Encrypted video traffic identification method based on graph neural network

Abstract

The invention provides an encrypted video traffic identification method based on a graph neural network, and the method comprises the following steps: 1, preprocessing traffic, storing the traffic captured from the network by using a pcap file, processing the pcap file by using an scapy library, dividing the traffic into different data streams, extracting features in each stream, and storing the features in a database; and storing the features in each stream into a csv file. When data streams are divided by using scapy, data packets of the same quintuple are stipulated to belong to the same stream. According to the method, data packets are divided into different streams according to destination / source I P addresses, destination / source port numbers and protocol types, then each stream is constructed into a graph by using an algorithm, the graphs are sent to a graph neural network for training, and the graphs can be used for identifying encrypted video traffic after training is completed. The encrypted video traffic identification method with strong generalization ability is designed, and when the network environment changes, the identification effect on the encrypted video traffic can still be good.

Description

Technical Field

[0001] The present invention relates to the field of encrypted video traffic recognition using neural networks, and in particular to an encrypted video traffic recognition method based on a graph neural network. Background Art

[0002] Dong et al. proposed a technique (Y. Dong, J. Zhao, and J. Jin, “Novel feature selection and classification of internet video traffic based on a hierarchical scheme,” Comput. Networks, vol. 119, pp. 102–111, 2017) that uses a hierarchical K-nearest neighbor algorithm to classify video traffic. When processing pcap files, this technique extracts five types of packet information: packet arrival time, source / destination IP address, protocol, and packet size. After extracting the traffic information, the packets are divided into different data streams, and four features are extracted for each stream. The K-nearest neighbor algorithm is used to combine the four features to classify the data streams into different types of video streams.

[0003] Shen et al. proposed a technique (M.Shen, J.Zhang, L.Zhu, K.Xu, and X.Du, “Accuratedecentralized application identification via encrypted traffic analysis using graph neural networks,” IEEE Transactions on Information Forensics and Security, vol.16, pp.2367–2380, 2021) to classify decentralized applications using graph neural networks. When processing pcap files, this technique extracts the packet protocol header information and size information. After dividing into data streams, this technique uses a graph construction algorithm to construct a graph for the first 25 packets of each data stream. The constructed graph is sent to the graph neural network for training, and after the training is completed, different decentralized applications can be distinguished.

[0004] The technology proposed by Dong et al. uses the statistical characteristics of traffic, especially the statistical characteristics of the time interval between packet arrivals. Such characteristics are easily affected by network delay or jitter. Therefore, when the network environment changes, the classification effect of this technology will deteriorate.

[0005] In the technology proposed by Shen et al., each graph node contains less information, so the ability to express the behavioral patterns of traffic in the network is limited, and the recognition effect is not ideal for the classification scenario of encrypted video traffic.

[0006] Therefore, it is necessary to provide an encrypted video traffic identification method based on graph neural network to solve the above technical problems. Summary of the invention

[0007] The present invention provides an encrypted video traffic identification method based on graph neural network, which solves the problem that each graph node contains less information, so the expression ability of the behavior pattern of the traffic in the network is limited, and the identification effect is not ideal for the classification scenario of encrypted video traffic.

[0008] The encrypted video traffic identification method based on graph neural network includes the following steps:

[0009] The first step is traffic preprocessing. For the traffic captured from the network, use pcap files to save it. Use the scapy library to process the pcap files, divide the traffic into different data streams, extract the features in each stream, and save the features in each stream into a csv file. When using scapy to divide the data stream, it is stipulated that the data packets with the same five-tuple belong to the same stream. For each stream, extract the five-tuple information, data packet size, and whether it is an ACK confirmation message of each data packet in each stream. Finally, use the Panda library to save the features of each stream into a csv file;

[0010] The second step is graph construction, which converts the first n packets of a flow into a graph. When constructing the graph, each graph node contains three features: the direction of the packet, the length of the packet, and the type of the packet;

[0011] Each node in the graph contains 5-dimensional features: 1-dimensional features are used to represent the length and direction features of the data packet, where the absolute value of the feature value represents the length of the data packet, and the positive or negative value of the feature value represents the direction; 4-dimensional features are used to represent the type features of the data packet. Specifically, for a normal data packet with a length of x sent from the client to the server, it is represented by a feature vector h, where hT = [+x, 1, 0, 0, 0]. Each node in the graph represents a data packet in the data stream, where each layer in the graph represents a fragment transmission stage. The nodes are connected in chronological order with edges. Between adjacent layers, the first node of each layer is connected, and the last node of each layer is connected.

