Encrypted application traffic identification method based on deep learning algorithm

Abstract

The embodiment of the invention relates to the technical field of encrypted application traffic identification, in particular to an encrypted application traffic identification method based on a deep learning algorithm, which comprises the following steps: preparing a test mobile phone and a test number, and continuously acquiring internet traffic data of an N3 interface of a 5G core network after confirming that 5G network connection is normal; filtering internet traffic data through the test number, extracting a plurality of pieces of traffic information of the test number from pcap packets of different instant messaging applications, respectively storing the traffic information as pcap files of different instant messaging applications, and labeling real labels; converting the pcap file into a grayscale image file, and dividing the grayscale image file according to a preset proportion to obtain a training set and a test set; constructing an encrypted application traffic identification model; based on the training set and the test set, carrying out iterative training on the model until convergence and carrying out verification; and inputting the target encrypted application traffic into the model, and obtaining an identification result of the target encrypted application traffic output by the model. According to the method, the identification accuracy of the encrypted application traffic is effectively improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the technical field of encrypted application traffic identification, and in particular, to an encrypted application traffic identification method based on a deep learning algorithm. Background Art

[0002] With the continuous development of 5G networks, more and more information is transmitted through the network. The gradual improvement of network security awareness and the development of encryption technology have led to a continuous surge in encrypted traffic in Internet services, especially instant messaging IM applications. The popularization of Internet encryption protocols represented by HTTPS, virtual private networks, tunnel encryption technology, communication channel encryption technology, etc. as common traffic encryption methods can ensure the confidentiality and integrity of data, and are therefore widely used in actual network applications. Based on the above reasons, it is becoming increasingly difficult to identify encrypted application traffic in the network.

[0003] At present, the identification methods for encrypted application traffic mainly include rule-based identification methods, traditional machine learning-based identification methods, and deep learning-based identification methods. For example, Jing Quanliang et al. proposed an I2P traffic identification method and system based on feature matching. On the basis of rule-based, the system changed the execution efficiency of the original algorithm based on length sequence matching. Velan P et al. proposed an encrypted traffic classification method based on traditional machine learning, introduced the grouping structure and standard behavior of multiple traffic encryption protocols in the network, and focused on the information provided by the encryption protocol itself in the encrypted traffic classification task. Zhu Yuanjian et al. proposed an encrypted traffic classification method based on deep neural networks, innovatively applying the obtained plaintext corresponding information to the precise labeling of user behavior, and finally completing the effective training of the traffic classification model.

[0004] However, the above-mentioned identification methods of encrypted application traffic all have shortcomings.

[0005] Rule-based identification methods are more suitable for traffic with fixed characteristics. However, with the development of network traffic encryption technology, traffic with fixed characteristics has become less and less. Therefore, rule-based identification methods can no longer cope with the ever-changing traffic characteristics and are difficult to identify and process.

[0006] Although the recognition method based on traditional machine learning can cope with the traffic characteristics of feature changes and has high training and calculation speeds, it is a shallow learning of traffic and highly dependent on manual feature engineering, with limited generalization capabilities. Faced with today's explosive application traffic, the processing ability for large-scale high-dimensional data is weak, and traditional machine learning cannot capture the complex nonlinear relationships in the data.

[0007] In the recognition method based on deep machine learning, it is necessary to perform plaintext and ciphertext analysis on the application traffic samples used for training and testing in advance. Therefore, there are high requirements for sample collection and analysis, and the general applicability is not high. Summary of the invention

[0008] In view of this, the embodiments of the present application propose an encrypted application traffic identification method based on a deep learning algorithm, which can improve the identification accuracy and classification accuracy of encrypted application traffic, and provide basic support for applications such as refined filtering and high-value data extraction.

