Multi-level encryption traffic classification system based on deep learning

Abstract

The invention provides a multi-level encryption traffic classification system based on deep learning. The data collection module is used for providing original traffic data and providing input for subsequent data preprocessing and model training; the data preprocessing module is used for carrying out standardization processing on the original traffic, ensuring the consistency and stability of input data and providing high-quality input data for subsequent model training; a Globe-Local ResNet backbone network architecture is used for carrying out fusion extraction of global and local features for network traffic, and the detection capability of an original ResNet on the network traffic is effectively improved. And the multi-level classification head module is used for classifying the traffic step by step in a multi-level mode and reducing the problem of sharp increase of the number of categories and the problems of increase of the number of categories and instability of the model. According to the method, efficient multi-dimensional encrypted traffic classification is realized, and through reasonable data processing and model design, the complexity improvement and the accuracy reduction caused by sharp increase of the number of categories are avoided while the classification precision is ensured.

Description

Technical Field

[0001] The present invention relates to the intersection of artificial intelligence and network security, and in particular to a multi-level encrypted traffic classification system based on deep learning. Background Art

[0002] With the rapid development of Internet technology, network communication volume has exploded, especially the proportion of encrypted traffic in network communication has gradually increased, and network security has become an increasingly important issue. In this context, how to efficiently and accurately classify network traffic has become a key issue in the field of network security. Traditional traffic detection methods are mostly based on feature extraction and rule matching. Although these methods are effective in the early simple network environment, they have shown significant limitations in the current complex and diverse network traffic, especially when facing a large amount of encrypted traffic.

[0003] In the process of classifying network traffic, the classification of encrypted traffic is particularly challenging. Since encrypted traffic has encrypted data content, it cannot be classified by relying on traditional methods based on packet payload feature matching. Encrypted traffic methods based on machine learning mainly rely on the metadata of encrypted traffic (such as traffic duration, packet interval, packet size, etc.), but there are many types of network traffic at present, and the performance characteristics of each type of traffic are different, making feature engineering more complicated. As a result, the classification stability of statistical machine learning methods based on metadata and flow features is poor.

[0004] There are two main directions for using deep learning methods to classify encrypted traffic. One is to stack traffic packets horizontally in time sequence, convert them into grayscale images, and then use convolutional neural networks (CNN) to classify traffic. The other is to splice traffic packets and use recurrent neural networks (RNN), long short-term memory networks (LTSM), Transformer and other models to directly classify the original traffic data.

[0005] Although the above-mentioned deep learning methods perform well in single-level classification tasks (for traffic applications or categories), the existing technology shows significant limitations when faced with multi-level classification tasks (simultaneous classification of traffic applications and scenarios). If applications and scenarios are directly combined into new classification categories, the number of categories will increase sharply, greatly increasing the complexity and computational cost of the model. At the same time, when new categories are added, the instability factors of the model increase significantly. Summary of the invention

[0006] In response to the above-mentioned problems, the present invention proposes a multi-level encrypted traffic classification system based on deep learning to achieve efficient multi-dimensional encrypted traffic classification. Through reasonable data processing and model design, it ensures classification accuracy while avoiding the increase in complexity and decrease in accuracy caused by the surge in the number of categories.

[0007] The technical solution adopted by the present invention to solve its technical problem is:

[0008] A multi-level encrypted traffic classification system based on deep learning, the system comprising:

[0009] Data collection module, used to provide raw traffic data and provide input for subsequent data preprocessing and model training;

[0010] The data preprocessing module is used to standardize the original traffic, ensure the consistency and stability of the input data, and provide high-quality input data for subsequent model training;

[0011] The Global-Local ResNet backbone network architecture is used to extract the global and local features of network traffic, effectively improving the original ResNet's ability to detect network traffic;

[0012] The multi-level classification head module is used to gradually classify traffic in a multi-level manner to reduce the problem of a surge in the number of categories and the problem of model instability caused by an increase in the number of categories.

[0013] As a further technical solution of the present invention, the data collection module includes:

[0014] A flow data extraction unit, used to capture network data packets and extract five-tuple information of the flow, wherein the five-tuple information includes source IP, destination IP, source port, destination port and protocol number;

[0015] The scene annotation unit is used to annotate the traffic scene through data label specialists, such as distinguishing login, video streaming, file transfer and other scenes;

[0016] Data standardization processing is used to save the captured traffic data into a standardized pcap data format.