[0012] The third step is model construction, which consists of a graph representation module and a classification module.

[0013] The graph representation model uses the graph obtained by the graph construction algorithm as input, obtains node representations through n-layer graph convolution operations, then flattens all node representations according to the time order of the nodes, and sends the flattened representations to the bidirectional long short-term memory network to learn the representation of the entire graph;

[0014] The classification module uses the output of the graph representation model as input, sends the representation of the entire graph to the fully connected layer, and finally passes through the Softmax layer to obtain the final classification result. The classification result is a 2-dimensional vector. If the value of the first dimension is greater than the value of the second dimension, the traffic classification result is considered to be "video", otherwise it is considered to be "non-video";

[0015] The fourth step is model training. In the model training phase, the model loss is calculated through the cross entropy loss function, and the model parameters are optimized using the Adam parameter optimization algorithm. For the model hyperparameters, the model hyperparameters are continuously adjusted to obtain the best generalization ability with the minimum performance loss. The hyperparameters include: the number of graph nodes, the number of graph convolution layers, the feature dimension of hidden layer nodes, the output dimension of the bidirectional long short-term memory model, and the activation function in the graph convolution. When looking for the optimal hyperparameters, only one hyperparameter value is changed each time, and the other hyperparameter values ​​are default. When the F1-score value of the model reaches the maximum, the hyperparameter value is fixed and set to the default value. The final model hyperparameter values ​​are as follows: the number of graph nodes is 70, the number of graph convolution layers is 5, the feature dimension of hidden layer nodes is 110, the output dimension of the bidirectional long short-term memory model is 55, and the activation function is ReLU.

[0016] The fifth step is model testing, using the three evaluation indicators of F1-score, Precision, and Recall to evaluate the test effect of the model.

[0017] Preferably, in the second step,

[0018] The data packets transmitted in the data stream are divided into four categories: confirmation-only data packets sent from the client to the server, normal data packets sent from the client to the server, confirmation-only data packets sent from the server to the client, and normal data packets sent from the server to the client;

[0019] In order to store the direction information of the data packet in the node, the length value of the upstream data packet is set to a positive value, and the length value of the downstream data packet is set to a negative value. That is, the direction is distinguished by the positive and negative values ​​of the data packet length. In the specific implementation of the model, since the data packet type feature is not a continuous numerical feature, one-hot encoding is used to represent the type of data packet.

[0020] Preferably, each layer in the diagram in the second step is a data packet that is continuously sent from one end to the other end in a short period of time and belongs to the same layer, for example Figure 1The 3rd and 4th nodes belong to the 3rd layer, and the 5th to 7th nodes belong to the 4th layer.

[0021] Preferably, the code of the entire model in the model construction is implemented based on Pytorch.

[0022] Compared with related technologies, the encrypted video traffic identification method based on graph neural network provided by the present invention has the following beneficial effects:

[0023] The present invention provides an encrypted video traffic identification method based on a graph neural network. The present invention divides data packets into different flows according to the destination / source IP address, the destination / source port number and the protocol type, and then uses an algorithm to construct each flow into a graph, which is sent to the graph neural network for training. After the training is completed, it can be used to identify encrypted video traffic. An encrypted video traffic identification method with strong generalization ability is designed. When the network environment changes, the identification effect of the encrypted video traffic can still perform well. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A schematic diagram of constructing a data stream as a graph in a method for identifying encrypted video traffic based on a graph neural network provided by the present invention;

[0025] Figure 2 A schematic diagram of an algorithm for converting a data stream into a graph in an encrypted video traffic identification method based on a graph neural network provided by the present invention. DETAILED DESCRIPTION

[0026] The present invention will be further described below in conjunction with the accompanying drawings and implementation modes.