[0009] On the first aspect, an embodiment of the present application proposes a method for identifying encrypted application traffic based on a deep learning algorithm, comprising the following steps: preparing a test mobile phone and a test number, and after confirming that the 5G network connection is normal, using different instant messaging applications to perform text sending operations through the test mobile phone, while continuously collecting Internet traffic data of the 5G core network N3 interface; filtering Internet traffic data through the test number, extracting several traffic information of the test number from the pcap packages of different instant messaging applications, saving them as pcap files of different instant messaging applications, and marking them with real labels; converting the pcap file into a grayscale image file, and dividing it into a training set and a test set according to a preset ratio; constructing an encrypted application traffic identification model, the encrypted application traffic identification model consists of a first convolutional layer, a first pooling layer, a second convolutional layer, a second pooling layer, a first fully connected layer, a second fully connected layer and an output layer; based on the training set and the test set, iteratively training the encrypted application traffic identification model until convergence and verifying it; inputting the target encrypted application traffic into the encrypted application traffic identification model, and obtaining the identification result of the target encrypted application traffic output by the encrypted application traffic identification model.

[0010] In some optional embodiments, when using different instant messaging applications to send texts through a test phone, the process includes: traversing the selected instant messaging applications, starting the current instant messaging application, and clearing other instant messaging applications in the background of the test phone to ensure that only the current instant messaging application is running; using the current instant messaging application to send texts through the test phone, with each operation lasting no less than 5 minutes; after completing the operation on the current instant messaging application, closing the current instant messaging application, starting the next instant messaging application, and clearing other instant messaging applications in the background of the test phone.

[0011] In some optional embodiments, several pieces of traffic information of a test number are extracted from pcap packages of different instant messaging applications and saved as pcap files of different instant messaging applications, respectively, including: removing the file header of the extracted traffic information; wherein the file header occupies the first 24 bytes of the traffic information; detecting whether the traffic information after removing the file header exceeds 784 bytes, if it exceeds 784 bytes, trimming the portion exceeding 784 bytes, and using the retained 784 bytes as the pcap file; if it does not exceed 784 bytes, filling the portion less than 784 bytes with 0, and using the filled 784 bytes as the pcap file; converting the pcap file into a grayscale image file, specifically: converting the 784-byte pcap file into a 28×28-byte grayscale image file; wherein the pcap file is a binary file, and the format of the grayscale image file is an IDX format.

[0012] In some optional embodiments, when iteratively training the encrypted application traffic identification model, the training samples in the training set are input into the first convolutional layer, and the first convolutional layer performs the first convolution operation on the input training samples to increase the diversity of feature extraction; the first pooling layer adopts the maximum pooling method to further extract the output of the first convolutional layer; the second convolutional layer performs the second convolution operation on the output of the first pooling layer for further extraction; the second pooling layer adopts the maximum pooling method to maintain the main features of the output of the second convolutional layer and reduce redundant information; the first fully connected layer performs a weighted sum calculation on the output of the second pooling layer to reduce the dimension of the data; the second fully connected layer performs a weighted sum calculation on the output of the first fully connected layer to further reduce the dimension of the data; the output layer performs softmax normalization based on the output of the second fully connected layer, and outputs the recognition result of the training sample.

[0013] In some optional embodiments, both the first convolutional layer and the second convolutional layer use the Relu activation function for nonlinear output, and Dropout regularization is set in the first fully connected layer to suppress overfitting and improve generalization ability.

[0014] In some optional embodiments, when iteratively training the encrypted application traffic identification model, a loss value is calculated based on the real labels marked on the training samples, the identification results of the training samples output by the encrypted application traffic identification model, and the cross-entropy loss function; it is determined whether the calculated loss value meets the preset convergence conditions; if the calculated loss value does not meet the preset convergence conditions, based on the calculated loss value, the weights and bias values ​​of the first convolutional layer, the second convolutional layer and the first fully connected layer, and the second fully connected layer are updated using the back propagation algorithm until the calculated loss value meets the preset convergence conditions; if the calculated loss value meets the preset convergence conditions, the test samples in the test set are input into the encrypted application traffic identification model to verify the performance of the encrypted application traffic identification model.