[0017] As a further technical solution of the present invention, the data preprocessing module includes:

[0018] The original traffic splitting unit is used to split the original traffic sequence in the segmented scenario into a traffic packet sequence and perform desensitization processing on each traffic packet;

[0019] The key feature extraction unit uses the traffic analysis library to extract key features from each traffic packet to obtain a packet header feature vector; the key features include: protocol type, port, TCP flag, sequence number, confirmation number, timestamp, window size, data packet size, payload length, lifetime, service type, checksum and priority, etc., and then uses the label encoding model to uniformly encode the key features into a feature vector;

[0020] Payload feature extraction unit: uses cropping and padding to process traffic packets into a consistent length, embeds and normalizes each byte, and encodes it into a 0-1 feature matrix;

[0021] The feature matrix concatenation unit is used to concatenate key features with the payload to obtain a feature matrix that can be used for deep learning model training.

[0022] As a further technical solution of the present invention, in the Global-Local ResNet backbone network architecture, the Global-Local operator performs different processing on feature maps of different sizes in ResNet, including the following steps:

[0023] First, let Represents the characteristics of each layer in the model, where x is the parameter of each feature node, N is the total number of layers in the network model, and in order to retain the local information in the network traffic characteristics, this operator The layer uses layer normalization (LN) to constrain the vector. The layer uses the Atrous spatial pyramid pooling (ASPP) operator to filter out interference information and retain valid information; the atrous pooling layer effectively extracts long-distance information that the traditional pooling layer cannot extract. In addition, the present invention uses a length-width asymmetric convolution kernel for the network traffic segment. The use of a wider convolution kernel can perceive and process longer data in a single operation, which also increases the pertinence and effectiveness of the model;

[0024] According to the overall structure of ResNet, the present invention introduces the Non Local operator to perform balanced perception of global information. The operator calculates the correlation between each feature node and the remaining nodes, which is expressed as:

[0025]

[0026] Where f is a pairwise function used to calculate the relationship between two feature nodes, and g is a unary function used to calculate the representation of a single feature node;

[0027] After the feature map of the ResNet backbone network is processed by the Global-Local operator of the present invention, the features will be input into the multi-level classification head module to perform binary classification on the scenes and categories.

[0028] As a further technical solution of the present invention, the multi-level classification head module receives features from the Global-LocalResNet backbone network, first classifies the features in the scene dimension, and after classifying them into a certain scene, classifies the applications contained in the scene, and finally obtains a scene-classification multi-classification result;

[0029] The loss function calculation formula for scene classification is as follows:

[0030]

[0031] Where N is the number of samples, is the true scene label of the i-th scene, is the predicted scene label of the i-th scene;

[0032] Suppose the number of scenes is S, where each scene s has N s samples, an independent application classification loss function is set up for each scenario s, and the loss function calculation formula for the total application classification is as follows:

[0033]

[0034] in is the true application label of the i-th sample in scene s, is the predicted application label of the i-th sample under scenario s. The weighted sum of each application is performed to obtain the total application classification loss function: where γ s is the weight coefficient of scene s, which is used to control the contribution of application classification loss of different scenes to the total loss. In summary, α and β are used to control the loss weights of scenes and applications respectively, and the final loss function is obtained:

[0035]

[0036] The beneficial effects of the present invention are:

[0037] (1) Multi-level classification head: A multi-level classification head is designed. The present invention first performs coarse-grained classification on the traffic scene, and then performs fine-grained classification on the specific application based on this. This method reduces the number of category combinations, improves the classification accuracy and generalization ability of the model, and solves the problem of single classification dimension and surge in the number of categories in the prior art.

[0038] (2) Reduce model complexity and improve classification accuracy: Through the gradual classification at the scene level and application level, the present invention avoids the need to process a large number of categories at the same time in the prior art, significantly reducing the complexity and computational cost of the model. Through the multi-level classification head design, the fine-tuning parameters of the model are flexibly adjusted to ensure that the classification accuracy is maintained during the adaptation process of the newly added categories, solving the problems of insufficient generalization ability and reduced classification accuracy in the prior art.

[0039] (3) Adapting to complex encrypted traffic classification: The present invention adopts deep learning methods to efficiently classify encrypted traffic, solving the shortcomings of traditional feature extraction and rule matching methods in processing complex encrypted traffic, making encrypted traffic classification more accurate and reliable.