[0027] Please refer to Acts 1-2. Figure 1 A schematic diagram of constructing a data stream as a graph in a method for identifying encrypted video traffic based on a graph neural network provided by the present invention; Figure 2 The present invention provides an encrypted video traffic identification method based on a graph neural network, and the algorithm diagram for converting a data stream into a graph is shown in FIG. The encrypted video traffic identification method based on a graph neural network includes the following steps:

[0028] The first step is traffic preprocessing. For the traffic captured from the network, use pcap files to save it. Use the scapy library to process the pcap files, divide the traffic into different data streams, extract the features in each stream, and save the features in each stream into a csv file. When using scapy to divide the data stream, it is stipulated that the data packets with the same five-tuple belong to the same stream. For each stream, extract the five-tuple information, data packet size, and whether it is an ACK confirmation message of each data packet in each stream. Finally, use the Panda library to save the features of each stream into a csv file;

[0029] The five-tuple is: source / destination IP address, source / destination port number, and protocol type.

[0030] The second step is graph construction, which converts the first n packets of a flow into a graph. When constructing the graph, each graph node contains three features: the direction of the packet, the length of the packet, and the type of the packet;

[0031] Each node in the graph contains 5-dimensional features: 1-dimensional features are used to represent the length and direction features of the data packet, where the absolute value of the feature value represents the length of the data packet, and the positive or negative value of the feature value represents the direction; 4-dimensional features are used to represent the type features of the data packet. Specifically, for a normal data packet with a length of x sent from the client to the server, it is represented by a feature vector h, where hT = [+x, 1, 0, 0, 0]. Each node in the graph represents a data packet in the data stream, where each layer in the graph represents a fragment transmission stage. The nodes are connected in chronological order with edges. Between adjacent layers, the first node of each layer is connected, and the last node of each layer is connected.

[0032] The third step is model construction, which consists of a graph representation module and a classification module.

[0033] The graph representation model uses the graph obtained by the graph construction algorithm as input, obtains node representations through n-layer graph convolution operations, then flattens all node representations according to the time order of the nodes, and sends the flattened representations to the bidirectional long short-term memory network to learn the representation of the entire graph;

[0034] The classification module uses the output of the graph representation model as input, sends the representation of the entire graph to the fully connected layer, and finally passes through the Softmax layer to obtain the final classification result. The classification result is a 2-dimensional vector. If the value of the first dimension is greater than the value of the second dimension, the traffic classification result is considered to be "video", otherwise it is considered to be "non-video";

[0035] The fourth step is model training. In the model training phase, the model loss is calculated through the cross entropy loss function, and the model parameters are optimized using the Adam parameter optimization algorithm. For the model hyperparameters, the model hyperparameters are continuously adjusted to obtain the best generalization ability with the minimum performance loss. The hyperparameters include: the number of graph nodes, the number of graph convolution layers, the feature dimension of hidden layer nodes, the output dimension of the bidirectional long short-term memory model, and the activation function in the graph convolution. When looking for the optimal hyperparameters, only one hyperparameter value is changed each time, and the other hyperparameter values ​​are default. When the F1-score value of the model reaches the maximum, the hyperparameter value is fixed and set to the default value. The final model hyperparameter values ​​are as follows: the number of graph nodes is 70, the number of graph convolution layers is 5, the feature dimension of hidden layer nodes is 110, the output dimension of the bidirectional long short-term memory model is 55, and the activation function is ReLU.

[0036] The fifth step is model testing, using the three evaluation indicators of F1-score, Precision, and Recall to evaluate the test effect of the model.

[0037] In the second step, the data packets transmitted in the data stream are divided into four categories: confirmation-only data packets sent from the client to the server, normal data packets sent from the client to the server, confirmation-only data packets sent from the server to the client, and normal data packets sent from the server to the client;

[0038] In order to store the direction information of the data packet in the node, the length value of the upstream data packet is set to a positive value, and the length value of the downstream data packet is set to a negative value. That is, the direction is distinguished by the positive and negative values ​​of the data packet length. In the specific implementation of the model, since the data packet type feature is not a continuous numerical feature, one-hot encoding is used to represent the type of data packet.