[0015] In some optional embodiments, the loss value is calculated based on the real label marked on the training sample, the recognition result of the training sample output by the encrypted application traffic recognition model, and the cross entropy loss function, which is implemented by the following formula:

[0016]

[0017] Where n represents the total number of categories of instant messaging applications, p(x i ) represents the value of the i-th category in the true label marked on the training sample, q(x i ) represents the value of the i-th category in the recognition result of the training sample output by the encrypted application traffic recognition model, and LOSS represents the calculated loss value.

[0018] This application uses a combination of image conversion and artificial intelligence to collect Internet traffic data generated by instant applications of the N3 interface of the 5G core network as the research object, and converts the binary pcap file into a grayscale image file to construct a training set and a test set for subsequent processing using 2D-CNN. Using 2D-CNN as the network construction, an encrypted application traffic identification model is constructed and trained to perform encrypted application traffic identification tasks, and encrypted application traffic is processed by image conversion. Using the powerful ability of 2D-CNN in image recognition, through convolution, pooling, full connection, softmax normalization classification and other processing, it makes up for the limitations of rule-based recognition methods and traditional machine learning-based recognition methods, and can well cope with the traffic identification problems caused by complex and diverse encryption algorithms, effectively improve the recognition rate and accuracy of encrypted application traffic identification, and provide reliable raw data support for the upper-level analysis platform.

[0019] In the second aspect, an embodiment of the present application proposes an encrypted application traffic identification system based on a deep learning algorithm, including: a sample acquisition module, a model building module, a model training module and a model use module, the sample acquisition module is composed of a collection unit, a filtering unit and a conversion unit; the collection unit is used to prepare a test mobile phone and a test number, and after confirming that the 5G network connection is normal, use different instant messaging applications to send texts through the test mobile phone, and continuously collect Internet traffic data of the 5G core network N3 interface; the filtering unit is used to filter Internet traffic data through the test number, extract several pieces of traffic information of the test number from the pcap packages of different instant messaging applications, and save them as pcap files of different instant messaging applications respectively. cap file and annotate the real label; a conversion unit is used to convert the pcap file into a grayscale image file, and divide it into a training set and a test set according to a preset ratio; a model building module is used to build an encrypted application traffic identification model, wherein the encrypted application traffic identification model consists of a first convolutional layer, a first pooling layer, a second convolutional layer, a second pooling layer, a first fully connected layer, a second fully connected layer and an output layer; a model training module is used to iteratively train the encrypted application traffic identification model based on the training set and the test set until convergence and verify it; a model use module is used to input the target encrypted application traffic into the encrypted application traffic identification model, and obtain the identification result of the target encrypted application traffic output by the encrypted application traffic identification model.

[0020] In a third aspect, an embodiment of the present application proposes an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a method for identifying encrypted application traffic based on a deep learning algorithm as described in the first aspect above.

[0021] In a fourth aspect, an embodiment of the present application proposes a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it can implement an encrypted application traffic identification method based on a deep learning algorithm as described in the first aspect above.

[0022] It can be understood that the beneficial effects of the second to fourth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the related technologies, the drawings required for use in the embodiments of the present application or the related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0024] Figure 1 It is a flowchart of a method for identifying encrypted application traffic based on a deep learning algorithm provided in one embodiment of the present application;

[0025] Figure 2 is a simplified flow chart of a method for identifying encrypted application traffic based on a deep learning algorithm provided in one embodiment of the present application;

[0026] Figure 3 It is a schematic diagram of the format of a pcap file provided in an embodiment of the present application;

[0027] Figure 4 It is a structural diagram of an encrypted application traffic identification model provided in one embodiment of the present application;

[0028] Figure 5 is a structural diagram of an encrypted application traffic identification system based on a deep learning algorithm provided in another embodiment of the present application;

[0029] Figure 6 It is a structural schematic diagram of an electronic device provided in another embodiment of the present application. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings. In the various embodiments of the present application, many technical details are proposed in order to make the reader better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present application can also be implemented. The division of the following embodiments is only for the convenience of description, and the specific implementation mode of the present application should not constitute any limitation. The various embodiments can be combined with each other and referenced to each other under the premise of no contradiction.