[0040] Through these improvements, the present invention can better cope with complex encrypted traffic classification tasks and improve the efficiency and accuracy of network security detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 A data collection flow chart provided for an embodiment of the present invention.

[0042] Figure 2 A data processing flow chart provided for an embodiment of the present invention.

[0043] Figure 3 An overall framework diagram provided for an embodiment of the present invention.

[0044] Figure 4 A schematic diagram of a Global-Local operator provided in an embodiment of the present invention.

[0045] Figure 5 A schematic diagram of the atrous spatial pyramid pooling (ASPP) provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] The system architecture of the present invention consists of four main modules: data collection module, data preprocessing module, Global-Local ResNet backbone network, and multi-level classification head. Each module is responsible for a specific function and realizes data transmission and processing through a standardized interface. The design goal of the system is to achieve efficient multi-dimensional encrypted traffic classification, and through reasonable data processing and model design, while ensuring classification accuracy, avoid the increase in complexity and decrease in accuracy caused by the surge in the number of categories.

[0048] The overall architecture is as follows Figure 3 As shown, the present invention provides a multi-level encrypted traffic classification system based on deep learning, the system comprising:

[0049] Data collection module, used to provide raw traffic data and provide input for subsequent data preprocessing and model training;

[0050] The data preprocessing module is used to standardize the original traffic, ensure the consistency and stability of the input data, and provide high-quality input data for subsequent model training;

[0051] The Global-Local ResNet backbone network architecture is used to extract the fusion of global and local features for network traffic, which effectively improves the original ResNet's ability to detect network traffic; the original ResNet is mainly for image data, but the feature map performance of network traffic is quite different from that of ResNet. Directly using ResNet to classify encrypted traffic has poor stability when performing feature extraction and facing problems such as category surge. Therefore, the present invention proposes a Global-Local operator to extract the fusion of global and local features for network traffic, which effectively improves the original ResNet's ability to detect network traffic.

[0052] The multi-level classification head module is used to gradually classify traffic in a multi-level manner to reduce the problem of a surge in the number of categories and the problem of model instability caused by an increase in the number of categories.

[0053] In this embodiment, the data collection flow chart is as follows: Figure 1 , the data collection module comprises:

[0054] A flow data extraction unit, used to capture network data packets and extract five-tuple information of the flow, wherein the five-tuple information includes source IP, destination IP, source port, destination port and protocol number;

[0055] The scene annotation unit is used to annotate the traffic scene through data label specialists, such as distinguishing login, video streaming, file transfer and other scenes;

[0056] Data standardization processing is used to save the captured traffic data into a standardized pcap data format.

[0057] In this embodiment, the data processing flow chart is as follows: Figure 2 , the data preprocessing module includes:

[0058] The original traffic splitting unit is used to split the original traffic sequence in the segmented scenario into a traffic packet sequence and perform desensitization processing on each traffic packet;

[0059] The key feature extraction unit uses the traffic analysis library to extract key features from each traffic packet to obtain a packet header feature vector; the key features include: protocol type, port, TCP flag, sequence number, confirmation number, timestamp, window size, data packet size, payload length, lifetime, service type, checksum and priority, etc., and then uses the label encoding model to uniformly encode the key features into a feature vector;

[0060] Payload feature extraction unit: uses cropping and padding to process traffic packets into a consistent length, embeds and normalizes each byte, and encodes it into a 0-1 feature matrix;

[0061] The feature matrix concatenation unit is used to concatenate key features with the payload to obtain a feature matrix that can be used for deep learning model training.

[0062] In this embodiment, the Global-Local operator proposed by the present invention is as follows: Figure 4 As shown in Figure 2, the Atrous spatial pyramid pooling (ASPP) module in the Global-Local operator is as follows: Figure 5 In the Global-Local ResNet backbone network architecture, the Global-Local operator performs different processing on feature maps of different sizes in ResNet, including the following steps:

[0063] First, let Represents the characteristics of each layer in the model, where x is the parameter of each feature node, N is the total number of layers in the network model, and in order to retain the local information in the network traffic characteristics, this operator The layer uses layer normalization (LN) to constrain the vector. The layer uses the Atrous spatial pyramid pooling (ASPP) operator to filter out interference information and retain valid information; the atrous pooling layer effectively extracts long-distance information that the traditional pooling layer cannot extract. In addition, the present invention uses a length-width asymmetric convolution kernel for the network traffic segment. The use of a wider convolution kernel can perceive and process longer data in a single operation, which also increases the pertinence and effectiveness of the model;