[0039] One-hot

[0040] Each layer in the figure in the second step is the data packets sent continuously from one end to the other end in a short time and belong to the same layer, for example Figure 1 The 3rd and 4th nodes belong to the 3rd layer, and the 5th to 7th nodes belong to the 4th layer.

[0041] The uplink data packets are the data packets sent from the client to the server, and the downlink data packets are the data packets sent from the server to the client.

[0042] The code of the entire model in the model construction is all implemented based on Pytorch.

[0043] The present invention converts the video stream into a graph structure that contains highly distinguishing features in the video stream, such as packet transmission direction, packet size, sequence number, frequency of only confirming packets, and fragmented transmission mode of the video. These features play an important role in identifying encrypted video traffic.

[0044] A graph neural network model is used to solve the problem of encrypted video traffic classification. The model can learn the embedded representation in the above structure to effectively realize the recognition of encrypted video streams.

[0045] In order to test the effect and generalization ability of the present invention, two self-built data sets D1, D2, and one public data set D3 were used, where D1 and D2 were collected from different network environments. For each data set, the traffic is divided into different data streams by the five-tuple information of the data packet (protocol, source / destination IP address, source / destination port number). Afterwards, the header information in the data packet is extracted from the data stream, such as: timestamp, source / destination IP address, source / destination port number, sequence number, ACK flag, and data packet size. Data set D1 is collected from mobile terminals and PC terminals (including wired networks and wireless networks). Data set D2 contains traffic collected from mobile terminals and PC terminals under 4G and 5G networks. Data set D3 consists of two public data sets.

[0046] The present invention is first trained and tested on three data sets respectively. The test results show that the F1-score of the present invention on the D1, D2, and D3 data sets reaches 0.89, 0.86, and 0.99 respectively, which are higher than other existing products. When testing the generalization ability of the model, the present invention is trained on the D1 data set and tested on the D2 and D3 data sets. The test results show that the F1-score of the model on the D2 and D3 data sets reaches 0.72 and 0.89 respectively, which are better than other existing products.

[0047] Example 1: The number of graph nodes is 70, the number of graph convolution layers is 3, the feature dimension of hidden layer nodes is 30, the output dimension of bidirectional long short-term memory model is 35, and the activation function is ReLU. Trained on the dataset D1, tested on the datasets D2 and D3. On the dataset D2, the F1-score, recall, and precision of the present invention reach 0.92, 0.98, and 0.86, respectively. The F1-score, recall, and precision of the present invention on the dataset D3 reach 0.69, 0.65, and 0.75, respectively.

[0048] Example 2: The number of graph nodes is 70, the number of graph convolution layers is 3, the feature dimension of hidden layer nodes is 110, the output dimension of bidirectional long short-term memory model is 55, and the activation function is ReLU. Trained on the data set D1, tested on the data sets D2 and D3. On the D2 data set, the F1-score, recall, and precision of the present invention reach 0.95, 0.94, and 0.97, respectively. The F1-score, recall, and precision of the present invention on the D3 data set reach 0.62, 0.29, and 0.75, respectively.

[0049] Example 3: The number of graph nodes is 70, the number of graph convolution layers is 5, the feature dimension of hidden layer nodes is 110, the output dimension of bidirectional long short-term memory model is 55, and the activation function is ReLU. Trained on the data set D1, tested on the data sets D2 and D3. On the D2 data set, the F1-score, recall, and precision of the present invention reach 0.89, 0.82, and 0.98 respectively. The F1-score, recall, and precision of the present invention on the D3 data set reach 0.72, 0.76, and 0.69 respectively.