[0031] An embodiment of the present application proposes an encrypted application traffic identification method based on a deep learning algorithm, which is applied to an electronic device, wherein the electronic device can be a terminal or a server. In this embodiment and the following embodiments, the electronic device is described using a server as an example. The implementation details of the encrypted application traffic identification method based on a deep learning algorithm proposed in this embodiment are specifically described below. The following content is only the relevant implementation details provided for ease of understanding and is not necessary for the implementation of this solution.

[0032] The specific process of the encrypted application traffic identification method based on the deep learning algorithm proposed in this embodiment can be as follows: Figure 1 As shown, it can be simplified as Figure 2 As shown, including:

[0033] S1, prepare the test phone and test number, confirm that the 5G network connection is normal, use different instant messaging applications on the test phone to send texts, and continuously collect Internet traffic data of the 5G core network N3 interface.

[0034] In the specific implementation, the identification of encrypted application traffic can be divided into two stages. The first stage is the traffic collection, data processing and file conversion stage, and the second stage is the model construction, training and use stage. In the first stage, first prepare the test mobile phone and test number to confirm whether the 5G network connection is normal. After confirming that the connection is normal, use different instant messaging applications to send texts through the test mobile phone, and continuously collect the Internet traffic data of the 5G core network N3 interface as basic data.

[0035] The N3 interface in the 5G network is the interface between the 5G wireless network and the 5G core network. It is an important interface in the 5G network architecture and also the link between the 5G wireless network and the 5G core network. It mainly transmits uplink and downlink user plane data between the 5G(R)AN and UPF, including Internet content, VoNR calls, IMS text messages, etc. Therefore, this embodiment selects to collect Internet traffic data of the 5G core network N3 interface to obtain encrypted application traffic.

[0036] In one example, when using different instant messaging applications to send texts through a test phone, it is necessary to traverse the selected instant messaging applications (for example, select WeChat, QQ, DingTalk, and Aliwangwang), start the current instant messaging application, and clean up other instant messaging applications in the background of the test phone to ensure that only the current instant messaging application is running. Then, the test phone uses the current instant messaging application to send texts, and each operation takes no less than 5 minutes. After completing the operation on the current instant messaging application, close the current instant messaging application, start the next instant messaging application, and clean up other instant messaging applications in the background of the test phone. Cleaning up the background operation can prevent other instant messaging applications from generating traffic when running in the background, thereby polluting the Internet traffic data generated by the current instant messaging application.

[0037] S2, filtering the Internet traffic data through the test number, extracting several pieces of traffic information of the test number from the pcap packages of different instant messaging applications, saving them as pcap files of different instant messaging applications respectively, and marking them with real labels.

[0038] In the specific implementation, after collecting the Internet traffic data, the server needs to filter the Internet traffic data through the test number, extract several traffic information of the test number from the pcap packages of different instant messaging applications, save them as pcap files of different instant messaging applications respectively, and mark them with real labels.

[0039] In one example, the server needs to remove the file header of the extracted traffic information. The format of the pcap file is as follows: Figure 3 As shown, the file header occupies the first 24 bytes, so the server needs to remove the first 24 bytes of the traffic information. Subsequently, the server needs to detect whether the traffic information after removing the file header exceeds 784 bytes. If the traffic information after removing the file header exceeds 784 bytes, it is necessary to trim the part exceeding 784 bytes and use the remaining 784 bytes as the pcap file. If the traffic information after removing the file header does not exceed 784 bytes, it is necessary to fill the part less than 784 bytes with 0, and use the filled 784 bytes as the pcap file. Among them, the pcap file is a binary file.

[0040] It is worth noting that the pcap file consists of PCAP Header, Packet Header and Packet Data. The pcap file has only one file header, which occupies 24 bytes and has a total of 7 fields. The Packet Header includes timestamp and data length information. Packet Data is the data frame of the link layer, and its format is the standard network protocol format.

[0041] S3, convert the pcap file into a grayscale image file, and divide it into a training set and a test set according to a preset ratio.