[0064] According to the overall structure of ResNet, the present invention introduces the Non Local operator to perform balanced perception of global information. The operator calculates the correlation between each feature node and the remaining nodes, which is expressed as:

[0065]

[0066] Where f is a pairwise function used to calculate the relationship between two feature nodes, and g is a unary function used to calculate the representation of a single feature node;

[0067] After the feature map of the ResNet backbone network is processed by the Global-Local operator of the present invention, the features will be input into the multi-level classification head module to perform binary classification on the scenes and categories.

[0068] In this embodiment, the multi-level classification head module receives features from the Global-Local ResNet backbone network, first classifies the features in the scene dimension, and after classifying them into a certain scene, classifies the applications contained in the scene, and finally obtains a scene-classification multi-classification result;

[0069] The loss function calculation formula for scene classification is as follows:

[0070]

[0071] Where N is the number of samples, is the true scene label of the i-th scene, is the predicted scene label of the i-th scene;

[0072] Suppose the number of scenes is S, where each scene s has N s samples, an independent application classification loss function is set up for each scenario s, and the loss function calculation formula for the total application classification is as follows:

[0073]

[0074] in is the true application label of the i-th sample in scene s, is the predicted application label of the i-th sample under scenario s. The weighted sum of each application is performed to obtain the total application classification loss function: where γ s is the weight coefficient of scene s, which is used to control the contribution of application classification loss of different scenes to the total loss. In summary, α and β are used to control the loss weights of scenes and applications respectively, and the final loss function is obtained:

[0075]

[0076] In order to facilitate those skilled in the art to better understand the technical solution of the present invention, specific embodiments of the present invention are given as follows:

[0077] Embodiment: A multi-level encrypted traffic classification method based on deep learning comprises the following steps:

[0078] 1. The data collection module uses tools such as Wireshark, Zeek, and Scapy to capture network traffic. First, capture network data packets and extract the five-tuple information of the traffic (source IP, destination IP, source port, destination port, and protocol number).

[0079] 2. The captured traffic data is annotated by data label specialists to distinguish different usage scenarios, such as login, video streaming, file transfer, etc.

[0080] 3. Save the captured and annotated traffic data in a standardized pcap data format to provide raw input for subsequent data preprocessing and model training.

[0081] 4. The data preprocessing module extracts features and cleans the captured traffic data. First, the original traffic sequence is split into traffic packet sequences according to the scenario, and each traffic packet is desensitized.

[0082] 5. Use traffic analysis libraries (such as scapy, tshark) to extract key header information from each traffic packet and generate a header feature vector.

[0083] 6. Concatenate the packet header features with the payload features, and use cropping or padding to process the traffic packets to make them reach a uniform length to ensure the consistency of subsequent model inputs.

[0084] 7. Embed each byte of traffic data and encode it into a value of 0-1. After standardization, generate a feature matrix that can be directly used by the deep learning model.

[0085] 8. The ResNet backbone network proposes a Global-Local operator to extract features from feature maps of different sizes. For local features, layer normalization (LN) is used to normalize the features of the layer to maintain feature consistency. For global features, the length-width asymmetric atrous pooling pyramid (ASPP) operator is used to improve the modeling of traffic data, retain effective information at long distances, and filter out noise data.

[0086] 9. The Non Local operator is introduced to perform balanced perception of global information. By calculating the correlation between each feature node and other nodes, the perception ability of global features is further enhanced.

[0087] 10. After feature processing, the extracted global and local features are input into the multi-level classification head module for scene classification.

[0088] 11. The multi-level classification head module first performs scene classification on the traffic data and divides the traffic into different scene categories, such as login, video streaming, file transfer, etc., to complete the coarse-grained classification.

[0089] 12. After completing the scene classification, further subdivide and classify the specific applications within each scene, such as classifying specific applications in the video streaming scene.

[0090] 13. After the classification is completed, the loss function of the scene classification and application classification is calculated, and the contribution of the scene and application classification to the total loss is adjusted according to the weight coefficient.

[0091] 14. Finally, the loss weights of the scenarios and application classifications are combined to obtain the total loss function, which is used to guide the optimization and training of the model.