[0050] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for identifying encrypted video traffic based on graph neural network, characterized in that: The following steps are involved: The first step is traffic preprocessing. For the traffic captured from the network, use pcap files to save it. Use the scapy library to process the pcap files, divide the traffic into different data streams, extract the features in each stream, and save the features in each stream into a csv file. When using scapy to divide the data streams, it is stipulated that the data packets with the same five-tuple belong to the same stream. For each stream, extract the five-tuple information, data packet size, and whether it is an ACK confirmation message of each data packet in each stream. Finally, use the Panda library to save the features of each stream into a csv file. The second step is graph construction, which converts the first n packets of a flow into a graph. When constructing the graph, each graph node contains three features: the direction of the packet, the length of the packet, and the type of the packet; Each node in the graph contains 5-dimensional features: 1-dimensional features are used to represent the length and direction features of the data packet, where the absolute value of the feature value represents the length of the data packet, and the positive and negative values ​​of the feature value represent the direction; 4-dimensional features are used to represent the type features of the data packet. Specifically, for a normal data packet with a length of x sent from the client to the server, it is represented by a feature vector h, where hT = [+x, 1, 0, 0, 0]. Each node in the graph represents a data packet in the data stream, where each layer in the graph represents a fragment transmission stage. The nodes are connected in chronological order with edges. Between adjacent layers, the first node of each layer is connected, and the last node of each layer is connected. The third step is model construction, which consists of a graph representation module and a classification module. The graph representation model uses the graph obtained by the graph construction algorithm as input, obtains node representations through n-layer graph convolution operations, then flattens all node representations according to the time order of the nodes, and sends the flattened representations to the bidirectional long short-term memory network to learn the representation of the entire graph; The classification module uses the output of the graph representation model as input, sends the representation of the entire graph to the fully connected layer, and finally passes through the Softmax layer to obtain the final classification result. The classification result is a 2-dimensional vector. If the value of the first dimension is greater than the value of the second dimension, the traffic classification result is considered to be "video", otherwise it is considered to be "non-video"; The fourth step is model training. In the model training phase, the model loss is calculated through the cross entropy loss function, and the model parameters are optimized using the Adam parameter optimization algorithm. For the model hyperparameters, the model hyperparameters are continuously adjusted to obtain the best generalization ability with the minimum performance loss. The hyperparameters include: the number of graph nodes, the number of graph convolution layers, the feature dimension of hidden layer nodes, the output dimension of the bidirectional long short-term memory model, and the activation function in the graph convolution. When looking for the optimal hyperparameters, only one hyperparameter value is changed each time, and the other hyperparameter values ​​are default. When the F1-score value of the model reaches the maximum, the hyperparameter value is fixed and set to the default value. The final model hyperparameter values ​​are as follows: the number of graph nodes is 70, the number of graph convolution layers is 5, the feature dimension of hidden layer nodes is 110, the output dimension of the bidirectional long short-term memory model is 55, and the activation function is ReLU. The fifth step is model testing, using three evaluation indicators: F1-score, Precision, and Recal l to evaluate the test effect of the model.

2. The encrypted video traffic identification method based on graph neural network according to claim 1 is characterized in that: In the second step, The data packets transmitted in the data stream are divided into four categories: confirmation-only data packets sent from the client to the server, normal data packets sent from the client to the server, confirmation-only data packets sent from the server to the client, and normal data packets sent from the server to the client; In order to store the direction information of the data packet in the node, the length value of the upstream data packet is set to a positive value, and the length value of the downstream data packet is set to a negative value. That is, the direction is distinguished by the positive and negative values ​​of the data packet length. In the specific implementation of the model, since the data packet type feature is not a continuous numerical feature, one-hot encoding is used to represent the type of data packet.

3. The encrypted video traffic identification method based on graph neural network according to claim 1 is characterized in that: In each layer of the diagram in the second step, data packets continuously sent from one end to the other end in a short period of time belong to the same layer. For example, the 3rd and 4th nodes in Figure 1 belong to the 3rd layer, and the 5th to 7th nodes belong to the 4th layer.

4. The encrypted video traffic identification method based on graph neural network according to claim 1 is characterized in that: The code of the entire model in the model construction is all implemented based on Pytorch.

Images