[0042] In a specific implementation, after obtaining the pcap file, the server needs to convert the pcap file into a grayscale image file, and divide it into a training set and a test set according to a preset ratio (such as 7:3).

[0043] In one example, the pcap file is a 784-byte binary file. When the server converts the pcap file into a grayscale image file, the server converts the 784-byte pcap file into a 28×28-byte grayscale image file. The format of the grayscale image file is an IDX format. In the grayscale image file, the pixel value (grayscale value) of each pixel is an integer between 0 and 255, where 0 represents black and 255 represents white.

[0044] It is worth noting that when dividing the training set and the test set, it is necessary to ensure the data balance of the grayscale image files from different instant messaging applications.

[0045] S4, build an encrypted application traffic identification model, which consists of a first convolutional layer, a first pooling layer, a second convolutional layer, a second pooling layer, a first fully connected layer, a second fully connected layer and an output layer.

[0046] In the specific implementation, the server needs to build an encrypted application traffic identification model. The specific structure of the encrypted application traffic identification model can be as follows: Figure 4 As shown, it consists of a first convolutional layer, a first pooling layer, a second convolutional layer, a second pooling layer, a first fully connected layer, a second fully connected layer and an output layer. When iteratively training the encrypted application traffic identification model, the training samples in the training set are input into the first convolutional layer, and the first convolutional layer performs the first convolution operation on the input training samples to increase the diversity of feature extraction; the first pooling layer adopts the maximum pooling method to further extract the output of the first convolutional layer; the second convolutional layer performs the second convolution operation on the output of the first pooling layer for further extraction; the second pooling layer adopts the maximum pooling method to maintain the main features of the output of the second convolutional layer and reduce redundant information; the first fully connected layer performs a weighted sum calculation on the output of the second pooling layer to reduce the dimension of the data; the second fully connected layer performs a weighted sum calculation on the output of the first fully connected layer to further reduce the dimension of the data; the output layer performs softmax normalization based on the output of the second fully connected layer, and outputs the recognition result of the training sample.

[0047] It is worth noting that the skeleton of the encrypted application traffic identification model is 2D-CNN. In the initial stage of training, the server needs to set the initial convolution kernel filter, stride, bias value and number of channels of the first and second convolution layers, as well as the initial weights and bias values ​​of the first and second fully connected layers.

[0048] In one example, the first convolutional layer and the second convolutional layer both use the Relu activation function for nonlinear output, and the first fully connected layer is set with Dropout regularization to suppress overfitting and improve generalization ability.

[0049] In one example, the input of the first convolutional layer is a 28×28 grayscale image file, and the size of the output of the first convolutional layer is 8×28×28. After being processed by the first pooling layer, the second convolutional layer, and the second pooling layer, the size of the output of the second pooling layer is 8×14×14. The size of the output of the second fully connected layer is 1×4, indicating 4 categories.

[0050] S5, based on the training set and the test set, the encrypted application traffic identification model is iteratively trained until convergence and verified.

[0051] In a specific implementation, after the server obtains the training set and the test set and completes the construction of the encrypted application traffic identification model, it can iteratively train the encrypted application traffic identification model based on the training set and the test set until convergence and perform verification.

[0052] In one example, the server needs to calculate the loss value based on the real label marked on the training sample, the recognition result of the training sample output by the encrypted application traffic identification model, and the cross entropy loss function, and then determine whether the calculated loss value meets the preset convergence condition. If the calculated loss value does not meet the preset convergence condition, the weights and bias values ​​of the first convolutional layer, the second convolutional layer and the first fully connected layer and the second fully connected layer are updated based on the calculated loss value using the back propagation algorithm until the calculated loss value meets the preset convergence condition. If the calculated loss value meets the preset convergence condition, the test sample in the test set is input into the encrypted application traffic identification model to perform performance verification on the encrypted application traffic identification model.

