Encrypted malicious traffic detection method and device based on multi-dimensional feature combination and masked autoencoder

Abstract

The present invention discloses a method and device for detecting encrypted malicious traffic based on multi-dimensional feature combination and masked autoencoder, aiming to solve the problems of insufficient feature extraction capability and low detection accuracy in existing encrypted traffic detection. First, by extracting multi-dimensional features from the original traffic data, including original traffic features, TLS plaintext message features and traditional statistical features, these one-dimensional feature data are converted into two-dimensional RGB images, thereby converting the encrypted traffic detection problem into an image classification problem. Then, self-supervised learning is performed using a masked autoencoder, pre-training is performed on a large amount of unlabeled traffic data, and fine-tuning is performed using a small amount of labeled data to improve the feature extraction capability and generalization performance of the model. Finally, the fine-tuned model is used to perform traffic classification to effectively detect and identify malicious behaviors in encrypted traffic. Experimental results show that the present invention has high detection accuracy and robustness on multiple actual traffic data sets.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder (MAE), which aims to improve the accuracy and robustness of malicious behavior detection in encrypted traffic. Background Art

[0002] Network anomaly detection, a key cybersecurity technology, extracts valuable traffic features from network data and uses these features to build classification models to identify anomalous behavior within network traffic. This detection technology can effectively prevent cyberattacks, protect personal information and assets from theft and destruction, thereby improving computer system security and maintaining the overall information security of the internet. Compared to traditional intrusion detection technologies, network anomaly detection not only has lower model training costs but is also more effective in detecting anomalous network behavior. It has become a key tool in modern cybersecurity defense systems.

[0003] Currently, network anomaly detection technologies are mainly divided into five categories: Detection based on statistical learning captures historical network traffic data, analyzes the relationship between data, uses statistical models to characterize normal network behavior and detect abnormal traffic; detection methods based on machine learning analyze the correlation mapping between input and output data, train to form classification models, and automatically process large amounts of network traffic data, but traditional methods rely on manual feature extraction and have limited effectiveness in dealing with complex attacks; detection based on deep learning introduces a multi-layer neural network structure to automatically extract complex features and perform deep pattern recognition, which is suitable for detecting complex attack behaviors hidden in network traffic, but its model training usually requires a large amount of labeled data and computing resources; detection based on ensemble learning improves model accuracy and robustness by combining multiple learners. Although it can reduce false positives and missed negatives, its complexity and cost are relatively high; detection methods based on protocol analysis rely on an in-depth understanding of network protocols, and detect abnormal behavior by constructing normal behavior models and comparing them with real-time traffic, but may be limited when processing encrypted traffic or unknown protocols.

[0004] While existing network anomaly detection technologies have made progress in both theory and application, they still face the challenge of insufficient feature extraction capabilities. Existing feature extraction methods often struggle to capture all key information in the raw data, resulting in low detection model accuracy and high false positive rates. Furthermore, in real-world network environments, traffic data is often mixed with a large amount of useless information. This "corrupted data" negatively impacts the performance of anomaly detection models, further reducing detection effectiveness. Summary of the Invention

[0005] This paper proposes a method for detecting encrypted malicious traffic based on a combination of multidimensional features and a masked autoencoder. This method aims to address the challenges of existing network security technologies for detecting encrypted traffic, including insufficient feature extraction capabilities, low detection accuracy, and reliance on large amounts of labeled data. By integrating multidimensional traffic features with self-supervised learning techniques, this method significantly improves the accuracy and robustness of detecting encrypted malicious traffic.

[0006] In order to solve the above technical problems, the technical solutions adopted by the present invention are as follows:

[0007] The first aspect provides an encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder, including:

[0008] S1: Preprocess the input raw network traffic data, extract the raw traffic features, and construct the original traffic feature matrix;

[0009] S2: Analyze the plaintext message features in the TLS handshake packet, extract key feature fields, and form a plaintext message feature matrix with discriminativeness;

[0010] S3: Extract statistical features of network traffic and construct the corresponding feature matrix;

[0011] S4: Using RGB multi-channel fusion technology, the feature matrices corresponding to the original traffic features, plaintext message features, and statistical features are fused into an RGB image to generate a multi-dimensional feature matrix;

[0012] S5: Use a masked autoencoder to perform self-supervised pre-training on the generated RGB image. By randomly masking parts of the RGB image, the model is trained to reconstruct the masked areas, thereby learning the potential feature patterns in the encrypted traffic and obtaining a pre-trained model.

[0013] S6: Fine-tune the pre-trained model using a small amount of labeled data;

[0014] S7: Detect encrypted malicious traffic using the fine-tuned model.

[0015] In one embodiment, S1 includes:

[0016] Perform multi-level traffic representation processing on the input raw network traffic data, decomposing the raw byte sequence of the network traffic into multi-level representation matrices at the byte level, packet level, and flow level, so that the raw traffic data is cut into segments of fixed size;

[0017] Each fragment is formatted to generate a multi-level traffic matrix that can fully characterize the traffic characteristics.

[0018] In one embodiment, the byte-level features are represented as:

[0019]

[0020] Among them, b1 and b2 represent the first and second bytes in the data packet respectively, and s i Indicates the total number of bytes in the data packet, B i Representation of the byte-level features of the i-th packet;

[0021] The packet-level features are represented as:

[0022] F pkt ={f1, f2, ..., f k}

[0023] Where f1 and f2 represent the first and second features of the data packet, respectively, and k is the number of extracted data packet features;

[0024] The flow-level feature representation is:

[0025] T flow =t end -t start

[0026]

[0027] Among them, T flow is the flow duration, t end and t start are the end time and start time of the flow respectively; R flow is the flow rate, S flow Indicates the total size of the stream.

[0028] In one embodiment, S2 includes:

[0029] Extract the "Client Hello" information in the TLS handshake packet to obtain the TLS version, cipher suite, and extension fields supported by the client;

[0030] Extract the "Server Hello" information to obtain the TLS cipher suite and extension fields selected by the server;

[0031] Parse the certificate information in the "Certificate" message, including the certificate length, serial number, and signature algorithm, to form a plaintext message feature matrix used to distinguish normal from malicious traffic.

