello" information in the TLS handshake packet to obtain the TLS version, cipher suite, and extension fields supported by the client; Extract the "Server Hello" information to obtain the TLS cipher suite and extension fields selected by the server; Parse the certificate information in the "Certificate" message, including the certificate length, serial number, and signature algorithm, to form a plaintext message feature matrix for distinguishing normal and malicious traffic.

5. The encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder as claimed in claim 4 is characterized in that: The data of the TLS handshake packet is P = {p1, p2, ..., p m }, the information of each field is represented in vector form: P TLS =[v TLS ,c TLS ,l cert ] Among them, p1 represents the first field feature in the TLS handshake packet data, p m represents the mth field feature in the TLS handshake packet data, represents the last feature item in the TLS handshake packet, m represents the total number of TLS handshake packet features, that is, the number of fields contained in the feature vector, v TLS Indicates the TLS version number, c TLS Indicates the cipher suite, l cert Indicates the length of the certificate.

6. The encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder as claimed in claim 1 is characterized in that: S4 includes: The original traffic feature matrix is ​​used as the R channel of the RGB image to retain the basic communication structure of the traffic; Map the plaintext message feature matrix to the G channel to strengthen the key encryption features in the TLS handshake packet; The statistical feature matrix is ​​mapped to the B channel to capture the statistical behavior pattern of the traffic, and fused to form a comprehensive feature image containing multi-dimensional information, which is an RGB image.

7. The encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder as claimed in claim 1, characterized in that S5 include: S5.1: Perform random masking on the generated RGB image to cover 75% of the image area, specifically: I masked =M⊙I RGB Where M is the mask matrix, ⊙ is the element-by-element multiplication operation, and the input image is I RGB , the masked image is I masked ; S5.2: Use the masked autoencoder to perform self-supervised pre-training on the masked image. The encoding process is performed through the encoder f enc Generate latent feature vector z: z=f enc (I masked ) Then through the decoder f dec Reconstruct the image: And use the mean square error as the loss function to guide the model to learn the potential feature patterns in the image, where the loss function is: Where N is the number of training samples, is the ith original RGB image sample, which is the three-dimensional feature matrix obtained by the Stack() operation. represents the RGB image reconstructed by the autoencoder model, which is the image reconstructed by the model based on the uncovered part; Step S5.3: Use stochastic gradient descent to optimize the autoencoder model and update the model parameters. The optimization goal is to minimize the loss function L MSE , the parameter update formula is: Among them, θ is the model parameter before updating, η is the learning rate, Denotes the loss function L MSE The gradient of the parameter θ, θ′ is the updated model parameter.

8. An encrypted malicious traffic detection device based on multi-dimensional feature combination and masked autoencoder, characterized in that: include: The original traffic feature extraction module is used to pre-process the input original network traffic data, extract the original traffic features, and construct the original traffic feature matrix; The plaintext message feature extraction module is used to parse the plaintext message features in the TLS handshake packet, extract key feature fields, and form a plaintext message feature matrix with distinguishing degree; Statistical feature extraction module, used to extract statistical features of network traffic and construct corresponding feature matrix; A fusion module is used to fuse the feature matrices corresponding to the original traffic features, plaintext message features, and statistical features into an RGB image using RGB multi-channel fusion technology to generate a multi-dimensional feature matrix; A self-supervised training module is used to perform self-supervised pre-training on the generated RGB images using a masked autoencoder. By randomly masking parts of the RGB images, the model is trained to reconstruct the masked areas, thereby learning the potential feature patterns in the encrypted traffic and obtaining a pre-trained model. Model fine-tuning module, used to fine-tune the pre-trained model using a small amount of labeled data; The traffic detection module is used to detect encrypted malicious traffic using the fine-tuned model.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder as described in any one of claims 1 to 7 is implemented.

10. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder as described in any one of claims 1 to 7 is implemented.

Images