[0053] In one example, based on the real labels marked on the training samples, the recognition results of the training samples output by the encrypted application traffic recognition model, and the cross entropy loss function, the loss value is calculated using the following formula:

[0054]

[0055] Where n represents the total number of categories of instant messaging applications, p(x i) represents the value of the i-th category in the true label marked on the training sample, q(x i ) represents the value of the i-th category in the recognition result of the training sample output by the encrypted application traffic recognition model, and LOSS represents the calculated loss value.

[0056] S6, input the target encrypted application traffic into the encrypted application traffic identification model, and obtain the identification result of the target encrypted application traffic output by the encrypted application traffic identification model.

[0057] In a specific implementation, after obtaining the trained encrypted application traffic identification model, the server can deploy the trained encrypted application traffic identification model in a scenario where it is needed. The server inputs the target encrypted application traffic into the trained encrypted application traffic identification model and obtains the identification result of the target encrypted application traffic output by the trained encrypted application traffic identification model.

[0058] In this embodiment, the Internet traffic data generated by the instant application of the N3 interface of the 5G core network is collected as the research object by combining image conversion and artificial intelligence, and the binary pcap file is converted into a grayscale image file to construct a training set and a test set for subsequent processing using 2D-CNN. Using 2D-CNN as the network construction, an encrypted application traffic identification model is constructed and trained to identify encrypted application traffic, and the encrypted application traffic is processed by image conversion. By using the powerful ability of 2D-CNN in image recognition, through convolution, pooling, full connection, softmax normalization classification and other processing, the limitations of rule-based recognition methods and traditional machine learning-based recognition methods are compensated, and the traffic recognition problems caused by complex and diverse encryption algorithms can be well dealt with, and the recognition rate and accuracy of encrypted application traffic recognition are effectively improved, providing reliable raw data support for the upper-level analysis platform.

[0059] The step division of the above methods is only for clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this application; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the scope of protection of this application.

[0060] Another embodiment of the present application proposes an encrypted application traffic identification system based on a deep learning algorithm. The following is a detailed description of the implementation details of the encrypted application traffic identification system based on a deep learning algorithm proposed in this embodiment. The following content is only for the convenience of understanding the implementation details and is not necessary for the implementation of this example. The structural diagram of the encrypted application traffic identification system based on a deep learning algorithm proposed in this embodiment can be as follows: Figure 5As shown, it includes: a sample acquisition module M1, a model construction module M2, a model training module M3 and a model use module M4. The sample acquisition module M1 is composed of a collection unit M11, a filtering unit M12 and a conversion unit M13.

[0061] The collection unit M11 is used to prepare the test mobile phone and test number. After confirming that the 5G network connection is normal, different instant messaging applications are used through the test mobile phone to send texts, while continuously collecting Internet traffic data of the 5G core network N3 interface.

[0062] The filtering unit M12 is used to filter the Internet traffic data through the test number, extract several pieces of traffic information of the test number from the pcap packages of different instant messaging applications, save them as pcap files of different instant messaging applications respectively, and mark them with real labels.

[0063] The conversion unit M13 is used to convert the pcap file into a grayscale image file, and divide it into a training set and a test set according to a preset ratio.

[0064] The model building module M2 is used to build an encrypted application traffic identification model, wherein the encrypted application traffic identification model consists of a first convolutional layer, a first pooling layer, a second convolutional layer, a second pooling layer, a first fully connected layer, a second fully connected layer and an output layer.

[0065] The model training module M3 is used to iteratively train the encrypted application traffic identification model until convergence and verify it based on the training set and the test set.

[0066] The model using module M4 is used to input the target encrypted application traffic into the encrypted application traffic identification model, and obtain the identification result of the target encrypted application traffic output by the encrypted application traffic identification model.

[0067] It is worth mentioning that all modules involved in this embodiment are logic modules. In practical applications, a logic unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. In addition, in order to highlight the innovative part of this application, this embodiment does not introduce units that are not closely related to solving the technical problems proposed by this application, but this does not mean that there are no other units in this embodiment.