[0032] In one embodiment, the data of the TLS handshake packet is P={p1, p2, ..., p m}, the information of each field is represented as a vector:

[0033] P TLS =[v TLS , CTLS , k cert ]

[0034] Among them, p1 represents the first field feature in the TLS handshake packet data, p m Represents the mth field feature in the TLS handshake packet data, represents the last feature item in the TLS handshake packet, m represents the total number of TLS handshake packet features, that is, the number of fields contained in the feature vector, v TLS Indicates the TLS version number, C TLS Indicates the cipher suite, k cert Indicates the length of the certificate.

[0035] In one embodiment, S4 includes:

[0036] The original traffic feature matrix is ​​used as the R channel of the RGB image to retain the basic communication structure of the traffic;

[0037] Map the plaintext message feature matrix to the G channel to strengthen the key encryption features in the TLS handshake packet;

[0038] The statistical feature matrix is ​​mapped to the B channel to capture the statistical behavior pattern of the traffic, and fused to form a comprehensive feature image containing multi-dimensional information, which is an RGB image.

[0039] In one embodiment, S5 includes:

[0040] S5.1: Perform random masking on the generated RGB image to cover 75% of the image area, specifically:

[0041] I masked =M⊙I RGB

[0042] Where M is the mask matrix, ⊙ is the element-by-element multiplication operation, and the input image is I RGB , the masked image is I masked ;

[0043] S5.2: Use the masked autoencoder to perform self-supervised pre-training on the masked image. The encoding process is done by the encoder f enc Generate the latent feature vector z:

[0044] z=f enc (I masked )

[0045] Then pass the decoder f dec Reconstruct the image:

[0046]

[0047] And use the mean square error as the loss function to guide the model to learn the potential feature patterns in the image, where the loss function is:

[0048]

[0049] Where N is the number of training samples, is the i-th original RGB image sample, which is the three-dimensional feature matrix obtained by the Stack() operation. represents the RGB image reconstructed by the autoencoder model, which is the image reconstructed by the model based on the uncovered part;

[0050] Step S5.3: Use stochastic gradient descent to optimize the autoencoder model and update the model parameters. The optimization goal is to minimize the loss function L MSE , the parameter update formula is:

[0051]

[0052] Among them, θ is the model parameter before updating, η is the learning rate, Denotes the loss function L MSE The gradient of the parameter θ, θ′ is the updated model parameter.

[0053] Based on the same inventive concept, the second aspect of the present invention provides an encrypted malicious traffic detection device based on multi-dimensional feature combination and masked autoencoder, comprising:

[0054] The original traffic feature extraction module is used to pre-process the input original network traffic data, extract the original traffic features, and construct the original traffic feature matrix;

[0055] The plaintext message feature extraction module is used to parse the plaintext message features in the TLS handshake packet, extract key feature fields, and form a plaintext message feature matrix with discriminativeness;

[0056] Statistical feature extraction module, used to extract statistical features of network traffic and construct the corresponding feature matrix;

[0057] A fusion module is used to use RGB multi-channel fusion technology to fuse the feature matrices corresponding to the original traffic features, plaintext message features, and statistical features into an RGB image to generate a multi-dimensional feature matrix;

[0058] A self-supervised training module is used to perform self-supervised pre-training on the generated RGB images using a masked autoencoder. By randomly masking parts of the RGB images, the model is trained to reconstruct the masked areas, thereby learning the potential feature patterns in the encrypted traffic and obtaining a pre-trained model.

[0059] Model fine-tuning module, used to fine-tune the pre-trained model using a small amount of labeled data;

[0060] The traffic detection module is used to detect encrypted malicious traffic using the fine-tuned model.

[0061] Based on the same inventive concept, the third aspect of the present invention provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, it implements the encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder described in the first aspect.

[0062] Based on the same inventive concept, the fourth aspect of the present invention provides a computer device, including a memory, a processor, and a computer program stored on the memory and runnable on the processor. When the processor executes the program, the encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder described in the first aspect is implemented.

[0063] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows:

[0064] The present invention proposes a method for detecting encrypted malicious traffic based on multi-dimensional feature combination and masked autoencoder. First, multi-dimensional features are extracted from the original traffic data, including original traffic features, TLS plaintext message features and traditional statistical features, and a corresponding feature matrix is ​​constructed. Then, these one-dimensional feature data are converted into two-dimensional RGB images, thereby converting the encrypted traffic detection problem into an image classification problem. Then, a masked autoencoder is used for self-supervised learning, pre-trained on a large amount of unlabeled traffic data, and fine-tuned with a small amount of labeled data to improve the model's feature extraction ability and generalization performance. Finally, the fine-tuned model is used to classify traffic to effectively detect and identify malicious behaviors in encrypted traffic. The method of the present invention has high detection accuracy and robustness on multiple actual traffic data sets. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0066] Figure 1 This is a flow chart of data preprocessing according to an embodiment of the present invention;

[0067] Figure 2 This is a flowchart of model pre-training and fine-tuning for an embodiment of the present invention;

[0068] Figure 3This is a flowchart of encrypted malicious traffic detection in an embodiment of the present invention;

[0069] Figure 4 Schematic diagram of the detection results of the method for detecting encrypted malicious traffic in an embodiment of the present invention;

[0070] Figure 5 Schematic diagram of pseudo code for extracting raw traffic features in an embodiment of the present invention;

[0071] Figure 6 Schematic diagram of pseudo code for plaintext message feature extraction according to an embodiment of the present invention;

[0072] Figure 7 Schematic diagram of pseudo code for traditional statistical feature extraction in an embodiment of the present invention. DETAILED DESCRIPTION

[0073] The present invention proposes an encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder to solve the problems of existing encrypted traffic detection technology in insufficient feature extraction capability, low detection accuracy and strong dependence on labeled data.