[0092] Effect:

[0093] For a network traffic dataset containing 25 applications and 76 scenarios, ResNet50 was used as the backbone network, and the Global-Local operator and multi-level classification head design were used to achieve a classification accuracy of 90.61%.

[0094] When a new category is added, the model can quickly adapt to the new traffic category by fine-tuning the application classification part, ensuring the scalability and stability of the system.

[0095] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0096] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A multi-level encrypted traffic classification system based on deep learning, characterized in that: The system comprises: Data collection module, used to provide raw traffic data and provide input for subsequent data preprocessing and model training; The data preprocessing module is used to standardize the original traffic, ensure the consistency and stability of the input data, and provide high-quality input data for subsequent model training; The Global-Local ResNet backbone network architecture is used to extract the global and local features of network traffic, effectively improving the original ResNet's ability to detect network traffic; The multi-level classification head module is used to gradually classify traffic in a multi-level manner to reduce the problem of a surge in the number of categories and the problem of model instability caused by an increase in the number of categories.

2. According to the multi-level encrypted traffic classification system based on deep learning in claim 1, it is characterized in that: The data collection module includes: A flow data extraction unit, used to capture network data packets and extract five-tuple information of the flow, wherein the five-tuple information includes source IP, destination IP, source port, destination port and protocol number; The scene annotation unit is used to annotate the traffic scene by data label specialists; Data standardization processing is used to save the captured traffic data into a standardized pcap data format.

3. According to the multi-level encrypted traffic classification system based on deep learning in claim 1, it is characterized in that: The data preprocessing module comprises: The original traffic splitting unit is used to split the original traffic sequence in the segmented scenario into a traffic packet sequence and perform desensitization processing on each traffic packet; The key feature extraction unit uses the traffic analysis library to extract key features from each traffic packet to obtain a packet header feature vector; the key features include: protocol type, port, TCP flag, sequence number, confirmation number, timestamp, window size, data packet size, payload length, lifetime, service type, checksum and priority, and then uses the label encoding model to uniformly encode the key features into a feature vector; Payload feature extraction unit: uses cropping and padding to process traffic packets into a consistent length, embeds and normalizes each byte, and encodes it into a 0-1 feature matrix; The feature matrix concatenation unit is used to concatenate key features with the payload to obtain a feature matrix that can be used for deep learning model training.

4. According to claim 3, a multi-level encrypted traffic classification system based on deep learning is characterized in that: In the Global-Local ResNet backbone network architecture, the Global-Local operator performs different processing on feature maps of different sizes in ResNet, including the following steps: First, let Represents the characteristics of each layer in the model, where x is the parameter of each feature node, N is the total number of layers of the network model, and in order to retain the local information in the network traffic characteristics, The layer uses inter-layer normalization to constrain the vector. The layer uses the dilated pooling pyramid operator to filter out interference information and retain valid information. The dilated pooling layer effectively extracts long-distance information that the traditional pooling layer cannot extract. In addition, for the network traffic segment, a length-width asymmetric convolution kernel is used. According to the overall structure of ResNet, the Non Local operator is introduced to perform balanced perception of global information. The operator calculates the correlation between each feature node and the remaining nodes, which is expressed as: Where f is a pairwise function used to calculate the relationship between two feature nodes, and g is a unary function used to calculate the representation of a single feature node; After the feature map of the ResNet backbone network is processed by the Global-Local operator, the features will be input into the multi-level classification head module for binary classification of scenes and categories.

5. According to the multi-level encrypted traffic classification system based on deep learning in claim 1, it is characterized in that: The multi-level classification head module receives features from the Global-Local ResNet backbone network, first classifies the features in the scene dimension, and after classifying them into a certain scene, classifies the applications contained in the scene, and finally obtains a scene-classification multi-classification result; The loss function calculation formula for scene classification is as follows: Where N is the number of samples, is the true scene label of the i-th scene, is the predicted scene label of the i-th scene; Suppose the number of scenes is S, where each scene s has N s samples, an independent application classification loss function is set up for each scenario s, and the loss function calculation formula for the total application classification is as follows: in is the true application label of the i-th sample in scene s, is the predicted application label of the i-th sample under scenario s. The weighted sum of each application is performed to obtain the total application classification loss function: where γ s is the weight coefficient of scene s, which is used to control the contribution of application classification loss of different scenes to the total loss. In summary, α and β are used to control the loss weights of scenes and applications respectively, and the final loss function is obtained:

Images