[0068] It is not difficult to find that this embodiment is a system embodiment corresponding to the above method embodiment, and this embodiment can be implemented in conjunction with the above method embodiment. The relevant technical details and technical effects mentioned in the above embodiments are still valid in this embodiment, and in order to reduce repetition, they are not repeated here. Accordingly, the relevant technical details mentioned in this embodiment can also be applied in the above embodiments.

[0069] Another embodiment of the present application provides an electronic device, the structure of which is as follows: Figure 6 As shown, it includes: at least one processor C1; and a memory C2 that is communicatively connected to the at least one processor C1; wherein the memory C2 stores instructions that can be executed by the at least one processor C1, and the instructions are executed by the at least one processor C1 so that the at least one processor C1 can execute an encrypted application traffic identification method based on a deep learning algorithm as described in the above-mentioned method embodiments.

[0070] The memory and the processor are connected by a bus, which may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors and memories. The bus can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and will not be further described in this article. The bus interface is responsible for providing an interface between the bus and the transceiver. The transceiver can be one component or multiple components, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium.

[0071] The processor is responsible for executing various instructions and operations, receiving, decoding and executing programs stored in the storage medium, and completing various complex calculations and control tasks. The memory can be used to store the data used or generated by the processor when performing operations and the instructions executed.

[0072] Another embodiment of the present application proposes a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it can implement an encrypted application traffic identification method based on a deep learning algorithm as described in the above method embodiments.

[0073] That is, those skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: hard disk, solid state drive, USB flash drive, mobile hard disk, ROM (Read-Only Memory), RAM (Random Access Memory) or optical disk and other media that can store program codes.

[0074] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present application, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present application.

Claims

1. A method for identifying encrypted application traffic based on deep learning algorithm, characterized in that: include: Prepare a test phone and test number. After confirming that the 5G network connection is normal, use different instant messaging applications on the test phone to send text messages. At the same time, continuously collect Internet traffic data of the 5G core network N3 interface. Filter Internet traffic data through test numbers, extract several pieces of traffic information of test numbers from pcap packages of different instant messaging applications, save them as pcap files of different instant messaging applications, and mark them with real labels; Convert the pcap file into a grayscale image file and divide it into training set and test set according to the preset ratio; Construct an encrypted application traffic identification model, which consists of a first convolutional layer, a first pooling layer, a second convolutional layer, a second pooling layer, a first fully connected layer, a second fully connected layer, and an output layer; Based on the training set and the test set, the encrypted application traffic identification model is iteratively trained until convergence and then verified; The target encrypted application traffic is input into the encrypted application traffic identification model, and the identification result of the target encrypted application traffic output by the encrypted application traffic identification model is obtained.

2. According to claim 1, a method for identifying encrypted application traffic based on a deep learning algorithm is characterized in that: By testing the mobile phone using different instant messaging applications to send texts, including: Traverse the selected instant messaging applications, start the current instant messaging application, and clear other instant messaging applications in the background of the test phone to ensure that only the current instant messaging application is running; Use the current instant messaging application to send text messages on the test phone, with each operation lasting no less than 5 minutes; After completing the operation on the current instant messaging application, close the current instant messaging application, start the next instant messaging application, and clear other instant messaging applications in the background of the test phone.

3. According to claim 2, a method for identifying encrypted application traffic based on a deep learning algorithm is characterized in that: Extract several pieces of traffic information of the test number from the pcap packages of different instant messaging applications and save them as pcap files of different instant messaging applications, including: Remove the file header of the extracted traffic information; the file header occupies the first 24 bytes of the traffic information; Check whether the traffic information after removing the file header exceeds 784 bytes. If it exceeds 784 bytes, trim the part exceeding 784 bytes and use the remaining 784 bytes as the pcap file. If it does not exceed 784 bytes, fill the part less than 784 bytes with 0 and use the filled 784 bytes as the pcap file. Convert the pcap file to a grayscale image file, specifically: Convert the 784-byte pcap file to a 28×28-byte grayscale image file; Among them, the pcap file is a binary file, and the format of the grayscale image file is IDX format.