[0074] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0075] Example 1

[0076] The present invention discloses a method for detecting encrypted malicious traffic based on multi-dimensional feature combination and masked autoencoder, comprising:

[0077] S1: Preprocess the input raw network traffic data, extract the raw traffic features, and construct the original traffic feature matrix;

[0078] S2: Analyze the plaintext message features in the TLS handshake packet, extract key feature fields, and form a plaintext message feature matrix with discriminativeness;

[0079] S3: Extract statistical features of network traffic and construct the corresponding feature matrix;

[0080] S4: Using RGB multi-channel fusion technology, the feature matrices corresponding to the original traffic features, plaintext message features, and statistical features are fused into an RGB image to generate a multi-dimensional feature matrix;

[0081] S5: Use a masked autoencoder to perform self-supervised pre-training on the generated RGB image. By randomly masking parts of the RGB image, the model is trained to reconstruct the masked areas, thereby learning the potential feature patterns in the encrypted traffic and obtaining a pre-trained model.

[0082] S6: Fine-tune the pre-trained model using a small amount of labeled data;

[0083] S7: Detect encrypted malicious traffic using the fine-tuned model.

[0084] Specifically, steps S1 to S4 are data preprocessing and feature extraction, S5 is self-supervised pre-training based on masked autoencoders, S6 is model fine-tuning, and S7 is the specific application of the model.

[0085] In practice, S1 is implemented as follows: It performs multi-level traffic representation processing on the raw network traffic data. First, it decomposes the network traffic data into a multi-level representation matrix at the byte, packet, and flow levels to capture the fine-grained characteristics of the traffic data. By cutting the raw traffic data into fixed-size segments and formatting each segment, a multi-level traffic matrix is ​​generated that comprehensively represents the traffic characteristics.

[0086] S21 can be implemented by parsing the plaintext message features in the TLS handshake packet using the Wireshark tool, extracting key feature fields such as the TLS version number, cipher suite, and certificate information, and forming a discriminative plaintext message feature matrix to enrich the feature representation of encrypted traffic.

[0087] S31 can be achieved by combining multiple traditional statistical features, such as packet size, time interval, flow duration, number of data packets, and flag bits, to construct a statistical feature matrix, and using data preprocessing techniques such as normalization and standardization to enhance the representativeness of features and the stability of model training;

[0088] S4 can be achieved by using RGB multi-channel fusion technology to fuse the three different dimensional feature matrices (i.e., original traffic features, plaintext message features, and statistical features) into a single RGB image representation to achieve a joint representation of multi-dimensional features while preserving the fine-grained information of traffic features.

[0089] S5: A masked autoencoder (MAE) is used for self-supervised pre-training of the generated RGB images. By randomly masking parts of the image, the model is trained to reconstruct the masked areas, thereby deeply learning the potential characteristic patterns in the encrypted traffic and improving the model's generalization ability.

[0090] S6: Fine-tune the pre-trained model using a small amount of labeled data, enabling the model to accurately distinguish between malicious and normal traffic in encrypted traffic, and ultimately achieve accurate detection of encrypted malicious traffic through S7.

[0091] In one embodiment, the multi-level traffic representation process includes segmenting each flow into a fixed-size byte sequence matrix, where the rows of the matrix represent different levels of traffic (e.g., byte level, packet level, and flow level), and the columns represent specific attributes of each level (e.g., protocol type, source and destination addresses, ports, etc.), including:

[0092] Divide network traffic data into different communication traffic segments according to its five-tuple (source / destination IP address, source / destination port number and protocol type);

[0093] Remove the Ethernet header information, set the port number to zero, and replace the IP address with a random address to prevent the model from learning irrelevant information;

[0094] These traffic segments are formatted into fixed-size two-dimensional matrices, each of which contains fine-grained features at the byte level, packet level, and flow level.

[0095] In one embodiment, S2 includes:

[0096] Extract the "Client Hello" information in the TLS handshake packet to obtain the TLS version, cipher suite, and extension fields supported by the client;

[0097] Extract the "Server Hello" information to obtain the TLS cipher suite and extension fields selected by the server;

[0098] Parse the certificate information in the "Certificate" message, including the certificate length, serial number, and signature algorithm, to form a plaintext message feature matrix used to distinguish normal from malicious traffic.

[0099] In one embodiment, the statistical feature extraction in S3 includes statistics on time, space, and flag features in network traffic, specifically including the extraction and calculation of source port, destination port, session duration, number of packets, total number of bytes, etc., specifically:

[0100] Use time-related features such as session duration and time interval to calculate the time series pattern of traffic;

[0101] Use spatially relevant features, such as the number of packets, total bytes, and packet length, to analyze traffic transmission behavior;

[0102] By using flag-related features, such as PUSH, ACK, and RST, the control information in each flow is recorded to form a statistical feature matrix.

[0103] In one embodiment, the RGB multi-channel fusion technology in S4 achieves a joint representation of multi-dimensional features by mapping the original traffic feature matrix, the plaintext message feature matrix, and the statistical feature matrix to three channels of the RGB image, including:

[0104] The original traffic feature matrix is ​​used as the R channel of the RGB image to retain the basic communication structure of the traffic;

[0105] Map the plaintext message feature matrix to the G channel to strengthen the key encryption features in the TLS handshake packet;

[0106] The statistical feature matrix is ​​mapped to the B channel to capture the statistical behavior pattern of the traffic, and a comprehensive feature image containing multi-dimensional information is formed through these fusions.

[0107] In one embodiment, the mask autoencoder pre-training in S5 includes randomly masking 75% of the area in the RGB image and reconstructing the masked area through model training to learn a deep feature representation of the flow, including:

[0108] Randomly mask 75% of the input RGB image so that the model only relies on the remaining 25% of information for reconstruction during training;

[0109] The encoder extracts features of the uncovered area, and the decoder reconstructs the covered area.

[0110] The mean square error (MSE) is used as the loss function to guide the model to learn the potential feature patterns in the image to improve the generalization ability of the model.

[0111] In one embodiment, the fine-tuning step in S6 includes using a small amount of labeled malicious traffic and normal traffic data to optimize the model through cross-validation and parameter adjustment, so that it can effectively identify malicious traffic in encrypted traffic, including:

[0112] After self-supervised pre-training on a large amount of unlabeled data, the model is fine-tuned using a small amount of labeled data;

[0113] Select the optimal model parameters through cross-validation, including learning rate, batch size, etc.;

[0114] Using evaluation indicators such as classification accuracy, recall rate, and F1 score, the model weights are adjusted to ensure that the model has high detection accuracy and robustness when facing new or variant malicious traffic.