4. A method for identifying encrypted application traffic based on a deep learning algorithm according to any one of claims 1 to 3, characterized in that: When iteratively training the encrypted application traffic identification model, the training samples in the training set are input into the first convolution layer, and the first convolution layer performs the first convolution operation on the input training samples to increase the diversity of feature extraction; The first pooling layer adopts the maximum pooling method to further extract the output of the first convolutional layer; the second convolutional layer performs the second convolution operation on the output of the first pooling layer for further extraction; the second pooling layer adopts the maximum pooling method to maintain the main features of the output of the second convolutional layer and reduce redundant information; the first fully connected layer performs weighted sum calculation on the output of the second pooling layer to reduce the dimension of the data; the second fully connected layer performs weighted sum calculation on the output of the first fully connected layer to further reduce the dimension of the data; the output layer performs softmax normalization based on the output of the second fully connected layer, and outputs the recognition result of the training sample.

5. According to claim 4, a method for identifying encrypted application traffic based on a deep learning algorithm is characterized in that: Both the first convolutional layer and the second convolutional layer use the Relu activation function for nonlinear output, and the first fully connected layer is set with Dropout regularization to suppress overfitting and improve generalization ability.

6. According to claim 4, a method for identifying encrypted application traffic based on a deep learning algorithm is characterized in that: When iteratively training the encrypted application traffic identification model, a loss value is calculated based on the real labels marked on the training samples, the identification results of the training samples output by the encrypted application traffic identification model, and the cross entropy loss function; Determine whether the calculated loss value meets the preset convergence condition; If the calculated loss value does not meet the preset convergence condition, based on the calculated loss value, the weights and bias values ​​of the first convolutional layer, the second convolutional layer, the first fully connected layer, and the second fully connected layer are updated using the back propagation algorithm until the calculated loss value meets the preset convergence condition; If the calculated loss value meets the preset convergence condition, the test samples in the test set are input into the encrypted application traffic identification model to verify the performance of the encrypted application traffic identification model.

7. The method for identifying encrypted application traffic based on a deep learning algorithm according to claim 6, characterized in that: The loss value is calculated based on the real label marked on the training sample, the recognition result of the training sample output by the encrypted application traffic recognition model, and the cross entropy loss function, which is implemented by the following formula: Where n represents the total number of categories of instant messaging applications, p(x i ) represents the value of the i-th category in the true label marked on the training sample, q(x i ) represents the value of the i-th category in the recognition result of the training sample output by the encrypted application traffic recognition model, and LOSS represents the calculated loss value.

8. An encrypted application traffic identification system based on deep learning algorithm, characterized in that: include: Sample acquisition module, model building module, model training module and model use module. The sample acquisition module consists of a collection unit, a filtering unit and a conversion unit. The collection unit is used to prepare the test mobile phone and test number, and after confirming that the 5G network connection is normal, use different instant messaging applications to send texts through the test mobile phone, and continuously collect Internet traffic data of the 5G core network N3 interface; A filtering unit is used to filter Internet traffic data through a test number, extract several pieces of traffic information of the test number from pcap packages of different instant messaging applications, save them as pcap files of different instant messaging applications respectively, and mark them with real labels; A conversion unit, used for converting the pcap file into a grayscale image file, and dividing it into a training set and a test set according to a preset ratio; A model building module, used to build an encrypted application traffic identification model, wherein the encrypted application traffic identification model consists of a first convolutional layer, a first pooling layer, a second convolutional layer, a second pooling layer, a first fully connected layer, a second fully connected layer and an output layer; Model training module, used to iteratively train the encrypted application traffic identification model until convergence and verify it based on the training set and test set; The model usage module is used to input the target encrypted application traffic into the encrypted application traffic identification model, and obtain the identification result of the target encrypted application traffic output by the encrypted application traffic identification model.

9. An electronic device, characterized in that: include: at least one processor; and, a memory communicatively coupled to the at least one processor; In which, the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute an encrypted application traffic identification method based on a deep learning algorithm as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, it can implement an encrypted application traffic identification method based on a deep learning algorithm as described in any one of claims 1 to 7.

Images