[0115] The main key points of the present invention include:

[0116] 1. Multi-dimensional feature fusion:

[0117] Comparative Document 1 (CN115426137A) mentions the statistical feature extraction of multi-dimensional network flows, but it mainly focuses on traditional statistical features, such as packet size, time interval, etc., which are relatively simple and lack in-depth analysis of the encryption protocol level. The present invention not only extracts traditional statistical features, but also focuses on parsing the plaintext message features in the TLS handshake packet, extracting deep-level features such as TLS version number, cipher suite, and certificate information. By further exploring these key encryption protocol features, the present invention can construct a more comprehensive traffic feature matrix, so that the detection model has stronger recognition capabilities, especially when facing complex encrypted traffic, it can effectively improve the feature extraction capabilities of the model.

[0118] Furthermore, while the fusion of multiple features is a common technique, this invention optimizes the depth of feature extraction and the joint representation of features. This method, unlike conventional multi-feature fusion, maps multidimensional features into a three-channel image using RGB imaging technology. This approach preserves the independence of features while fully exploiting the correlations between them through joint representation. Compared to simple statistical feature extraction, this feature fusion method effectively overcomes the problem of information hiding in encrypted traffic, making the characteristics of malicious traffic more prominent.

[0119] Technical Difficulty: In encrypted traffic environments, the encryption of communication content makes it difficult to extract features using traditional content parsing methods. This invention overcomes this deficiency by combining deep protocol analysis with multidimensional features. Specifically, it extracts handshake packets and transmission features from encryption protocols, constructing a feature matrix that effectively characterizes traffic. By integrating multidimensional features, the model's adaptability in complex traffic environments is ensured.

[0120] 2. Innovative Applications of Masked Autoencoders:

[0121] Masked autoencoders, as self-supervised learning models, have been used in the prior art. For example, Reference 2 (CN118400195A) uses masked autoencoders to reconstruct network traffic features, and Reference 3 (CN116346384A) uses variational autoencoders for malicious traffic detection. However, the present invention makes specific optimizations in the application of autoencoders.

[0122] The masked autoencoder in the present invention structurally adopts an encoding and decoding mechanism for multi-dimensional feature images. By randomly masking parts of the image, the model can not only perform self-supervised learning on unlabeled data, but also reconstruct deep features on incomplete data. In addition, compared to the masked autoencoder in Comparative Document 2, which focuses on the reconstruction of general traffic features, the present invention focuses more on extracting features in encrypted traffic through deep self-supervised pre-training, and introduces a hierarchical multi-scale feature extraction mechanism in the structure, so that the model can learn complex patterns of encrypted traffic at different scales. Specifically, the encoder of the present invention not only performs simple feature reconstruction on the input data, but also can perform deeper learning of features through a multi-level coding structure to capture hidden encrypted traffic patterns. This design enables the model to have higher accuracy when processing feature associations and abnormal patterns in encrypted traffic. At the same time, it enables the model to obtain a deep understanding of complex traffic features in the unsupervised learning stage, reducing the dependence on large amounts of labeled data.

[0123] Compared to the variational autoencoder in Comparative Document 3, the masked autoencoder masks some of the input and focuses on feature reconstruction, making it more adaptable in self-supervised learning. This is particularly true in encrypted traffic environments, where it can effectively improve the model's feature representation capabilities without relying on the probability distribution of the generative model, as in the variational autoencoder. Furthermore, the present invention incorporates the specific scenarios of encrypted traffic and optimizes the model's structure, enabling it to overcome the information loss associated with encryption when processing encrypted traffic.

[0124] Technical Advantages: The application of masked autoencoders in this solution not only enables effective pre-training of the model on unlabeled data, but also reduces its reliance on labeled data through self-supervised learning. Furthermore, combined with the input of RGB multi-channel feature images, the model can reconstruct and extract features in multidimensional space, improving the accuracy of malicious traffic detection.

[0125] Regarding multi-scale feature extraction: This solution uses a multi-dimensional, multi-layered approach to extract network traffic features. Specifically, this approach extracts raw traffic features, plaintext packet features, and traditional statistical features. These three types of features reflect different levels of network traffic information.

[0126] 1. Raw traffic characteristics: reflect the underlying structure of traffic, such as byte-level and packet-level characteristics.

[0127] This application processes the original data as follows. First, in actual traffic analysis, it is usually necessary to analyze each group of communications separately, that is, to cut the original pcap into multiple sub-pcaps, each of which represents a group of communication traffic. According to the experiments conducted by Wang et al. on the impact of different traffic representations on the model, it can be seen that using Session has better overall effect than Flow, but the effect varies under different conditions and is not stable. Therefore, this application first cuts the complete traffic pcap packet with Session as the granularity. Then delete the Ethernet header of the traffic, set the port number to zero, and replace the IP with a random address, but retain its direction. This measure can prevent the model from learning irrelevant information. Finally, capture M adjacent data packets in the traffic and format them into a two-dimensional matrix of size H*W as a representation of the traffic, where H and W represent the height and width of the two-dimensional matrix, respectively. It should be noted that when there are fewer than M data packets in the data stream, the matrix only contains the bytes of the existing data packets, and other positions are not filled.

[0128] At the same time, the present invention adopts a multi-level traffic representation method, which represents the traffic as a fixed-size representation matrix containing 5 packet-level matrices to capture data features at different levels. The specific pseudo code is as follows Figure 5 shown.

[0129] 2. Plaintext message features: By extracting the features of plaintext messages in encrypted traffic (such as TLS handshake packet information), the protocol layer features in the traffic are obtained.

[0130] In the detection of encrypted malicious traffic, plaintext message features involve analyzing unencrypted information to identify potential malicious traffic. The handshake process of the SSL / TLS protocol contains some plaintext transmission parts, such as key fields in the Client Hello and Server Hello messages. These fields can be used to distinguish malicious TLS traffic. By extracting handshake packet information, malicious traffic can be effectively identified and detection accuracy can be improved. The specific pseudo code is as follows Figure 6 shown.

[0131] 3. Statistical characteristics: Extract statistical information from the macro behavior of network traffic, such as packet size, time interval, etc., to reflect the overall distribution of network traffic.

[0132] Traditional statistical features: With the popularization of communication encryption technology, it is increasingly difficult for intrusion detection systems (IDS) based on content analysis to directly detect traffic content. Therefore, the use of statistical features to analyze and identify traffic behavior has shown unique advantages. Statistical features are mainly derived from basic data of network traffic, such as packet size, time interval, flow duration, etc. By analyzing these features, abnormal behavior can be discovered, thereby identifying potential malicious traffic, while not relying on direct access to encrypted content. This method protects content privacy and is suitable for real-time analysis. The specific pseudo code is as follows Figure 7 shown.

[0133] The multi-scale feature extraction mechanism ensures that the model can simultaneously capture local information (such as byte and packet-level features) and global information (such as statistical features) in the traffic by jointly extracting features at different levels and dimensions, thereby improving the model's ability to perceive new and hidden attacks.

[0134] Masked Autoencoder

[0135] The Masked Autoencoder (MAE) used in the prior art can theoretically be used for traffic feature reconstruction in this solution, but it cannot achieve the technical effects of the solution of the present invention:

[0136] Similarities:

[0137] The structure of masked autoencoders is similar: the masked autoencoder in Reference 2 and the MAE used in this solution both train the model by partially masking (masking) the input and reconstructing the masked portion using the remaining information. This self-supervised learning approach effectively extracts features from unlabeled data, so the basic principles are the same and, in theory, both can be used to reconstruct traffic features.

[0138] Differences:

[0139] Difference in applicability: The masked autoencoder in Comparative Document 2 is mainly used for the reconstruction of general images or sequence data, while the autoencoder in the present invention is specifically optimized for encrypted traffic features. Network traffic data, especially encrypted traffic, has more complex structures and noise characteristics. The present invention uses a multi-dimensional feature joint mechanism (including original traffic features, plaintext message features, and statistical features) to make feature extraction more suitable for traffic detection tasks. The masked autoencoder in Comparative Document 2 is not specifically optimized for the multi-dimensional features in network traffic and cannot fully capture the key information in encrypted traffic.

[0140] Ability to reconstruct traffic features: The masked autoencoder in this invention not only processes imaged traffic data but also utilizes a multi-dimensional feature fusion and optimization process. This means the model not only relies on simple masking and reconstruction but also incorporates information from different levels of traffic, particularly plaintext message features and statistical features in encrypted traffic. The autoencoder in Comparative Document 2, on the other hand, lacks specialized traffic feature optimization and may perform poorly when processing complex network traffic, particularly for hidden attack patterns in encrypted traffic.

[0141] Therefore, although the masked autoencoder in Comparative Document 2 can be used to reconstruct general traffic features, if the method in Comparative Document 2 is applied to Comparative Document 1, only general traffic features are reconstructed, and the detection accuracy is low. However, due to the optimization and multi-dimensional feature fusion of the masked autoencoder in the present invention, it can better adapt to the complex features in encrypted traffic. Therefore, the autoencoder in the solution of the present invention is more suitable for reconstructing multi-dimensional traffic features and has higher robustness and detection accuracy when handling encrypted malicious traffic detection tasks.

[0142] The technical solution of the present invention comprises the following steps:

[0143] Step 1: Data preprocessing and feature extraction. The input raw network traffic data is processed with multi-level traffic representation. First, the network traffic data is decomposed into a multi-level representation matrix at the byte level, packet level, and flow level to capture the fine-grained features of the traffic data. Then, tools such as Wireshark are used to parse the plaintext message features in the TLS handshake packet, extract key fields such as the TLS version number, cipher suite, and certificate information, and generate a TLS feature matrix. In addition, the statistical features of the network traffic, including packet size, time interval, flow duration, and number of packets, are extracted, and a feature matrix in a unified format is generated through normalization and standardization. Finally, these multidimensional features are converted into a two-dimensional RGB image representation through RGB multi-channel fusion technology to achieve joint representation of multidimensional features.

[0144] Step 2: The RGB image generated in Step 1 is fed into a masked autoencoder (MAE) for self-supervised pre-training. The model consists of an input layer, a masked autoencoder, and a classifier module. Specifically, the input layer receives a multi-dimensional feature matrix, processed through feature extraction and visualization, and feeds it into the masked autoencoder. In the masked autoencoder, 75% of the RGB image is randomly masked. During training, the model relies on the unmasked 25% to reconstruct the masked portion, thereby learning the underlying characteristic patterns in the image. The masked autoencoder consists of an encoder and a decoder: the encoder processes only the unmasked portion of the image to extract deep feature representations; the decoder uses these features and positional information to reconstruct the complete image, specifically the masked regions. Through this layer-by-layer encoding and decoding process, the masked autoencoder effectively extracts and reconstructs information from the traffic feature image, enhancing the overall model's feature extraction capabilities against novel or covert attacks. After pre-training, the masked autoencoder's model weights can be further used for fine-tuning and malicious traffic classification tasks. This step does not rely on labeled data, significantly improves the generalization ability of the model, reduces dependence on large amounts of labeled data, and enables the model to exhibit greater robustness and detection accuracy in encrypted traffic environments.

[0145] Step 3: After completing the self-supervised pre-training, the model is fine-tuned using a small amount of labeled traffic data. The model parameters are optimized based on the classification information in the labeled data, so that the model can more accurately identify malicious behavior in encrypted traffic. The fine-tuned model can effectively detect malicious traffic in encrypted traffic in a real network environment. The verification results show that the present invention is superior to the existing technology in terms of detection accuracy and robustness. Figure 4As shown in the figure, FlowPrint: FlowPrint is a method for detecting malicious encrypted traffic by generating fingerprints by capturing the spatial and temporal characteristics of network traffic. AppScanner: AppScanner is an application traffic analysis tool based on random forests that performs data mining by analyzing traffic features generated by applications. DF (Deep Fingerprinting): DF is a traffic detection method based on directional sequences and convolutional neural networks, primarily used for deep fingerprint analysis of network traffic. 2D-CNN (Two-Dimensional Convolutional Neural Network): 2D-CNN uses header and payload information to construct a two-dimensional matrix for traffic analysis and extracts traffic features using a convolutional neural network. 3D-CNN (Three-Dimensional Convolutional Neural Network): 3D-CNN extends two-dimensional convolutional neural networks to incorporate the temporal dimension for traffic analysis, improving detection accuracy. FS-Net: FS-Net is a CNN-based feature selection network used for network traffic classification and detection. PERT (Pre-trained Transformer): PERT uses a pre-trained model based on BERT for traffic classification and is primarily used for transfer learning in natural language processing tasks. ET-BERT: ET-BERT is an extended BERT model with a specific byte pair encoding and pre-training task for encrypted traffic classification.

[0146] Step 1 specifically includes the following steps:

[0147] Step 1.1: For the input raw network traffic data, first perform a hierarchical representation of it at the byte level, packet level, and flow level to extract the basic features related to network traffic. Suppose the traffic data is X = {x1, x2, ..., x n}, normalize the features of each data packet to ensure data consistency:

[0148]

[0149] Among them, x i is the original eigenvalue of the ith data packet, x′ i is the normalized feature value of the ith data packet, whose features include packet size, transmission protocol, timestamp, etc. min(X) and max(X) represent the minimum and maximum values ​​of the traffic data, respectively.

[0150] Byte-level representation: Let data packet x′ i The byte representation is B i , whose size is s i . This feature can be expressed as:

[0151]

[0152] Among them, b j Indicates the jth byte in the data packet, s i Indicates the total number of bytes in the packet.

[0153] Packet-level representation: For each packet x′ i , extract its protocol type, port number and other network layer features to form a feature vector F pkt

[0154] F pkt ={f1, f2, ..., f k}

[0155] Among them, f i represents a feature of the data packet, and k is the number of extracted features (such as protocol type, source port, destination port, etc.).

[0156] Flow-level representation: For each complete network flow X, its flow duration and packet transmission rate are extracted and expressed as:

[0157] T flow =t end --t start

[0158]

[0159] Among them, T flow is the flow duration, t end and t start are the end time and start time of the flow respectively; R flow is the flow rate, S flow Indicates the total size of the stream.

[0160] Step 1.2: Parse the plaintext message features in the TLS handshake packet, extract key fields including TLS version number, cipher suite, certificate length, etc., and generate a TLS feature matrix. Suppose the TLS handshake packet data is P = {p1, p2, ..., p m}, the information of each field can be expressed in vector form:

[0161] P TLS =[v TLS , c TLS , l cert ]

[0162] Among them, p1 represents the first field feature in the TLS handshake packet data, which may be the TLS version number or other first feature item, p mRepresents the mth field feature in the TLS handshake packet data, indicating the last feature item in the TLS handshake packet, which may be the certificate length or other related features. m represents the total number of TLS handshake packet features, that is, the number of fields contained in the feature vector. v TLS Indicates the TLS version number, c TLS Indicates the cipher suite, l cert Indicates the length of the certificate.

[0163] Step 1.3, extract the statistical characteristics of network traffic, such as packet size, time interval and number of data packets.

[0164] Packet size statistics: Let the size of the i-th data packet in the traffic be S i , the average packet size in the traffic can be calculated:

[0165]

[0166] Where n is the number of data packets, S i is the size of the i-th data packet.

[0167] Time interval statistics: Let the time interval between the i-th and i+1-th data packets be t interval , the calculation formula is:

[0168] t interval =t i+1 -t i

[0169] Among them, t i and t i+1 are the timestamps of the i-th and i+1-th packets respectively.

[0170] Packet count statistics: Let the total number of packets contained in the network traffic be Npkt. This feature can be directly expressed as:

[0171]

[0172] Where n is the number of packets in the flow.

[0173] Step 1.4: The original traffic features extracted in step 1.1, the plaintext message features in the TLS handshake packet extracted in step 1.2, and the statistical features extracted in step 1.3 are converted into a two-dimensional RGB image representation through RGB multi-channel fusion technology to generate a multi-dimensional feature matrix M, and finally form a fused feature image I. RGB :

[0174] I RGB =Stack(M R , M G , M B )

[0175] Among them, M R , M G , M B Represent the corresponding channel matrices respectively. The Stack() operation stacks these matrices according to the channel dimension to form a three-dimensional matrix I with three channels. RGB .

[0176] Step 2, self-supervised pre-training based on masked autoencoders, is described in detail as follows:

[0177] Step 2.1, perform random masking on the RGB image generated in step 1.4, covering 75% of the image area. Let the input image be I RGB , the masked image is I masked , expressed as:

[0178] I masked =M⊙I RGB

[0179] Where M is the mask matrix and ⊙ is the element-by-element multiplication operation.

[0180] Step 2.2, use the masked self-encoder to perform self-supervised pre-training on the masked image. The encoding process is done by the encoder f enc Generate the latent feature vector z:

[0181] z=f enc (I masked )

[0182] Then pass the decoder f dec Reconstruct the image:

[0183]

[0184] The loss function of the model is defined as the mean squared error between the input image and the reconstructed image:

[0185]

[0186] Where N is the number of training samples, The i-th original RGB image sample, which is the three-dimensional feature matrix obtained by the Stack() operation, Represents the RGB image reconstructed by the autoencoder model. This is the image reconstructed by the model based on the uncovered part.

[0187] Step 2.3, use stochastic gradient descent to optimize the autoencoder model and update the model parameters. The optimization goal is to minimize the loss function L MSE , the parameter update formula is:

[0188]

[0189] Among them, θ is the model parameter, η is the learning rate, Denotes the loss function L MSE The gradient of the parameter θ. Denotes the loss function L MSE Partial derivatives with respect to each parameter θ.

[0190] Step 3: Model fine-tuning and malicious traffic detection.

[0191] In step 3.1, fine-tune the pre-trained masked autoencoder using a small amount of labeled traffic data. The fine-tuning process uses the cross entropy loss function to optimize the model:

[0192]

[0193] Among them, i represents the i-th sample in the training sample set, y i is the true label, is the model prediction result, N is the number of training samples;

[0194] In step 3.2, after fine-tuning the model, deploy it in a real-world network environment to detect malicious traffic. The model will classify the encrypted traffic captured in real time and identify malicious behavior. The specific process is as follows:

[0195] First, use a network sniffing tool (such as Wireshark) to capture network traffic data in real time. Assume the captured traffic data is:

[0196] X real ={x1,x2,…,x T}

[0197] where x t is a traffic sample captured at time t.

[0198] Then, the collected real-time traffic data is subjected to feature extraction and preprocessing. It is converted into the same feature representation as the training data to generate the input feature matrix M real . This is then fed into the fine-tuned model.

[0199] The model's input feature matrix M real Perform forward propagation and output the corresponding classification probability P(y|M real ). The specific classification probability calculation formula is:

[0200]

[0201] Among them, z is the linear output of the model, K is the total number of classification categories, k is a specific category, P(y|M real ) is the probability that the traffic belongs to category y, z y 、z k Represents the linear output or logit value for category y, k in the linear output.

[0202] The technical solution of the present invention will be further specifically described below through embodiments and in conjunction with the accompanying drawings.

[0203] Example:

[0204] The input raw data of the present invention uses an encrypted traffic data set. Before training and testing the encrypted malicious traffic detection model, the initial input data will be preprocessed. Figure 1 First, we perform multi-level representation processing on the raw traffic data, decomposing the network traffic data into multi-level representation matrices at the byte level, packet level, and flow level, and normalizing these data. For the TLS handshake packet data involved in the traffic, we extract the TLS feature matrix by parsing fields such as the TLS version number, cipher suite, and certificate information. Finally, we combine these features with statistical features (such as packet size and time interval) to generate a fused multi-dimensional feature matrix. This matrix is ​​then converted into a two-dimensional image representation using RGB imaging methods to meet the input requirements of subsequent deep learning models.

[0205] Figure 2 This is the model pre-training and fine-tuning process of the present invention. First, use the masked autoencoder to Figure 1 Self-supervised pre-training is performed on RGB images generated in [1]. Specifically, by randomly masking 75% of the image, the model must reconstruct the masked areas during training, thereby learning deep features from the image. Subsequently, based on a small amount of labeled data, the pre-trained model is fine-tuned to improve its classification accuracy and generalization ability in the encrypted malicious traffic detection task. The goal of pre-training and fine-tuning is to optimize the model parameters so that it can accurately distinguish between normal and malicious traffic.

[0206] Figure 3 This is the malicious traffic detection process of the present invention. Figure 1 The test sample set generated in [1] is fed into the fine-tuned model for malicious traffic detection. The model calculates the probability distribution for each class through forward propagation and selects the most likely class as the final prediction based on a multi-classification decision rule. If the prediction indicates malicious traffic, the system issues an alert and logs the relevant information for further security measures. If the prediction indicates normal traffic, it is allowed to pass through the network system.

[0207] Example 2

[0208] Based on the same inventive concept, this embodiment discloses an encrypted malicious traffic detection device based on multi-dimensional feature combination and masked autoencoder, comprising:

[0209] The original traffic feature extraction module is used to pre-process the input original network traffic data, extract the original traffic features, and construct the original traffic feature matrix;

[0210] The plaintext message feature extraction module is used to parse the plaintext message features in the TLS handshake packet, extract key feature fields, and form a plaintext message feature matrix with discriminativeness;

[0211] Statistical feature extraction module, used to extract statistical features of network traffic and construct the corresponding feature matrix;

[0212] A fusion module is used to use RGB multi-channel fusion technology to fuse the feature matrices corresponding to the original traffic features, plaintext message features, and statistical features into an RGB image to generate a multi-dimensional feature matrix;

[0213] A self-supervised training module is used to perform self-supervised pre-training on the generated RGB images using a masked autoencoder. By randomly masking parts of the RGB images, the model is trained to reconstruct the masked areas, thereby learning the potential feature patterns in the encrypted traffic and obtaining a pre-trained model.

[0214] Model fine-tuning module, used to fine-tune the pre-trained model using a small amount of labeled data;

[0215] The traffic detection module is used to detect encrypted malicious traffic using the fine-tuned model.

[0216] Since the device described in Example 2 of the present invention is used to implement the encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder in Example 1 of the present invention, those skilled in the art will be able to understand the specific structure and variations of the device based on the method described in Example 1 of the present invention, and therefore will not be described in detail here. All devices used in the method of Example 1 of the present invention fall within the scope of protection of the present invention.

[0217] Example 3

[0218] Based on the same inventive concept, the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method described in the first embodiment is implemented.

[0219] Since the computer-readable storage medium described in the third embodiment of the present invention is the computer-readable storage medium used to implement the encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder in the first embodiment of the present invention, based on the method described in the first embodiment of the present invention, those skilled in the art can understand the specific structure and variations of the computer-readable storage medium, so they are not described in detail here. All computer-readable storage media used in the method of the first embodiment of the present invention fall within the scope of protection of the present invention.

[0220] Example 4

[0221] The present invention also provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first embodiment when executing the program.

[0222] Since the computer device described in Example 4 of the present invention is the computer device used to implement the encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder in Example 1 of the present invention, based on the method described in Example 1 of the present invention, those skilled in the art will be able to understand the specific structure and variations of the computer device, so they will not be described in detail here. All computer devices used in the method of Example 1 of the present invention fall within the scope of protection of the present invention.

[0223] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0224] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0225] Although preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they are aware of the basic inventive concepts. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention. Obviously, those skilled in the art may make various changes and modifications to the embodiments of the present invention without departing from the spirit and scope of the embodiments of the present invention. Thus, the present invention is intended to include such changes and modifications to the embodiments of the present invention if they fall within the scope of the claims and their equivalents.

Claims

1. A method for detecting encrypted malicious traffic based on multi-dimensional feature combination and masked autoencoder, characterized in that: include: S1: Preprocess the input raw network traffic data, extract the raw traffic features, and construct the original traffic feature matrix; S2: Analyze the plaintext message features in the TLS handshake packet, extract key feature fields, and form a plaintext message feature matrix with discriminativeness; S3: Extract statistical features of network traffic and construct the corresponding feature matrix; S4: Using RGB multi-channel fusion technology, the feature matrices corresponding to the original traffic features, plaintext message features, and statistical features are fused into an RGB image to generate a multi-dimensional feature matrix; S5: Use a masked autoencoder to perform self-supervised pre-training on the generated RGB image. By randomly masking parts of the RGB image, the model is trained to reconstruct the masked areas, thereby learning the potential feature patterns in the encrypted traffic and obtaining a pre-trained model. S6: Fine-tune the pre-trained model using a small amount of labeled data; S7: Detect encrypted malicious traffic using the fine-tuned model.

2. The encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder according to claim 1 is characterized in that: S1 includes: Perform multi-level traffic representation processing on the input raw network traffic data, decomposing the raw byte sequence of the network traffic into multi-level representation matrices at the byte level, packet level, and flow level, so that the raw traffic data is cut into segments of fixed size; Each fragment is formatted to generate a multi-level traffic matrix that can fully characterize the traffic characteristics.

3. The encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder according to claim 2 is characterized in that: The byte-level feature representation is: Among them, b1 and b2 represent the first and second bytes in the data packet respectively, and s i Indicates the total number of bytes in the data packet, B i Representation of the byte-level features of the i-th packet; The packet-level features are represented as: F pkt ={f1,f2,…,f k } Where f1 and f2 represent the first and second features of the data packet, respectively, and k is the number of extracted data packet features; The flow-level feature representation is: T flow =t end -t start Among them, T flow is the flow duration, t end and t start are the end time and start time of the flow respectively; R flow is the flow rate, S flow Indicates the total size of the stream.

4. The method for detecting encrypted malicious traffic based on multi-dimensional feature combination and masked autoencoder according to claim 1, wherein S2 include: Extract the "Client Hello" information in the TLS handshake packet to obtain the TLS version, cipher suite, and extension fields supported by the client; Extract the "Server Hello" information to obtain the TLS cipher suite and extension fields selected by the server; Parse the certificate information in the "Certificate" message, including the certificate length, serial number, and signature algorithm, to form a plaintext message feature matrix used to distinguish normal from malicious traffic.

5. The method for detecting encrypted malicious traffic based on multi-dimensional feature combination and masked autoencoder according to claim 4, characterized in that: The data of the TLS handshake packet is P = {p1, p2, ..., p m }, the information of each field is represented as a vector: P TLS =[v TLS ,c TLS ,l cert ] Among them, p1 represents the first field feature in the TLS handshake packet data, p m Represents the mth field feature in the TLS handshake packet data, represents the last feature item in the TLS handshake packet, m represents the total number of TLS handshake packet features, that is, the number of fields contained in the feature vector, v TLS Indicates the TLS version number, c TLS Indicates the cipher suite, l cert Indicates the length of the certificate.

6. The method for detecting encrypted malicious traffic based on multi-dimensional feature combination and masked autoencoder according to claim 1, characterized in that: S4 includes: The original traffic feature matrix is ​​used as the R channel of the RGB image to retain the basic communication structure of the traffic; Map the plaintext message feature matrix to the G channel to strengthen the key encryption features in the TLS handshake packet; The statistical feature matrix is ​​mapped to the B channel to capture the statistical behavior pattern of the traffic, and fused to form a comprehensive feature image containing multi-dimensional information, which is an RGB image.

7. The method for detecting encrypted malicious traffic based on multi-dimensional feature combination and masked autoencoder according to claim 1, wherein S5 include: S5.1: Perform random masking on the generated RGB image to cover 75% of the image area, specifically: I masked =M⊙I RGB Where M is the mask matrix, ⊙ is the element-by-element multiplication operation, and the input image is I RGB , the masked image is I masked ; S5.2: Use the masked autoencoder to perform self-supervised pre-training on the masked image. The encoding process is done by the encoder f enc Generate the latent feature vector z: z=f enc (I masked ) Then pass the decoder f dec Reconstruct the image: And use the mean square error as the loss function to guide the model to learn the potential feature patterns in the image, where the loss function is: Where N is the number of training samples, is the i-th original RGB image sample, which is the three-dimensional feature matrix obtained by the Stack() operation. represents the RGB image reconstructed by the autoencoder model, which is the image reconstructed by the model based on the uncovered part; Step S5.3: Use stochastic gradient descent to optimize the autoencoder model and update the model parameters. The optimization goal is to minimize the loss function L MSE , the parameter update formula is: Among them, θ is the model parameter before updating, η is the learning rate, Denotes the loss function L MSE The gradient of the parameter θ, θ′ is the updated model parameter.

8. An encrypted malicious traffic detection device based on multi-dimensional feature combination and masked autoencoder, characterized in that: include: The original traffic feature extraction module is used to pre-process the input original network traffic data, extract the original traffic features, and construct the original traffic feature matrix; The plaintext message feature extraction module is used to parse the plaintext message features in the TLS handshake packet, extract key feature fields, and form a plaintext message feature matrix with discriminativeness; Statistical feature extraction module, used to extract statistical features of network traffic and construct the corresponding feature matrix; The fusion module is used to use RGB multi-channel fusion technology to fuse the feature matrices corresponding to the original traffic features, plaintext message features, and statistical features into an RGB image to generate a multi-dimensional feature matrix; A self-supervised training module is used to perform self-supervised pre-training on the generated RGB images using a masked autoencoder. By randomly masking parts of the RGB images, the model is trained to reconstruct the masked areas, thereby learning the potential feature patterns in the encrypted traffic and obtaining a pre-trained model. Model fine-tuning module, used to fine-tune the pre-trained model using a small amount of labeled data; The traffic detection module is used to detect encrypted malicious traffic using the fine-tuned model.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder as described in any one of claims 1 to 7 is implemented.

10. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the encrypted malicious traffic detection method based on multi-dimensional feature combination and masked autoencoder as described in any one of claims 1 to 7 is implemented.

Images